usertrust 0.1.0

package/dist/policy/decay.js

@@ -0,0 +1,133 @@
+/**
+ * Decay Rate Calculator
+ *
+ * Calculates exponential decay rates for quota/budget consumption.
+ * Enables time-weighted rate limiting that rewards idle periods.
+ *
+ * The decay model uses: value(t) = initial * e^(-lambda * t)
+ * where lambda is the decay constant and t is time elapsed.
+ *
+ * Adapted from Field Project fermion/src/higgs/decay-rate.ts.
+ */
+// ---------------------------------------------------------------------------
+// DecayRateCalculator
+// ---------------------------------------------------------------------------
+/**
+ * Decay rate calculator using exponential decay model.
+ *
+ * Used for time-weighted rate limiting. Older consumption contributes less
+ * to current budget usage, rewarding tenants who space out their requests.
+ */
+export class DecayRateCalculator {
+    /** Decay constant (lambda = ln(2) / halfLife) */
+    lambda;
+    /** Minimum threshold for considering a value "fully decayed" */
+    minThreshold;
+    constructor(config) {
+        if (config.halfLifeMs <= 0) {
+            throw new Error("Half-life must be positive");
+        }
+        this.lambda = Math.LN2 / config.halfLifeMs;
+        this.minThreshold = config.minThreshold ?? 1e-9;
+    }
+    /**
+     * Calculate the decayed value after a given time elapsed.
+     *
+     * @param initialValue - The original value before decay
+     * @param elapsedMs - Time elapsed in milliseconds
+     * @returns Decay result with decayed value and metadata
+     */
+    calculate(initialValue, elapsedMs) {
+        if (elapsedMs < 0) {
+            throw new Error("Elapsed time cannot be negative");
+        }
+        if (initialValue <= 0) {
+            return {
+                decayedValue: 0,
+                decayFactor: 1,
+                elapsedMs,
+                fullyDecayed: true,
+            };
+        }
+        const decayFactor = Math.exp(-this.lambda * elapsedMs);
+        const decayedValue = initialValue * decayFactor;
+        const fullyDecayed = decayedValue < this.minThreshold;
+        return {
+            decayedValue: fullyDecayed ? 0 : decayedValue,
+            decayFactor,
+            elapsedMs,
+            fullyDecayed,
+        };
+    }
+    /**
+     * Calculate the weighted sum of multiple timestamped values.
+     * Each value is decayed based on its age relative to the reference time.
+     *
+     * @param entries - Array of timestamped entries
+     * @param referenceTime - The reference time (usually Date.now())
+     * @returns Total decayed value
+     */
+    calculateWeightedSum(entries, referenceTime = Date.now()) {
+        let total = 0;
+        for (const entry of entries) {
+            const elapsedMs = referenceTime - entry.ts;
+            if (elapsedMs < 0) {
+                // Future entry — use full value
+                total += entry.value;
+            }
+            else {
+                const result = this.calculate(entry.value, elapsedMs);
+                total += result.decayedValue;
+            }
+        }
+        return total;
+    }
+    /**
+     * Calculate time required for a value to decay to a target.
+     *
+     * @param currentValue - Current value
+     * @param targetValue - Target value to decay to
+     * @returns Time in milliseconds, or Infinity if target >= current
+     */
+    timeToDecay(currentValue, targetValue) {
+        if (targetValue >= currentValue || targetValue <= 0) {
+            return Number.POSITIVE_INFINITY;
+        }
+        // t = -ln(target/current) / lambda
+        return -Math.log(targetValue / currentValue) / this.lambda;
+    }
+    /**
+     * Get the half-life of this calculator.
+     */
+    getHalfLifeMs() {
+        return Math.LN2 / this.lambda;
+    }
+}
+// ---------------------------------------------------------------------------
+// Convenience: calculateDecayRate function
+// ---------------------------------------------------------------------------
+/**
+ * Calculate the decay rate for a set of timestamped entries.
+ *
+ * This is the primary entry point — a pure function that creates a calculator,
+ * computes the weighted sum, and returns the total decayed value.
+ *
+ * @param entries - Array of timestamped entries
+ * @param halfLife - Half-life in milliseconds (default: 1 hour)
+ * @returns Total decayed value (weighted sum)
+ */
+export function calculateDecayRate(entries, halfLife = 3_600_000) {
+    const calc = new DecayRateCalculator({ halfLifeMs: halfLife });
+    return calc.calculateWeightedSum(entries);
+}
+/**
+ * Create a decay calculator with a half-life matching a cost window.
+ * The half-life is set to 1/4 of the window so most decay occurs within it.
+ */
+export function createCostDecayCalculator(windowMs) {
+    return new DecayRateCalculator({
+        halfLifeMs: windowMs / 4,
+        minThreshold: 0.0001, // $0.0001 threshold for cost values
+    });
+}
+//# sourceMappingURL=decay.js.map

package/dist/policy/decay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decay.js","sourceRoot":"","sources":["../../src/policy/decay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkCH,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IAC/B,iDAAiD;IAChC,MAAM,CAAS;IAChC,gEAAgE;IAC/C,YAAY,CAAS;IAEtC,YAAY,MAAmB;QAC9B,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;;;;;OAMG;IACH,SAAS,CAAC,YAAoB,EAAE,SAAiB;QAChD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACvB,OAAO;gBACN,YAAY,EAAE,CAAC;gBACf,WAAW,EAAE,CAAC;gBACd,SAAS;gBACT,YAAY,EAAE,IAAI;aAClB,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,YAAY,GAAG,WAAW,CAAC;QAChD,MAAM,YAAY,GAAG,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAEtD,OAAO;YACN,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;YAC7C,WAAW;YACX,SAAS;YACT,YAAY;SACZ,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,oBAAoB,CAAC,OAA2B,EAAE,gBAAwB,IAAI,CAAC,GAAG,EAAE;QACnF,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,aAAa,GAAG,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBACnB,gCAAgC;gBAChC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACP,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBACtD,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC;YAC9B,CAAC;QACF,CAAC;QAED,OAAO,KAAK,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,YAAoB,EAAE,WAAmB;QACpD,IAAI,WAAW,IAAI,YAAY,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,MAAM,CAAC,iBAAiB,CAAC;QACjC,CAAC;QAED,mCAAmC;QACnC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,aAAa;QACZ,OAAO,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IAC/B,CAAC;CACD;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA2B,EAAE,QAAQ,GAAG,SAAS;IACnF,MAAM,IAAI,GAAG,IAAI,mBAAmB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACzD,OAAO,IAAI,mBAAmB,CAAC;QAC9B,UAAU,EAAE,QAAQ,GAAG,CAAC;QACxB,YAAY,EAAE,MAAM,EAAE,oCAAoC;KAC1D,CAAC,CAAC;AACJ,CAAC"}

package/dist/policy/default-rules.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Default Policy Rules
+ *
+ * Sensible defaults for financial governance:
+ * 1. Block zero-budget calls (budget <= 0 → deny, hard)
+ * 2. Warn on high-cost operations (estimated_cost > 1000 → warn, soft)
+ * 3. Block if budget exceeded (budget_remaining < estimated_cost → deny, hard)
+ */
+import type { GateRule } from "./gate.js";
+export declare const DEFAULT_RULES: GateRule[];
+/**
+ * Custom condition check for budget-exceeded rule.
+ * The default rules use two `exists` conditions as a prerequisite;
+ * actual comparison is done via this helper since cross-field
+ * comparison is not expressible with single-field operators alone.
+ *
+ * Usage:
+ *   if (isBudgetExceeded(context)) { ... }
+ */
+export declare function isBudgetExceeded(context: Record<string, unknown>): boolean;
+//# sourceMappingURL=default-rules.d.ts.map

package/dist/policy/default-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-rules.d.ts","sourceRoot":"","sources":["../../src/policy/default-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE1C,eAAO,MAAM,aAAa,EAAE,QAAQ,EAkCnC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAK1E"}

package/dist/policy/default-rules.js

@@ -0,0 +1,60 @@
+/**
+ * Default Policy Rules
+ *
+ * Sensible defaults for financial governance:
+ * 1. Block zero-budget calls (budget <= 0 → deny, hard)
+ * 2. Warn on high-cost operations (estimated_cost > 1000 → warn, soft)
+ * 3. Block if budget exceeded (budget_remaining < estimated_cost → deny, hard)
+ */
+export const DEFAULT_RULES = [
+    {
+        id: "block-zero-budget",
+        name: "Block zero-budget calls",
+        description: "Deny any operation when the caller has zero or negative budget",
+        priority: 1,
+        enabled: true,
+        effect: "deny",
+        enforcement: "hard",
+        severity: "critical",
+        conditions: [{ field: "budget", operator: "lte", value: 0 }],
+    },
+    {
+        id: "warn-high-cost",
+        name: "Warn on high-cost operations",
+        description: "Emit a warning when estimated cost exceeds 1000 tokens",
+        priority: 50,
+        enabled: true,
+        effect: "warn",
+        enforcement: "soft",
+        severity: "medium",
+        conditions: [{ field: "estimated_cost", operator: "gt", value: 1000 }],
+    },
+    {
+        id: "block-budget-exhausted",
+        name: "Block if budget exhausted",
+        description: "Deny operation when remaining budget is zero or negative",
+        priority: 2,
+        enabled: true,
+        effect: "deny",
+        enforcement: "hard",
+        severity: "high",
+        conditions: [{ field: "budget_remaining", operator: "lte", value: 0 }],
+    },
+];
+/**
+ * Custom condition check for budget-exceeded rule.
+ * The default rules use two `exists` conditions as a prerequisite;
+ * actual comparison is done via this helper since cross-field
+ * comparison is not expressible with single-field operators alone.
+ *
+ * Usage:
+ *   if (isBudgetExceeded(context)) { ... }
+ */
+export function isBudgetExceeded(context) {
+    const remaining = context.budget_remaining;
+    const estimated = context.estimated_cost;
+    if (typeof remaining !== "number" || typeof estimated !== "number")
+        return false;
+    return remaining < estimated;
+}
+//# sourceMappingURL=default-rules.js.map

package/dist/policy/default-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-rules.js","sourceRoot":"","sources":["../../src/policy/default-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,MAAM,CAAC,MAAM,aAAa,GAAe;IACxC;QACC,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,MAAM;QACnB,QAAQ,EAAE,UAAU;QACpB,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;KAC5D;IACD;QACC,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,8BAA8B;QACpC,WAAW,EAAE,wDAAwD;QACrE,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,MAAM;QACnB,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACtE;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,2BAA2B;QACjC,WAAW,EAAE,0DAA0D;QACvE,QAAQ,EAAE,CAAC;QACX,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,MAAM;QACnB,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;KACtE;CACD,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC;IACzC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjF,OAAO,SAAS,GAAG,SAAS,CAAC;AAC9B,CAAC"}

package/dist/policy/gate.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Policy Gate — 12 Field Operators
+ *
+ * Evaluates policy rules against a context to determine allow/deny decisions.
+ * Supports both hard (blocking) and soft (warning) enforcement modes.
+ *
+ * Adapted from Turf policy-gate.ts for the usertrust SDK.
+ * Uses the shared PolicyRule/FieldCondition types with dot-notation field
+ * resolution, glob matching on scope patterns, and time-window constraints.
+ *
+ * 12 operators: exists, not_exists, eq, neq, gt, gte, lt, lte, in, not_in,
+ * contains, regex.
+ */
+import type { PolicyEffect, PolicyEnforcement, PolicyRule, PolicySeverity } from "../shared/types.js";
+export interface RuleMatch {
+    /** Rule name */
+    name: string;
+    /** Effect of the matched rule */
+    effect: PolicyEffect;
+    /** Enforcement level */
+    enforcement: PolicyEnforcement;
+    /** Severity if set */
+    severity: PolicySeverity | undefined;
+}
+export interface PolicyResult {
+    /** Overall decision: deny if any hard violation, otherwise allow */
+    decision: "allow" | "deny";
+    /** Whether soft violations (warnings) were found */
+    hasWarnings: boolean;
+    /** All matched rules */
+    matched: RuleMatch[];
+    /** Hard violations that caused deny */
+    hardViolations: RuleMatch[];
+    /** Soft violations (warnings only) */
+    softViolations: RuleMatch[];
+    /** Human-readable reasons */
+    reasons: string[];
+    /** Evaluation timestamp */
+    evaluatedAt: string;
+}
+/**
+ * Test if any scope in the context matches any scope pattern from the rule.
+ * Uses minimatch for full glob support (**, *, brace expansion, etc.).
+ */
+export declare function matchesScope(patterns: string[], scopes: string[]): boolean;
+export interface TimeWindow {
+    /** Days of week (0=Sun, 6=Sat) */
+    daysOfWeek?: number[];
+    /** Start hour (0-23, inclusive) */
+    startHour?: number;
+    /** End hour (0-23, exclusive) */
+    endHour?: number;
+}
+/**
+ * Check if a timestamp falls within any of the given time windows.
+ * Returns true if timeWindows is empty/undefined (no constraint).
+ */
+export declare function isWithinTimeWindow(timeWindows: TimeWindow[] | undefined, timestamp: string): boolean;
+/**
+ * Context passed into evaluatePolicy. Fields are available for dot-notation
+ * resolution. The special keys `scope` and `timeWindows` enable glob and
+ * time-window matching respectively.
+ */
+export interface PolicyContext extends Record<string, unknown> {
+    /** Optional scope patterns to match against rule scope conditions */
+    scope?: string[];
+    /** Optional time windows for temporal constraints */
+    timeWindows?: TimeWindow[];
+    /** Optional timestamp override (defaults to now) */
+    timestamp?: string;
+}
+/**
+ * Extended policy rule for the gate. Adds optional `id`, `description`,
+ * `priority`, `enabled`, `scopePatterns`, and `timeWindows` fields to the
+ * shared PolicyRule type.
+ */
+export interface GateRule extends PolicyRule {
+    /** Unique rule identifier */
+    id?: string;
+    /** Human-readable description */
+    description?: string;
+    /** Rule priority (lower = higher priority). Default: 100 */
+    priority?: number;
+    /** Whether the rule is active. Default: true */
+    enabled?: boolean;
+    /** Glob patterns for scope matching */
+    scopePatterns?: string[];
+    /** Time windows for temporal constraints */
+    timeWindows?: TimeWindow[];
+}
+/**
+ * Evaluate policy rules against a context.
+ *
+ * Rules are sorted by priority (lower = higher priority, default 100).
+ * All matching rules are evaluated. The overall decision is "deny" if any
+ * hard violation is found. Soft violations produce warnings but allow.
+ *
+ * @param rules - Policy rules to evaluate
+ * @param context - Evaluation context with arbitrary fields
+ * @returns Policy evaluation result
+ */
+export declare function evaluatePolicy(rules: GateRule[], context: PolicyContext): PolicyResult;
+/**
+ * Load policy rules from a JSON or YAML file.
+ *
+ * Supports:
+ * - `.json` files: expects `{ "rules": [...] }` or a bare array
+ * - `.yml` / `.yaml` files: expects `rules: [...]` or a bare sequence
+ *
+ * Returns an empty array if the file cannot be read or parsed.
+ *
+ * @param path - Absolute or relative path to the policy file
+ * @returns Array of policy rules
+ */
+export declare function loadPolicies(path: string): GateRule[];
+//# sourceMappingURL=gate.d.ts.map

package/dist/policy/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/policy/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAGX,YAAY,EACZ,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,MAAM,oBAAoB,CAAC;AAM5B,MAAM,WAAW,SAAS;IACzB,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,wBAAwB;IACxB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,sBAAsB;IACtB,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC5B,oEAAoE;IACpE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,oDAAoD;IACpD,WAAW,EAAE,OAAO,CAAC;IACrB,wBAAwB;IACxB,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,uCAAuC;IACvC,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B,sCAAsC;IACtC,cAAc,EAAE,SAAS,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2BAA2B;IAC3B,WAAW,EAAE,MAAM,CAAC;CACpB;AAsFD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAE1E;AAMD,MAAM,WAAW,UAAU;IAC1B,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CACjC,WAAW,EAAE,UAAU,EAAE,GAAG,SAAS,EACrC,SAAS,EAAE,MAAM,GACf,OAAO,CAaT;AAMD;;;;GAIG;AACH,MAAM,WAAW,aAAc,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC7D,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,qDAAqD;IACrD,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC3C,6BAA6B;IAC7B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,4CAA4C;IAC5C,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;CAC3B;AAkCD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,GAAG,YAAY,CAkDtF;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAiBrD"}

package/dist/policy/gate.js

@@ -0,0 +1,227 @@
+/**
+ * Policy Gate — 12 Field Operators
+ *
+ * Evaluates policy rules against a context to determine allow/deny decisions.
+ * Supports both hard (blocking) and soft (warning) enforcement modes.
+ *
+ * Adapted from Turf policy-gate.ts for the usertrust SDK.
+ * Uses the shared PolicyRule/FieldCondition types with dot-notation field
+ * resolution, glob matching on scope patterns, and time-window constraints.
+ *
+ * 12 operators: exists, not_exists, eq, neq, gt, gte, lt, lte, in, not_in,
+ * contains, regex.
+ */
+import { readFileSync } from "node:fs";
+import { minimatch } from "minimatch";
+import { parse as parseYaml } from "yaml";
+// ---------------------------------------------------------------------------
+// Dot-notation field resolution
+// ---------------------------------------------------------------------------
+/**
+ * Resolve a dot-separated field path from a nested object.
+ * E.g. "context.data.model" traverses { context: { data: { model: "x" } } }.
+ */
+function resolveFieldPath(path, context) {
+    const parts = path.split(".");
+    let current = context;
+    for (const part of parts) {
+        if (current == null || typeof current !== "object")
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+// ---------------------------------------------------------------------------
+// Field condition evaluation (12 operators)
+// ---------------------------------------------------------------------------
+/**
+ * Evaluate a single field condition against the evaluation context.
+ * Supports all 12 operators from the FieldOperator union.
+ */
+function evaluateFieldCondition(fc, context) {
+    const resolved = resolveFieldPath(fc.field, context);
+    switch (fc.operator) {
+        case "exists":
+            return resolved !== undefined && resolved !== null;
+        case "not_exists":
+            return resolved === undefined || resolved === null;
+        case "eq":
+            return resolved === fc.value;
+        case "neq":
+            return resolved !== fc.value;
+        case "gt":
+            return typeof resolved === "number" && typeof fc.value === "number" && resolved > fc.value;
+        case "gte":
+            return typeof resolved === "number" && typeof fc.value === "number" && resolved >= fc.value;
+        case "lt":
+            return typeof resolved === "number" && typeof fc.value === "number" && resolved < fc.value;
+        case "lte":
+            return typeof resolved === "number" && typeof fc.value === "number" && resolved <= fc.value;
+        case "in":
+            return Array.isArray(fc.value) && fc.value.includes(resolved);
+        case "not_in":
+            return Array.isArray(fc.value) && !fc.value.includes(resolved);
+        case "contains":
+            return (typeof resolved === "string" && typeof fc.value === "string" && resolved.includes(fc.value));
+        case "regex":
+            if (typeof resolved !== "string" || typeof fc.value !== "string")
+                return false;
+            try {
+                return new RegExp(fc.value).test(resolved);
+            }
+            catch {
+                return false;
+            }
+        default:
+            return false;
+    }
+}
+// ---------------------------------------------------------------------------
+// Glob matching for scope patterns
+// ---------------------------------------------------------------------------
+/**
+ * Test if any scope in the context matches any scope pattern from the rule.
+ * Uses minimatch for full glob support (**, *, brace expansion, etc.).
+ */
+export function matchesScope(patterns, scopes) {
+    return scopes.some((scope) => patterns.some((pattern) => minimatch(scope, pattern)));
+}
+/**
+ * Check if a timestamp falls within any of the given time windows.
+ * Returns true if timeWindows is empty/undefined (no constraint).
+ */
+export function isWithinTimeWindow(timeWindows, timestamp) {
+    if (!timeWindows || timeWindows.length === 0)
+        return true;
+    const date = new Date(timestamp);
+    const dayOfWeek = date.getDay();
+    const hour = date.getHours();
+    return timeWindows.some((tw) => {
+        if (tw.daysOfWeek && !tw.daysOfWeek.includes(dayOfWeek))
+            return false;
+        if (tw.startHour !== undefined && hour < tw.startHour)
+            return false;
+        if (tw.endHour !== undefined && hour >= tw.endHour)
+            return false;
+        return true;
+    });
+}
+/**
+ * Evaluate all conditions of a rule against the context.
+ */
+function ruleMatches(rule, context) {
+    const enabled = rule.enabled ?? true;
+    if (!enabled)
+        return false;
+    // All field conditions must match
+    for (const fc of rule.conditions) {
+        if (!evaluateFieldCondition(fc, context))
+            return false;
+    }
+    // Scope matching (if rule has scope patterns)
+    if (rule.scopePatterns && rule.scopePatterns.length > 0) {
+        const ctxScopes = context.scope;
+        if (!ctxScopes || ctxScopes.length === 0)
+            return false;
+        if (!matchesScope(rule.scopePatterns, ctxScopes))
+            return false;
+    }
+    // Time window matching
+    if (rule.timeWindows && rule.timeWindows.length > 0) {
+        const timestamp = context.timestamp ?? new Date().toISOString();
+        if (!isWithinTimeWindow(rule.timeWindows, timestamp))
+            return false;
+    }
+    return true;
+}
+// ---------------------------------------------------------------------------
+// Policy evaluation (main entry point)
+// ---------------------------------------------------------------------------
+/**
+ * Evaluate policy rules against a context.
+ *
+ * Rules are sorted by priority (lower = higher priority, default 100).
+ * All matching rules are evaluated. The overall decision is "deny" if any
+ * hard violation is found. Soft violations produce warnings but allow.
+ *
+ * @param rules - Policy rules to evaluate
+ * @param context - Evaluation context with arbitrary fields
+ * @returns Policy evaluation result
+ */
+export function evaluatePolicy(rules, context) {
+    const timestamp = context.timestamp ?? new Date().toISOString();
+    // Sort by priority (ascending — lower number = higher priority)
+    const sortedRules = [...rules].sort((a, b) => (a.priority ?? 100) - (b.priority ?? 100));
+    const matched = [];
+    const hardViolations = [];
+    const softViolations = [];
+    const reasons = [];
+    for (const rule of sortedRules) {
+        if (!ruleMatches(rule, context))
+            continue;
+        const match = {
+            name: rule.name,
+            effect: rule.effect,
+            enforcement: rule.enforcement,
+            severity: rule.severity,
+        };
+        matched.push(match);
+        // Classify violation
+        const isViolation = rule.effect === "deny" || rule.effect === "warn";
+        if (isViolation) {
+            const label = rule.id ? `[${rule.id}]` : `[${rule.name}]`;
+            const rationale = rule.description ?? rule.name;
+            const reason = rule.enforcement === "hard" ? `${label} ${rationale}` : `[WARN] ${label} ${rationale}`;
+            reasons.push(reason);
+            if (rule.enforcement === "hard") {
+                hardViolations.push(match);
+            }
+            else {
+                softViolations.push(match);
+            }
+        }
+    }
+    return {
+        decision: hardViolations.length > 0 ? "deny" : "allow",
+        hasWarnings: softViolations.length > 0,
+        matched,
+        hardViolations,
+        softViolations,
+        reasons,
+        evaluatedAt: timestamp,
+    };
+}
+// ---------------------------------------------------------------------------
+// Policy file loading
+// ---------------------------------------------------------------------------
+/**
+ * Load policy rules from a JSON or YAML file.
+ *
+ * Supports:
+ * - `.json` files: expects `{ "rules": [...] }` or a bare array
+ * - `.yml` / `.yaml` files: expects `rules: [...]` or a bare sequence
+ *
+ * Returns an empty array if the file cannot be read or parsed.
+ *
+ * @param path - Absolute or relative path to the policy file
+ * @returns Array of policy rules
+ */
+export function loadPolicies(path) {
+    try {
+        const raw = readFileSync(path, "utf-8");
+        const isYaml = path.endsWith(".yml") || path.endsWith(".yaml");
+        const parsed = isYaml ? parseYaml(raw) : JSON.parse(raw);
+        if (Array.isArray(parsed))
+            return parsed;
+        if (parsed !== null && typeof parsed === "object") {
+            const obj = parsed;
+            if (Array.isArray(obj.rules))
+                return obj.rules;
+        }
+        return [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=gate.js.map

package/dist/policy/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/policy/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AA0C1C,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAgC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,OAAO,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,sBAAsB,CAAC,EAAkB,EAAE,OAAgC;IACnF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAErD,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;QAEpD,KAAK,YAAY;YAChB,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,CAAC;QAEpD,KAAK,IAAI;YACR,OAAO,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC;QAE9B,KAAK,KAAK;YACT,OAAO,QAAQ,KAAK,EAAE,CAAC,KAAK,CAAC;QAE9B,KAAK,IAAI;YACR,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC;QAE5F,KAAK,KAAK;YACT,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC;QAE7F,KAAK,IAAI;YACR,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC;QAE5F,KAAK,KAAK;YACT,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC;QAE7F,KAAK,IAAI;YACR,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE/D,KAAK,QAAQ;YACZ,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEhE,KAAK,UAAU;YACd,OAAO,CACN,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAC3F,CAAC;QAEH,KAAK,OAAO;YACX,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC/E,IAAI,CAAC;gBACJ,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;QAEF;YACC,OAAO,KAAK,CAAC;IACf,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB,EAAE,MAAgB;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAeD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CACjC,WAAqC,EACrC,SAAiB;IAEjB,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAE7B,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;QAC9B,IAAI,EAAE,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,GAAG,EAAE,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;AACJ,CAAC;AAwCD;;GAEG;AACH,SAAS,WAAW,CAAC,IAAc,EAAE,OAAsB;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,kCAAkC;IAClC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;IACxD,CAAC;IAED,8CAA8C;IAC9C,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IAChE,CAAC;IAED,uBAAuB;IACvB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,SAAS,GAAI,OAAO,CAAC,SAAgC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxF,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB,EAAE,OAAsB;IACvE,MAAM,SAAS,GAAI,OAAO,CAAC,SAAgC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAExF,gEAAgE;IAChE,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC;IAEzF,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,cAAc,GAAgB,EAAE,CAAC;IACvC,MAAM,cAAc,GAAgB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,SAAS;QAE1C,MAAM,KAAK,GAAc;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;QAEF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEpB,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC;QACrE,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;YAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC;YAChD,MAAM,MAAM,GACX,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,SAAS,EAAE,CAAC;YAExF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAErB,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBACjC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACP,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACF,CAAC;IACF,CAAC;IAED,OAAO;QACN,QAAQ,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACtD,WAAW,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC;QACtC,OAAO;QACP,cAAc;QACd,cAAc;QACd,OAAO;QACP,WAAW,EAAE,SAAS;KACtB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAExC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAY,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAElE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,MAAoB,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,KAAmB,CAAC;QAC9D,CAAC;QAED,OAAO,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC"}

package/dist/policy/pii.d.ts

@@ -0,0 +1,28 @@
+/**
+ * PII Detector
+ *
+ * Pattern-based PII detection for event payloads.
+ * Recursively scans strings in objects/arrays and returns
+ * which PII types were found and at which paths.
+ *
+ * Pure module — no side effects, no network calls.
+ *
+ * Detects: email, phone, SSN, credit card (Luhn-validated), IPv4.
+ *
+ * Adapted from Field Project fermion/src/higgs/pii-detector.ts.
+ */
+export interface PIIDetection {
+    /** Whether any PII was found */
+    found: boolean;
+    /** PII types detected (e.g. ["email", "ssn"]) */
+    types: string[];
+    /** Dot-paths where PII was found (e.g. ["user.email(email)", "billing.ssn(ssn)"]) */
+    paths: string[];
+}
+/**
+ * Detect PII in any value by recursively scanning strings in objects/arrays.
+ *
+ * Returns which PII types were found and at which dot-paths.
+ */
+export declare function detectPII(data: unknown): PIIDetection;
+//# sourceMappingURL=pii.d.ts.map

package/dist/policy/pii.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.d.ts","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,YAAY;IAC5B,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qFAAqF;IACrF,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAiFD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAWrD"}