palaryn 0.1.0 → 0.3.2

package/src/types/policy.ts

@@ -0,0 +1,83 @@
+export type PolicyDecision = 'allow' | 'deny' | 'transform' | 'require_approval';
+
+export type PolicyEffect = 'ALLOW' | 'DENY' | 'TRANSFORM' | 'REQUIRE_APPROVAL';
+
+export interface PolicyTransformation {
+  type: 'strip_header' | 'redact_field' | 'replace_value' | 'redact_sql_column' | 'sanitize_path' | 'mask_command_arg';
+  target: string;
+  value?: string;
+}
+
+export interface PolicyRule {
+  name: string;
+  description?: string;
+  effect: PolicyEffect;
+  priority?: number;
+  conditions: PolicyConditions;
+  transformations?: PolicyTransformation[];
+  approval?: {
+    scope: string;
+    ttl_seconds: number;
+    reason?: string;
+  };
+}
+
+export interface PolicyConditions {
+  tools?: string[];
+  tool_match?: string; // regex pattern
+  capabilities?: ('read' | 'write' | 'delete' | 'admin')[];
+  actors?: string[];
+  actor_types?: ('agent' | 'user' | 'system')[];
+  domains?: string[]; // for HTTP tool - allowed domains
+  domain_blocklist?: string[];
+  methods?: string[];
+  labels?: string[];
+  label_match?: string;
+  platforms?: string[];
+  workspace_ids?: string[];
+  // Filesystem conditions
+  file_paths?: string[];           // glob patterns to match (e.g., ['*.env', '/etc/**'])
+  file_paths_blocklist?: string[]; // glob patterns to block
+  file_extensions?: string[];      // file extensions to match (e.g., ['.env', '.key', '.pem'])
+
+  // SQL conditions
+  sql_tables?: string[];           // table names to match
+  sql_tables_blocklist?: string[]; // tables to block
+  sql_statements?: string[];       // statement types (e.g., ['SELECT', 'INSERT'])
+
+  // Shell conditions
+  shell_commands?: string[];           // allowed commands to match
+  shell_commands_blocklist?: string[]; // blocked commands
+
+  // Provider interception conditions
+  providers?: string[];                // provider names (e.g., ['claude', 'openai', 'gemini'])
+  provider_tool_types?: string[];      // tool types (e.g., ['computer_use', 'code_interpreter'])
+
+  /** DLP conditions — evaluated when DLP context is available (after DLP scan) */
+  dlp_severity?: string[];      // e.g., ['high', 'critical'] — match if DLP max severity is in this list
+  dlp_detected?: boolean;       // true = rule matches only when DLP detections exist
+  dlp_pattern_names?: string[]; // match if any of these pattern names were detected
+}
+
+export interface PolicyPack {
+  name: string;
+  version: string;
+  description?: string;
+  rules: PolicyRule[];
+  domain_allowlist?: string[];
+  domain_blocklist?: string[];
+  default_effect?: PolicyEffect;
+}
+
+export interface PolicyEvalResult {
+  decision: PolicyDecision;
+  rule_id: string;
+  rule_name: string;
+  reasons: string[];
+  transformations?: PolicyTransformation[];
+  approval?: {
+    scope: string;
+    ttl_seconds: number;
+    reason?: string;
+  };
+}

package/src/types/stripe-config.ts

@@ -0,0 +1,11 @@
+export interface StripeConfig {
+  secret_key: string;
+  webhook_secret: string;
+  price_ids: {
+    pro_monthly: string;
+    business_monthly: string;
+  };
+  portal_return_url?: string;
+  checkout_success_url?: string;
+  checkout_cancel_url?: string;
+}

package/src/types/subscription.ts

@@ -0,0 +1,59 @@
+export type PlanTier = 'free' | 'pro' | 'business' | 'enterprise';
+
+export interface Subscription {
+  id: string;
+  workspace_id: string;
+  stripe_customer_id: string;
+  stripe_subscription_id?: string;
+  plan: PlanTier;
+  status: 'active' | 'past_due' | 'canceled' | 'trialing' | 'incomplete';
+  current_period_start?: string; // ISO
+  current_period_end?: string;   // ISO
+  cancel_at_period_end?: boolean;
+  created_at: string; // ISO
+  updated_at: string; // ISO
+}
+
+export interface PlanLimits {
+  calls_per_month: number;
+  workspaces: number;
+  members_per_workspace: number;
+  api_keys_per_workspace: number;
+  audit_retention_days: number;
+  features: string[];
+}
+
+export const PLAN_LIMITS: Record<PlanTier, PlanLimits> = {
+  free: {
+    calls_per_month: 10000,
+    workspaces: 1,
+    members_per_workspace: 3,
+    api_keys_per_workspace: 5,
+    audit_retention_days: 7,
+    features: ['basic_dlp', 'basic_policy'],
+  },
+  pro: {
+    calls_per_month: 100000,
+    workspaces: 5,
+    members_per_workspace: 10,
+    api_keys_per_workspace: 25,
+    audit_retention_days: 30,
+    features: ['basic_dlp', 'basic_policy', 'prompt_injection', 'anomaly_detection', 'custom_policies'],
+  },
+  business: {
+    calls_per_month: 1000000,
+    workspaces: 20,
+    members_per_workspace: 50,
+    api_keys_per_workspace: 100,
+    audit_retention_days: 90,
+    features: ['basic_dlp', 'basic_policy', 'prompt_injection', 'anomaly_detection', 'custom_policies', 'sso', 'advanced_dlp'],
+  },
+  enterprise: {
+    calls_per_month: Infinity,
+    workspaces: Infinity,
+    members_per_workspace: Infinity,
+    api_keys_per_workspace: Infinity,
+    audit_retention_days: 365,
+    features: ['basic_dlp', 'basic_policy', 'prompt_injection', 'anomaly_detection', 'custom_policies', 'sso', 'advanced_dlp', 'dedicated_support', 'custom_integrations'],
+  },
+};

package/src/types/tool-call.ts

@@ -0,0 +1,47 @@
+export interface Actor {
+  type: 'agent' | 'user' | 'system';
+  id: string;
+  display?: string;
+}
+
+export interface Source {
+  platform: string;
+  session_id?: string;
+}
+
+export interface ToolInfo {
+  name: string;
+  version?: string;
+  capability: 'read' | 'write' | 'delete' | 'admin';
+}
+
+export interface ToolCallArgs {
+  method?: string;
+  url?: string;
+  headers?: Record<string, string>;
+  body?: unknown;
+  [key: string]: unknown;
+}
+
+export interface Constraints {
+  max_cost_usd?: number;
+  timeout_ms?: number;
+}
+
+export interface CallContext {
+  purpose?: string;
+  labels?: string[];
+}
+
+export interface ToolCall {
+  tool_call_id: string;
+  task_id: string;
+  workspace_id: string;
+  actor: Actor;
+  source: Source;
+  tool: ToolInfo;
+  args: ToolCallArgs;
+  constraints?: Constraints;
+  context?: CallContext;
+  timestamp?: string;
+}

package/src/types/tool-result.ts

@@ -0,0 +1,82 @@
+import { PolicyDecision } from './policy';
+
+export type ToolResultStatus = 'ok' | 'blocked' | 'needs_approval' | 'error';
+export type DLPSeverity = 'low' | 'medium' | 'high';
+export type RedactionMethod = 'mask' | 'hash' | 'drop' | 'tokenize';
+
+export interface DLPRedaction {
+  path: string;
+  method: RedactionMethod;
+  original_type?: string;
+  /** Masked preview of the matched value, e.g. "AKI***DEF" or "+1-5***234" */
+  masked_preview?: string;
+}
+
+export interface DLPReport {
+  detected: string[];
+  redactions: DLPRedaction[];
+  severity: DLPSeverity;
+}
+
+export interface UsageData {
+  input_tokens?: number;
+  output_tokens?: number;
+  total_tokens?: number;
+  /** Anthropic: tokens written to cache (billed at 1.25x input price) */
+  cache_creation_tokens?: number;
+  /** Anthropic: tokens read from cache (billed at 0.1x input price) */
+  cache_read_tokens?: number;
+  /** OpenAI o1/o3: reasoning tokens (billed at output price) */
+  reasoning_tokens?: number;
+  provider_cost_usd?: number;
+  computed_cost_usd?: number;
+  source?: string;
+  model?: string;
+  provider?: string;
+}
+
+export interface BudgetReport {
+  estimated_cost_usd: number;
+  spent_cost_usd_task: number;
+  remaining_cost_usd_task: number;
+  actual_cost_usd?: number;
+  usage?: UsageData;
+}
+
+export interface ToolOutput {
+  // HTTP output fields
+  http_status?: number;
+  body?: unknown;
+  headers?: Record<string, string>;
+  // Filesystem executor: affected paths
+  paths?: string[];
+  // SQL executor: affected row count
+  rows_affected?: number;
+  // Shell executor: process exit code
+  exit_code?: number;
+  // Shell executor: stderr output
+  stderr?: string;
+  // Generic extensible metadata for any executor
+  metadata?: Record<string, unknown>;
+}
+
+export interface TimingInfo {
+  started_at: string;
+  duration_ms: number;
+}
+
+export interface ToolResult {
+  tool_call_id: string;
+  task_id: string;
+  status: ToolResultStatus;
+  policy: {
+    decision: PolicyDecision;
+    rule_id?: string;
+    reasons: string[];
+  };
+  dlp: DLPReport;
+  budget: BudgetReport;
+  output?: ToolOutput;
+  error?: string;
+  timing: TimingInfo;
+}

package/src/types/user.ts

@@ -0,0 +1,125 @@
+// ---------------------------------------------------------------------------
+// OAuth & SaaS Types
+// ---------------------------------------------------------------------------
+
+import { PlanTier } from './subscription';
+
+export type OAuthProvider = 'google' | 'github';
+
+export interface User {
+  id: string;
+  email: string;
+  display_name: string;
+  avatar_url?: string;
+  password_hash?: string;
+  status: 'active' | 'suspended' | 'deleted';
+  onboarding_completed: boolean;
+  created_at: string; // ISO
+  updated_at: string; // ISO
+}
+
+export interface OAuthAccount {
+  id: string;
+  user_id: string;
+  provider: OAuthProvider;
+  provider_user_id: string;
+  provider_email: string;
+  access_token_encrypted?: string;
+  refresh_token_encrypted?: string;
+  token_expires_at?: string; // ISO
+  created_at: string; // ISO
+  updated_at: string; // ISO
+}
+
+export interface Workspace {
+  id: string;
+  name: string;
+  slug: string;
+  owner_user_id: string;
+  plan: PlanTier;
+  settings: Record<string, unknown>;
+  created_at: string; // ISO
+  updated_at: string; // ISO
+}
+
+export interface WorkspaceMember {
+  id: string;
+  workspace_id: string;
+  user_id: string;
+  role: 'owner' | 'admin' | 'member' | 'viewer';
+  joined_at: string; // ISO
+}
+
+export interface Session {
+  id: string;
+  user_id: string;
+  workspace_id?: string;
+  ip_address?: string;
+  user_agent?: string;
+  expires_at: string; // ISO
+  last_active_at: string; // ISO
+  created_at: string; // ISO
+}
+
+export interface UserApiKey {
+  id: string;
+  key_hash: string;          // Format: "salt:hash" (salted) or plain hex (legacy unsalted)
+  key_prefix: string;        // First 8 chars for identification
+  user_id: string;
+  workspace_id: string;
+  name: string;
+  roles: string[];
+  tags: string[];            // Freeform labels, e.g. ["project:demo", "env:staging"]
+  revoked: boolean;
+  last_used_at?: string;     // ISO
+  created_at: string;        // ISO
+}
+
+// ---------------------------------------------------------------------------
+// OAuth flow types
+// ---------------------------------------------------------------------------
+
+export interface OAuthProfile {
+  provider: OAuthProvider;
+  provider_user_id: string;
+  email: string;
+  display_name: string;
+  avatar_url?: string;
+}
+
+export interface OAuthFlowState {
+  provider: OAuthProvider;
+  code_verifier?: string; // PKCE (Google)
+  nonce: string;
+  redirect_uri: string;
+  created_at: number; // Unix ms
+}
+
+// ---------------------------------------------------------------------------
+// OAuth configuration types
+// ---------------------------------------------------------------------------
+
+export interface GoogleOAuthProvider {
+  client_id: string;
+  client_secret: string;
+  redirect_uri?: string;
+}
+
+export interface GitHubOAuthProvider {
+  client_id: string;
+  client_secret: string;
+  redirect_uri?: string;
+}
+
+export interface OAuthConfig {
+  enabled: boolean;
+  session_secret: string;
+  session_ttl_seconds: number; // Default: 7 days (604800)
+  google?: GoogleOAuthProvider;
+  github?: GitHubOAuthProvider;
+}
+
+export interface FrontendConfig {
+  enabled: boolean;
+  build_path: string; // Path to built frontend assets (default: web/dist)
+}

package/tsconfig.json

@@ -0,0 +1,24 @@
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "module": "commonjs",
+    "lib": ["ES2020"],
+    "outDir": "./dist",
+    "rootDir": ".",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "moduleResolution": "node",
+    "paths": {
+      "@/*": ["./src/*"]
+    },
+    "baseUrl": "."
+  },
+  "include": ["src/**/*", "tests/**/*", "sdk/**/*"],
+  "exclude": ["node_modules", "dist", "tests/e2e"]
+}