@predicatesystems/authority 0.3.1

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EAGtB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,aAAa,EACb,UAAU,EACV,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,UAAU,EACV,uBAAuB,EACvB,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,wCAAwC,EACxC,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sCAAsC,EACtC,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,oCAAoC,EACzC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,eAAe,GAAG,YAAY,CAAC;CAC/C;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAiC;gBAElD,OAAO,EAAE,sBAAsB;IAQrC,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAoE3E"}

package/dist/src/index.js

@@ -0,0 +1,142 @@
+import { AuthorityClientError } from "./errors.js";
+import { isAuthorizationResponse, toSidecarAuthorizeRequest, } from "./types.js";
+export { AuthorityClientError } from "./errors.js";
+export { AUTHORIZATION_REASONS, POLICY_EFFECTS, VERIFICATION_STATUSES, isAuthorizationDecision, isMandateClaims, isLabelPassed, isPolicyRule, isProofEvent, passedLabels, isSignedMandate, toSidecarAuthorizeRequest, } from "./types.js";
+export { effectiveMaxDelegationDepth, globMatch, matchesRule } from "./policy/matching.js";
+export { PolicyEngine } from "./policy/engine.js";
+export { ActionGuard, AuthorizationDeniedError, } from "./guard/action-guard.js";
+export { guardedFileRead, guardedFileWrite, guardedHttp, guardedShell, } from "./wrappers/sensitive-operations.js";
+export { buildWebStateEvidenceFromRuntimeSnapshot, buildWebStateEvidence, webStateSnapshotFromRuntimeSnapshot, } from "./evidence/web-state.js";
+export { buildDesktopAccessibilityStateEvidence, buildTerminalStateEvidence, collectVerificationEvidence, } from "./evidence/non-web.js";
+export class AuthorityClient {
+    baseUrl;
+    timeoutMs;
+    maxRetries;
+    backoffInitialMs;
+    endpointPath;
+    constructor(options) {
+        this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+        this.timeoutMs = options.timeoutMs ?? 2000;
+        this.maxRetries = options.maxRetries ?? 0;
+        this.backoffInitialMs = options.backoffInitialMs ?? 200;
+        this.endpointPath = options.endpointPath ?? "/v1/authorize";
+    }
+    async authorize(request) {
+        const wireRequest = toSidecarAuthorizeRequest(request);
+        const attempts = this.maxRetries + 1;
+        for (let attempt = 0; attempt < attempts; attempt += 1) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+            try {
+                let response;
+                try {
+                    response = await fetch(`${this.baseUrl}${this.endpointPath}`, {
+                        method: "POST",
+                        headers: {
+                            "content-type": "application/json",
+                        },
+                        body: JSON.stringify(wireRequest),
+                        signal: controller.signal,
+                    });
+                }
+                catch (error) {
+                    if (attempt < this.maxRetries) {
+                        await sleep(this.backoffInitialMs * (attempt + 1));
+                        continue;
+                    }
+                    if (error instanceof Error && error.name === "AbortError") {
+                        throw new AuthorityClientError("authorize request timed out", {
+                            code: "timeout",
+                            cause: error,
+                        });
+                    }
+                    throw new AuthorityClientError("authorize request failed before response", {
+                        code: "network_error",
+                        cause: error,
+                    });
+                }
+                const payload = await parseJsonSafely(response);
+                // Sidecar deny decisions intentionally return HTTP 403 with decision body.
+                if (response.status === 403 && isAuthorizationResponse(payload)) {
+                    return payload;
+                }
+                if (!response.ok) {
+                    if (response.status >= 500 && attempt < this.maxRetries) {
+                        await sleep(this.backoffInitialMs * (attempt + 1));
+                        continue;
+                    }
+                    throw mapHttpError(response.status, payload);
+                }
+                if (!isAuthorizationResponse(payload)) {
+                    throw new AuthorityClientError("invalid authorize response payload", {
+                        code: "protocol_error",
+                        status: response.status,
+                        details: payload,
+                    });
+                }
+                return payload;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        }
+        throw new AuthorityClientError("authorize request exhausted retry budget", {
+            code: "network_error",
+        });
+    }
+}
+function sleep(ms) {
+    if (ms <= 0) {
+        return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+async function parseJsonSafely(response) {
+    const text = await response.text();
+    if (text.trim() === "") {
+        return {};
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        throw new AuthorityClientError("non-JSON response from authority sidecar", {
+            code: "protocol_error",
+            status: response.status,
+            details: text,
+            cause: error,
+        });
+    }
+}
+function mapHttpError(status, payload) {
+    const message = extractErrorMessage(payload) ?? `authorize_failed_${status}`;
+    if (status === 400) {
+        return new AuthorityClientError(message, { code: "bad_request", status, details: payload });
+    }
+    if (status === 401) {
+        return new AuthorityClientError(message, { code: "unauthorized", status, details: payload });
+    }
+    if (status === 403) {
+        return new AuthorityClientError(message, { code: "forbidden", status, details: payload });
+    }
+    if (status >= 500) {
+        return new AuthorityClientError(message, { code: "server_error", status, details: payload });
+    }
+    return new AuthorityClientError(message, { code: "protocol_error", status, details: payload });
+}
+function extractErrorMessage(payload) {
+    if (typeof payload !== "object" || payload === null) {
+        return null;
+    }
+    const obj = payload;
+    if (typeof obj.error === "string" && obj.error.trim() !== "") {
+        return obj.error;
+    }
+    if (typeof obj.detail === "string" && obj.detail.trim() !== "") {
+        return obj.detail;
+    }
+    return null;
+}
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAGL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AAsBpB,OAAO,EAAE,oBAAoB,EAAiC,MAAM,aAAa,CAAC;AAClF,OAAO,EACL,qBAAqB,EACrB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,eAAe,EACf,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,yBAAyB,GAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,YAAY,EAA0B,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EACL,WAAW,EACX,wBAAwB,GAGzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,YAAY,GAKb,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,wCAAwC,EACxC,qBAAqB,EAIrB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sCAAsC,EACtC,0BAA0B,EAC1B,2BAA2B,GAS5B,MAAM,uBAAuB,CAAC;AAU/B,MAAM,OAAO,eAAe;IACT,OAAO,CAAS;IAChB,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,gBAAgB,CAAS;IACzB,YAAY,CAAiC;IAE9D,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,GAAG,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,eAAe,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAyB;QACvC,MAAM,WAAW,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QAErC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC;gBACH,IAAI,QAAkB,CAAC;gBACvB,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,EAAE;wBAC5D,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;wBACjC,MAAM,EAAE,UAAU,CAAC,MAAM;qBAC1B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;wBAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;wBACnD,SAAS;oBACX,CAAC;oBACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC1D,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,EAAE;4BAC5D,IAAI,EAAE,SAAS;4BACf,KAAK,EAAE,KAAK;yBACb,CAAC,CAAC;oBACL,CAAC;oBACD,MAAM,IAAI,oBAAoB,CAAC,0CAA0C,EAAE;wBACzE,IAAI,EAAE,eAAe;wBACrB,KAAK,EAAE,KAAK;qBACb,CAAC,CAAC;gBACL,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;gBAEhD,2EAA2E;gBAC3E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChE,OAAO,OAAO,CAAC;gBACjB,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;wBACxD,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;wBACnD,SAAS;oBACX,CAAC;oBACD,MAAM,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC/C,CAAC;gBAED,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,EAAE;wBACnE,IAAI,EAAE,gBAAgB;wBACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,OAAO,EAAE,OAAO;qBACjB,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,OAAO,CAAC;YACjB,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,oBAAoB,CAAC,0CAA0C,EAAE;YACzE,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAkB;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,oBAAoB,CAAC,0CAA0C,EAAE;YACzE,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,OAAgB;IACpD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,oBAAoB,MAAM,EAAE,CAAC;IAC7E,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAClB,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,IAAI,oBAAoB,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/D,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/policy/engine.d.ts

@@ -0,0 +1,19 @@
+import type { ActionRequest } from "../contracts/action-request.js";
+import type { AuthorizationReason } from "../contracts/enums.js";
+import type { PolicyRule } from "../contracts/policy-rule.js";
+export interface PolicyMatchResult {
+    allowed: boolean;
+    reason: AuthorizationReason;
+    matched_rule?: string | null;
+    missing_labels?: string[];
+}
+export declare class PolicyEngine {
+    private rules;
+    private globalMaxDelegationDepth;
+    constructor(rules: PolicyRule[], globalMaxDelegationDepth?: number | null);
+    replaceRules(rules: PolicyRule[]): void;
+    setGlobalMaxDelegationDepth(maxDepth: number | null): void;
+    replacePolicy(rules: PolicyRule[], globalMaxDelegationDepth: number | null): void;
+    evaluate(request: ActionRequest, delegationDepth?: number): PolicyMatchResult;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/src/policy/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/policy/engine.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAI9D,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,wBAAwB,CAAgB;gBAEpC,KAAK,EAAE,UAAU,EAAE,EAAE,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI;IAKzE,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI;IAIvC,2BAA2B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1D,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,wBAAwB,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAKjF,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,eAAe,SAAI,GAAG,iBAAiB;CAyEzE"}

package/dist/src/policy/engine.js

@@ -0,0 +1,82 @@
+import { isLabelPassed } from "../contracts/verification.js";
+import { effectiveMaxDelegationDepth, matchesRule } from "./matching.js";
+export class PolicyEngine {
+    rules;
+    globalMaxDelegationDepth;
+    constructor(rules, globalMaxDelegationDepth) {
+        this.rules = rules;
+        this.globalMaxDelegationDepth = globalMaxDelegationDepth ?? null;
+    }
+    replaceRules(rules) {
+        this.rules = rules;
+    }
+    setGlobalMaxDelegationDepth(maxDepth) {
+        this.globalMaxDelegationDepth = maxDepth;
+    }
+    replacePolicy(rules, globalMaxDelegationDepth) {
+        this.rules = rules;
+        this.globalMaxDelegationDepth = globalMaxDelegationDepth;
+    }
+    evaluate(request, delegationDepth = 0) {
+        const matchingRules = this.rules.filter((rule) => matchesRule(rule, request));
+        if (matchingRules.length === 0) {
+            return {
+                allowed: false,
+                reason: "no_matching_policy",
+            };
+        }
+        for (const rule of matchingRules) {
+            if (rule.effect === "deny") {
+                return {
+                    allowed: false,
+                    reason: "explicit_deny",
+                    matched_rule: rule.name,
+                };
+            }
+        }
+        let firstAllowFailure = null;
+        for (const rule of matchingRules) {
+            if (rule.effect !== "allow") {
+                continue;
+            }
+            const effectiveMaxDepth = effectiveMaxDelegationDepth(this.globalMaxDelegationDepth, rule.max_delegation_depth);
+            if (effectiveMaxDepth !== null && delegationDepth > effectiveMaxDepth) {
+                const failure = {
+                    allowed: false,
+                    reason: "max_delegation_depth_exceeded",
+                    matched_rule: rule.name,
+                };
+                if (firstAllowFailure === null) {
+                    firstAllowFailure = failure;
+                }
+                continue;
+            }
+            const missingLabels = (rule.required_labels ?? []).filter((label) => !isLabelPassed(request.verification_evidence, label));
+            if (missingLabels.length > 0) {
+                const failure = {
+                    allowed: false,
+                    reason: "missing_required_verification",
+                    matched_rule: rule.name,
+                    missing_labels: missingLabels,
+                };
+                if (firstAllowFailure === null) {
+                    firstAllowFailure = failure;
+                }
+                continue;
+            }
+            return {
+                allowed: true,
+                reason: "allowed",
+                matched_rule: rule.name,
+            };
+        }
+        if (firstAllowFailure !== null) {
+            return firstAllowFailure;
+        }
+        return {
+            allowed: false,
+            reason: "no_matching_policy",
+        };
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/src/policy/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../../src/policy/engine.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AASzE,MAAM,OAAO,YAAY;IACf,KAAK,CAAe;IACpB,wBAAwB,CAAgB;IAEhD,YAAY,KAAmB,EAAE,wBAAwC;QACvE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,IAAI,IAAI,CAAC;IACnE,CAAC;IAED,YAAY,CAAC,KAAmB;QAC9B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,2BAA2B,CAAC,QAAuB;QACjD,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC;IAC3C,CAAC;IAED,aAAa,CAAC,KAAmB,EAAE,wBAAuC;QACxE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,wBAAwB,GAAG,wBAAwB,CAAC;IAC3D,CAAC;IAED,QAAQ,CAAC,OAAsB,EAAE,eAAe,GAAG,CAAC;QAClD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC9E,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,oBAAoB;aAC7B,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,eAAe;oBACvB,YAAY,EAAE,IAAI,CAAC,IAAI;iBACxB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,GAA6B,IAAI,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,MAAM,iBAAiB,GAAG,2BAA2B,CACnD,IAAI,CAAC,wBAAwB,EAC7B,IAAI,CAAC,oBAAoB,CAC1B,CAAC;YACF,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,GAAG,iBAAiB,EAAE,CAAC;gBACtE,MAAM,OAAO,GAAsB;oBACjC,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,+BAA+B;oBACvC,YAAY,EAAE,IAAI,CAAC,IAAI;iBACxB,CAAC;gBACF,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;oBAC/B,iBAAiB,GAAG,OAAO,CAAC;gBAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CACvD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAChE,CAAC;YACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAsB;oBACjC,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,+BAA+B;oBACvC,YAAY,EAAE,IAAI,CAAC,IAAI;oBACvB,cAAc,EAAE,aAAa;iBAC9B,CAAC;gBACF,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;oBAC/B,iBAAiB,GAAG,OAAO,CAAC;gBAC9B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,SAAS;gBACjB,YAAY,EAAE,IAAI,CAAC,IAAI;aACxB,CAAC;QACJ,CAAC;QAED,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,oBAAoB;SAC7B,CAAC;IACJ,CAAC;CACF"}

package/dist/src/policy/matching.d.ts

@@ -0,0 +1,6 @@
+import type { ActionRequest } from "../contracts/action-request.js";
+import type { PolicyRule } from "../contracts/policy-rule.js";
+export declare function matchesRule(rule: PolicyRule, request: ActionRequest): boolean;
+export declare function effectiveMaxDelegationDepth(globalMax: number | null | undefined, ruleMax: number | null | undefined): number | null;
+export declare function globMatch(value: string, pattern: string): boolean;
+//# sourceMappingURL=matching.d.ts.map

package/dist/src/policy/matching.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matching.d.ts","sourceRoot":"","sources":["../../../src/policy/matching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAQ7E;AAED,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACjC,MAAM,GAAG,IAAI,CAUf;AAGD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAGjE"}

package/dist/src/policy/matching.js

@@ -0,0 +1,46 @@
+export function matchesRule(rule, request) {
+    const principal = request.principal.principal_id;
+    const action = request.action_spec.action;
+    const resource = request.action_spec.resource;
+    const principalOk = rule.principals.some((pattern) => globMatch(principal, pattern));
+    const actionOk = rule.actions.some((pattern) => globMatch(action, pattern));
+    const resourceOk = rule.resources.some((pattern) => globMatch(resource, pattern));
+    return principalOk && actionOk && resourceOk;
+}
+export function effectiveMaxDelegationDepth(globalMax, ruleMax) {
+    const g = globalMax ?? null;
+    const r = ruleMax ?? null;
+    if (g === null) {
+        return r;
+    }
+    if (r === null) {
+        return g;
+    }
+    return Math.min(g, r);
+}
+// Minimal fnmatch-like matcher for parity with Python rule patterns.
+export function globMatch(value, pattern) {
+    const regex = globToRegExp(pattern);
+    return regex.test(value);
+}
+function globToRegExp(pattern) {
+    let out = "^";
+    for (let i = 0; i < pattern.length; i += 1) {
+        const ch = pattern[i];
+        if (ch === "*") {
+            out += ".*";
+        }
+        else if (ch === "?") {
+            out += ".";
+        }
+        else {
+            out += escapeRegexChar(ch);
+        }
+    }
+    out += "$";
+    return new RegExp(out);
+}
+function escapeRegexChar(ch) {
+    return /[\\^$.*+?()[\]{}|]/.test(ch) ? `\\${ch}` : ch;
+}
+//# sourceMappingURL=matching.js.map

package/dist/src/policy/matching.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"matching.js","sourceRoot":"","sources":["../../../src/policy/matching.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,OAAsB;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAClF,OAAO,WAAW,IAAI,QAAQ,IAAI,UAAU,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAAoC,EACpC,OAAkC;IAElC,MAAM,CAAC,GAAG,SAAS,IAAI,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,OAAe;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,IAAI,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,GAAG,IAAI,GAAG,CAAC;QACb,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,GAAG,IAAI,GAAG,CAAC;IACX,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,EAAU;IACjC,OAAO,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/src/types.d.ts

@@ -0,0 +1,19 @@
+export type { ActionRequest, ActionSpec, AuthorizeRequest, PrincipalRef, SidecarAuthorizeRequest, StateEvidence, VerificationEvidence, VerificationSignal, } from "./contracts/action-request.js";
+export { toSidecarAuthorizeRequest } from "./contracts/action-request.js";
+export type { AuthorizationResponse } from "./contracts/decision.js";
+export { isAuthorizationResponse } from "./contracts/decision.js";
+export type { AuthorizationDecision } from "./contracts/authorization-decision.js";
+export { isAuthorizationDecision } from "./contracts/authorization-decision.js";
+export type { AuthorizationReason, PolicyEffect, VerificationStatus } from "./contracts/enums.js";
+export { AUTHORIZATION_REASONS, POLICY_EFFECTS, VERIFICATION_STATUSES } from "./contracts/enums.js";
+export type { MandateClaims, SignedMandate } from "./contracts/mandate.js";
+export { isMandateClaims, isSignedMandate } from "./contracts/mandate.js";
+export type { PolicyRule } from "./contracts/policy-rule.js";
+export { isPolicyRule } from "./contracts/policy-rule.js";
+export type { ProofEvent } from "./contracts/proof-event.js";
+export { isProofEvent } from "./contracts/proof-event.js";
+export { isLabelPassed, passedLabels } from "./contracts/verification.js";
+export { buildWebStateEvidenceFromRuntimeSnapshot, buildWebStateEvidence, type RuntimeSnapshotLike, type WebStateEvidenceOptions, type WebStateSnapshot, webStateSnapshotFromRuntimeSnapshot, } from "./evidence/web-state.js";
+export { buildDesktopAccessibilityStateEvidence, buildTerminalStateEvidence, collectVerificationEvidence, type DesktopAccessibilityEvidenceProvider, type DesktopAccessibilitySnapshot, type DesktopStateEvidenceOptions, type EvidenceHasher, type TerminalEvidenceProvider, type TerminalSessionSnapshot, type TerminalStateEvidenceOptions, type VerificationSignalProvider, } from "./evidence/non-web.js";
+export type { SidecarAuthorizeRequest as AuthorizationRequest } from "./contracts/action-request.js";
+//# sourceMappingURL=types.d.ts.map

package/dist/src/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,YAAY,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACpG,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC1E,YAAY,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,YAAY,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EACL,wCAAwC,EACxC,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sCAAsC,EACtC,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,oCAAoC,EACzC,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAG/B,YAAY,EAAE,uBAAuB,IAAI,oBAAoB,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/src/types.js

@@ -0,0 +1,11 @@
+export { toSidecarAuthorizeRequest } from "./contracts/action-request.js";
+export { isAuthorizationResponse } from "./contracts/decision.js";
+export { isAuthorizationDecision } from "./contracts/authorization-decision.js";
+export { AUTHORIZATION_REASONS, POLICY_EFFECTS, VERIFICATION_STATUSES } from "./contracts/enums.js";
+export { isMandateClaims, isSignedMandate } from "./contracts/mandate.js";
+export { isPolicyRule } from "./contracts/policy-rule.js";
+export { isProofEvent } from "./contracts/proof-event.js";
+export { isLabelPassed, passedLabels } from "./contracts/verification.js";
+export { buildWebStateEvidenceFromRuntimeSnapshot, buildWebStateEvidence, webStateSnapshotFromRuntimeSnapshot, } from "./evidence/web-state.js";
+export { buildDesktopAccessibilityStateEvidence, buildTerminalStateEvidence, collectVerificationEvidence, } from "./evidence/non-web.js";
+//# sourceMappingURL=types.js.map

package/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE1E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,EACL,wCAAwC,EACxC,qBAAqB,EAIrB,mCAAmC,GACpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sCAAsC,EACtC,0BAA0B,EAC1B,2BAA2B,GAS5B,MAAM,uBAAuB,CAAC"}

package/dist/src/wrappers/sensitive-operations.d.ts

@@ -0,0 +1,44 @@
+import { type ActionExecutionResult, type ActionGuard } from "../guard/action-guard.js";
+import type { ActionRequest } from "../types.js";
+export interface GuardedShellOptions<T> {
+    guard: ActionGuard;
+    request: ActionRequest;
+    command: string;
+    execute: (command: string) => Promise<T> | T;
+    delegationDepth?: number;
+}
+export interface GuardedFileReadOptions<T> {
+    guard: ActionGuard;
+    request: ActionRequest;
+    path: string;
+    read: (path: string) => Promise<T> | T;
+    delegationDepth?: number;
+}
+export interface GuardedFileWriteOptions<T> {
+    guard: ActionGuard;
+    request: ActionRequest;
+    path: string;
+    contents: string;
+    write: (path: string, contents: string) => Promise<T> | T;
+    delegationDepth?: number;
+}
+export interface GuardedHttpOptions<T> {
+    guard: ActionGuard;
+    request: ActionRequest;
+    url: string;
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    send: (request: {
+        url: string;
+        method: string;
+        headers?: Record<string, string>;
+        body?: string;
+    }) => Promise<T> | T;
+    delegationDepth?: number;
+}
+export declare function guardedShell<T>(options: GuardedShellOptions<T>): Promise<ActionExecutionResult<T>>;
+export declare function guardedFileRead<T>(options: GuardedFileReadOptions<T>): Promise<ActionExecutionResult<T>>;
+export declare function guardedFileWrite<T>(options: GuardedFileWriteOptions<T>): Promise<ActionExecutionResult<T>>;
+export declare function guardedHttp<T>(options: GuardedHttpOptions<T>): Promise<ActionExecutionResult<T>>;
+//# sourceMappingURL=sensitive-operations.d.ts.map

package/dist/src/wrappers/sensitive-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-operations.d.ts","sourceRoot":"","sources":["../../../src/wrappers/sensitive-operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAA4B,MAAM,0BAA0B,CAAC;AAClH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,aAAa,CAAC;AAExE,MAAM,WAAW,mBAAmB,CAAC,CAAC;IACpC,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC;IACvC,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC;IACxC,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,CAAC,OAAO,EAAE;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAQD,wBAAsB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CASxG;AAED,wBAAsB,eAAe,CAAC,CAAC,EACrC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CASnC;AAED,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,OAAO,EAAE,uBAAuB,CAAC,CAAC,CAAC,GAClC,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CASnC;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CActG"}

package/dist/src/wrappers/sensitive-operations.js

@@ -0,0 +1,52 @@
+import { AuthorizationDeniedError } from "../guard/action-guard.js";
+function requireAllow(decision) {
+    if (!decision.allowed) {
+        throw new AuthorizationDeniedError(decision);
+    }
+}
+export async function guardedShell(options) {
+    const decision = options.guard.authorize(options.request, options.delegationDepth ?? 0);
+    requireAllow(decision);
+    const value = await options.execute(options.command);
+    return {
+        value,
+        decision,
+        mandate: decision.mandate ?? null,
+    };
+}
+export async function guardedFileRead(options) {
+    const decision = options.guard.authorize(options.request, options.delegationDepth ?? 0);
+    requireAllow(decision);
+    const value = await options.read(options.path);
+    return {
+        value,
+        decision,
+        mandate: decision.mandate ?? null,
+    };
+}
+export async function guardedFileWrite(options) {
+    const decision = options.guard.authorize(options.request, options.delegationDepth ?? 0);
+    requireAllow(decision);
+    const value = await options.write(options.path, options.contents);
+    return {
+        value,
+        decision,
+        mandate: decision.mandate ?? null,
+    };
+}
+export async function guardedHttp(options) {
+    const decision = options.guard.authorize(options.request, options.delegationDepth ?? 0);
+    requireAllow(decision);
+    const value = await options.send({
+        url: options.url,
+        method: options.method ?? "GET",
+        headers: options.headers,
+        body: options.body,
+    });
+    return {
+        value,
+        decision,
+        mandate: decision.mandate ?? null,
+    };
+}
+//# sourceMappingURL=sensitive-operations.js.map

package/dist/src/wrappers/sensitive-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-operations.js","sourceRoot":"","sources":["../../../src/wrappers/sensitive-operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AA4ClH,SAAS,YAAY,CAAC,QAA+B;IACnD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAI,OAA+B;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IACxF,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,OAAO;QACL,KAAK;QACL,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAkC;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IACxF,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO;QACL,KAAK;QACL,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAmC;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IACxF,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClE,OAAO;QACL,KAAK;QACL,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,OAA8B;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;IACxF,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QAC/B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,QAAQ;QACR,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@predicatesystems/authority",
+  "version": "0.3.1",
+  "description": "TypeScript authority SDK for Predicate Systems sidecar integration.",
+  "license": "(MIT OR Apache-2.0)",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE*"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "lint": "biome check src tests",
+    "test": "vitest run",
+    "test:integration": "RUN_SIDECAR_INTEGRATION_TESTS=true vitest run tests/integration.sidecar.test.ts",
+    "test:watch": "vitest",
+    "smoke:npm": "bash ./smoke-from-npm.sh",
+    "security:audit": "npm audit --audit-level=high",
+    "precommit": "npm run lint && npm run typecheck && npm test",
+    "prepare": "husky",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run typecheck && npm run test && npm run build"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/PredicateSystems/predicate-authority-ts.git"
+  },
+  "keywords": [
+    "predicate",
+    "authority",
+    "typescript",
+    "sdk",
+    "security"
+  ],
+  "devDependencies": {
+    "@biomejs/biome": "^1.9.4",
+    "@types/node": "^22.13.10",
+    "husky": "^9.1.7",
+    "typescript": "^5.8.2",
+    "vitest": "^3.0.8"
+  }
+}