@reaatech/tool-use-firewall-config

Status: Pre-1.0 — APIs may change in minor versions. Pin to a specific version in production.

Zod-based policy schema definitions and YAML policy file loader for tool-use-firewall. Validates policy configurations at startup and provides typed interfaces for the policy engine.

Installation

npm install @reaatech/tool-use-firewall-config
# or
pnpm add @reaatech/tool-use-firewall-config

Feature Overview

• Zod validation — Full policy config schema with nested rate limit, cost, validation, approval, audit, upstream, metrics, secret-scan, and anomaly subschemas
• YAML loading — loadPolicyConfig(path) reads and validates a YAML policy file, throws typed ValidationError on parse failures
• Policy linting — validatePolicyFile(path) checks a policy against the schema and verifies every regex is ReDoS-safe, returning structured errors/warnings (powers the --validate CLI flag)
• Default values — Sensible defaults for settings, timeouts, budget actions, and audit levels
• TypeScript types — All config shapes exported as z.infer types for compile-time safety
• Dual ESM/CJS output

Quick Start

import { loadPolicyConfig, type PolicyConfig } from "@reaatech/tool-use-firewall-config";

const config: PolicyConfig = loadPolicyConfig("./policies/default.yaml");
console.log(config.settings?.default_action); // "block"

Lint a policy without booting the proxy (e.g. in CI):

import { validatePolicyFile } from "@reaatech/tool-use-firewall-config";

const result = validatePolicyFile("./policy.yaml");
if (!result.valid) {
  console.error(result.errors.join("\n"));
  process.exit(1);
}

Exports

| Export | Description | |--------|-------------| | loadPolicyConfig(path) | Read and validate a YAML policy file | | validatePolicyFile(path) / PolicyValidationResult | Lint a policy (schema + ReDoS) without throwing; returns { valid, errors, warnings } | | policyConfigSchema | Root Zod schema for the full policy YAML | | ruleSchema / Rule | Allow/block/approval rule with conditions and priority | | ruleConditionSchema / RuleCondition | Argument-based condition with pattern/equals/contains/gt/lt | | exceptionConditionSchema / ExceptionCondition | Read-only exception condition (argument + regex pattern) | | rateLimitConfigSchema / RateLimitConfig | Global, per-tool, and per-session rate limits | | costConfigSchema / CostConfig | Session budgets and per-tool costs | | validationRuleSchema / ValidationRule | Regex, shell-safe, and SQL-safe validation rules | | approvalConfigSchema / ApprovalConfig | Multi-level approval configuration | | auditConfigSchema / AuditConfig | Audit level, output targets, and redaction config |

License

MIT