delimit-presets

Governance policy presets for Delimit -- the API governance engine for CI/CD.

Drop-in policy files for PCI-DSS, HIPAA, fintech, startup, enterprise, and API-first teams.

Install

npm install delimit-presets

Usage

With Delimit CLI

Copy a preset into your project as delimit.yml:

cp node_modules/delimit-presets/presets/pci-dss.yml ./delimit.yml
delimit lint old-spec.yml new-spec.yml

With Delimit GitHub Action

- uses: delimit-ai/delimit-action@v1
  with:
    old-spec: specs/old.yml
    new-spec: specs/new.yml
    policy: node_modules/delimit-presets/presets/hipaa.yml

Programmatic

const { getPreset, getPresetPath, listPresets } = require('delimit-presets');

// List all preset names
console.log(listPresets());
// ['strict', 'default', 'relaxed', 'pci-dss', 'hipaa', 'fintech', 'startup', 'enterprise', 'api-first']

// Get preset metadata
const preset = getPreset('pci-dss');
console.log(preset.name);        // 'PCI-DSS'
console.log(preset.description); // 'Payment Card Industry compliance...'
console.log(preset.path);        // absolute path to pci-dss.yml

// Get just the file path
const policyPath = getPresetPath('hipaa');

Presets

| Preset | Mode | Audience | Breaking Changes | Security | Constraints | |--------|------|----------|-----------------|----------|-------------| | strict | Enforce | Public APIs | All errors | -- | -- | | default | Balanced | General purpose | Key changes error, rest warn | -- | -- | | relaxed | Advisory | Internal APIs | Warnings only | -- | -- | | pci-dss | Enforce | Payment systems | All errors | Auth removal blocked | -- | | hipaa | Enforce | Healthcare | All errors | Auth removal blocked | Format warnings | | fintech | Enforce | Financial services | All errors | Auth + scope blocked | Length changes blocked | | startup | Advisory | Early-stage | Warnings/info only | Security warnings | -- | | enterprise | Enforce | Large orgs | All errors | Auth + scope blocked | Constraint warnings | | api-first | Enforce | API products | All errors | Auth removal blocked | Constraint warnings |

Preset Details

strict -- Zero tolerance. Every breaking change is an error. Use for mature public APIs.

default -- Balanced defaults. Blocks endpoint removal, method removal, required param addition, and response field removal. Warns on type changes.

relaxed -- Maximum flexibility. Only warns on breaking changes, never blocks. Good for internal APIs where you control all consumers.

pci-dss -- Payment Card Industry Data Security Standard. Blocks all breaking changes plus security scheme removal and scope reduction. Every rule produces PCI-prefixed violation messages for audit trails.

hipaa -- Health Insurance Portability and Accountability Act. Blocks all breaking changes and security scheme removal. Warns on format changes (date/time handling for patient records). Every rule produces HIPAA-prefixed violation messages.

fintech -- Financial technology. The most comprehensive preset. Blocks all breaking changes, security changes, format changes, and validation constraint changes (max length decrease, min length increase). Protects state machines and monetary data formats.

startup -- Move fast without breaking unknowingly. Advisory mode only -- CI never fails. Breaking changes produce warnings, minor changes produce info notes. Builds awareness while allowing rapid iteration.

enterprise -- Full enforcement with organizational policies. Blocks all breaking changes. Warns on format and constraint changes. Includes deprecation policy requiring 90-day notice and Sunset headers.

api-first -- For teams that design the API contract before implementation. Strict enforcement on all breaking changes. Warns on format, parameter type, and constraint changes with guidance to document in migration guides. Includes 30-day deprecation policy.

Policy Format

Each preset is a valid delimit.yml file. The format supports:

override_defaults: true  # Replace built-in rules (false = merge)

rules:
  - id: rule_id
    name: Human-readable name
    description: Why this rule exists
    change_types:
      - endpoint_removed
      - method_removed
      - required_param_added
      - param_removed
      - field_removed
      - type_changed
      - enum_value_removed
      - required_field_added
      - response_type_changed
      - param_type_changed
      - format_changed
      - security_removed
      - security_scope_removed
      - max_length_decreased
      - min_length_increased
    severity: error | warning | info
    action: forbid | warn | allow
    conditions:
      path_pattern: "^/v1/.*"      # Regex on API path
      exclude_paths: ["/internal"]  # Skip these paths
    message: "Violation at {path}"

organization:
  deprecation:
    min_notice_days: 30
    require_sunset_header: true

Customization

Start from a preset and customize:

cp node_modules/delimit-presets/presets/enterprise.yml ./delimit.yml
# Edit delimit.yml to add project-specific rules

Links

• Delimit -- API governance for CI/CD
• Delimit CLI -- CLI tool
• Delimit GitHub Action -- CI integration
• Documentation

License

MIT