@sema-agent/core/dist/core/compliance.js

Stateless, task-oriented AI agent core

export const COMPLIANCE_CAPABILITIES = Object.freeze(["mcp_servers", "workflows", "web_fetch", "org_memory_mount"]);
export const BUILTIN_COMPLIANCE_DENIES = {
    hipaa: ["web_fetch", "org_memory_mount"],
    zdr: ["org_memory_mount"],
};
const PROFILES = ["hipaa", "zdr"];
function codedError(code, message) {
    const e = new Error(message);
    e.code = code;
    return e;
}
export function resolveComplianceDenies(posture) {
    if (!PROFILES.includes(posture.profile)) {
        throw codedError("config.compliance_posture", `compliance posture profile "${String(posture.profile)}" is not a member of the closed profile set ` +
            `(${PROFILES.join(", ")}) — refusing to half-apply an unparseable posture.`);
    }
    const denies = new Set(BUILTIN_COMPLIANCE_DENIES[posture.profile]);
    for (const cap of posture.additionalDenies ?? []) {
        if (!COMPLIANCE_CAPABILITIES.includes(cap)) {
            throw codedError("config.compliance_posture", `compliance posture additionalDenies contains "${String(cap)}", not a member of the closed capability set ` +
                `(${COMPLIANCE_CAPABILITIES.join(", ")}) — a misspelled deny must never silently not-enforce.`);
        }
        denies.add(cap);
    }
    return denies;
}
export const WEB_FETCH_TOOL_NAME = "WebFetch";
export function complianceCallDenial(denies, toolName) {
    if (denies.has("web_fetch") && toolName === WEB_FETCH_TOOL_NAME) {
        return (`"${toolName}" is denied by this principal's compliance posture (capability "web_fetch") — ` +
            `the call is refused by policy; do not retry it.`);
    }
    return undefined;
}