Struct RulePackRule 

pub struct RulePackRule {
    pub id: String,
    pub kind: RulePackRuleKind,
    pub callees: Vec<String>,
    pub specifiers: Vec<String>,
    pub effects: Vec<EffectKind>,
    pub exports: Vec<String>,
    pub ignore_type_only: bool,
    pub files: Vec<String>,
    pub exclude: Vec<String>,
    pub zones: Vec<String>,
    pub message: Option<String>,
    pub severity: Option<Severity>,
}

One declarative policy rule inside a rule pack.

callees applies only to banned-call rules; specifiers and ignoreTypeOnly apply only to banned-import rules; effects applies only to banned-effect rules; exports applies only to banned-export rules. zones can scope any rule kind to files classified into one of the named boundary zones. Setting a field on the wrong kind is a load error (fail loud, never silently ignore policy).

Fields

id: String

Rule id, unique within the pack. Must use only ASCII letters, digits, ., _, and - so "<pack>/<id>" is unambiguous in output, baselines, and scoped suppression comments.

kind: RulePackRuleKind

Which check this rule performs.

callees: Vec<String>

Callee patterns to ban (banned-call only). Matching is segment-aware and import-resolved, identical to boundaries.calls.forbidden: child_process.* covers import { exec } from "node:child_process", the bare specifier, and namespace/default imports; fetch matches only the global fetch; a leading *.member matches any object.

specifiers: Vec<String>

Import specifiers to ban (banned-import only). Matched segment-aware against the RAW specifier: moment covers moment and moment/locale/nl but not moment-timezone. A trailing /* form, such as @org/ui/*, matches subpaths only (@org/ui/internal) and not the package root (@org/ui). Aliased or rewritten specifiers (e.g. npm:moment) are not matched.

effects: Vec<EffectKind>

Effect classes to ban (banned-effect only). Effects are derived from security_matchers.toml catalogue rows and matched against captured call sites after import-resolution canonicalization.

exports: Vec<String>

Export names to ban (banned-export only). "default" matches the default export; any other entry matches an exported name exactly; a single trailing * makes it a prefix match (internal*). No other glob syntax is supported. Re-exports are out of scope for this rule.

ignore_type_only: bool

When true, type-only imports (import type ... and type-only re-exports) are ignored by banned-import; type-only exports are ignored by banned-export. Defaults to false: type-only sites are flagged too.

files: Vec<String>

Optional include globs (project-root-relative). Empty or absent means the rule applies to every analyzed file.

exclude: Vec<String>

Optional exclude globs (project-root-relative), applied after files.

zones: Vec<String>

Optional boundary zones this rule applies to. Empty or absent means the rule applies regardless of zone; non-empty values require matching configured boundaries and combine with files/exclude as AND.

message: Option<String>

Author-provided message naming the sanctioned alternative. Rendered next to each finding.

severity: Option<Severity>

Per-rule severity overriding the rules."policy-violation" master. off disables this rule. When the master itself is off, the whole evaluator is disabled and per-rule severity cannot resurrect it.

Trait Implementations

impl Clone for RulePackRule

fn clone(&self) -> RulePackRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RulePackRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for RulePackRule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for RulePackRule

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for RulePackRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.