@openagentid/arsenal-sdk/policy

declare function compareOperator(operator: ConditionOperatorValue, actual: string, expected: string): boolean;

declare function denyWith(reason: string): PolicyDecision;

declare function evaluatePolicy(policy: PolicyDocument, request: PolicyRequest): PolicyDecision;

declare function policyAllows(decision: PolicyDecision): boolean;

declare class PolicyEngine {
    addPolicy(policy: PolicyDocument): void;
    removePolicy(policyId: string): PolicyDocument | undefined;
    getPolicy(policyId: string): PolicyDocument | undefined;
    policyIds(): readonly string[];
    size(): number;
    evaluate(request: PolicyRequest): PolicyDecision;
}

declare const BindingType: {
    readonly Required: "required";
    readonly Preferred: "preferred";
};

type BindingTypeValue = (typeof BindingType)[keyof typeof BindingType];

declare const ConditionOperator: {
    readonly Equals: "equals";
    readonly NotEquals: "not_equals";
    readonly Contains: "contains";
    readonly StartsWith: "starts_with";
    readonly EndsWith: "ends_with";
    readonly Matches: "matches";
    readonly In: "in";
    readonly NotIn: "not_in";
};

type ConditionOperatorValue = (typeof ConditionOperator)[keyof typeof ConditionOperator];

interface Constraints {
    device_binding?: DeviceBinding;
    session_binding?: SessionBinding;
    origin_binding?: OriginBinding;
    network_constraints?: NetworkConstraints;
    time_constraints?: TimeConstraints;
    environment_constraints?: EnvironmentConstraint;
    require_pop: boolean;
}

interface DeviceBinding {
    device_id: string;
    binding_type: BindingTypeValue;
}

interface EnvironmentConstraint {
    required_environment?: string;
    required_tags?: ReadonlySet<string>;
    forbidden_tags?: ReadonlySet<string>;
}

interface NetworkConstraints {
    allowed_ips?: ReadonlySet<string>;
    denied_ips?: ReadonlySet<string>;
    allowed_cidrs?: readonly string[];
    allowed_asns?: ReadonlySet<number>;
}

interface OriginBinding {
    allowed_origins: ReadonlySet<string>;
}

type PolicyCondition = {
    type: "agent_id";
    operator: ConditionOperatorValue;
    value: string;
} | {
    type: "tenant_id";
    operator: ConditionOperatorValue;
    value: string;
} | {
    type: "scope";
    operator: ConditionOperatorValue;
    value: string;
} | {
    type: "environment";
    operator: ConditionOperatorValue;
    value: string;
} | {
    type: "time_of_day";
    allowed_hours: readonly number[];
} | {
    type: "day_of_week";
    allowed_days: readonly number[];
} | {
    type: "ip_address";
    allowed_cidrs: readonly string[];
} | {
    type: "attribute";
    key: string;
    operator: ConditionOperatorValue;
    value: string;
} | {
    type: "and";
    conditions: readonly PolicyCondition[];
} | {
    type: "or";
    conditions: readonly PolicyCondition[];
} | {
    type: "not";
    condition: PolicyCondition;
};

interface PolicyDecision {
    effect: PolicyEffectValue;
    matched_rule?: string;
    reason?: string;
}

interface PolicyDocument {
    id: string;
    version: number;
    tenant_id: string;
    name: string;
    description?: string;
    rules: readonly PolicyRule[];
    default_effect: PolicyEffectValue;
    is_active: boolean;
    priority: number;
    created_at: string;
    updated_at: string;
    signature?: PolicySignature;
    labels: Readonly<Record<string, string>>;
}

declare const PolicyEffect: {
    readonly Allow: "allow";
    readonly Deny: "deny";
};

type PolicyEffectValue = (typeof PolicyEffect)[keyof typeof PolicyEffect];

interface PolicyRequest {
    agent_id: string;
    tenant_id: string;
    requested_scope: string;
    timestamp: Date;
    environment?: string;
    client_ip?: string;
    attributes: Readonly<Record<string, string>>;
}

interface PolicyRule {
    id: string;
    description?: string;
    effect: PolicyEffectValue;
    conditions: readonly PolicyCondition[];
    scopes?: ScopeSet;
    constraints?: Constraints;
    rate_limits?: RateLimits;
    budget?: UsageBudget;
}

interface PolicySignature {
    bytes: Uint8Array;
    algorithm: string;
    key_id: string;
    signed_at: string;
}

interface RateLimits {
    requests_per_second?: number;
    requests_per_minute?: number;
    requests_per_hour?: number;
    max_concurrent?: number;
    max_request_size?: number;
    max_response_size?: number;
}

declare class Scope {
    static parse(scope: string): Scope;
    static wildcard(): Scope;
    static readOnly(service: string): Scope;
    static fullAccess(service: string): Scope;
    get service(): string;
    get resource(): string;
    get action(): string;
    isWildcard(): boolean;
    implies(other: Scope): boolean;
    asString(): string;
    toString(): string;
    toJSON(): string;
    equals(other: Scope): boolean;
}

declare class ScopeSet {
    static empty(): ScopeSet;
    static single(scope: Scope): ScopeSet;
    static fromStrings(scopes: readonly string[]): ScopeSet;
    static fromScopes(scopes: readonly Scope[]): ScopeSet;
    add(scope: Scope): ScopeSet;
    remove(scope: Scope): ScopeSet;
    contains(scope: Scope): boolean;
    allows(requested: Scope): boolean;
    isSupersetOf(other: ScopeSet): boolean;
    intersection(other: ScopeSet): ScopeSet;
    union(other: ScopeSet): ScopeSet;
    get length(): number;
    isEmpty(): boolean;
    toArray(): readonly Scope[];
    toStrings(): readonly string[];
    [Symbol.iterator](): Iterator<Scope>;
    toJSON(): readonly string[];
}

interface SessionBinding {
    session_id: string;
    session_key_hash?: Uint8Array;
}

interface TimeConstraints {
    not_before?: string;
    not_after?: string;
    allowed_hours?: readonly number[];
    allowed_days?: readonly number[];
}

interface UsageBudget {
    max_requests?: number;
    max_bytes?: number;
    max_cost_units?: number;
    max_secret_unwraps?: number;
    max_delegation_depth?: number;
}

sha512-bqdIp1hFYeffqXDaTpq/JMJune81cNwrj23kaUl1OoXjp97Bf8kX47/EaOjCX7oLAbTk69SgD7q2p8nrMNeIeQ==