@aegis-scan/core 0.16.6 → 0.18.0

package/dist/manipulation-resistance/response-validator.js

@@ -0,0 +1,186 @@
+/**
+ * Wrapper response validation + authority-claim detection.
+ *
+ * Closes APTS-MR-002 (Response Validation and Sanitization) +
+ * APTS-MR-005 (Authority Claim Detection and Rejection).
+ *
+ * Design notes:
+ *   - LLM-pentest wrappers return JSON-ish output that flows into AEGIS
+ *     Findings. Untrusted output may contain (a) malformed structure,
+ *     (b) HTML/script payloads in finding text, (c) over-long fields
+ *     designed to exhaust memory, (d) authority claims like "I have root
+ *     access" that should not be propagated as fact without verification.
+ *   - validateWrapperResponse runs a per-wrapper Zod schema +
+ *     sanitization. Schemas are intentionally lenient on field
+ *     presence to tolerate the variation in upstream output shapes
+ *     (Strix emits findings | vulnerabilities | results); strict on
+ *     field types where present.
+ *   - detectAuthorityClaim scans finding text for phrases that assert
+ *     orchestrator-relevant authority (admin, root, RCE, reverse-shell)
+ *     and returns a structured claim record. Caller decides whether to
+ *     halt-pending-operator-confirmation or reject outright.
+ */
+import { z } from 'zod';
+const MAX_FIELD_LEN = 16_384;
+const LooseFindingSchema = z
+    .object({
+    id: z.union([z.string(), z.number()]).optional(),
+    severity: z.string().optional(),
+    title: z.string().optional(),
+    name: z.string().optional(),
+    description: z.string().optional(),
+    cwe: z.union([z.number(), z.string()]).optional(),
+    cvss: z.number().optional(),
+    vulnerability: z.string().optional(),
+    evidence: z.string().optional(),
+})
+    .passthrough();
+const StrixOutputSchema = z
+    .object({
+    findings: z.array(LooseFindingSchema).optional(),
+    vulnerabilities: z.array(LooseFindingSchema).optional(),
+    results: z.array(LooseFindingSchema).optional(),
+})
+    .passthrough();
+const PtaiOutputSchema = z
+    .object({
+    runs: z
+        .array(z
+        .object({
+        results: z.array(z.unknown()).optional(),
+    })
+        .passthrough())
+        .optional(),
+    findings: z.array(LooseFindingSchema).optional(),
+})
+    .passthrough();
+const PentestswarmOutputSchema = z
+    .object({
+    findings: z.array(LooseFindingSchema).optional(),
+    issues: z.array(LooseFindingSchema).optional(),
+    report: z.unknown().optional(),
+})
+    .passthrough();
+const SubfinderEntrySchema = z
+    .object({
+    host: z.string().optional(),
+    input: z.string().optional(),
+    source: z.string().optional(),
+})
+    .passthrough();
+/**
+ * Per-wrapper output schema. Unknown wrappers fall back to deny — the
+ * caller must register a schema before AEGIS will trust the output.
+ */
+const WRAPPER_SCHEMAS = {
+    strix: StrixOutputSchema,
+    ptai: PtaiOutputSchema,
+    pentestswarm: PentestswarmOutputSchema,
+    subfinder: SubfinderEntrySchema,
+};
+/**
+ * Validate + sanitize a wrapper's structured output before propagating
+ * to Findings. Returns { ok: true, cleaned } on success or
+ * { ok: false, reason } with an APTS reference on rejection.
+ */
+export function validateWrapperResponse(wrapperName, raw) {
+    const schema = WRAPPER_SCHEMAS[wrapperName];
+    if (!schema) {
+        return {
+            ok: false,
+            reason: `no validation schema registered for wrapper "${wrapperName}"`,
+            apts_refs: ['APTS-MR-002'],
+        };
+    }
+    const parsed = schema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            reason: `wrapper "${wrapperName}" output failed schema validation: ${parsed.error.issues
+                .slice(0, 3)
+                .map((i) => `${i.path.join('.')} ${i.message}`)
+                .join('; ')}`,
+            apts_refs: ['APTS-MR-002'],
+        };
+    }
+    return {
+        ok: true,
+        cleaned: sanitize(parsed.data, MAX_FIELD_LEN),
+        apts_refs: ['APTS-MR-002'],
+    };
+}
+/**
+ * Recursively HTML-encode angle brackets + ampersands inside string
+ * leaves and cap field lengths. Defends against HTML/script payloads
+ * embedded in finding titles + descriptions and against
+ * memory-exhaustion via finding-flood.
+ */
+function sanitize(value, maxLen) {
+    if (typeof value === 'string') {
+        const truncated = value.length > maxLen ? value.slice(0, maxLen) + '…[truncated]' : value;
+        return truncated.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+    }
+    if (Array.isArray(value))
+        return value.map((v) => sanitize(v, maxLen));
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = sanitize(v, maxLen);
+        }
+        return out;
+    }
+    return value;
+}
+const AUTHORITY_PATTERNS = [
+    // RCE / reverse-shell — strongest claims, reject outright pending operator review
+    { re: /\breverse[\s-]?shell\b/iu, claim: 'reverse-shell', action: 'reject' },
+    { re: /\b(?:remote code execution|RCE)\b/iu, claim: 'rce', action: 'reject' },
+    { re: /\barbitrary code execution\b/iu, claim: 'rce', action: 'reject' },
+    // Root / system-level — strong but possibly legitimate finding text
+    { re: /\b(?:root access|root shell|root-level)\b/iu, claim: 'root', action: 'verify' },
+    { re: /\b(?:superuser|system-level access)\b/iu, claim: 'root', action: 'verify' },
+    // Admin — often a legitimate finding ("admin endpoint exposed"); only flag
+    // assertive forms ("I have admin", "have gained admin").
+    {
+        re: /\b(?:I have|have gained|have obtained|have achieved|have full)[\s\w]{0,40}\badmin(?:istrator)?\b/iu,
+        claim: 'admin',
+        action: 'verify',
+    },
+    {
+        re: /\b(?:I have|have gained|have obtained)[\s\w]{0,40}\bcompromised\b/iu,
+        claim: 'admin',
+        action: 'verify',
+    },
+];
+/**
+ * Detect authority claims in finding text. Returns the strongest match
+ * (RCE > root > admin) or `claim: 'none'` if no pattern fires.
+ *
+ * Suggested-action policy:
+ *   - 'reject' for RCE / reverse-shell — these are high-impact assertions
+ *     that AEGIS must not propagate without operator confirmation.
+ *   - 'verify' for root/admin — pause for operator confirmation via
+ *     SIGUSR1 resume, then proceed if confirmed.
+ *   - 'pass' when no claim detected.
+ */
+export function detectAuthorityClaim(findingText) {
+    for (const pattern of AUTHORITY_PATTERNS) {
+        const match = pattern.re.exec(findingText);
+        if (match) {
+            return {
+                claim: pattern.claim,
+                rationale: `finding text asserts ${pattern.claim} authority claim`,
+                matched_phrase: match[0],
+                suggested_action: pattern.action,
+                apts_refs: ['APTS-MR-005'],
+            };
+        }
+    }
+    return {
+        claim: 'none',
+        rationale: 'no authority-claim phrase detected',
+        suggested_action: 'pass',
+        apts_refs: ['APTS-MR-005'],
+    };
+}
+//# sourceMappingURL=response-validator.js.map

package/dist/manipulation-resistance/response-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-validator.js","sourceRoot":"","sources":["../../src/manipulation-resistance/response-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC;SACJ,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;SACD,WAAW,EAAE,CACjB;SACA,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB;;;GAGG;AACH,MAAM,eAAe,GAA2C;IAC9D,KAAK,EAAE,iBAAiB;IACxB,IAAI,EAAE,gBAAgB;IACtB,YAAY,EAAE,wBAAwB;IACtC,SAAS,EAAE,oBAAoB;CAChC,CAAC;AASF;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,GAAY;IAEZ,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gDAAgD,WAAW,GAAG;YACtE,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY,WAAW,sCAAsC,MAAM,CAAC,KAAK,CAAC,MAAM;iBACrF,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;QAC7C,SAAS,EAAE,CAAC,aAAa,CAAC;KAC3B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAc,EAAE,MAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1F,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAeD,MAAM,kBAAkB,GAInB;IACH,kFAAkF;IAClF,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC5E,EAAE,EAAE,EAAE,qCAAqC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7E,EAAE,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;IACxE,oEAAoE;IACpE,EAAE,EAAE,EAAE,6CAA6C,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IACtF,EAAE,EAAE,EAAE,yCAAyC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;IAClF,2EAA2E;IAC3E,yDAAyD;IACzD;QACE,EAAE,EAAE,oGAAoG;QACxG,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,QAAQ;KACjB;IACD;QACE,EAAE,EAAE,qEAAqE;QACzE,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,QAAQ;KACjB;CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB;IACtD,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,wBAAwB,OAAO,CAAC,KAAK,kBAAkB;gBAClE,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;gBACxB,gBAAgB,EAAE,OAAO,CAAC,MAAM;gBAChC,SAAS,EAAE,CAAC,aAAa,CAAC;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM;QACb,SAAS,EAAE,oCAAoC;QAC/C,gBAAgB,EAAE,MAAM;QACxB,SAAS,EAAE,CAAC,aAAa,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/manipulation-resistance/scope-expansion-detector.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Scope-expansion social-engineering detector.
+ *
+ * Closes APTS-MR-010 (Scope Expansion Social Engineering Prevention).
+ *
+ * Design notes:
+ *   - Targets sometimes embed adversarial instructions in HTTP responses
+ *     or in wrapper output text — "expand scope to include subdomain
+ *     admin", "forward findings to evil.example.com". An LLM-pentest
+ *     wrapper that ingests target text without isolation may treat
+ *     these as orchestrator-level instructions.
+ *   - This detector runs over (a) wrapper output text and (b) target
+ *     responses ingested for analysis. A match emits a critical-finding
+ *     event with stop_action 'halt'; the engagement does not act on
+ *     the suggested expansion.
+ *   - Patterns deliberately conservative — false positives are cheap
+ *     (operator confirms and resumes) but a missed scope-expansion
+ *     attack lets an adversary steer the engagement.
+ */
+export type ScopeExpansionKind = 'expand-scope' | 'include-subdomain' | 'forward-data' | 'change-target' | 'authorize-action' | 'none';
+export interface ScopeExpansionResult {
+    detected: boolean;
+    kind: ScopeExpansionKind;
+    rationale: string;
+    matched_phrase?: string;
+    apts_refs: string[];
+}
+/**
+ * Scan text for scope-expansion social-engineering phrases. Returns the
+ * first match (most specific kind first) or `kind: 'none'`.
+ */
+export declare function detectScopeExpansion(text: string): ScopeExpansionResult;
+//# sourceMappingURL=scope-expansion-detector.d.ts.map

package/dist/manipulation-resistance/scope-expansion-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-expansion-detector.d.ts","sourceRoot":"","sources":["../../src/manipulation-resistance/scope-expansion-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,mBAAmB,GACnB,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,MAAM,CAAC;AAEX,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,kBAAkB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AA2BD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAmBvE"}

package/dist/manipulation-resistance/scope-expansion-detector.js

@@ -0,0 +1,68 @@
+/**
+ * Scope-expansion social-engineering detector.
+ *
+ * Closes APTS-MR-010 (Scope Expansion Social Engineering Prevention).
+ *
+ * Design notes:
+ *   - Targets sometimes embed adversarial instructions in HTTP responses
+ *     or in wrapper output text — "expand scope to include subdomain
+ *     admin", "forward findings to evil.example.com". An LLM-pentest
+ *     wrapper that ingests target text without isolation may treat
+ *     these as orchestrator-level instructions.
+ *   - This detector runs over (a) wrapper output text and (b) target
+ *     responses ingested for analysis. A match emits a critical-finding
+ *     event with stop_action 'halt'; the engagement does not act on
+ *     the suggested expansion.
+ *   - Patterns deliberately conservative — false positives are cheap
+ *     (operator confirms and resumes) but a missed scope-expansion
+ *     attack lets an adversary steer the engagement.
+ */
+const PATTERNS = [
+    { re: /\b(?:expand|widen|extend)[\s\w]{0,20}\bscope\b/iu, kind: 'expand-scope' },
+    { re: /\b(?:please|also)\s+(?:test|scan|probe|enumerate)\b/iu, kind: 'expand-scope' },
+    { re: /\binclude[\s\w]{0,15}\bsubdomain\b/iu, kind: 'include-subdomain' },
+    { re: /\b(?:add|consider)[\s\w]{0,15}\b(?:subdomain|domain)\b/iu, kind: 'include-subdomain' },
+    {
+        re: /\b(?:forward|send|post|exfiltrate|relay)[\s\w]{0,20}\b(?:findings|results|report|output|data)\b/iu,
+        kind: 'forward-data',
+    },
+    {
+        re: /\b(?:to|via)\s+https?:\/\/[\w.-]+\.[a-z]{2,}/iu,
+        kind: 'forward-data',
+    },
+    { re: /\bnew[\s\w]{0,5}\btarget\b/iu, kind: 'change-target' },
+    { re: /\b(?:switch|change|move)[\s\w]{0,15}\btarget\b/iu, kind: 'change-target' },
+    {
+        re: /\b(?:you are authorized|i authorize you|permission granted|approved by)\b/iu,
+        kind: 'authorize-action',
+    },
+    {
+        re: /\b(?:override|bypass)[\s\w]{0,15}\b(?:scope|RoE|policy)\b/iu,
+        kind: 'authorize-action',
+    },
+];
+/**
+ * Scan text for scope-expansion social-engineering phrases. Returns the
+ * first match (most specific kind first) or `kind: 'none'`.
+ */
+export function detectScopeExpansion(text) {
+    for (const pattern of PATTERNS) {
+        const match = pattern.re.exec(text);
+        if (match) {
+            return {
+                detected: true,
+                kind: pattern.kind,
+                rationale: `text contains scope-expansion phrase of kind "${pattern.kind}"`,
+                matched_phrase: match[0],
+                apts_refs: ['APTS-MR-010'],
+            };
+        }
+    }
+    return {
+        detected: false,
+        kind: 'none',
+        rationale: 'no scope-expansion phrase detected',
+        apts_refs: ['APTS-MR-010'],
+    };
+}
+//# sourceMappingURL=scope-expansion-detector.js.map

package/dist/manipulation-resistance/scope-expansion-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-expansion-detector.js","sourceRoot":"","sources":["../../src/manipulation-resistance/scope-expansion-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,QAAQ,GAA4D;IACxE,EAAE,EAAE,EAAE,kDAAkD,EAAE,IAAI,EAAE,cAAc,EAAE;IAChF,EAAE,EAAE,EAAE,uDAAuD,EAAE,IAAI,EAAE,cAAc,EAAE;IACrF,EAAE,EAAE,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE;IACzE,EAAE,EAAE,EAAE,0DAA0D,EAAE,IAAI,EAAE,mBAAmB,EAAE;IAC7F;QACE,EAAE,EAAE,mGAAmG;QACvG,IAAI,EAAE,cAAc;KACrB;IACD;QACE,EAAE,EAAE,gDAAgD;QACpD,IAAI,EAAE,cAAc;KACrB;IACD,EAAE,EAAE,EAAE,8BAA8B,EAAE,IAAI,EAAE,eAAe,EAAE;IAC7D,EAAE,EAAE,EAAE,kDAAkD,EAAE,IAAI,EAAE,eAAe,EAAE;IACjF;QACE,EAAE,EAAE,6EAA6E;QACjF,IAAI,EAAE,kBAAkB;KACzB;IACD;QACE,EAAE,EAAE,6DAA6D;QACjE,IAAI,EAAE,kBAAkB;KACzB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,SAAS,EAAE,iDAAiD,OAAO,CAAC,IAAI,GAAG;gBAC3E,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;gBACxB,SAAS,EAAE,CAAC,aAAa,CAAC;aAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,oCAAoC;QAC/C,SAAS,EAAE,CAAC,aAAa,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/oversight/approval-gates.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Pre-approval gates per autonomy level + mandatory human decision points.
+ *
+ * Closes APTS-HO-001 (Pre-Approval Gates per AL-level) +
+ * APTS-HO-010 (Mandatory Human Decision Points).
+ *
+ * Design notes:
+ *   - APTS recognizes 4 autonomy levels (L1-L4). AEGIS scanner
+ *     phases map onto these: recon = L1, discovery = L2, exploitation
+ *     = L3, reporting = L4. RoE.autonomy_levels declares whether
+ *     each level requires an explicit approval before its phase
+ *     dispatches.
+ *   - HO-010 reuses the same machinery for irreversible-action
+ *     classes (auth-bypass, data-modify, config-modify, ddos) — the
+ *     orchestrator pauses at phase entry when the corresponding
+ *     class is in the per-phase policy.
+ *   - Approval semantics: pre-engagement consent (operator-attested
+ *     in RoE.authorization.statement) authorizes L1+L2 by default;
+ *     L3+L4 require explicit per-engagement opt-in via the
+ *     `aegis siege --approve <level>` flow (or RoE.autonomy_levels.LX.pre_approved).
+ */
+export type AutonomyLevel = 'L1' | 'L2' | 'L3' | 'L4';
+export declare const PHASE_TO_AUTONOMY_LEVEL: Readonly<Record<string, AutonomyLevel>>;
+export interface AutonomyLevelPolicy {
+    approval_required?: boolean;
+    pre_approved?: boolean;
+    irreversible_action_classes?: string[];
+}
+export interface AutonomyLevelsConfig {
+    L1?: AutonomyLevelPolicy;
+    L2?: AutonomyLevelPolicy;
+    L3?: AutonomyLevelPolicy;
+    L4?: AutonomyLevelPolicy;
+}
+export interface ApprovalGateDecision {
+    allowed: boolean;
+    reason: string;
+    level: AutonomyLevel;
+    apts_refs: string[];
+}
+/**
+ * Decide whether a phase entry is authorized. Returns allowed=true
+ * when (a) no approval is required, (b) approval is pre-approved, or
+ * (c) the operator has confirmed engagement-wide consent.
+ */
+export declare function evaluateApprovalGate(phase: string, autonomyLevels: AutonomyLevelsConfig | undefined, engagementConfirmed: boolean): ApprovalGateDecision;
+/**
+ * Identify whether a phase invocation includes an irreversible action
+ * class that requires HO-010 mandatory human-decision-point gating.
+ *
+ * Returns the matched classes (empty array means no gate required).
+ */
+export declare function detectIrreversibleActions(phase: string, autonomyLevels: AutonomyLevelsConfig | undefined): string[];
+export interface IrreversibleGateDecision {
+    allowed: boolean;
+    classes: string[];
+    reason: string;
+    level: AutonomyLevel | null;
+    apts_refs: string[];
+}
+/**
+ * APTS-HO-010 mandatory human-decision-point gate.
+ *
+ * Even when `evaluateApprovalGate` passes (e.g. via engagement-wide
+ * --confirm on L1/L2), a phase that declares irreversible-action
+ * classes still requires explicit per-level `pre_approved: true` in
+ * the RoE. Engagement-wide consent cannot authorize irreversible
+ * actions implicitly; the operator must look at the action list and
+ * acknowledge it by writing `pre_approved: true` next to the
+ * `irreversible_action_classes` array.
+ *
+ * Returns `allowed: false` when classes are declared and not
+ * pre-approved; the orchestrator halts with HO-010 reason at phase
+ * entry.
+ */
+export declare function evaluateIrreversibleGate(phase: string, autonomyLevels: AutonomyLevelsConfig | undefined): IrreversibleGateDecision;
+//# sourceMappingURL=approval-gates.d.ts.map

package/dist/oversight/approval-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-gates.d.ts","sourceRoot":"","sources":["../../src/oversight/approval-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAK1E,CAAC;AAEH,MAAM,WAAW,mBAAmB;IAClC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,CAAC,EAAE,mBAAmB,CAAC;IACzB,EAAE,CAAC,EAAE,mBAAmB,CAAC;IACzB,EAAE,CAAC,EAAE,mBAAmB,CAAC;IACzB,EAAE,CAAC,EAAE,mBAAmB,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,oBAAoB,GAAG,SAAS,EAChD,mBAAmB,EAAE,OAAO,GAC3B,oBAAoB,CA0CtB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,oBAAoB,GAAG,SAAS,GAC/C,MAAM,EAAE,CAIV;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,oBAAoB,GAAG,SAAS,GAC/C,wBAAwB,CA6B1B"}

package/dist/oversight/approval-gates.js

@@ -0,0 +1,133 @@
+/**
+ * Pre-approval gates per autonomy level + mandatory human decision points.
+ *
+ * Closes APTS-HO-001 (Pre-Approval Gates per AL-level) +
+ * APTS-HO-010 (Mandatory Human Decision Points).
+ *
+ * Design notes:
+ *   - APTS recognizes 4 autonomy levels (L1-L4). AEGIS scanner
+ *     phases map onto these: recon = L1, discovery = L2, exploitation
+ *     = L3, reporting = L4. RoE.autonomy_levels declares whether
+ *     each level requires an explicit approval before its phase
+ *     dispatches.
+ *   - HO-010 reuses the same machinery for irreversible-action
+ *     classes (auth-bypass, data-modify, config-modify, ddos) — the
+ *     orchestrator pauses at phase entry when the corresponding
+ *     class is in the per-phase policy.
+ *   - Approval semantics: pre-engagement consent (operator-attested
+ *     in RoE.authorization.statement) authorizes L1+L2 by default;
+ *     L3+L4 require explicit per-engagement opt-in via the
+ *     `aegis siege --approve <level>` flow (or RoE.autonomy_levels.LX.pre_approved).
+ */
+export const PHASE_TO_AUTONOMY_LEVEL = Object.freeze({
+    recon: 'L1',
+    discovery: 'L2',
+    exploitation: 'L3',
+    reporting: 'L4',
+});
+/**
+ * Decide whether a phase entry is authorized. Returns allowed=true
+ * when (a) no approval is required, (b) approval is pre-approved, or
+ * (c) the operator has confirmed engagement-wide consent.
+ */
+export function evaluateApprovalGate(phase, autonomyLevels, engagementConfirmed) {
+    const level = PHASE_TO_AUTONOMY_LEVEL[phase];
+    if (!level) {
+        return {
+            allowed: true,
+            reason: `phase "${phase}" has no AL mapping; allowing by default`,
+            level: 'L1',
+            apts_refs: ['APTS-HO-001'],
+        };
+    }
+    const policy = autonomyLevels?.[level];
+    if (!policy || policy.approval_required !== true) {
+        return {
+            allowed: true,
+            reason: `${level}: approval not required per RoE`,
+            level,
+            apts_refs: ['APTS-HO-001'],
+        };
+    }
+    if (policy.pre_approved === true) {
+        return {
+            allowed: true,
+            reason: `${level}: pre-approved per RoE.autonomy_levels.${level}.pre_approved`,
+            level,
+            apts_refs: ['APTS-HO-001'],
+        };
+    }
+    // Engagement-wide consent (--confirm) authorizes L1+L2 by default.
+    if (engagementConfirmed && (level === 'L1' || level === 'L2')) {
+        return {
+            allowed: true,
+            reason: `${level}: authorized via engagement-wide --confirm`,
+            level,
+            apts_refs: ['APTS-HO-001'],
+        };
+    }
+    return {
+        allowed: false,
+        reason: `${level}: approval required but not pre-approved — engagement halts pending operator confirmation`,
+        level,
+        apts_refs: ['APTS-HO-001', 'APTS-HO-010'],
+    };
+}
+/**
+ * Identify whether a phase invocation includes an irreversible action
+ * class that requires HO-010 mandatory human-decision-point gating.
+ *
+ * Returns the matched classes (empty array means no gate required).
+ */
+export function detectIrreversibleActions(phase, autonomyLevels) {
+    const level = PHASE_TO_AUTONOMY_LEVEL[phase];
+    if (!level || !autonomyLevels?.[level]?.irreversible_action_classes)
+        return [];
+    return [...(autonomyLevels[level]?.irreversible_action_classes ?? [])];
+}
+/**
+ * APTS-HO-010 mandatory human-decision-point gate.
+ *
+ * Even when `evaluateApprovalGate` passes (e.g. via engagement-wide
+ * --confirm on L1/L2), a phase that declares irreversible-action
+ * classes still requires explicit per-level `pre_approved: true` in
+ * the RoE. Engagement-wide consent cannot authorize irreversible
+ * actions implicitly; the operator must look at the action list and
+ * acknowledge it by writing `pre_approved: true` next to the
+ * `irreversible_action_classes` array.
+ *
+ * Returns `allowed: false` when classes are declared and not
+ * pre-approved; the orchestrator halts with HO-010 reason at phase
+ * entry.
+ */
+export function evaluateIrreversibleGate(phase, autonomyLevels) {
+    const classes = detectIrreversibleActions(phase, autonomyLevels);
+    if (classes.length === 0) {
+        return {
+            allowed: true,
+            classes: [],
+            reason: `${phase}: no irreversible action classes declared`,
+            level: PHASE_TO_AUTONOMY_LEVEL[phase] ?? null,
+            apts_refs: ['APTS-HO-010'],
+        };
+    }
+    const level = PHASE_TO_AUTONOMY_LEVEL[phase] ?? null;
+    const policy = level ? autonomyLevels?.[level] : undefined;
+    if (policy?.pre_approved === true) {
+        return {
+            allowed: true,
+            classes,
+            reason: `${phase}: irreversible classes [${classes.join(', ')}] pre-approved per RoE.autonomy_levels.${level}.pre_approved`,
+            level,
+            apts_refs: ['APTS-HO-010'],
+        };
+    }
+    return {
+        allowed: false,
+        classes,
+        reason: `${phase}: irreversible action classes [${classes.join(', ')}] declared but not pre-approved — HO-010 requires explicit RoE.autonomy_levels.${level}.pre_approved=true to authorize irreversible actions; engagement-wide --confirm is INSUFFICIENT for irreversible classes`,
+        level,
+        apts_refs: ['APTS-HO-010'],
+    };
+}
+//# sourceMappingURL=approval-gates.js.map

package/dist/oversight/approval-gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-gates.js","sourceRoot":"","sources":["../../src/oversight/approval-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAA4C,MAAM,CAAC,MAAM,CAAC;IAC5F,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,YAAY,EAAE,IAAI;IAClB,SAAS,EAAE,IAAI;CAChB,CAAC,CAAC;AAsBH;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,cAAgD,EAChD,mBAA4B;IAE5B,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,UAAU,KAAK,0CAA0C;YACjE,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,GAAG,KAAK,iCAAiC;YACjD,KAAK;YACL,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,GAAG,KAAK,0CAA0C,KAAK,eAAe;YAC9E,KAAK;YACL,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,mEAAmE;IACnE,IAAI,mBAAmB,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,GAAG,KAAK,4CAA4C;YAC5D,KAAK;YACL,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,GAAG,KAAK,2FAA2F;QAC3G,KAAK;QACL,SAAS,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAa,EACb,cAAgD;IAEhD,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,EAAE,2BAA2B;QAAE,OAAO,EAAE,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC;AAUD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,KAAa,EACb,cAAgD;IAEhD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,GAAG,KAAK,2CAA2C;YAC3D,KAAK,EAAE,uBAAuB,CAAC,KAAK,CAAC,IAAI,IAAI;YAC7C,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACrD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,MAAM,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO;YACP,MAAM,EAAE,GAAG,KAAK,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,KAAK,eAAe;YAC3H,KAAK;YACL,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,OAAO;QACP,MAAM,EAAE,GAAG,KAAK,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kFAAkF,KAAK,0HAA0H;QACrR,KAAK;QACL,SAAS,EAAE,CAAC,aAAa,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/oversight/authority-matrix.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Authority delegation matrix.
+ *
+ * Closes APTS-HO-004 (Authority Delegation Matrix).
+ *
+ * Design notes:
+ *   - Operator-supplied delegation matrix in RoE.authorization
+ *     declares which roles can approve which action classes. The
+ *     orchestrator validates the matrix at engagement start and
+ *     emits it into the audit trail; runtime enforcement of the
+ *     specific role↔action mapping is deferred to the operator's
+ *     own approval workflow (e.g. PagerDuty/Slack approver matching).
+ *   - This module focuses on validation + the action-class lookup
+ *     used by the escalation framework when it needs to attribute
+ *     a halt-pending event to the role that can lift it.
+ */
+export interface DelegationEntry {
+    role: string;
+    can_approve: string[];
+}
+export interface AuthorityMatrixValidation {
+    ok: boolean;
+    errors: string[];
+    matrix?: DelegationEntry[];
+    apts_refs: string[];
+}
+/**
+ * Validate the matrix shape: non-empty role + at least one
+ * can_approve entry, no duplicate roles, no empty action class
+ * strings. Returns ok=true with the (deduplicated) matrix.
+ */
+export declare function validateDelegationMatrix(matrix: unknown): AuthorityMatrixValidation;
+/**
+ * Find roles that can approve a given action class. Returns an empty
+ * array when no role can — escalation framework treats this as
+ * "halt cannot be lifted" and surfaces a different audit message.
+ */
+export declare function rolesForAction(matrix: DelegationEntry[], actionClass: string): string[];
+//# sourceMappingURL=authority-matrix.d.ts.map

package/dist/oversight/authority-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-matrix.d.ts","sourceRoot":"","sources":["../../src/oversight/authority-matrix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,yBAAyB,CA4CnF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAEvF"}

package/dist/oversight/authority-matrix.js

@@ -0,0 +1,75 @@
+/**
+ * Authority delegation matrix.
+ *
+ * Closes APTS-HO-004 (Authority Delegation Matrix).
+ *
+ * Design notes:
+ *   - Operator-supplied delegation matrix in RoE.authorization
+ *     declares which roles can approve which action classes. The
+ *     orchestrator validates the matrix at engagement start and
+ *     emits it into the audit trail; runtime enforcement of the
+ *     specific role↔action mapping is deferred to the operator's
+ *     own approval workflow (e.g. PagerDuty/Slack approver matching).
+ *   - This module focuses on validation + the action-class lookup
+ *     used by the escalation framework when it needs to attribute
+ *     a halt-pending event to the role that can lift it.
+ */
+/**
+ * Validate the matrix shape: non-empty role + at least one
+ * can_approve entry, no duplicate roles, no empty action class
+ * strings. Returns ok=true with the (deduplicated) matrix.
+ */
+export function validateDelegationMatrix(matrix) {
+    if (!Array.isArray(matrix)) {
+        return {
+            ok: false,
+            errors: ['delegation_matrix must be an array'],
+            apts_refs: ['APTS-HO-004'],
+        };
+    }
+    const errors = [];
+    const seenRoles = new Set();
+    const out = [];
+    for (let i = 0; i < matrix.length; i++) {
+        const e = matrix[i];
+        if (!e || typeof e !== 'object') {
+            errors.push(`entry [${i}]: must be an object`);
+            continue;
+        }
+        const entry = e;
+        const role = entry.role;
+        const canApprove = entry.can_approve;
+        if (typeof role !== 'string' || role.trim().length === 0) {
+            errors.push(`entry [${i}]: role must be a non-empty string`);
+            continue;
+        }
+        if (seenRoles.has(role)) {
+            errors.push(`entry [${i}]: duplicate role "${role}"`);
+            continue;
+        }
+        if (!Array.isArray(canApprove) || canApprove.length === 0) {
+            errors.push(`entry [${i}]: can_approve must be a non-empty array`);
+            continue;
+        }
+        const approvals = canApprove.filter((a) => typeof a === 'string' && a.length > 0);
+        if (approvals.length !== canApprove.length) {
+            errors.push(`entry [${i}]: can_approve contains non-string or empty entries`);
+            continue;
+        }
+        seenRoles.add(role);
+        out.push({ role, can_approve: approvals });
+    }
+    if (errors.length > 0) {
+        return { ok: false, errors, apts_refs: ['APTS-HO-004'] };
+    }
+    return { ok: true, errors: [], matrix: out, apts_refs: ['APTS-HO-004'] };
+}
+/**
+ * Find roles that can approve a given action class. Returns an empty
+ * array when no role can — escalation framework treats this as
+ * "halt cannot be lifted" and surfaces a different audit message.
+ */
+export function rolesForAction(matrix, actionClass) {
+    return matrix.filter((e) => e.can_approve.includes(actionClass)).map((e) => e.role);
+}
+//# sourceMappingURL=authority-matrix.js.map

package/dist/oversight/authority-matrix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-matrix.js","sourceRoot":"","sources":["../../src/oversight/authority-matrix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAcH;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAe;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC,oCAAoC,CAAC;YAC9C,SAAS,EAAE,CAAC,aAAa,CAAC;SAC3B,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;YAC/C,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,CAA4B,CAAC;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC;QACrC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,oCAAoC,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,IAAI,GAAG,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,0CAA0C,CAAC,CAAC;YACnE,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAa,CAAC;QAC9F,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,qDAAqD,CAAC,CAAC;YAC9E,SAAS;QACX,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAyB,EAAE,WAAmB;IAC3E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC"}