@aegis-scan/core 0.16.6 → 0.17.0

package/dist/roe/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/roe/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA6MxB,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;QA3FlB,yEAAyE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAvCzE,mGAAmG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+InG,iFAAiF;;;;;;;;;;;;;;;;;IAEjF,sEAAsE;;QAzItE,0CAA0C;;;;;;;;;;;;;;QAS1C,yEAAyE;;QAEzE,mDAAmD;;;;;;;;;;;;;;;;;;;IAgInD,gEAAgE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAEhE,2EAA2E;;;;;;;;;;;IAE3E,0FAA0F;;QAjF1F,wEAAwE;;QAExE,8CAA8C;;;;;;;;;;;;;;QAS9C,kFAAkF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyE3E,CAAC;AAEZ,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAK5C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,kBAAkB,CAuDlF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,GAAE,IAAiB,GAAG,kBAAkB,CAkC7F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,GACP,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,aAAa,CAYxD;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,EACR,GAAG,GAAE,IAAiB,GACrB,kBAAkB,CAuBpB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IACP,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;CACrB,GACL,GAAG,CAqDL"}

package/dist/roe/types.js

@@ -0,0 +1,525 @@
+/**
+ * Rules of Engagement (RoE) schema for AEGIS Autonomous Pentest Layer.
+ *
+ * Closes APTS Tier-1 requirements:
+ *   - APTS-SE-001 — Rules of Engagement Specification and Validation
+ *   - APTS-SE-003 — Domain Scope Validation and Wildcard Handling
+ *   - APTS-SE-004 — Temporal Boundary and Timezone Handling
+ *   - APTS-SE-005 — Asset Criticality Classification and Integration
+ *   - APTS-SE-006 — Pre-Action Scope Validation
+ *   - APTS-AL-006 — Basic Scope Validation and Policy Enforcement
+ *   - APTS-AL-014 — Boundary Definition and Enforcement Framework
+ *
+ * Design notes:
+ *   - JSON-shaped, Zod-strict-validated. Operators may author in YAML and
+ *     pre-convert at load time, but the canonical on-disk form is JSON.
+ *   - The schema captures authorization-attestation, in-/out-of-scope
+ *     domains and IP ranges, asset criticality classification, temporal
+ *     envelope (with optional blackout windows), and stop conditions.
+ *   - Per-action validators are pure functions on a loaded RoE — they
+ *     take a target/action and return an explicit allow/deny decision
+ *     with rationale. The decision is logged by the orchestrator into
+ *     the audit channel.
+ */
+import { z } from 'zod';
+// ---------------------------------------------------------------------------
+// Sub-schemas
+const DomainPatternSchema = z.object({
+    pattern: z
+        .string()
+        .min(1)
+        .refine((s) => !s.includes('://') && !s.includes('/'), { message: 'domain pattern must be a bare hostname or wildcard, no scheme or path' }),
+    includeSubdomains: z.boolean().default(false),
+});
+const CidrSchema = z
+    .string()
+    .regex(/^(?:\d{1,3}\.){3}\d{1,3}\/\d{1,2}$|^[0-9a-fA-F:]+\/\d{1,3}$/u, { message: 'CIDR must be IPv4 (a.b.c.d/n) or IPv6 (xxxx:.../n)' });
+const InScopeSchema = z
+    .object({
+    domains: z.array(DomainPatternSchema).default([]),
+    ip_ranges: z.array(CidrSchema).default([]),
+    repository_paths: z.array(z.string().min(1)).default([]),
+})
+    .strict();
+const OutOfScopeSchema = z
+    .object({
+    domains: z.array(z.string().min(1)).default([]),
+    ip_ranges: z.array(CidrSchema).default([]),
+    paths: z.array(z.string().min(1)).default([]),
+})
+    .strict();
+const AssetCriticalityEntrySchema = z
+    .object({
+    pattern: z.string().min(1),
+    classification: z.enum(['critical', 'high', 'medium', 'low']),
+    notes: z.string().optional(),
+})
+    .strict();
+const BlackoutWindowSchema = z
+    .object({
+    start: z.string().datetime({ offset: true }),
+    end: z.string().datetime({ offset: true }),
+    reason: z.string().min(1),
+})
+    .strict()
+    .refine((w) => Date.parse(w.end) > Date.parse(w.start), {
+    message: 'blackout window end must be after start',
+});
+const TemporalSchema = z
+    .object({
+    start: z.string().datetime({ offset: true }),
+    end: z.string().datetime({ offset: true }),
+    timezone: z.string().min(1),
+    blackout_windows: z.array(BlackoutWindowSchema).default([]),
+})
+    .strict()
+    .refine((t) => Date.parse(t.end) > Date.parse(t.start), {
+    message: 'temporal envelope end must be after start',
+});
+const StopConditionsSchema = z
+    .object({
+    on_critical_finding: z.enum(['halt', 'notify-and-continue', 'continue']).default('halt'),
+    max_findings: z.number().int().positive().optional(),
+    max_duration_minutes: z.number().int().positive().optional(),
+    /** APTS-HO-003 — per-phase decision timeout. Falls back to max_duration_minutes/4 when omitted. */
+    phase_timeout_minutes: z.number().int().positive().optional(),
+    on_target_unreachable_seconds: z.number().int().positive().optional(),
+})
+    .strict();
+const SafetyControlsSchema = z
+    .object({
+    /** APTS-SC-010 — auto-halt thresholds. */
+    health_thresholds: z
+        .object({
+        max_heap_mb: z.number().int().positive().optional(),
+        max_error_rate: z.number().min(0).max(1).optional(),
+        max_target_response_ms: z.number().int().positive().optional(),
+    })
+        .strict()
+        .optional(),
+    /** APTS-SC-009 — operator dead-man-switch heartbeat URL (HTTPS only). */
+    heartbeat_url: z.string().url().optional(),
+    /** APTS-SC-009 — heartbeat interval in seconds. */
+    heartbeat_interval_seconds: z.number().int().positive().optional(),
+})
+    .strict();
+const DelegationEntrySchema = z
+    .object({
+    role: z.string().min(1),
+    can_approve: z.array(z.string().min(1)).min(1),
+})
+    .strict();
+const AuthorizationSchema = z
+    .object({
+    statement: z.string().min(20, {
+        message: 'authorization statement must be at least 20 chars (forces explicit attestation rather than placeholder text)',
+    }),
+    authority_url: z.string().url().optional(),
+    signature_method: z.enum(['operator-attested', 'external-signed']).default('operator-attested'),
+    /** APTS-HO-004 — declarative role↔action authority delegation matrix. */
+    delegation_matrix: z.array(DelegationEntrySchema).optional(),
+})
+    .strict();
+const AutonomyLevelPolicySchema = z
+    .object({
+    approval_required: z.boolean().optional(),
+    pre_approved: z.boolean().optional(),
+    irreversible_action_classes: z.array(z.string().min(1)).optional(),
+})
+    .strict();
+const AutonomyLevelsSchema = z
+    .object({
+    L1: AutonomyLevelPolicySchema.optional(),
+    L2: AutonomyLevelPolicySchema.optional(),
+    L3: AutonomyLevelPolicySchema.optional(),
+    L4: AutonomyLevelPolicySchema.optional(),
+})
+    .strict();
+const ComplianceTriggersSchema = z
+    .object({
+    regulatory_class: z.array(z.string().min(1)).min(1),
+    on_match: z.enum(['halt', 'notify']).default('halt'),
+})
+    .strict();
+const EscalationPolicySchema = z
+    .object({
+    /** APTS-HO-011 — severity at which an unexpected-finding halt fires. */
+    severity_threshold: z.enum(['info', 'low', 'medium', 'high', 'critical', 'blocker']).optional(),
+    /** APTS-HO-012 — CIA-axis halt thresholds. */
+    cia_threshold: z
+        .object({
+        c: z.enum(['none', 'low', 'medium', 'high']).optional(),
+        i: z.enum(['none', 'low', 'medium', 'high']).optional(),
+        a: z.enum(['none', 'low', 'medium', 'high']).optional(),
+    })
+        .strict()
+        .optional(),
+    /** APTS-HO-013 — when true, low-confidence findings halt-pause the engagement. */
+    pause_on_low_confidence: z.boolean().optional(),
+})
+    .strict();
+const OperatorSchema = z
+    .object({
+    organization: z.string().min(1),
+    authorized_by: z.string().min(1),
+    contact: z.string().min(1),
+})
+    .strict();
+const NotificationChannelSchema = z
+    .object({
+    type: z.enum(['webhook', 'log']),
+    url: z.string().url().optional(),
+    events: z
+        .array(z.enum(['start', 'halt', 'critical-finding', 'completion']))
+        .min(1),
+})
+    .strict();
+const NotificationsSchema = z
+    .object({
+    channels: z.array(NotificationChannelSchema).default([]),
+})
+    .strict();
+const ReferencesSchema = z
+    .object({
+    incident_response_plan: z.string().optional(),
+    contract_id: z.string().optional(),
+    apts_conformance_claim: z.string().optional(),
+})
+    .strict();
+const SandboxingSchema = z
+    .object({
+    mode: z.enum(['docker', 'firejail', 'none']).default('none'),
+    docker_network: z.string().min(1).optional(),
+    image_overrides: z.record(z.string().min(1), z.string().min(1)).optional(),
+    extra_docker_args: z.array(z.string()).optional(),
+})
+    .strict();
+// ---------------------------------------------------------------------------
+// Top-level RoE schema
+export const RoESchema = z
+    .object({
+    roe_id: z.string().min(1),
+    spec_version: z.literal('0.1.0'),
+    operator: OperatorSchema,
+    authorization: AuthorizationSchema,
+    in_scope: InScopeSchema,
+    out_of_scope: OutOfScopeSchema.default({}),
+    asset_criticality: z.array(AssetCriticalityEntrySchema).default([]),
+    temporal: TemporalSchema,
+    stop_conditions: StopConditionsSchema.default({ on_critical_finding: 'halt' }),
+    notifications: NotificationsSchema.optional(),
+    references: ReferencesSchema.optional(),
+    /** APTS-MR-018 — declarative sandboxing constraints for LLM-pentest wrappers. */
+    sandboxing: SandboxingSchema.default({ mode: 'none' }),
+    /** APTS-SC-009/010, HO-003 — declarative safety-control overrides. */
+    safety_controls: SafetyControlsSchema.optional(),
+    /** APTS-HO-001/010 — per-autonomy-level pre-approval gating. */
+    autonomy_levels: AutonomyLevelsSchema.optional(),
+    /** APTS-HO-014 — regulatory class triggers for finding-text escalation. */
+    compliance_triggers: ComplianceTriggersSchema.optional(),
+    /** APTS-HO-011/012/013 — escalation thresholds for severity / CIA vector / confidence. */
+    escalation: EscalationPolicySchema.optional(),
+})
+    .strict();
+/**
+ * Validate that a target (URL, hostname, or IP) is in scope and not in the
+ * out_of_scope deny list. Closes APTS-SE-003 + APTS-SE-006 + APTS-AL-006.
+ */
+export function validateTargetInScope(target, roe) {
+    const host = stripToHostname(target);
+    if (!host) {
+        return {
+            allowed: false,
+            reason: `target ${target} could not be parsed to a hostname or IP`,
+            apts_refs: ['APTS-SE-003', 'APTS-SE-006'],
+        };
+    }
+    // First: deny-list (out_of_scope wins over in_scope when both match)
+    for (const denied of roe.out_of_scope.domains) {
+        if (matchDomain(host, denied, false)) {
+            return {
+                allowed: false,
+                reason: `target ${host} matches out_of_scope domain pattern ${denied}`,
+                apts_refs: ['APTS-SE-009', 'APTS-AL-014'],
+            };
+        }
+    }
+    for (const denied of roe.out_of_scope.ip_ranges) {
+        if (ipInCidr(host, denied)) {
+            return {
+                allowed: false,
+                reason: `target ${host} matches out_of_scope CIDR ${denied}`,
+                apts_refs: ['APTS-SE-009', 'APTS-AL-014'],
+            };
+        }
+    }
+    // Second: in-scope check (must match at least one)
+    for (const dom of roe.in_scope.domains) {
+        if (matchDomain(host, dom.pattern, dom.includeSubdomains)) {
+            return {
+                allowed: true,
+                reason: `target ${host} matches in_scope domain pattern ${dom.pattern}${dom.includeSubdomains ? ' (subdomains included)' : ''}`,
+                apts_refs: ['APTS-SE-003', 'APTS-SE-006', 'APTS-AL-006'],
+            };
+        }
+    }
+    for (const cidr of roe.in_scope.ip_ranges) {
+        if (ipInCidr(host, cidr)) {
+            return {
+                allowed: true,
+                reason: `target ${host} is within in_scope CIDR ${cidr}`,
+                apts_refs: ['APTS-SE-002', 'APTS-SE-006', 'APTS-AL-006'],
+            };
+        }
+    }
+    return {
+        allowed: false,
+        reason: `target ${host} is not within any in_scope domain or CIDR`,
+        apts_refs: ['APTS-SE-003', 'APTS-SE-006'],
+    };
+}
+/**
+ * Validate the current time is within the temporal envelope and not in a
+ * blackout window. Closes APTS-SE-004 + APTS-SE-008.
+ */
+export function validateTemporalEnvelope(roe, now = new Date()) {
+    const ts = now.getTime();
+    const start = Date.parse(roe.temporal.start);
+    const end = Date.parse(roe.temporal.end);
+    if (ts < start) {
+        return {
+            allowed: false,
+            reason: `current time (${now.toISOString()}) is before engagement start (${roe.temporal.start})`,
+            apts_refs: ['APTS-SE-004'],
+        };
+    }
+    if (ts > end) {
+        return {
+            allowed: false,
+            reason: `current time (${now.toISOString()}) is after engagement end (${roe.temporal.end})`,
+            apts_refs: ['APTS-SE-004', 'APTS-SE-008'],
+        };
+    }
+    for (const window of roe.temporal.blackout_windows ?? []) {
+        const ws = Date.parse(window.start);
+        const we = Date.parse(window.end);
+        if (ts >= ws && ts <= we) {
+            return {
+                allowed: false,
+                reason: `current time is inside blackout window (${window.start} → ${window.end}: ${window.reason})`,
+                apts_refs: ['APTS-SE-004', 'APTS-SE-008'],
+            };
+        }
+    }
+    return {
+        allowed: true,
+        reason: 'within temporal envelope and outside any blackout window',
+        apts_refs: ['APTS-SE-004', 'APTS-SE-008'],
+    };
+}
+/**
+ * Classify a target's asset criticality per APTS-SE-005. Returns
+ * `'unspecified'` if no asset_criticality entry matches.
+ */
+export function getAssetCriticality(target, roe) {
+    const host = stripToHostname(target);
+    if (!host)
+        return 'unspecified';
+    // Match in declaration order — first match wins. Operators can pin
+    // critical assets at the top of the list to take precedence over
+    // broader patterns.
+    for (const entry of roe.asset_criticality) {
+        if (matchDomain(host, entry.pattern, true) || pathMatches(target, entry.pattern)) {
+            return entry.classification;
+        }
+    }
+    return 'unspecified';
+}
+/**
+ * Composite pre-action validator. Combines scope + temporal + per-action
+ * stop-condition checks. Returns an explicit allow/deny with the
+ * complete reason chain. Closes APTS-SE-006.
+ */
+export function validateAction(target, action, roe, now = new Date()) {
+    const temporal = validateTemporalEnvelope(roe, now);
+    if (!temporal.allowed) {
+        return {
+            allowed: false,
+            reason: `action ${action}: ${temporal.reason}`,
+            apts_refs: temporal.apts_refs,
+        };
+    }
+    const scope = validateTargetInScope(target, roe);
+    if (!scope.allowed) {
+        return {
+            allowed: false,
+            reason: `action ${action}: ${scope.reason}`,
+            apts_refs: scope.apts_refs,
+        };
+    }
+    const criticality = getAssetCriticality(target, roe);
+    return {
+        allowed: true,
+        reason: `action ${action} on ${target} (criticality: ${criticality}) within scope and temporal envelope`,
+        apts_refs: ['APTS-SE-006', 'APTS-SE-005', 'APTS-AL-006'],
+    };
+}
+/**
+ * Synthesize a minimal RoE from a `--target` flag for back-compat with the
+ * pre-RoE `aegis siege --target URL --confirm` interface. Operator should
+ * graduate to a real RoE file for any non-trivial engagement; this helper
+ * exists so existing scripts continue to function. Marks the synthesized
+ * RoE as such so audit logs can flag the difference.
+ *
+ * Defaults are CONSERVATIVE-strict, not permissive-back-compat:
+ *   - `safety_controls.health_thresholds` non-trivial so SC-010 health
+ *     check actually trips on a runaway engagement.
+ *   - `autonomy_levels.L3.approval_required: true` — exploitation halts
+ *     unless the operator provides a real RoE that explicitly
+ *     pre-approves L3. This is a back-compat BREAK from earlier
+ *     versions where --confirm authorized everything; the rationale is
+ *     that synthesized minimal RoE should never silently authorize
+ *     exploitation phase. Operators who need exploitation must author
+ *     a full RoE.
+ *   - `escalation.severity_threshold: 'critical'` — matches the
+ *     `stop_conditions.on_critical_finding: 'halt'` policy on the
+ *     finding-text path (HO-011).
+ *   - `escalation.cia_threshold: { c:'high', i:'high', a:'high' }` —
+ *     CIA-axis halt on any high-impact finding (HO-012).
+ *   - `pause_on_low_confidence: false` — operator opt-in for HO-013
+ *     to avoid noisy halts during normal scans.
+ *
+ * The previous permissive defaults were flagged by an internal audit
+ * as "mechanism-MET but inert in default mode". Closing that gap
+ * required this BC break.
+ */
+export function synthesizeMinimalRoE(target, options = {}) {
+    const now = new Date();
+    const end = new Date(now.getTime() + (options.durationMinutes ?? 60) * 60_000);
+    const host = stripToHostname(target) ?? target;
+    return {
+        roe_id: `synthesized-${now.toISOString().replace(/[:.]/g, '-')}`,
+        spec_version: '0.1.0',
+        operator: {
+            organization: options.organization ?? 'unspecified-operator',
+            authorized_by: 'cli-flag-fallback',
+            contact: 'unspecified',
+        },
+        authorization: {
+            statement: 'AEGIS-synthesized minimal RoE from --target flag (no operator-attested RoE file provided)',
+            signature_method: 'operator-attested',
+        },
+        in_scope: {
+            domains: [{ pattern: host, includeSubdomains: false }],
+            ip_ranges: [],
+            repository_paths: [],
+        },
+        out_of_scope: { domains: [], ip_ranges: [], paths: [] },
+        asset_criticality: [],
+        temporal: {
+            start: now.toISOString(),
+            end: end.toISOString(),
+            timezone: 'UTC',
+            blackout_windows: [],
+        },
+        stop_conditions: { on_critical_finding: 'halt' },
+        sandboxing: { mode: 'none' },
+        safety_controls: {
+            health_thresholds: {
+                max_heap_mb: 4096,
+                max_error_rate: 0.5,
+                max_target_response_ms: 30_000,
+            },
+            heartbeat_interval_seconds: 30,
+        },
+        autonomy_levels: {
+            L1: { approval_required: false },
+            L2: { approval_required: false },
+            L3: { approval_required: true },
+            L4: { approval_required: false },
+        },
+        escalation: {
+            severity_threshold: 'critical',
+            cia_threshold: { c: 'high', i: 'high', a: 'high' },
+            pause_on_low_confidence: false,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+function stripToHostname(input) {
+    const trimmed = input.trim();
+    if (!trimmed)
+        return null;
+    // If it parses as a URL, take the hostname.
+    try {
+        const u = new URL(trimmed.includes('://') ? trimmed : `https://${trimmed}`);
+        if (u.hostname)
+            return u.hostname;
+    }
+    catch {
+        /* fall through */
+    }
+    return trimmed;
+}
+function matchDomain(host, pattern, includeSubdomains) {
+    const h = host.toLowerCase();
+    const p = pattern.toLowerCase();
+    // Wildcard patterns: `*.example.com` → matches any single-level subdomain
+    // plus the bare domain when includeSubdomains is true.
+    if (p.startsWith('*.')) {
+        const bare = p.slice(2);
+        return h === bare || h.endsWith('.' + bare);
+    }
+    if (h === p)
+        return true;
+    if (includeSubdomains && h.endsWith('.' + p))
+        return true;
+    return false;
+}
+function ipInCidr(host, cidr) {
+    // IPv4-only for v0.1.0; IPv6 ranges are accepted by the schema but
+    // matching is treated as out-of-scope (returns false). A future
+    // iteration extends this. The conservative answer for IPv6 is "not
+    // matched" — so an IPv6 deny-list still blocks via domain rules.
+    const m = /^(?:\d{1,3}\.){3}\d{1,3}$/.exec(host);
+    if (!m)
+        return false;
+    const [range, bitsStr] = cidr.split('/');
+    if (!range || !bitsStr)
+        return false;
+    if (!/^(?:\d{1,3}\.){3}\d{1,3}$/.test(range))
+        return false;
+    const bits = parseInt(bitsStr, 10);
+    if (!Number.isFinite(bits) || bits < 0 || bits > 32)
+        return false;
+    const hostInt = ipv4ToInt(host);
+    const rangeInt = ipv4ToInt(range);
+    if (hostInt === null || rangeInt === null)
+        return false;
+    if (bits === 0)
+        return true;
+    const mask = bits === 32 ? 0xffffffff : (~0 << (32 - bits)) >>> 0;
+    return (hostInt & mask) === (rangeInt & mask);
+}
+function ipv4ToInt(ip) {
+    const parts = ip.split('.').map((p) => parseInt(p, 10));
+    if (parts.length !== 4)
+        return null;
+    let out = 0;
+    for (const p of parts) {
+        if (!Number.isFinite(p) || p < 0 || p > 255)
+            return null;
+        out = ((out << 8) | p) >>> 0;
+    }
+    return out >>> 0;
+}
+function pathMatches(target, pattern) {
+    // Path-prefix match — minimal implementation for asset_criticality
+    // entries that point at repo paths or URL paths. Glob support is a
+    // Phase-2 cluster-1.5 enhancement.
+    if (!pattern.includes('/'))
+        return false;
+    return target.includes(pattern);
+}
+//# sourceMappingURL=types.js.map

package/dist/roe/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/roe/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,cAAc;AAEd,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC7C,EAAE,OAAO,EAAE,uEAAuE,EAAE,CACrF;IACH,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,KAAK,CACJ,8DAA8D,EAC9D,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE,CAAC;AAEJ,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,2BAA2B,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;IACtD,OAAO,EAAE,yCAAyC;CACnD,CAAC,CAAC;AAEL,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC5D,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE;IACtD,OAAO,EAAE,2CAA2C;CACrD,CAAC,CAAC;AAEL,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACpD,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5D,mGAAmG;IACnG,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7D,6BAA6B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,0CAA0C;IAC1C,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACnD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KAC/D,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,mDAAmD;IACnD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE;QAC5B,OAAO,EACL,8GAA8G;KACjH,CAAC;IACF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IAC/F,yEAAyE;IACzE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,yBAAyB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,EAAE,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACxC,EAAE,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACxC,EAAE,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACxC,EAAE,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,wEAAwE;IACxE,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/F,8CAA8C;IAC9C,aAAa,EAAE,CAAC;SACb,MAAM,CAAC;QACN,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvD,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QACvD,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;KACxD,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,kFAAkF;IAClF,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,yBAAyB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;SAClE,GAAG,CAAC,CAAC,CAAC;CACV,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC5D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1E,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8EAA8E;AAC9E,uBAAuB;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAChC,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,mBAAmB;IAClC,QAAQ,EAAE,aAAa;IACvB,YAAY,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1C,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,QAAQ,EAAE,cAAc;IACxB,eAAe,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9E,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,iFAAiF;IACjF,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACtD,sEAAsE;IACtE,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAChD,gEAAgE;IAChE,eAAe,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAChD,2EAA2E;IAC3E,mBAAmB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACxD,0FAA0F;IAC1F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAcZ;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAQ;IAC5D,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,UAAU,MAAM,0CAA0C;YAClE,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC9C,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,UAAU,IAAI,wCAAwC,MAAM,EAAE;gBACtE,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;aAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAChD,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,UAAU,IAAI,8BAA8B,MAAM,EAAE;gBAC5D,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;aAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU,IAAI,oCAAoC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC/H,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,UAAU,IAAI,4BAA4B,IAAI,EAAE;gBACxD,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC;aACzD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,UAAU,IAAI,4CAA4C;QAClE,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAQ,EAAE,MAAY,IAAI,IAAI,EAAE;IACvE,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,iBAAiB,GAAG,CAAC,WAAW,EAAE,iCAAiC,GAAG,CAAC,QAAQ,CAAC,KAAK,GAAG;YAChG,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,GAAG,GAAG,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,iBAAiB,GAAG,CAAC,WAAW,EAAE,8BAA8B,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG;YAC3F,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;SAC1C,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,2CAA2C,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,GAAG;gBACpG,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;aAC1C,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,0DAA0D;QAClE,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,GAAQ;IAER,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,aAAa,CAAC;IAChC,mEAAmE;IACnE,iEAAiE;IACjE,oBAAoB;IACpB,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC1C,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC,cAAc,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAc,EACd,MAAc,EACd,GAAQ,EACR,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,UAAU,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE;YAC9C,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC9B,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,UAAU,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE;YAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,UAAU,MAAM,OAAO,MAAM,kBAAkB,WAAW,sCAAsC;QACxG,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,aAAa,CAAC;KACzD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,UAGI,EAAE;IAEN,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;IAE/C,OAAO;QACL,MAAM,EAAE,eAAe,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;QAChE,YAAY,EAAE,OAAO;QACrB,QAAQ,EAAE;YACR,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,sBAAsB;YAC5D,aAAa,EAAE,mBAAmB;YAClC,OAAO,EAAE,aAAa;SACvB;QACD,aAAa,EAAE;YACb,SAAS,EACP,2FAA2F;YAC7F,gBAAgB,EAAE,mBAAmB;SACtC;QACD,QAAQ,EAAE;YACR,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;YACtD,SAAS,EAAE,EAAE;YACb,gBAAgB,EAAE,EAAE;SACrB;QACD,YAAY,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACvD,iBAAiB,EAAE,EAAE;QACrB,QAAQ,EAAE;YACR,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE;YACxB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;YACtB,QAAQ,EAAE,KAAK;YACf,gBAAgB,EAAE,EAAE;SACrB;QACD,eAAe,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE;QAChD,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC5B,eAAe,EAAE;YACf,iBAAiB,EAAE;gBACjB,WAAW,EAAE,IAAI;gBACjB,cAAc,EAAE,GAAG;gBACnB,sBAAsB,EAAE,MAAM;aAC/B;YACD,0BAA0B,EAAE,EAAE;SAC/B;QACD,eAAe,EAAE;YACf,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;YAChC,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;YAChC,EAAE,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;YAC/B,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE;SACjC;QACD,UAAU,EAAE;YACV,kBAAkB,EAAE,UAAU;YAC9B,aAAa,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE;YAClD,uBAAuB,EAAE,KAAK;SAC/B;KACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AAEV,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,4CAA4C;IAC5C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe,EAAE,iBAA0B;IAC5E,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,iBAAiB,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,mEAAmE;IACnE,gEAAgE;IAChE,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,CAAC,GAAG,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QACzD,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe;IAClD,mEAAmE;IACnE,mEAAmE;IACnE,mCAAmC;IACnC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC"}

package/dist/runtime/chain.d.ts

@@ -0,0 +1,60 @@
+import type { EngagementEvent, EventSink } from './events.js';
+export interface ChainedEmitterOpts {
+    sink: EventSink;
+    /** Initial prev-hash. null = chain starts here. Use the prior chain's tail when continuing across resume. */
+    initialPrevHash?: string | null;
+}
+/**
+ * Stateful emitter that maintains the running prev_hash → this_hash chain.
+ * Each `emit` call pours the chain forward by one link. The current chain
+ * tail is exposed via `getTail()` so a resume operation can pick up where
+ * the prior session left off.
+ */
+export declare class ChainedEmitter {
+    private readonly opts;
+    private prevHash;
+    constructor(opts: ChainedEmitterOpts);
+    emit(event: EngagementEvent): EngagementEvent;
+    getTail(): string | null;
+}
+export interface ChainVerifyOk {
+    ok: true;
+    total_events: number;
+    tail_hash: string | null;
+}
+export interface ChainVerifyFailure {
+    ok: false;
+    error: string;
+    /** 0-indexed line number where the chain broke. */
+    broken_at: number;
+    total_events_processed: number;
+}
+export type ChainVerifyResult = ChainVerifyOk | ChainVerifyFailure;
+/**
+ * Verify the integrity of a JSONL audit-log file. Each EVENT line must:
+ *   - parse as JSON
+ *   - carry this_hash + prev_hash fields
+ *   - have a this_hash that matches the canonical hash of its other fields
+ *   - have a prev_hash that matches the previous line's this_hash (null on line 0)
+ *
+ * Snapshot lines (those with `state_version` but no `event` field) are
+ * SKIPPED — they exist alongside events in the same JSONL file (audit-fix
+ * 2026-04-27 made writeEngagementState append-not-overwrite).
+ *
+ * KNOWN SCOPE LIMIT (audit-fix-2 2026-04-27):
+ *   Snapshot lines are NOT part of the hash chain. An attacker with
+ *   write access to the state-file can post-hoc tamper with snapshot
+ *   fields (`completed_phases`, `findings_so_far`, `paused_at`,
+ *   `reason`) without breaking chain verification. The EVENT timeline
+ *   remains tamper-evident — every state transition emits an event,
+ *   so a tampered snapshot is contradicted by the unchanged event
+ *   stream. Resume-from-snapshot consumers MUST cross-check snapshot
+ *   contents against the event chain before trusting them. Closing
+ *   this gap fully would require chaining snapshot writes through
+ *   ChainedEmitter (snapshot becomes an event with prev_hash +
+ *   this_hash); deferred to a future cluster.
+ *
+ * Returns ok-with-tail-hash on success, or failure-at-line-N with reason.
+ */
+export declare function verifyAuditChain(path: string): ChainVerifyResult;
+//# sourceMappingURL=chain.d.ts.map

package/dist/runtime/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/runtime/chain.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI9D,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,CAAC;IAChB,6GAA6G;IAC7G,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;;GAKG;AACH,qBAAa,cAAc;IAEb,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,QAAQ,CAAgB;gBACH,IAAI,EAAE,kBAAkB;IAIrD,IAAI,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe;IAc7C,OAAO,IAAI,MAAM,GAAG,IAAI;CAGzB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,IAAI,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AACD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AACD,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,kBAAkB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CA8EhE"}