@superblocksteam/shared 0.9602.0 → 0.9603.0

package/src/types/codeSecurity/index.ts

@@ -0,0 +1,51 @@
+// Wire contract for the code-security dependency-scan endpoints, shared by the
+// server handlers and the UI so the two can't drift. The taxonomy below is
+// mirrored by the PackageVulnerability DB entity (its columns import these).
+
+export type Ecosystem = 'npm';
+export type VulnerabilitySource = 'osv';
+export type AdvisoryKind = 'vulnerability' | 'malware';
+
+// Qualitative bands, ascending, then `unknown` (no scorable CVSS vector and no
+// qualitative rating). Doubles as the runtime allowlist for untrusted severity input.
+export const SEVERITY_LEVELS = ['none', 'low', 'medium', 'high', 'critical', 'unknown'] as const;
+export type SeverityLevel = (typeof SEVERITY_LEVELS)[number];
+
+// needs_review: version couldn't be pinned, so a "clear" verdict would be unearned.
+export type DependencyScanStatus = 'clear' | 'needs_review' | 'unresolved';
+
+export interface AdvisoryDetail {
+  advisoryId: string;
+  source: VulnerabilitySource;
+  kind: AdvisoryKind;
+  severity: SeverityLevel;
+  summary: string | null;
+  packageName: string;
+  currentVersion: string;
+  fixedVersion: string | null;
+  lowConfidence: boolean;
+}
+
+export interface PerAppVuln {
+  appId: string;
+  name: string;
+  owner: string | null;
+  published: boolean;
+  visibility: 'private' | 'public';
+  status: DependencyScanStatus;
+  totalCount: number;
+  topSeverity: SeverityLevel | null;
+  severityCounts: Partial<Record<SeverityLevel, number>>;
+  advisories: AdvisoryDetail[];
+  lowConfidence: boolean;
+  // Caller may undeploy this app (APPLICATIONS:DEPLOY). Set per-request on the
+  // list handler — not part of the org scan cache.
+  canDeploy: boolean;
+}
+
+export interface DependencyScanSummary {
+  overallSeverityCounts: Partial<Record<SeverityLevel, number>>;
+  publishedPublicWithVulns: number;
+  publishedWithVulns: number;
+  totalProjects: number;
+}

package/src/types/deployment/deployQueueStatus.ts

@@ -9,3 +9,38 @@ export enum DeployQueueStatus {
 
 /** Status returned by the deploy-status polling endpoint. "none" means no queue entry exists. */
 export type DeployStatusResponseStatus = 'none' | DeployQueueStatus;
+
+/**
+ * Identifies a sub-stage of the native-DB publish lifecycle that the UI
+ * surfaces independently of the overall deploy queue status. `provisioning`
+ * tracks `ensure_database` work; `migrating` tracks `migrate_schema` work.
+ */
+export type LifecycleStageKind = 'provisioning' | 'migrating';
+
+/**
+ * Aggregated state of a lifecycle stage across all prod bindings for a
+ * commit. Worst-case wins (any failed → failed, any in_progress →
+ * in_progress, all complete → complete, otherwise pending).
+ */
+export type LifecycleStageState = 'pending' | 'in_progress' | 'complete' | 'failed';
+
+export interface LifecycleStageProgress {
+  kind: LifecycleStageKind;
+  state: LifecycleStageState;
+  errorCode?: string;
+  errorMessage?: string;
+}
+
+/**
+ * Native-DB lifecycle progress for a publish. Sent alongside the deploy
+ * queue status so the UI can render provisioning and migration steps.
+ * Omitted from responses when no native-DB requirements exist for the commit.
+ *
+ * `stages` lists only lifecycle work queued for THIS commit — republishes
+ * that reuse an already-provisioned / already-migrated DB may return
+ * `hasNativeDb: true` with an empty `stages` array.
+ */
+export interface DeployLifecycleProgress {
+  hasNativeDb: boolean;
+  stages: LifecycleStageProgress[];
+}

package/src/types/deployment/index.ts

@@ -1,4 +1,11 @@
-export { DeployQueueStatus, type DeployStatusResponseStatus } from './deployQueueStatus.js';
+export {
+  DeployQueueStatus,
+  type DeployLifecycleProgress,
+  type DeployStatusResponseStatus,
+  type LifecycleStageKind,
+  type LifecycleStageProgress,
+  type LifecycleStageState
+} from './deployQueueStatus.js';
 
 export interface DeploymentDto {
   commitId: string | null;

package/src/types/index.ts

@@ -6,6 +6,7 @@ export * from './audit/index.js';
 export * from './auth/index.js';
 export * from './billing/index.js';
 export * from './ai/index.js';
+export * from './codeSecurity/index.js';
 export * from './commit/index.js';
 export * from './branch/index.js';
 export * from './common/index.js';
@@ -22,22 +23,24 @@ export * from './lock/index.js';
 export * from './observability/index.js';
 export * from './organization/index.js';
 export * from './page/index.js';
+export * from './pagination/index.js';
 export * from './policyGate/index.js';
 export * from './plugin/index.js';
 export * from './profile/index.js';
+export * from './publishPipeline/index.js';
 export * from './rbac/index.js';
+export * from './remoteCommit/index.js';
+export * from './repoConnection/index.js';
+export * from './repository/index.js';
 export * from './response/index.js';
 export * from './reviewPolicy/index.js';
-export * from './remoteCommit/index.js';
 export * from './scim/index.js';
 export * from './signingKeyRotationJob/index.js';
+export * from './template/index.js';
+export * from './uiBlock/index.js';
 export * from './user/index.js';
 export * from './userToken/index.js';
 export * from './version/index.js';
-export * from './repoConnection/index.js';
-export * from './repository/index.js';
 export * from './git/index.js';
-export * from './template/index.js';
 export * from './metadata/index.js';
 export * from './resource/index.js';
-export * from './uiBlock/index.js';

package/src/types/pagination/index.ts

@@ -0,0 +1,7 @@
+// Offset-pagination envelope. `total` is the filtered count before slicing.
+export interface Pagination<T> {
+  items: T[];
+  total: number;
+  limit: number;
+  offset: number;
+}

package/src/types/publishPipeline/index.ts

@@ -0,0 +1,104 @@
+/**
+ * Shared contract for the publish pipeline: one ordered list of steps the
+ * server computes for the UI status poll (GET publish-pipeline). Domains
+ * project into these types; rich payloads ride in opaque `detail` and are only
+ * read by that domain's UI renderer.
+ *
+ * Status-only — it does not start execution and does not gate deploy.
+ * Mutations (publish-readiness/start, POST deployments) start work and keep
+ * their own authoritative checks (build, policy, database lifecycle reconcile);
+ * this plan only reflects progress for the rail.
+ */
+
+/** Which domain owns a step. Extend as new gates are added. */
+export type PublishStepKind = 'build' | 'database_migration' | 'database_provisioning' | 'policy_gates' | 'publish';
+
+/**
+ * Domain-agnostic status. Ordered here by roll-up precedence (worst first).
+ * `blocked` means this step's own check failed (remediation). Waiting on an
+ * earlier step is `pending` with optional `blockedBy`.
+ * `skipped` is a visible N/A row (e.g. Build when the app has no native-git remote).
+ */
+export type PublishStepStatus =
+  | 'failed'
+  | 'blocked'
+  | 'action_required'
+  | 'stale'
+  | 'in_progress'
+  | 'pending'
+  | 'advisory'
+  | 'passed'
+  | 'skipped';
+
+export type BuildPublishStepDetail = {
+  buildStatus: string | null;
+  error?: string;
+};
+
+export type PublishDeployStepDetail = {
+  error?: string;
+  isLive?: boolean;
+  queueStatus: string;
+};
+
+export type PublishStep = {
+  /** Stable unique id in the plan (a PublishStepId; typed as string so unknown ids still flow through). */
+  id: string;
+  kind: PublishStepKind;
+  status: PublishStepStatus;
+  /** Human label for the step row (server-derived). */
+  displayName: string;
+  /** Static help text under the display name (not an error). */
+  description?: string;
+  /** Short subtitle / one-line error. */
+  summary?: string;
+  /** When status is pending and waiting on earlier steps. */
+  blockedBy?: PublishStepKind[];
+  /** Machine code when blocked/failed (e.g. POLICY_GATE_BLOCKED). */
+  blockingReason?: string;
+  /** Opaque domain payload; generic pipeline must not read this. */
+  detail?: unknown;
+};
+
+export type PublishPlanTarget = {
+  applicationId: string;
+  commitId: string;
+};
+
+export type PublishPlan = {
+  status: PublishStepStatus;
+  steps: PublishStep[];
+  target: PublishPlanTarget;
+};
+
+/**
+ * Single source of truth for publish-plan step ids. These are wire values: the
+ * server emits them on each step and the UI matches on them to wire custom
+ * detail panels. Keys are lowerCamelCase; values are the lowercase snake_case
+ * wire literals. Add new steps here and they become available to both sides.
+ */
+export const PublishStepId = {
+  build: 'build',
+  databaseMigration: 'database_migration',
+  databaseProvisioning: 'database_provisioning',
+  policyGatesBeforeBuild: 'policy_gates:before_build',
+  policyGatesBeforeDeploy: 'policy_gates:before_deploy',
+  publish: 'publish'
+} as const;
+
+export type PublishStepId = (typeof PublishStepId)[keyof typeof PublishStepId];
+
+/**
+ * Fixed spine order. Composer filters to steps that were emitted; order is always
+ * this sequence. Policy may emit before_build and/or before_deploy.
+ */
+export const PUBLISH_STEP_SPINE: readonly PublishStepId[] = [
+  PublishStepId.policyGatesBeforeBuild,
+  PublishStepId.build,
+  PublishStepId.policyGatesBeforeDeploy,
+  PublishStepId.databaseProvisioning,
+  PublishStepId.databaseMigration,
+  PublishStepId.publish
+] as const;
+
+export * from './plan.js';

package/src/types/publishPipeline/plan.test.ts

@@ -0,0 +1,200 @@
+import { describe, expect, test } from 'vitest';
+
+import type { PublishStep, PublishStepKind, PublishStepStatus } from './index.js';
+import { applyBlockedByEligibility, buildPublishPlan, orderPublishSteps, rollUpPublishPlan } from './plan.js';
+
+const TARGET = { applicationId: 'app-1', commitId: 'commit-1' };
+
+function step(overrides: Partial<PublishStep> & Pick<PublishStep, 'id'>): PublishStep {
+  return {
+    displayName: overrides.displayName ?? overrides.id,
+    kind: overrides.kind ?? 'build',
+    status: overrides.status ?? 'passed',
+    ...overrides
+  };
+}
+
+describe('rollUpPublishPlan', () => {
+  test('an empty plan is passed', () => {
+    expect(rollUpPublishPlan([])).toBe('passed');
+  });
+
+  test('the worst status wins by precedence', () => {
+    expect(
+      rollUpPublishPlan([step({ id: 'a', status: 'passed' }), step({ id: 'b', status: 'advisory' }), step({ id: 'c', status: 'blocked' })])
+    ).toBe('blocked');
+    expect(rollUpPublishPlan([step({ id: 'a', status: 'in_progress' }), step({ id: 'b', status: 'failed' })])).toBe('failed');
+    expect(rollUpPublishPlan([step({ id: 'a', status: 'advisory' }), step({ id: 'b', status: 'passed' })])).toBe('advisory');
+  });
+
+  test('skipped never masks a real status', () => {
+    expect(rollUpPublishPlan([step({ id: 'a', status: 'skipped' }), step({ id: 'b', status: 'passed' })])).toBe('passed');
+    expect(rollUpPublishPlan([step({ id: 'a', status: 'skipped' })])).toBe('skipped');
+  });
+
+  test('precedence order is exhaustive and worst-first', () => {
+    const precedence: PublishStepStatus[] = [
+      'failed',
+      'blocked',
+      'action_required',
+      'stale',
+      'in_progress',
+      'pending',
+      'advisory',
+      'passed',
+      'skipped'
+    ];
+    for (let i = 0; i < precedence.length; i += 1) {
+      const worse = precedence[i];
+      const better = precedence[i + 1];
+      const steps = better
+        ? [step({ id: 'better', status: better }), step({ id: 'worse', status: worse })]
+        : [step({ id: 'only', status: worse })];
+      expect(rollUpPublishPlan(steps)).toBe(worse);
+    }
+  });
+});
+
+describe('orderPublishSteps', () => {
+  test('orders steps by the publish spine regardless of input order', () => {
+    const ordered = orderPublishSteps([
+      step({ id: 'publish', kind: 'publish' }),
+      step({ id: 'policy_gates:before_build', kind: 'policy_gates' }),
+      step({ id: 'build', kind: 'build' }),
+      step({ id: 'database_provisioning', kind: 'database_provisioning' }),
+      step({ id: 'policy_gates:before_deploy', kind: 'policy_gates' }),
+      step({ id: 'database_migration', kind: 'database_migration' })
+    ]);
+    expect(ordered.map((s) => s.id)).toEqual([
+      'policy_gates:before_build',
+      'build',
+      'policy_gates:before_deploy',
+      'database_provisioning',
+      'database_migration',
+      'publish'
+    ]);
+  });
+
+  test('omits ids that are not present', () => {
+    const ordered = orderPublishSteps([step({ id: 'build', kind: 'build' }), step({ id: 'publish', kind: 'publish' })]);
+    expect(ordered.map((s) => s.id)).toEqual(['build', 'publish']);
+  });
+});
+
+describe('applyBlockedByEligibility', () => {
+  test('marks later pending steps as blockedBy earlier unclear steps', () => {
+    const steps = applyBlockedByEligibility([
+      step({ id: 'build', kind: 'build', status: 'in_progress' }),
+      step({ id: 'publish', kind: 'publish', status: 'pending' })
+    ]);
+    expect(steps[1].blockedBy).toEqual<PublishStepKind[]>(['build']);
+    expect(steps[1].status).toBe('pending');
+  });
+
+  test('does not overwrite a step that already failed', () => {
+    const steps = applyBlockedByEligibility([
+      step({ id: 'build', kind: 'build', status: 'failed' }),
+      step({ id: 'publish', kind: 'publish', status: 'failed' })
+    ]);
+    expect(steps[1].blockedBy).toBeUndefined();
+    expect(steps[1].status).toBe('failed');
+  });
+
+  test('holds an in_progress publish as pending until earlier policy gates clear', () => {
+    const steps = applyBlockedByEligibility([
+      step({
+        id: 'policy_gates:before_deploy',
+        kind: 'policy_gates',
+        status: 'in_progress',
+        displayName: 'Policy Agents'
+      }),
+      step({
+        id: 'publish',
+        kind: 'publish',
+        status: 'in_progress',
+        displayName: 'Publishing…'
+      })
+    ]);
+    expect(steps[1].status).toBe('pending');
+    expect(steps[1].blockedBy).toEqual<PublishStepKind[]>(['policy_gates']);
+    expect(steps[1].displayName).toBe('Publish');
+  });
+
+  test('clears blockedBy when all earlier steps are clear', () => {
+    const steps = applyBlockedByEligibility([
+      step({ id: 'build', kind: 'build', status: 'passed' }),
+      step({ id: 'publish', kind: 'publish', status: 'pending', blockedBy: ['build'] })
+    ]);
+    expect(steps[1].blockedBy).toBeUndefined();
+  });
+
+  test('does not block policy gates on an unfinished build (they run concurrently)', () => {
+    const steps = applyBlockedByEligibility([
+      step({ id: 'build', kind: 'build', status: 'in_progress' }),
+      step({
+        id: 'policy_gates:before_deploy',
+        kind: 'policy_gates',
+        status: 'in_progress',
+        displayName: 'Policy Agents'
+      })
+    ]);
+    expect(steps[1].blockedBy).toBeUndefined();
+    expect(steps[1].status).toBe('in_progress');
+    expect(steps[1].displayName).toBe('Policy Agents');
+  });
+
+  test('keeps a pending policy gate idle rather than waiting on the build', () => {
+    const steps = applyBlockedByEligibility([
+      step({ id: 'build', kind: 'build', status: 'in_progress' }),
+      step({ id: 'policy_gates:before_deploy', kind: 'policy_gates', status: 'pending' })
+    ]);
+    expect(steps[1].blockedBy).toBeUndefined();
+    expect(steps[1].status).toBe('pending');
+  });
+
+  test('still blocks publish on both the build and policy gates', () => {
+    const steps = applyBlockedByEligibility([
+      step({ id: 'build', kind: 'build', status: 'in_progress' }),
+      step({ id: 'policy_gates:before_deploy', kind: 'policy_gates', status: 'in_progress' }),
+      step({ id: 'publish', kind: 'publish', status: 'pending' })
+    ]);
+    expect(steps[2].blockedBy).toEqual<PublishStepKind[]>(['build', 'policy_gates']);
+    expect(steps[2].status).toBe('pending');
+  });
+
+  test('lists each unclear kind at most once in blockedBy', () => {
+    // Two earlier steps can share a kind (e.g. multiple database_* rows). The
+    // rail waits on kinds, not step ids, so blockedBy must not repeat a kind.
+    const steps = applyBlockedByEligibility([
+      step({
+        id: 'database_provisioning:a',
+        kind: 'database_provisioning',
+        status: 'in_progress'
+      }),
+      step({
+        id: 'database_provisioning:b',
+        kind: 'database_provisioning',
+        status: 'pending'
+      }),
+      step({ id: 'publish', kind: 'publish', status: 'pending' })
+    ]);
+    expect(steps[2].blockedBy).toEqual<PublishStepKind[]>(['database_provisioning']);
+  });
+});
+
+describe('buildPublishPlan', () => {
+  test('orders, applies eligibility, and rolls up', () => {
+    const plan = buildPublishPlan(TARGET, [
+      step({ id: 'publish', kind: 'publish', status: 'pending' }),
+      step({ id: 'build', kind: 'build', status: 'in_progress' })
+    ]);
+    expect(plan.target).toEqual(TARGET);
+    expect(plan.steps.map((s) => s.id)).toEqual(['build', 'publish']);
+    expect(plan.steps[1].blockedBy).toEqual(['build']);
+    expect(plan.status).toBe('in_progress');
+  });
+
+  test('an empty plan is passed', () => {
+    expect(buildPublishPlan(TARGET, []).status).toBe('passed');
+  });
+});

package/src/types/publishPipeline/plan.ts

@@ -0,0 +1,114 @@
+import type { PublishPlan, PublishPlanTarget, PublishStep, PublishStepKind, PublishStepStatus } from './index.js';
+import { PUBLISH_STEP_SPINE } from './index.js';
+
+/** Worst-first. When summarizing many steps into one status, first match wins. */
+const STATUS_PRECEDENCE: PublishStepStatus[] = [
+  'failed',
+  'blocked',
+  'action_required',
+  'stale',
+  'in_progress',
+  'pending',
+  'advisory',
+  'passed',
+  'skipped'
+];
+
+const CLEAR_STATUSES = new Set<PublishStepStatus>(['passed', 'advisory', 'skipped']);
+
+/** Collapse ordered steps into the single status shown on the plan. Empty = passed. */
+export function rollUpPublishPlan(steps: PublishStep[]): PublishStepStatus {
+  const present = new Set(steps.map((s) => s.status));
+  return STATUS_PRECEDENCE.find((s) => present.has(s)) ?? 'passed';
+}
+
+/** Order steps by the fixed spine; unknown ids are appended in input order. */
+export function orderPublishSteps(steps: PublishStep[]): PublishStep[] {
+  const byId = new Map(steps.map((s) => [s.id, s]));
+  const ordered: PublishStep[] = [];
+  for (const id of PUBLISH_STEP_SPINE) {
+    const step = byId.get(id);
+    if (step) {
+      ordered.push(step);
+      byId.delete(id);
+    }
+  }
+  for (const step of steps) {
+    if (byId.has(step.id)) {
+      ordered.push(step);
+      byId.delete(step.id);
+    }
+  }
+  return ordered;
+}
+
+function isClear(status: PublishStepStatus): boolean {
+  return CLEAR_STATUSES.has(status);
+}
+
+/** Idle label when a step is held waiting on earlier work (not actively running). */
+const PENDING_DISPLAY_NAMES: Record<PublishStepKind, string> = {
+  build: 'Build',
+  database_migration: 'Database migration',
+  database_provisioning: 'Database provisioning',
+  policy_gates: 'Policy Agents',
+  publish: 'Publish'
+};
+
+/**
+ * Kinds that execute concurrently and therefore must not appear as each other's
+ * prerequisite. The SABS build and the policy agents both key off the commit and
+ * run in parallel — policy agents analyze the committed code directly and do not
+ * wait for the build artifact — so neither should show "Waiting on" the other in
+ * the rail. They both still gate the final publish.
+ */
+const CONCURRENT_KINDS = new Set<PublishStepKind>(['build', 'policy_gates']);
+
+/** An earlier unclear step gates a later step unless the two run concurrently. */
+function earlierKindBlocks(earlier: PublishStepKind, current: PublishStepKind): boolean {
+  return !(CONCURRENT_KINDS.has(earlier) && CONCURRENT_KINDS.has(current));
+}
+
+/**
+ * For each step that is not yet clear, set `blockedBy` to kinds of earlier
+ * steps that are not clear and that actually gate it (concurrent steps such as
+ * build and policy gates do not gate each other). Premature `in_progress` (e.g.
+ * deploy already QUEUED while policy gates still run) is held as `pending` so
+ * the rail does not show "Publishing…" ahead of unfinished prerequisites. Failed
+ * and other terminal statuses are left alone. Clears blockedBy when the gating
+ * steps clear.
+ */
+export function applyBlockedByEligibility(steps: PublishStep[]): PublishStep[] {
+  // Kind set (not a list): multiple earlier steps can share a kind, but the
+  // rail waits on kinds — blockedBy must not repeat the same kind.
+  const unclearKinds = new Set<PublishStepKind>();
+  return steps.map((step) => {
+    const blockers = [...unclearKinds].filter((kind) => earlierKindBlocks(kind, step.kind));
+    if (blockers.length > 0 && (step.status === 'pending' || step.status === 'in_progress')) {
+      const next: PublishStep = {
+        ...step,
+        status: 'pending',
+        blockedBy: blockers,
+        displayName: PENDING_DISPLAY_NAMES[step.kind]
+      };
+      unclearKinds.add(step.kind);
+      return next;
+    }
+    if (step.status === 'pending') {
+      const rest = { ...step };
+      delete rest.blockedBy;
+      unclearKinds.add(step.kind);
+      return rest;
+    }
+    if (!isClear(step.status)) {
+      unclearKinds.add(step.kind);
+    }
+    return step;
+  });
+}
+
+/** Order, apply eligibility, roll up. */
+export function buildPublishPlan(target: PublishPlanTarget, steps: PublishStep[]): PublishPlan {
+  const ordered = applyBlockedByEligibility(orderPublishSteps(steps));
+  return { status: rollUpPublishPlan(ordered), steps: ordered, target };
+}

package/src/types/publishPipeline/stepIds.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, test } from 'vitest';
+
+import { PUBLISH_STEP_SPINE, PublishStepId } from './index.js';
+
+describe('PublishStepId', () => {
+  test('exposes the stable wire id for every publish step', () => {
+    expect(PublishStepId).toEqual({
+      build: 'build',
+      databaseMigration: 'database_migration',
+      databaseProvisioning: 'database_provisioning',
+      policyGatesBeforeBuild: 'policy_gates:before_build',
+      policyGatesBeforeDeploy: 'policy_gates:before_deploy',
+      publish: 'publish'
+    });
+  });
+
+  test('the spine is made up only of known step ids, in fixed order', () => {
+    expect(PUBLISH_STEP_SPINE).toEqual([
+      PublishStepId.policyGatesBeforeBuild,
+      PublishStepId.build,
+      PublishStepId.policyGatesBeforeDeploy,
+      PublishStepId.databaseProvisioning,
+      PublishStepId.databaseMigration,
+      PublishStepId.publish
+    ]);
+  });
+
+  test('every known step id appears in the spine exactly once', () => {
+    const ids = Object.values(PublishStepId);
+    for (const id of ids) {
+      expect(PUBLISH_STEP_SPINE.filter((spineId) => spineId === id)).toHaveLength(1);
+    }
+    expect(PUBLISH_STEP_SPINE).toHaveLength(ids.length);
+  });
+});

package/src/types/rbac/index.ts

@@ -152,7 +152,7 @@ export enum ResourceTypeEnum {
   // ORGANIZATION_REQUESTS = 'org.requests',
   ORGANIZATION_USERS = 'org.users',
   ORG_KNOWLEDGE = 'org_knowledge',
-  POLICY_AGENTS = 'policy_agents',
+  POLICIES = 'policies',
   PROFILES = 'profiles',
   REPOSITORIES = 'repos',
   ROLES = 'roles',
@@ -225,7 +225,7 @@ export const ActionTypeByResourceType = {
   PROFILES: {
     MANAGE: ActionTypeEnum.MANAGE
   },
-  POLICY_AGENTS: {
+  POLICIES: {
     MANAGE: ActionTypeEnum.MANAGE,
     VIEW: ActionTypeEnum.VIEW
   },