@struktoai/mirage-core/dist/policy/boundary.js

A Unified Virtual Filesystem For AI Agents

// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
import { postVfsGate, preVfsGate } from "./policies.js";
/** The POSIX policy boundary for dispatched filesystem operations: the
 * ordered builtin and user policies, the owning mount prefix, its
 * configured mode (the authorization ceiling), the session whose grants
 * govern the op, the approval ledger a path rule that asks is put to
 * where no line is running, and who makes the op (without one, the gates
 * read the async context's). Mirrors Python's Boundary. */
export class Boundary {
    policies;
    prefix;
    mode;
    sessionId;
    decisions;
    access;
    caller;
    constructor(policies, prefix = '', mode, sessionId = '', decisions = null, access, caller) {
        this.policies = policies;
        this.prefix = prefix;
        this.mode = mode;
        this.sessionId = sessionId;
        this.decisions = decisions;
        this.access = access;
        this.caller = caller;
    }
    async admit(call, path, write, access = {}, issuer) {
        await preVfsGate(this.policies, call, path, write, this.prefix, this.sessionId, issuer, {
            ...(this.mode === undefined ? {} : { mode: this.mode }),
            decisions: this.decisions,
            ...(this.access === undefined ? {} : { access: this.access }),
            ...(this.caller === undefined ? {} : { caller: this.caller }),
            ...access,
        });
    }
    /** Fire postVfs on a finished call and hand its result back whole. */
    async complete(call, path, write, result, issuer) {
        await postVfsGate(this.policies, call, path, write, this.prefix, result, this.sessionId, issuer, {
            ...(this.mode === undefined ? {} : { mode: this.mode }),
            decisions: this.decisions,
            ...(this.access === undefined ? {} : { access: this.access }),
            ...(this.caller === undefined ? {} : { caller: this.caller }),
        });
        return result;
    }
}
//# sourceMappingURL=boundary.js.map