@akasecurity/ai-tc-claude-code 0.9.7 → 0.9.8

package/scripts/scan-worker.js

@@ -16284,6 +16284,124 @@ var ConfigScanRecord = external_exports.object({
   findings: external_exports.array(ConfigPostureFindingInput).optional()
 });
 
+// ../../packages/schema/src/zod/control-plane.ts
+var ATTACHED_CREDENTIAL_SPEC_VERSION = 1;
+var AttachedCredential = external_exports.object({
+  specVersion: external_exports.literal(ATTACHED_CREDENTIAL_SPEC_VERSION),
+  // The control-plane endpoint this credential was minted against.
+  endpoint: external_exports.string().min(1),
+  // The bearer credential itself. Never logged, never rendered — status
+  // surfaces show `keyPrefix` and nothing else.
+  apiKey: external_exports.string().min(1),
+  // First few characters of the key, safe to display so a user can match the
+  // credential against their organization's key list.
+  keyPrefix: external_exports.string().min(1).max(16).optional(),
+  mintedAt: external_exports.iso.datetime().optional()
+});
+var MAX_DATE_MS = 253402300799999;
+var MAX_INT4 = 2147483647;
+var StorePosturePack = external_exports.object({
+  packId: external_exports.string().min(1),
+  // 'namespace/packId'
+  version: external_exports.string().min(1),
+  enabled: external_exports.boolean(),
+  // Stringified pass-through of the local store's `installed_packs.updated_at`
+  // — the column format is store-version-dependent (epoch millis vs ISO), so
+  // the wire shape assumes neither.
+  updatedAt: external_exports.string().nullable()
+}).meta({ id: "StorePosturePack" });
+var StorePosturePolicyCounts = external_exports.object({
+  total: external_exports.number().int().min(0),
+  disabled: external_exports.number().int().min(0),
+  // Exhaustive per-action map; the builder pre-fills every action with 0.
+  //
+  // Spelled out member-by-member rather than `z.record(ActionTaken, …)`. Zod
+  // enforces exhaustiveness either way, but z.record emits `propertyNames` +
+  // `additionalProperties` into a generated schema document, and a type
+  // generator renders THAT with every key optional — a sender built against
+  // the generated type would typecheck and still be rejected at runtime. An
+  // explicit object emits `properties` + `required`, so generated types
+  // demand all five.
+  //
+  // `satisfies Record<ActionTaken, …>` keeps the link to the enum: adding an
+  // ActionTaken member is a COMPILE error here instead of silent drift.
+  // `.strict()` is load-bearing — it rejects an unknown action key, which a
+  // bare object would silently STRIP, accepting a miscounted map as valid.
+  byAction: external_exports.object({
+    warn: external_exports.number().int().min(0),
+    redact: external_exports.number().int().min(0),
+    block: external_exports.number().int().min(0),
+    allow: external_exports.number().int().min(0),
+    log: external_exports.number().int().min(0)
+  }).strict()
+}).meta({ id: "StorePosturePolicyCounts" });
+var StorePosturePlugin = external_exports.object({
+  /** Package name of the reporting plugin. */
+  package: external_exports.string().min(1).max(200),
+  version: external_exports.string().min(1).max(64),
+  /** Version of the bundled core, when the build records one separately. */
+  ossVersion: external_exports.string().max(64).nullable(),
+  /**
+   * `version` of the policy bundle this machine last fetched. Bounded at 200
+   * rather than the 64 a bare sha256 hex digest needs today, so a later
+   * format with an algorithm prefix does not start rejecting the channel.
+   */
+  policyBundleVersion: external_exports.string().max(200).nullable(),
+  /** Epoch millis, on the CLIENT clock, of that fetch. */
+  policyFetchedAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable()
+}).meta({ id: "StorePosturePlugin" });
+var StorePostureSnapshot = external_exports.object({
+  deviceId: external_exports.guid(),
+  hostname: external_exports.string().min(1).max(253),
+  // Epoch millis on the CLIENT clock. Bounded by what a receiving store
+  // accepts (see MAX_DATE_MS), not by what a JavaScript Date can hold.
+  capturedAt: external_exports.number().int().min(0).max(MAX_DATE_MS),
+  // False is a measurement, not an error state: "no local store exists on
+  // this machine".
+  storePresent: external_exports.boolean(),
+  schemaVersion: external_exports.number().int().min(0).max(MAX_INT4).nullable(),
+  // PRAGMA user_version
+  findingsTotal: external_exports.number().int().min(0).max(MAX_INT4),
+  // Epoch millis, bounded like `capturedAt` — see MAX_DATE_MS on what that
+  // bound does and does not do. Worth stating for these two specifically:
+  // they are read from the local store's own ROWS rather than from this
+  // machine's clock, so a damaged or hand-edited store is enough to produce
+  // an out-of-range value with no clock skew involved.
+  findingsFirstAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  findingsLastAt: external_exports.number().int().min(0).max(MAX_DATE_MS).nullable(),
+  packs: external_exports.array(StorePosturePack).max(500),
+  policyCounts: StorePosturePolicyCounts,
+  // OPTIONAL, not nullable: a reporter that predates this member keeps
+  // getting its 200 without a payload change.
+  plugin: StorePosturePlugin.optional()
+}).meta({ id: "StorePostureSnapshot" });
+var CAPTURE_VERSION_PREFIX = "capture/";
+var RecordAuditEventRequest = AuditEventInput.extend({
+  inspections: external_exports.array(ToolCallInspection).default([])
+}).refine((v) => v.inspections.every((i) => !i.ruleVersion.startsWith(CAPTURE_VERSION_PREFIX)), {
+  message: `inspections[].ruleVersion must not start with \`${CAPTURE_VERSION_PREFIX}\` \u2014 that namespace is reserved for capture definitions the control plane mints itself`,
+  path: ["inspections"]
+}).meta({ id: "RecordAuditEventRequest" });
+var IngestAck = external_exports.object({
+  accepted: external_exports.number().int().nonnegative(),
+  duplicates: external_exports.number().int().nonnegative()
+});
+var PRINTABLE = /^[^\p{Cc}\p{Cf}]*$/u;
+var printable = (max) => external_exports.string().max(max).regex(PRINTABLE, "must not contain control characters");
+var PluginWhoami = external_exports.object({
+  tenantName: printable(200),
+  userEmail: printable(320),
+  role: printable(64),
+  keyKind: printable(64),
+  serverTime: printable(64)
+});
+var ControlPlaneErrorBody = external_exports.object({
+  error: external_exports.object({
+    code: external_exports.string().optional(),
+    message: external_exports.string().optional()
+  }).optional()
+});
+
 // ../../packages/schema/src/zod/registry.ts
 var Namespace = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);
 var PackId = external_exports.string().regex(/^[a-z][a-z0-9-]*$/);