@agent-teams/engineering-foundation 0.3.0 → 0.4.0

package/dist/capabilities/public-api-compatibility/module.js

@@ -0,0 +1,69 @@
+import { CapabilityInputError, capabilityReport } from "../../capability-runtime.js";
+import { MicrosoftPublicApiExtractor } from "./adapters/outbound/api-extractor/microsoft-public-api-extractor.js";
+import { NodeChangeFingerprint } from "./adapters/outbound/crypto/node-change-fingerprint.js";
+import { FilesystemPublicApiRepository } from "./adapters/outbound/filesystem/filesystem-public-api-repository.js";
+import { PUBLIC_API_COMPATIBILITY_RULES_BY_ID } from "./application/rules.js";
+import { analyzePublicApiCompatibility } from "./application/use-cases/analyze-public-api-compatibility.js";
+import { promotePublicApiBaselines } from "./application/use-cases/promote-public-api-baselines.js";
+import { CAPABILITY_CONFIG_SCHEMA_VERSION, CAPABILITY_ID, loadCapabilityConfig } from "./contract/config.js";
+export { PUBLIC_API_COMPATIBILITY_RULES_BY_ID };
+function createDependencies() {
+    return Object.freeze({
+        extractor: new MicrosoftPublicApiExtractor(),
+        fingerprint: new NodeChangeFingerprint(),
+        repository: new FilesystemPublicApiRepository()
+    });
+}
+export async function promotePublicApiRelease(input) {
+    const policy = await loadCapabilityConfig(input.consumerRoot, input.configPath, input.signal);
+    return promotePublicApiBaselines({
+        consumerRoot: input.consumerRoot,
+        policy,
+        ...(input.signal === undefined ? {} : { signal: input.signal })
+    }, createDependencies());
+}
+export function createPublicApiCompatibilityCapability() {
+    const dependencies = createDependencies();
+    return Object.freeze({
+        id: CAPABILITY_ID,
+        configSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+        async run(invocation) {
+            try {
+                const policy = await loadCapabilityConfig(invocation.consumerRoot, invocation.configPath, invocation.signal);
+                return capabilityReport({
+                    capabilityId: CAPABILITY_ID,
+                    capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                    diagnostics: await analyzePublicApiCompatibility({
+                        consumerRoot: invocation.consumerRoot,
+                        policy,
+                        ...(invocation.signal === undefined ? {} : { signal: invocation.signal })
+                    }, dependencies)
+                });
+            }
+            catch (error) {
+                if (error instanceof CapabilityInputError) {
+                    return capabilityReport({
+                        capabilityId: CAPABILITY_ID,
+                        capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                        outcome: error.problem.code === "EXECUTION_CANCELLED"
+                            ? "cancelled"
+                            : "invalid-input",
+                        problem: error.problem
+                    });
+                }
+                return capabilityReport({
+                    capabilityId: CAPABILITY_ID,
+                    capabilityConfigSchemaVersion: CAPABILITY_CONFIG_SCHEMA_VERSION,
+                    outcome: "failed",
+                    problem: {
+                        code: "CAPABILITY_EXECUTION_FAILED",
+                        message: "Public API compatibility capability execution failed.",
+                        phase: "public-api-compatibility-execution",
+                        retryable: false
+                    }
+                });
+            }
+        }
+    });
+}
+//# sourceMappingURL=module.js.map

package/dist/capabilities/public-api-compatibility/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../../../src/capabilities/public-api-compatibility/module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAGjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,qEAAqE,CAAC;AAClH,OAAO,EAAE,qBAAqB,EAAE,MAAM,uDAAuD,CAAC;AAC9F,OAAO,EAAE,6BAA6B,EAAE,MAAM,oEAAoE,CAAC;AACnH,OAAO,EAAE,oCAAoC,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,6BAA6B,EAAE,MAAM,6DAA6D,CAAC;AAC5G,OAAO,EAAE,yBAAyB,EAAE,MAAM,yDAAyD,CAAC;AACpG,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,oBAAoB,EACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oCAAoC,EAAE,CAAC;AAEhD,SAAS,kBAAkB;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,SAAS,EAAE,IAAI,2BAA2B,EAAE;QAC5C,WAAW,EAAE,IAAI,qBAAqB,EAAE;QACxC,UAAU,EAAE,IAAI,6BAA6B,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,MAAM,CACb,CAAC;IACF,OAAO,yBAAyB,CAC9B;QACE,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAChE,EACD,kBAAkB,EAAE,CACrB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC;IACpD,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,aAAa;QACjB,mBAAmB,EAAE,gCAAgC;QACrD,KAAK,CAAC,GAAG,CAAC,UAAgC;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,UAAU,CAAC,YAAY,EACvB,UAAU,CAAC,UAAU,EACrB,UAAU,CAAC,MAAM,CAClB,CAAC;gBACF,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,WAAW,EAAE,MAAM,6BAA6B,CAC9C;wBACE,YAAY,EAAE,UAAU,CAAC,YAAY;wBACrC,MAAM;wBACN,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;qBAC1E,EACD,YAAY,CACb;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;oBAC1C,OAAO,gBAAgB,CAAC;wBACtB,YAAY,EAAE,aAAa;wBAC3B,6BAA6B,EAAE,gCAAgC;wBAC/D,OAAO,EACL,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,qBAAqB;4BAC1C,CAAC,CAAC,WAAW;4BACb,CAAC,CAAC,eAAe;wBACrB,OAAO,EAAE,KAAK,CAAC,OAAO;qBACvB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,gBAAgB,CAAC;oBACtB,YAAY,EAAE,aAAa;oBAC3B,6BAA6B,EAAE,gCAAgC;oBAC/D,OAAO,EAAE,QAAQ;oBACjB,OAAO,EAAE;wBACP,IAAI,EAAE,6BAA6B;wBACnC,OAAO,EAAE,uDAAuD;wBAChE,KAAK,EAAE,oCAAoC;wBAC3C,SAAS,EAAE,KAAK;qBACjB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.d.ts

@@ -0,0 +1,6 @@
+import type { RepositorySecurityEvidence, RepositorySecurityPolicy } from "../../../application/model/repository-security.js";
+import type { RepositorySecurityReader } from "../../../application/ports/repository-security-reader.js";
+export declare class FilesystemRepositorySecurityReader implements RepositorySecurityReader {
+    read(consumerRoot: string, policy: RepositorySecurityPolicy, signal?: AbortSignal): Promise<RepositorySecurityEvidence>;
+}
+//# sourceMappingURL=filesystem-repository-security-reader.d.ts.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-repository-security-reader.d.ts","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,0BAA0B,EAC1B,wBAAwB,EAKzB,MAAM,mDAAmD,CAAC;AAC3D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AA4PzG,qBAAa,kCAAmC,YAAW,wBAAwB;IAC3E,IAAI,CACR,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAoBrC;CACF"}

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.js

@@ -0,0 +1,200 @@
+import { opendir, readFile, realpath, stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { CapabilityInputError } from "../../../../../capability-runtime.js";
+import { pathTraversesSymbolicLink } from "../../../../../filesystem-path-safety.js";
+import { assertNotCancelled, parseStrictYamlSource } from "../../../../../strict-yaml.js";
+const MAX_FILE_BYTES = 4 * 1024 * 1024;
+function inputError(code, message) {
+    throw new CapabilityInputError({
+        code,
+        message,
+        phase: "repository-security-evidence",
+        retryable: false
+    });
+}
+function record(value, field) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        inputError("REPOSITORY_SECURITY_EVIDENCE_INVALID", `${field} must be an object.`);
+    }
+    return value;
+}
+function contained(parent, candidate) {
+    const relation = relative(parent, candidate);
+    return relation === "" || (!isAbsolute(relation) && relation !== ".." && !relation.startsWith(`..${sep}`));
+}
+async function safePath(root, repositoryPath, kind) {
+    const candidate = resolve(root, repositoryPath);
+    if (await pathTraversesSymbolicLink(root, candidate)) {
+        inputError("REPOSITORY_SECURITY_SYMLINK_PROHIBITED", `Security evidence cannot traverse a symbolic link: ${repositoryPath}.`);
+    }
+    const canonical = await realpath(candidate).catch(() => inputError("REPOSITORY_SECURITY_EVIDENCE_UNAVAILABLE", `Security evidence is unavailable: ${repositoryPath}.`));
+    if (!contained(root, canonical)) {
+        inputError("REPOSITORY_SECURITY_EVIDENCE_ESCAPE", `Security evidence escapes the repository: ${repositoryPath}.`);
+    }
+    const metadata = await stat(canonical);
+    if ((kind === "directory" && !metadata.isDirectory()) ||
+        (kind === "file" && (!metadata.isFile() || metadata.size > MAX_FILE_BYTES))) {
+        inputError("REPOSITORY_SECURITY_EVIDENCE_INVALID", `Security evidence is not a valid ${kind}: ${repositoryPath}.`);
+    }
+    return canonical;
+}
+function permissions(value, field) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (value === "read-all" || value === "write-all") {
+        return value;
+    }
+    const input = record(value, field);
+    const result = {};
+    for (const [name, permission] of Object.entries(input)) {
+        if (permission !== "none" && permission !== "read" && permission !== "write") {
+            inputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field}.${name} must be none, read, or write.`);
+        }
+        result[name] = permission;
+    }
+    return Object.freeze(result);
+}
+function triggers(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value)) {
+        if (!value.every((entry) => typeof entry === "string")) {
+            inputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", "Workflow triggers must be strings.");
+        }
+        return Object.freeze(value.toSorted());
+    }
+    return Object.freeze(Object.keys(record(value, "workflow.on")).toSorted());
+}
+function unconditionalTriggers(value) {
+    if (typeof value === "string") {
+        return [value];
+    }
+    if (Array.isArray(value)) {
+        return Object.freeze(value.filter((entry) => typeof entry === "string").toSorted());
+    }
+    const input = record(value, "workflow.on");
+    return Object.freeze(Object.entries(input)
+        .filter(([, configuration]) => {
+        if (configuration === null) {
+            return true;
+        }
+        return (typeof configuration === "object" &&
+            !Array.isArray(configuration) &&
+            Object.keys(configuration).length === 0);
+    })
+        .map(([trigger]) => trigger)
+        .toSorted());
+}
+function steps(value, field) {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        inputError("REPOSITORY_SECURITY_WORKFLOW_INVALID", `${field} must be an array.`);
+    }
+    return Object.freeze(value.map((entry, index) => {
+        const step = record(entry, `${field}[${index}]`);
+        const stepInputs = step["with"];
+        return Object.freeze({
+            conditional: step["if"] !== undefined,
+            nonBlocking: step["continue-on-error"] !== undefined &&
+                step["continue-on-error"] !== false,
+            inputs: Object.freeze(stepInputs === undefined
+                ? {}
+                : record(stepInputs, `${field}[${index}].with`)),
+            ...(typeof step["uses"] === "string" ? { uses: step["uses"] } : {}),
+            ...(typeof step["run"] === "string" ? { run: step["run"] } : {})
+        });
+    }));
+}
+function workflow(path, source) {
+    const input = record(parseStrictYamlSource(source, `workflow:${path}`), `workflow ${path}`);
+    const jobsInput = record(input["jobs"], `workflow ${path}.jobs`);
+    const jobs = Object.entries(jobsInput).map(([id, value]) => {
+        const job = record(value, `workflow ${path}.jobs.${id}`);
+        const jobPermissions = permissions(job["permissions"], `workflow ${path}.jobs.${id}.permissions`);
+        return Object.freeze({
+            conditional: job["if"] !== undefined,
+            nonBlocking: job["continue-on-error"] !== undefined &&
+                job["continue-on-error"] !== false,
+            id,
+            ...(typeof job["uses"] === "string" ? { uses: job["uses"] } : {}),
+            ...(jobPermissions === undefined ? {} : { permissions: jobPermissions }),
+            steps: steps(job["steps"], `workflow ${path}.jobs.${id}.steps`)
+        });
+    });
+    const workflowPermissions = permissions(input["permissions"], `workflow ${path}.permissions`);
+    return Object.freeze({
+        path,
+        triggers: triggers(input["on"]),
+        unconditionalTriggers: unconditionalTriggers(input["on"]),
+        ...(workflowPermissions === undefined ? {} : { permissions: workflowPermissions }),
+        jobs: Object.freeze(jobs.toSorted((left, right) => left.id.localeCompare(right.id)))
+    });
+}
+async function readWorkflowDirectory(root, policy, signal) {
+    const directory = await safePath(root, policy.workflowDirectory, "directory");
+    const names = [];
+    const handle = await opendir(directory);
+    for await (const entry of handle) {
+        assertNotCancelled(signal);
+        if (entry.isSymbolicLink() || !entry.isFile() || !/\.ya?ml$/iu.test(entry.name)) {
+            inputError("REPOSITORY_SECURITY_WORKFLOW_ENTRY_INVALID", `Workflow directory contains an unsupported entry: ${entry.name}.`);
+        }
+        names.push(entry.name);
+    }
+    const evidence = [];
+    for (const name of names.toSorted()) {
+        const repositoryPath = `${policy.workflowDirectory}/${name}`;
+        const file = await safePath(root, repositoryPath, "file");
+        evidence.push(workflow(repositoryPath, await readFile(file, "utf8")));
+    }
+    return Object.freeze(evidence);
+}
+async function readPackage(root, manifestPath) {
+    const file = await safePath(root, manifestPath, "file");
+    let input;
+    try {
+        input = JSON.parse(await readFile(file, "utf8"));
+    }
+    catch {
+        inputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Package manifest is not valid JSON: ${manifestPath}.`);
+    }
+    const manifest = record(input, `package manifest ${manifestPath}`);
+    if (typeof manifest["name"] !== "string") {
+        inputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Publishable package name is invalid: ${manifestPath}.`);
+    }
+    const files = manifest["files"];
+    if (files !== undefined && (!Array.isArray(files) || !files.every((entry) => typeof entry === "string"))) {
+        inputError("REPOSITORY_SECURITY_PACKAGE_INVALID", `Publishable package files must be strings: ${manifestPath}.`);
+    }
+    const publishConfig = manifest["publishConfig"];
+    return Object.freeze({
+        manifestPath,
+        packageName: manifest["name"],
+        ...(files === undefined ? {} : { files: Object.freeze(files) }),
+        provenance: typeof publishConfig === "object" &&
+            publishConfig !== null &&
+            !Array.isArray(publishConfig) &&
+            publishConfig["provenance"] === true
+    });
+}
+export class FilesystemRepositorySecurityReader {
+    async read(consumerRoot, policy, signal) {
+        assertNotCancelled(signal);
+        const root = await realpath(consumerRoot).catch(() => inputError("CONSUMER_ROOT_UNAVAILABLE", "Consumer root must be an accessible directory."));
+        const [workflows, packages] = await Promise.all([
+            readWorkflowDirectory(root, policy, signal),
+            Promise.all(policy.publishablePackageManifests.map((manifestPath) => readPackage(root, manifestPath)))
+        ]);
+        for (const requiredWorkflow of [policy.dependencyReviewWorkflow, policy.sbomWorkflow]) {
+            if (!workflows.some(({ path }) => path === requiredWorkflow)) {
+                inputError("REPOSITORY_SECURITY_REQUIRED_WORKFLOW_UNAVAILABLE", `Required security workflow is not discovered: ${requiredWorkflow}.`);
+            }
+        }
+        return Object.freeze({ workflows, packages: Object.freeze(packages) });
+    }
+}
+//# sourceMappingURL=filesystem-repository-security-reader.js.map

package/dist/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-repository-security-reader.js","sourceRoot":"","sources":["../../../../../../src/capabilities/repository-security-baseline/adapters/outbound/filesystem/filesystem-repository-security-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAY1F,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,SAAS,UAAU,CAAC,IAAY,EAAE,OAAe;IAC/C,MAAM,IAAI,oBAAoB,CAAC;QAC7B,IAAI;QACJ,OAAO;QACP,KAAK,EAAE,8BAA8B;QACrC,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAc,EAAE,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,UAAU,CAAC,sCAAsC,EAAE,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,MAAc,EAAE,SAAiB;IAClD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,cAAsB,EACtB,IAA0B;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,MAAM,yBAAyB,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACrD,UAAU,CACR,wCAAwC,EACxC,sDAAsD,cAAc,GAAG,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CACrD,UAAU,CACR,0CAA0C,EAC1C,qCAAqC,cAAc,GAAG,CACvD,CACF,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAChC,UAAU,CACR,qCAAqC,EACrC,6CAA6C,cAAc,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,IACE,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjD,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,EAC3E,CAAC;QACD,UAAU,CACR,sCAAsC,EACtC,oCAAoC,IAAI,KAAK,cAAc,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAuC,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC7E,UAAU,CACR,sCAAsC,EACtC,GAAG,KAAK,IAAI,IAAI,gCAAgC,CACjD,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,sCAAsC,EAAE,oCAAoC,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,EAAE;QAC5B,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CACL,OAAO,aAAa,KAAK,QAAQ;YACjC,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,CAAC,CACxC,CAAC;IACJ,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC;SAC3B,QAAQ,EAAE,CACd,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,KAAa;IAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,UAAU,CAAC,sCAAsC,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS;YACrC,WAAW,EACT,IAAI,CAAC,mBAAmB,CAAC,KAAK,SAAS;gBACvC,IAAI,CAAC,mBAAmB,CAAC,KAAK,KAAK;YACrC,MAAM,EAAE,MAAM,CAAC,MAAM,CACnB,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,IAAI,KAAK,QAAQ,CAAC,CAClD;YACD,GAAG,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,YAAY,IAAI,OAAO,CAAC,CAAC;IACjE,MAAM,IAAI,GAA0B,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,WAAW,CAChC,GAAG,CAAC,aAAa,CAAC,EAClB,YAAY,IAAI,SAAS,EAAE,cAAc,CAC1C,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YACpC,WAAW,EACT,GAAG,CAAC,mBAAmB,CAAC,KAAK,SAAS;gBACtC,GAAG,CAAC,mBAAmB,CAAC,KAAK,KAAK;YACpC,EAAE;YACF,GAAG,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;YACxE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,YAAY,IAAI,SAAS,EAAE,QAAQ,CAAC;SAChE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,YAAY,IAAI,cAAc,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,qBAAqB,EAAE,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;QAClF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;KACrF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,MAAgC,EAChC,MAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAChF,UAAU,CACR,4CAA4C,EAC5C,qDAAqD,KAAK,CAAC,IAAI,GAAG,CACnE,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;QACpC,MAAM,cAAc,GAAG,GAAG,MAAM,CAAC,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAY,EACZ,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,CACR,qCAAqC,EACrC,uCAAuC,YAAY,GAAG,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,oBAAoB,YAAY,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzC,UAAU,CACR,qCAAqC,EACrC,wCAAwC,YAAY,GAAG,CACxD,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzG,UAAU,CACR,qCAAqC,EACrC,8CAA8C,YAAY,GAAG,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,YAAY;QACZ,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC;QAC7B,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,UAAU,EACR,OAAO,aAAa,KAAK,QAAQ;YACjC,aAAa,KAAK,IAAI;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;YAC5B,aAAyC,CAAC,YAAY,CAAC,KAAK,IAAI;KACpE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,kCAAkC;IAC7C,KAAK,CAAC,IAAI,CACR,YAAoB,EACpB,MAAgC,EAChC,MAAoB;QAEpB,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CACnD,UAAU,CAAC,2BAA2B,EAAE,gDAAgD,CAAC,CAC1F,CAAC;QACF,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9C,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;YAC3C,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAC1F;SACF,CAAC,CAAC;QACH,KAAK,MAAM,gBAAgB,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACtF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;gBAC7D,UAAU,CACR,mDAAmD,EACnD,iDAAiD,gBAAgB,GAAG,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;CACF"}

package/dist/capabilities/repository-security-baseline/application/model/repository-security.d.ts

@@ -0,0 +1,46 @@
+export type WorkflowPermission = "none" | "read" | "write";
+export interface WorkflowStepEvidence {
+    readonly conditional: boolean;
+    readonly nonBlocking: boolean;
+    readonly inputs: Readonly<Record<string, unknown>>;
+    readonly uses?: string;
+    readonly run?: string;
+}
+export interface WorkflowJobEvidence {
+    readonly conditional: boolean;
+    readonly nonBlocking: boolean;
+    readonly id: string;
+    readonly uses?: string;
+    readonly permissions?: Readonly<Record<string, WorkflowPermission>> | "read-all" | "write-all";
+    readonly steps: readonly WorkflowStepEvidence[];
+}
+export interface WorkflowEvidence {
+    readonly path: string;
+    readonly triggers: readonly string[];
+    readonly unconditionalTriggers: readonly string[];
+    readonly permissions?: Readonly<Record<string, WorkflowPermission>> | "read-all" | "write-all";
+    readonly jobs: readonly WorkflowJobEvidence[];
+}
+export interface PublishablePackageEvidence {
+    readonly manifestPath: string;
+    readonly packageName: string;
+    readonly files?: readonly string[];
+    readonly provenance: boolean;
+}
+export interface RepositorySecurityEvidence {
+    readonly workflows: readonly WorkflowEvidence[];
+    readonly packages: readonly PublishablePackageEvidence[];
+}
+export interface PrivilegedJobPolicy {
+    readonly workflowPath: string;
+    readonly jobId: string;
+    readonly permissions: Readonly<Record<string, WorkflowPermission>>;
+}
+export interface RepositorySecurityPolicy {
+    readonly workflowDirectory: string;
+    readonly dependencyReviewWorkflow: string;
+    readonly sbomWorkflow: string;
+    readonly privilegedJobs: readonly PrivilegedJobPolicy[];
+    readonly publishablePackageManifests: readonly string[];
+}
+//# sourceMappingURL=repository-security.d.ts.map

package/dist/capabilities/repository-security-baseline/application/model/repository-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/model/repository-security.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;IAC/F,QAAQ,CAAC,KAAK,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACjD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;IAC/F,QAAQ,CAAC,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD,QAAQ,CAAC,2BAA2B,EAAE,SAAS,MAAM,EAAE,CAAC;CACzD"}

package/dist/capabilities/repository-security-baseline/application/model/repository-security.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=repository-security.js.map

package/dist/capabilities/repository-security-baseline/application/model/repository-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/model/repository-security.ts"],"names":[],"mappings":""}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.d.ts

@@ -0,0 +1,4 @@
+import type { FoundationDiagnostic } from "../../../../check-contract.js";
+import type { RepositorySecurityEvidence, RepositorySecurityPolicy } from "../model/repository-security.js";
+export declare function evaluateRepositorySecurity(policy: RepositorySecurityPolicy, evidence: RepositorySecurityEvidence): readonly FoundationDiagnostic[];
+//# sourceMappingURL=evaluate-repository-security.d.ts.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-security.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAEV,0BAA0B,EAC1B,wBAAwB,EAGzB,MAAM,iCAAiC,CAAC;AA0HzC,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,wBAAwB,EAChC,QAAQ,EAAE,0BAA0B,GACnC,SAAS,oBAAoB,EAAE,CAuLjC"}

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.js

@@ -0,0 +1,218 @@
+import { REPOSITORY_SECURITY_RULES } from "../rules.js";
+const FULL_SHA_ACTION = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_./-]+)?@[0-9a-fA-F]{40}$/u;
+const FULL_DIGEST_CONTAINER = /^docker:\/\/.+@sha256:[0-9a-fA-F]{64}$/u;
+const UNSAFE_PACKAGE_SEGMENT = /^(?:\.env(?:\..*)?|\.git|node_modules|src|tests?|auth\.json)$/iu;
+const PACKAGE_PATH_META = /[*?{}[\]\\]/u;
+const UNTRUSTED_EXPRESSION_IN_RUN = /\$\{\{[^}]*github\s*(?:\.\s*(?:event|head_ref)\b|\[\s*["'](?:event|head_ref)["']\s*\])/iu;
+function diagnostic(input) {
+    return {
+        ruleId: input.rule.id,
+        severity: input.rule.severity,
+        subject: input.subject,
+        message: input.message,
+        location: { path: input.path },
+        relatedLocations: [],
+        evidence: input.evidence ?? [],
+        remediation: input.rule.remediation,
+        requiresArchitectureReview: input.rule.requiresArchitectureReview
+    };
+}
+function exactPermissions(actual, expected) {
+    const actualEntries = Object.entries(actual).toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+    const expectedEntries = Object.entries(expected).toSorted(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+    return JSON.stringify(actualEntries) === JSON.stringify(expectedEntries);
+}
+function policyForJob(policy, workflowPath, jobId) {
+    return policy.privilegedJobs.find((candidate) => candidate.workflowPath === workflowPath && candidate.jobId === jobId);
+}
+function actionPinned(action) {
+    if (action.startsWith("./")) {
+        return !action.split("/").includes("..") && !action.includes("${{");
+    }
+    return FULL_SHA_ACTION.test(action) || FULL_DIGEST_CONTAINER.test(action);
+}
+function jobPermissions(job, workflowPermissions) {
+    return job.permissions ?? workflowPermissions;
+}
+function inputIsEnabledOrAbsent(step, name) {
+    const value = step.inputs[name];
+    return (value === undefined ||
+        value === true ||
+        (typeof value === "string" && value.toLowerCase() === "true"));
+}
+function inputIsDisabledOrAbsent(step, name) {
+    const value = step.inputs[name];
+    return (value === undefined ||
+        value === false ||
+        (typeof value === "string" && value.toLowerCase() === "false"));
+}
+function scansRepositoryRoot(step) {
+    const path = step.inputs["path"];
+    return ((path === undefined || path === "." || path === "./") &&
+        step.inputs["file"] === undefined &&
+        step.inputs["image"] === undefined);
+}
+function unsafePackagePath(entry) {
+    if (entry.length === 0 ||
+        entry.startsWith("/") ||
+        entry.includes("//") ||
+        PACKAGE_PATH_META.test(entry)) {
+        return true;
+    }
+    const segments = entry.split("/");
+    return segments.some((segment) => segment.length === 0 ||
+        segment === "." ||
+        segment === ".." ||
+        UNSAFE_PACKAGE_SEGMENT.test(segment));
+}
+export function evaluateRepositorySecurity(policy, evidence) {
+    const diagnostics = [];
+    const seenPrivilegedJobs = new Set();
+    let dependencyReviewFound = false;
+    let sbomFound = false;
+    for (const workflow of evidence.workflows) {
+        if (workflow.permissions === undefined ||
+            typeof workflow.permissions === "string" ||
+            Object.values(workflow.permissions).some((value) => value === "write")) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.permissionsInvalid,
+                subject: workflow.path,
+                path: workflow.path,
+                message: "Workflow root permissions are missing, broad, or write-capable."
+            }));
+        }
+        if (workflow.triggers.includes("pull_request_target")) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.dangerousTrigger,
+                subject: workflow.path,
+                path: workflow.path,
+                message: "Workflow uses prohibited pull_request_target."
+            }));
+        }
+        for (const job of workflow.jobs) {
+            const permissionSet = jobPermissions(job, workflow.permissions);
+            const privileged = policyForJob(policy, workflow.path, job.id);
+            if (privileged !== undefined) {
+                seenPrivilegedJobs.add(`${workflow.path}:${job.id}`);
+            }
+            const hasWrite = permissionSet === "write-all" ||
+                (typeof permissionSet === "object" &&
+                    Object.values(permissionSet).some((value) => value === "write"));
+            const privilegeMismatch = privileged === undefined
+                ? hasWrite
+                : typeof permissionSet !== "object" ||
+                    !exactPermissions(permissionSet, privileged.permissions);
+            if (privilegeMismatch) {
+                diagnostics.push(diagnostic({
+                    rule: REPOSITORY_SECURITY_RULES.privilegedJobMismatch,
+                    subject: `${workflow.path}:${job.id}`,
+                    path: workflow.path,
+                    message: "Job permissions do not match one exact privileged-job declaration."
+                }));
+            }
+            if (job.uses !== undefined && !actionPinned(job.uses)) {
+                diagnostics.push(diagnostic({
+                    rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
+                    subject: `${workflow.path}:${job.id}`,
+                    path: workflow.path,
+                    message: `Reusable workflow is not pinned to immutable evidence: ${job.uses}.`,
+                    evidence: [{ kind: "action", value: job.uses }]
+                }));
+            }
+            for (const step of job.steps) {
+                if (step.uses !== undefined && !actionPinned(step.uses)) {
+                    diagnostics.push(diagnostic({
+                        rule: REPOSITORY_SECURITY_RULES.actionNotPinned,
+                        subject: `${workflow.path}:${job.id}`,
+                        path: workflow.path,
+                        message: `Action is not pinned to immutable evidence: ${step.uses}.`,
+                        evidence: [{ kind: "action", value: step.uses }]
+                    }));
+                }
+                if (step.run !== undefined && UNTRUSTED_EXPRESSION_IN_RUN.test(step.run)) {
+                    diagnostics.push(diagnostic({
+                        rule: REPOSITORY_SECURITY_RULES.eventInterpolationInRun,
+                        subject: `${workflow.path}:${job.id}`,
+                        path: workflow.path,
+                        message: "Shell script directly interpolates github.event data."
+                    }));
+                }
+                if (workflow.path === policy.dependencyReviewWorkflow &&
+                    workflow.unconditionalTriggers.includes("pull_request") &&
+                    !job.conditional &&
+                    !job.nonBlocking &&
+                    !step.conditional &&
+                    !step.nonBlocking &&
+                    inputIsDisabledOrAbsent(step, "warn-only") &&
+                    step.inputs["config-file"] === undefined &&
+                    step.uses?.startsWith("actions/dependency-review-action@") === true &&
+                    actionPinned(step.uses)) {
+                    dependencyReviewFound = true;
+                }
+                if (workflow.path === policy.sbomWorkflow &&
+                    workflow.unconditionalTriggers.includes("pull_request") &&
+                    !job.conditional &&
+                    !job.nonBlocking &&
+                    !step.conditional &&
+                    !step.nonBlocking &&
+                    inputIsEnabledOrAbsent(step, "upload-artifact") &&
+                    scansRepositoryRoot(step) &&
+                    step.uses?.startsWith("anchore/sbom-action@") === true &&
+                    actionPinned(step.uses)) {
+                    sbomFound = true;
+                }
+            }
+        }
+    }
+    if (!dependencyReviewFound) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.dependencyReviewMissing,
+            subject: policy.dependencyReviewWorkflow,
+            path: policy.dependencyReviewWorkflow,
+            message: "Declared dependency-review workflow does not run the pinned official action."
+        }));
+    }
+    if (!sbomFound) {
+        diagnostics.push(diagnostic({
+            rule: REPOSITORY_SECURITY_RULES.sbomMissing,
+            subject: policy.sbomWorkflow,
+            path: policy.sbomWorkflow,
+            message: "Declared SBOM workflow does not run the pinned Anchore action."
+        }));
+    }
+    for (const privileged of policy.privilegedJobs) {
+        const key = `${privileged.workflowPath}:${privileged.jobId}`;
+        if (!seenPrivilegedJobs.has(key)) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.stalePrivilegedJob,
+                subject: key,
+                path: privileged.workflowPath,
+                message: "Privileged-job declaration has no matching workflow job."
+            }));
+        }
+    }
+    for (const packageEvidence of evidence.packages) {
+        if (!packageEvidence.provenance) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.packageProvenanceMissing,
+                subject: packageEvidence.packageName,
+                path: packageEvidence.manifestPath,
+                message: "Publishable package does not enable npm provenance."
+            }));
+        }
+        const unsafeFiles = packageEvidence.files?.filter(unsafePackagePath);
+        if (packageEvidence.files === undefined ||
+            packageEvidence.files.length === 0 ||
+            (unsafeFiles !== undefined && unsafeFiles.length > 0)) {
+            diagnostics.push(diagnostic({
+                rule: REPOSITORY_SECURITY_RULES.packageFilesUnsafe,
+                subject: packageEvidence.packageName,
+                path: packageEvidence.manifestPath,
+                message: "Publishable package files allowlist is missing or unsafe.",
+                evidence: (unsafeFiles ?? []).map((value) => ({ kind: "unsafe-path", value }))
+            }));
+        }
+    }
+    return diagnostics;
+}
+//# sourceMappingURL=evaluate-repository-security.js.map

package/dist/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate-repository-security.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/policies/evaluate-repository-security.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AAErB,MAAM,eAAe,GAAG,4EAA4E,CAAC;AACrG,MAAM,qBAAqB,GAAG,yCAAyC,CAAC;AACxE,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,2BAA2B,GAC/B,0FAA0F,CAAC;AAE7F,SAAS,UAAU,CAAC,KAMnB;IACC,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,gBAAgB,EAAE,EAAE;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;QACnC,0BAA0B,EAAE,KAAK,CAAC,IAAI,CAAC,0BAA0B;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAoD,EACpD,QAAsD;IAEtD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CACxE,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC5E,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,YAAY,CACnB,MAAgC,EAChC,YAAoB,EACpB,KAAa;IAEb,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,KAAK,KAAK,KAAK,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,cAAc,CACrB,GAAwB,EACxB,mBAAmF;IAEnF,OAAO,GAAG,CAAC,WAAW,IAAI,mBAAmB,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,IAAI;QACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAA0C,EAC1C,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,KAAK;QACf,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAA0C;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CACL,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS;QACjC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,CACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,QAAoC;IAEpC,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,IAAI,qBAAqB,GAAG,KAAK,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IACE,QAAQ,CAAC,WAAW,KAAK,SAAS;YAClC,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;YACxC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,EACtE,CAAC;YACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,QAAQ,CAAC,IAAI;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,iEAAiE;aAC3E,CAAC,CACH,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACtD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,gBAAgB;gBAChD,OAAO,EAAE,QAAQ,CAAC,IAAI;gBACtB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,OAAO,EAAE,+CAA+C;aACzD,CAAC,CACH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,kBAAkB,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACvD,CAAC;YACD,MAAM,QAAQ,GACZ,aAAa,KAAK,WAAW;gBAC7B,CAAC,OAAO,aAAa,KAAK,QAAQ;oBAChC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC;YACrE,MAAM,iBAAiB,GACrB,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,OAAO,aAAa,KAAK,QAAQ;oBACjC,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;YAC/D,IAAI,iBAAiB,EAAE,CAAC;gBACtB,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;oBACT,IAAI,EAAE,yBAAyB,CAAC,qBAAqB;oBACrD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;oBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,oEAAoE;iBAC9E,CAAC,CACH,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;oBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;oBAC/C,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;oBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,0DAA0D,GAAG,CAAC,IAAI,GAAG;oBAC9E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;iBAChD,CAAC,CACH,CAAC;YACJ,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;wBACT,IAAI,EAAE,yBAAyB,CAAC,eAAe;wBAC/C,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;wBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,OAAO,EAAE,+CAA+C,IAAI,CAAC,IAAI,GAAG;wBACpE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;qBACjD,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzE,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;wBACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;wBACvD,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE;wBACrC,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,OAAO,EAAE,uDAAuD;qBACjE,CAAC,CACH,CAAC;gBACJ,CAAC;gBACD,IACE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,wBAAwB;oBACjD,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACvD,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,IAAI,CAAC,WAAW;oBACjB,CAAC,IAAI,CAAC,WAAW;oBACjB,uBAAuB,CAAC,IAAI,EAAE,WAAW,CAAC;oBAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,SAAS;oBACxC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,mCAAmC,CAAC,KAAK,IAAI;oBACnE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,CAAC;oBACD,qBAAqB,GAAG,IAAI,CAAC;gBAC/B,CAAC;gBACD,IACE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,YAAY;oBACrC,QAAQ,CAAC,qBAAqB,CAAC,QAAQ,CAAC,cAAc,CAAC;oBACvD,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,GAAG,CAAC,WAAW;oBAChB,CAAC,IAAI,CAAC,WAAW;oBACjB,CAAC,IAAI,CAAC,WAAW;oBACjB,sBAAsB,CAAC,IAAI,EAAE,iBAAiB,CAAC;oBAC/C,mBAAmB,CAAC,IAAI,CAAC;oBACzB,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,sBAAsB,CAAC,KAAK,IAAI;oBACtD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvB,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,uBAAuB;YACvD,OAAO,EAAE,MAAM,CAAC,wBAAwB;YACxC,IAAI,EAAE,MAAM,CAAC,wBAAwB;YACrC,OAAO,EAAE,8EAA8E;SACxF,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;YACT,IAAI,EAAE,yBAAyB,CAAC,WAAW;YAC3C,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,IAAI,EAAE,MAAM,CAAC,YAAY;YACzB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,UAAU,CAAC,YAAY;gBAC7B,OAAO,EAAE,0DAA0D;aACpE,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,eAAe,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;YAChC,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,wBAAwB;gBACxD,OAAO,EAAE,eAAe,CAAC,WAAW;gBACpC,IAAI,EAAE,eAAe,CAAC,YAAY;gBAClC,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrE,IACE,eAAe,CAAC,KAAK,KAAK,SAAS;YACnC,eAAe,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAClC,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,EACrD,CAAC;YACD,WAAW,CAAC,IAAI,CACd,UAAU,CAAC;gBACT,IAAI,EAAE,yBAAyB,CAAC,kBAAkB;gBAClD,OAAO,EAAE,eAAe,CAAC,WAAW;gBACpC,IAAI,EAAE,eAAe,CAAC,YAAY;gBAClC,OAAO,EAAE,2DAA2D;gBACpE,QAAQ,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;aAC/E,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/capabilities/repository-security-baseline/application/ports/repository-security-reader.d.ts

@@ -0,0 +1,5 @@
+import type { RepositorySecurityEvidence, RepositorySecurityPolicy } from "../model/repository-security.js";
+export interface RepositorySecurityReader {
+    read(consumerRoot: string, policy: RepositorySecurityPolicy, signal?: AbortSignal): Promise<RepositorySecurityEvidence>;
+}
+//# sourceMappingURL=repository-security-reader.d.ts.map

package/dist/capabilities/repository-security-baseline/application/ports/repository-security-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-reader.d.ts","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/ports/repository-security-reader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,wBAAwB,EACzB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,WAAW,wBAAwB;IACvC,IAAI,CACF,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,wBAAwB,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC"}

package/dist/capabilities/repository-security-baseline/application/ports/repository-security-reader.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=repository-security-reader.js.map

package/dist/capabilities/repository-security-baseline/application/ports/repository-security-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-security-reader.js","sourceRoot":"","sources":["../../../../../src/capabilities/repository-security-baseline/application/ports/repository-security-reader.ts"],"names":[],"mappings":""}