@sema-agent/core/dist/core/compliance.js

Stateless, task-oriented AI agent core

import { describeRejectedValue } from "./tool-search-setting.js";
export const COMPLIANCE_CAPABILITIES = Object.freeze(["mcp_servers", "workflows", "web_fetch", "org_memory_mount"]);
export const BUILTIN_COMPLIANCE_DENIES = {
    hipaa: ["web_fetch", "org_memory_mount"],
    zdr: ["org_memory_mount"],
};
const PROFILES = ["hipaa", "zdr"];
function codedError(code, message) {
    const e = new Error(message);
    e.code = code;
    return e;
}
export function resolveComplianceDenies(posture) {
    if (!PROFILES.includes(posture.profile)) {
        throw codedError("config.compliance_posture", `compliance posture profile "${String(posture.profile)}" is not a member of the closed profile set ` +
            `(${PROFILES.join(", ")}) — refusing to half-apply an unparseable posture.`);
    }
    const denies = new Set(BUILTIN_COMPLIANCE_DENIES[posture.profile]);
    for (const cap of posture.additionalDenies ?? []) {
        const problem = complianceCapabilityProblem(cap, "compliance posture additionalDenies");
        if (problem !== undefined)
            throw codedError("config.compliance_posture", problem);
        denies.add(cap);
    }
    return denies;
}
export function complianceCapabilityProblem(cap, owner) {
    if (COMPLIANCE_CAPABILITIES.some((member) => member === cap))
        return undefined;
    const shown = (typeof cap === "object" && cap !== null) || typeof cap === "function" ? describeRejectedValue(cap) : `"${String(cap)}"`;
    return (`${owner} contains ${shown}, not a member of the closed capability set ` +
        `(${COMPLIANCE_CAPABILITIES.join(", ")}) — a misspelled deny must never silently not-enforce.`);
}
export const WEB_FETCH_TOOL_NAME = "WebFetch";
export function complianceCallDenial(denies, toolName) {
    if (denies.has("web_fetch") && toolName === WEB_FETCH_TOOL_NAME) {
        return (`"${toolName}" is denied by this principal's compliance posture (capability "web_fetch") — ` +
            `the call is refused by policy; do not retry it.`);
    }
    return undefined;
}