Skip to main content

Generated Files

Complete reference for everything ninka compile writes to authz/out/.

Commit all of authz/out/

Every file below is committed to your repository. Together they are the approved, executable form of your policies, and ninka verify gates CI on their byte-identity. Do not hand-edit them.

Files at a glance​

FileRole
<id>.regoThe runtime policy logic.
<id>.manifest.jsonContract and audit chain.
<id>.build.jsonBuild environment and integrity hashes.
<id>.validation.jsonTranslation-validation vectors.
<id>.wasmThe compiled OPA WASM — the shipped artifact.
types.gen.tsGenerated TypeScript input types and the policies table.
input-contract.jsonProject-wide merged input contract.

<id>.wasm, <id>.build.json, and <id>.validation.json are written only when the OPA toolchain is available. See CLI → compile.

<id>.rego​

The runtime policy logic — the decision only, with zero metadata (no timestamps, no compiler version, no descriptions) and a fixed section order. This is what the compiler emits from your Tegata; it is byte-checked by verify.

<id>.manifest.json​

The contract and audit chain for the policy. The tegata_hash is the approval and diff target.

FieldMeaning
policy_idThe policy id.
tegata_version"0.1".
generated_by{ package, version } of the ninka-authz release.
tegata_hashFingerprint of the canonical Tegata — what you approve.
rego_sha256Hash of the emitted Rego.
covered_resource_typesResource types this policy covers.
input_requirementsArray of { key, type, required, origins[] }.
log_allowlistAttributes eligible to appear raw in decision logs.

<id>.build.json​

The build environment and integrity hashes.

FieldMeaning
policy_idThe policy id.
opa_version"0.65.0".
entrypoint"ninka/<snake>/allow".
wasm_sha256Hash of the compiled WASM.
rego_sha256Hash of the emitted Rego.
validation{ vector_count, vectors_sha256, status: "passed" }.

The runtime reads *.build.json at load time and checks these hashes fail-closed — see Runtime API → load.

<id>.validation.json​

The translation-validation vectors — decision cases derived from the Tegata and run against the built WASM. verify recomputes and re-runs them.

{ "policy_id": "…", "tegata_hash": "…", "validation_version": "1", "vectors": [ { "id": "…", "input": {}, "expected": true } ] }

<id>.wasm​

The compiled OPA WASM — the shipped artifact that runs at the boundary. Its SHA-256 must match build.json (wasm_sha256) for the runtime to load it.

types.gen.ts​

Generated TypeScript: a per-policy input interface plus a policies table of typed PolicyRefs. You import policies and the types from this file; do not edit it by hand. It is byte-checked by verify.

// GENERATED by `ninka compile` — do not edit by hand.
/** Input contract of policy "invoice-access" (tegata_hash c2b55b92fb53…). */
export interface InvoiceAccessInput {
  subject: {
    properties: {
      roles: string[];
      user_id: string;
      [key: string]: unknown;
    };
  };
  action: {
    name: "approve" | "delete" | "view";
  };
  resource: {
    type: "invoice";
    properties: {
      amount: number;
      submitted_by: string;
      [key: string]: unknown;
    };
  };
}

export type PolicyRef<Id extends string, In> = Id & { readonly __input?: In };

export const policies = {
  invoiceAccess: "invoice-access" as PolicyRef<"invoice-access", InvoiceAccessInput>,
} as const;

Passing policies.invoiceAccess to check pins the exact input shape at compile time — see Runtime API.

input-contract.json​

The project-wide merged input contract across all policies.

{ "generated_by": { "package": "…", "version": "…" }, "keys": [ { "key": "…", "type": "…", "required_by": [], "policies": [] } ] }

See also​