@azmr/policycore

0.2.2Copy Anchor Link

Patch ChangesCopy Anchor Link

• ea59e9b: Package metadata: homepage now points at each package's page on platform.azmara.io (docs.azmara.io never resolved), bugs links to the GitHub issues, and README doc links follow. @azmr/ui gets a description that matches the design system it now is.
• Updated dependencies [ea59e9b]
  • @azmr/security@0.3.2

0.2.1Copy Anchor Link

Patch ChangesCopy Anchor Link

• 449c93a: Fix exports condition order (types before import) across ai, cli, db-supabase, policycore, query, matching the same fix already applied to core/ui/security.

  Add "sideEffects": false to ai, db-supabase, policycore, query — audited each src/ tree first (no module-level executable statements outside function/class bodies); verified with an esbuild bundle of a single named import from @azmr/policycore (24.85KB unminified) that unused exports tree-shake out (3KB bundled, zero unrelated exports leaked). @azmr/cli deliberately excluded — its src/index.ts calls main() unconditionally at module scope (the CLI's actual entry point), a genuine import-time side effect; marking it sideEffects: false would tell bundlers it's safe to drop, which is false for this package.

  Add engines.node: ">=22.0.0" to @azmr/ai (previously had no engines field at all) — matches isolated-vm@^6.1.2's own documented requirement (see notes.isolated-vm in its package.json), not the >=18.0.0/>=20.0.0 baseline other packages use, since production auto-fix runs genuinely need isolated-vm (the node:vm fallback is dev/CI-only). README corrected to match (was still claiming Node ≥18).

  Document "ESM only, no CommonJS build" in the root README and every package README that didn't already have it (ai, cli, db, db-supabase, policycore, query — core/ui/security got this in an earlier PR).

  No public API change.

  Note: @azmr/ai and @azmr/cli are excluded from this changeset's frontmatter even though their package.json/README changes are part of this PR — both are in .changeset/config.json's ignore list, and changesets rejects a changeset mixing ignored and non-ignored packages. Since they're ignored, the normal changesets/action release flow will never version-bump or publish them — their fixes land in the repo but won't reach npm without a manual publish or a deliberate change to the ignore list. Flagged as an open question for the maintainer; not resolved in this PR.

• Updated dependencies [a5a2134]

• Updated dependencies [c8712c6]

• Updated dependencies [7e2bf0e]

  • @azmr/security@0.3.1

0.2.0Copy Anchor Link

Minor ChangesCopy Anchor Link

• c4f2c02: Initial release of @azmr/policycore — a standalone security layer for the Azmara platform, built on top of @azmr/security's createRateLimiter, createAccessControl, and createAuditLogger rather than reimplementing them:

  • createPolicyEngine — composes rate limiting, an RBAC auth requirement, and CORS as code into one per-route evaluate() call.
  • evaluateCors/validateCorsPolicy — pure, framework-agnostic CORS evaluation.
  • createRequestSigner — HMAC-SHA256 request signing for service-to-service calls, with a timestamp tolerance window and opt-in nonce replay tracking.
  • createLocalEnvSecretsAdapter/createSecretsManager — backend-agnostic secrets retrieval, local-env adapter shipped now, optional caching.
  • createApiKeyManager — in-memory API key issue/rotate/revoke/verify, hashed storage, timing-safe comparison.
  • scanSourceForPolicyIssues — flags CORS wildcard-with-credentials misconfigurations in source.
  • generateOwaspReport/formatOwaspReportMarkdown/formatOwaspReportJson — OWASP Top 10 (2021) compliance reporting with an explicit honesty mechanism: categories are "not-evaluated", "no-findings", or "findings-present" — a clean report is never presented as a certification.

Patch ChangesCopy Anchor Link

• Updated dependencies [c4f2c02]
  • @azmr/security@0.3.0