@avi770/testteam 3.0.0 → 3.2.0

package/dist/core/run-mode/types.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Run-mode & frame streaming — shared types (Phase 3.2 seam).
+ * The INTENDED single source of truth for headed-vs-headless browser launches and the frame-stream
+ * sink the Execution Bridge pushes to and the Cockpit consumes. Default is headless + a no-op sink,
+ * so existing runs are unchanged and cost nothing.
+ *
+ * Adoption status: every browser-launching engine agent now derives its launch options from
+ * `launchOptions(this.runMode)` (the headless literals are gone), and a headed RunMode threads
+ * end-to-end — `--headed` (CLI) → `registerAllAgents`/`reinstantiateAgent` → `BaseAgent.runMode`,
+ * and `bridge/playwright-pool.ts` for the Cockpit. Frames are streamed to the Cockpit via the
+ * `FrameSink` here → `core/run-events` `SseFrameSink` (an `event: frame` SSE channel).
+ * Spec: blueprint/agents/01-testteam-bot.md (visible/headed run -> the Cockpit), build-plan 3.2.
+ */
+export interface RunMode {
+    /** When true, launch a visible (headed) browser for the Cockpit screencast. */
+    readonly headed: boolean;
+    /** Optional slow-motion delay (ms) so a headed run is watchable. */
+    readonly slowMoMs?: number;
+}
+/** Playwright launch options derived from a RunMode. */
+export interface LaunchOptions {
+    readonly headless: boolean;
+    readonly slowMo?: number;
+}
+/** A single streamed screencast frame. */
+export interface Frame {
+    readonly seq: number;
+    readonly atMs: number;
+    readonly dataBase64: string;
+    readonly mime: string;
+}
+/** Where frames are pushed (Cockpit SSE consumer, recorder, etc.). */
+export interface FrameSink {
+    push(frame: Frame): void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/run-mode/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../core/run-mode/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,OAAO;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,sEAAsE;AACtE,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC1B"}

package/dist/core/run-mode/types.js

@@ -0,0 +1,15 @@
+/**
+ * Run-mode & frame streaming — shared types (Phase 3.2 seam).
+ * The INTENDED single source of truth for headed-vs-headless browser launches and the frame-stream
+ * sink the Execution Bridge pushes to and the Cockpit consumes. Default is headless + a no-op sink,
+ * so existing runs are unchanged and cost nothing.
+ *
+ * Adoption status: every browser-launching engine agent now derives its launch options from
+ * `launchOptions(this.runMode)` (the headless literals are gone), and a headed RunMode threads
+ * end-to-end — `--headed` (CLI) → `registerAllAgents`/`reinstantiateAgent` → `BaseAgent.runMode`,
+ * and `bridge/playwright-pool.ts` for the Cockpit. Frames are streamed to the Cockpit via the
+ * `FrameSink` here → `core/run-events` `SseFrameSink` (an `event: frame` SSE channel).
+ * Spec: blueprint/agents/01-testteam-bot.md (visible/headed run -> the Cockpit), build-plan 3.2.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/run-mode/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../core/run-mode/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/core/run-quota.d.ts

@@ -0,0 +1,22 @@
+import type { LicenseTier } from './license.js';
+export interface RunQuotaStatus {
+    /** True only when a valid license is present — otherwise enforcement is dormant. */
+    active: boolean;
+    /** True when the run may proceed (always true when dormant). */
+    allowed: boolean;
+    tier?: LicenseTier;
+    used?: number;
+    limit?: number;
+    remaining?: number;
+    /** True at ≥80% of the limit — surface an upgrade nudge. */
+    warning?: boolean;
+    /** Human-readable refusal reason, set only when `allowed` is false. */
+    message?: string;
+}
+/**
+ * Read-only quota check for the current billing period. Does NOT record the run —
+ * the caller records a run (via `recordRun`) only when `active` is true and the
+ * run is actually initiated.
+ */
+export declare function checkRunQuota(configDir: string): RunQuotaStatus;
+//# sourceMappingURL=run-quota.d.ts.map

package/dist/core/run-quota.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-quota.d.ts","sourceRoot":"","sources":["../../core/run-quota.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CA2B/D"}

package/dist/core/run-quota.js

@@ -0,0 +1,44 @@
+/**
+ * Monthly run-quota enforcement (B2 monetization).
+ *
+ * Composes the license (core/license.ts) with the run counter (core/run-counter.ts).
+ * The critical property is **dormancy**: enforcement is active ONLY when a real,
+ * anchor-verified license is present. On the default self-hosted install — and on
+ * any build without a baked `TRUSTED_PUBLIC_KEY` — `loadLicense` returns `null`, so
+ * `checkRunQuota` reports `active:false, allowed:true` and the caller does nothing
+ * (no throttling, no `.testteam-runs.json` written). This is what keeps wiring the
+ * quota in from regressing today's keyless free users.
+ */
+import { loadLicense } from './license.js';
+import { checkRunLimit } from './run-counter.js';
+/**
+ * Read-only quota check for the current billing period. Does NOT record the run —
+ * the caller records a run (via `recordRun`) only when `active` is true and the
+ * run is actually initiated.
+ */
+export function checkRunQuota(configDir) {
+    const license = loadLicense(configDir);
+    if (!license) {
+        // Dormant: no license → no quota. Preserves current free/self-hosted behaviour.
+        return { active: false, allowed: true };
+    }
+    const check = checkRunLimit(configDir, license.maxRunsPerMonth);
+    const base = {
+        active: true,
+        tier: license.tier,
+        used: check.used,
+        limit: license.maxRunsPerMonth,
+        remaining: check.remaining,
+        warning: check.warning,
+    };
+    if (!check.allowed) {
+        return {
+            ...base,
+            allowed: false,
+            message: `Monthly run quota reached: ${check.used}/${license.maxRunsPerMonth} runs used on the ` +
+                `${license.tier} tier. The counter resets at the start of next month; upgrade for a higher limit.`,
+        };
+    }
+    return { ...base, allowed: true };
+}
+//# sourceMappingURL=run-quota.js.map

package/dist/core/run-quota.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-quota.js","sourceRoot":"","sources":["../../core/run-quota.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAkBjD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,gFAAgF;QAChF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,IAAa;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,OAAO,CAAC,eAAe;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,OAAO,EACL,8BAA8B,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,oBAAoB;gBACvF,GAAG,OAAO,CAAC,IAAI,mFAAmF;SACrG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC"}

package/dist/core/security-audit/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Security Audit — The Sentinel (agent #8) — public surface.
+ * Composite/operational layer: orchestrates engine agents 07, 34, 35, 36, 37, 38.
+ * Spec: blueprint/agents/08-security-audit.md.
+ */
+export { ENGINE_MODULE } from './types.js';
+export type { EngineModuleName, ScanEndpoint, ScanTarget, CveEntry, CanaryToken, CanaryAlert, IacMisconfigFinding, IacMisconfigSeverity, AttackStep, AttackPath, ExploitEnvironment, ProofOfExploit, VirtualPatchDraft, SecretRotationRunbook, PostureScore, ScoreDeduction, RankedFinding, SecurityScanResult, SentinelConfig, ScanBudget, ScanCostUnit, GovernorDecision, GovernorResult, AcceptedBaseline, ScanBaseline, } from './types.js';
+export { SecuritySentinel, FrugalGovernor, partitionCvesByReachability, cveToFinding, detectCanaryUse, buildAttackPaths, checkIacBlobs, buildProofOfExploit, draftVirtualPatch, draftRotationRunbook, computePostureScore, rankFindings, } from './sentinel.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/security-audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../core/security-audit/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/core/security-audit/index.js

@@ -0,0 +1,10 @@
+/**
+ * Security Audit — The Sentinel (agent #8) — public surface.
+ * Composite/operational layer: orchestrates engine agents 07, 34, 35, 36, 37, 38.
+ * Spec: blueprint/agents/08-security-audit.md.
+ */
+// --- Types ---
+export { ENGINE_MODULE } from './types.js';
+// --- Implementation ---
+export { SecuritySentinel, FrugalGovernor, partitionCvesByReachability, cveToFinding, detectCanaryUse, buildAttackPaths, checkIacBlobs, buildProofOfExploit, draftVirtualPatch, draftRotationRunbook, computePostureScore, rankFindings, } from './sentinel.js';
+//# sourceMappingURL=index.js.map

package/dist/core/security-audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../core/security-audit/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,gBAAgB;AAChB,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AA6BxC,yBAAyB;AACzB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,GACb,MAAM,YAAY,CAAC"}

package/dist/core/security-audit/sentinel.d.ts

@@ -0,0 +1,196 @@
+/**
+ * Security Audit — The Sentinel (agent #8).
+ * Continuous/composite operational layer: orchestrates engine agents 07, 34, 35, 36, 37, 38.
+ * Spec: blueprint/agents/08-security-audit.md.
+ *
+ * Design principles (from spec):
+ *  • Passive-before-active; diff-aware incremental; baseline-diff reporting.
+ *  • Reachability-gated CVE triage — only alert on reachable CVEs.
+ *  • Exploit-chain analysis — chains ≥2 low/medium findings into attack paths.
+ *  • Sandbox proof-of-exploit runs only against staging; NEVER prod.
+ *  • Frugal governor — cheapest-highest-value checks first; halt when budget exhausted.
+ *    FAIL-CLOSED: when halted, the phase is marked budgetTruncated and skippedChecks are
+ *    recorded — the scan is never silently treated as clean.
+ *  • Virtual patches and secret rotation runbooks are DRAFTED for human apply; never auto-applied.
+ *  • Critical/canary → immediate escalation.
+ *  • Show-the-math scoring; never round up; deterministic under fixed inputs.
+ *
+ * Engine-agent contract:
+ *  This module is the RESULTS-PROCESSOR layer above the engine agents. It accepts
+ *  pre-collected Finding arrays from the engine agents rather than invoking them directly
+ *  (engine agents each own I/O: HTTP, browser, filesystem). The contract is:
+ *   1. ENGINE_MODULE (./types) mirrors the engine agents' `module` literals — a BEST-EFFORT
+ *      string match (the engines export no shared constant; a rename is not compiler-caught).
+ *   2. The ENFORCED coupling is the integration test asserting COMPOSED_ENGINE_AGENTS exist
+ *      as registered 'security'-squad agents (renumber/regroup breaks the build).
+ *   3. Integration tests drive realistic engine-output shapes through the full pipeline.
+ */
+import type { Finding } from '../types.js';
+import { type ScanTarget, type CveEntry, type CanaryToken, type CanaryAlert, type IacMisconfigFinding, type AttackPath, type ProofOfExploit, type VirtualPatchDraft, type SecretRotationRunbook, type PostureScore, type RankedFinding, type SecurityScanResult, type SentinelConfig, type GovernorResult, type ScanCostUnit } from './types.js';
+/**
+ * FrugalGovernor tracks units consumed and enforces the budget.
+ * Cheapest-highest-value checks are registered first; the governor halts
+ * before queuing expensive work when the budget is exhausted.
+ *
+ * FAIL-CLOSED: tryConsume() returning false NEVER means "proceed as if clean".
+ * Callers MUST record the skipped phase in skippedChecks and mark the scan
+ * budgetTruncated=true. Skipped phases are explicitly surfaced to the caller.
+ */
+export declare class FrugalGovernor {
+    private consumed;
+    private readonly total;
+    private halted;
+    constructor(totalUnits: ScanCostUnit);
+    /**
+     * Try to consume `units`.
+     * Returns true if within budget and units were consumed; false if budget exceeded.
+     * On false: the CALLER must record the skipped check name in skippedChecks[].
+     */
+    tryConsume(units: ScanCostUnit): boolean;
+    result(reason: string): GovernorResult;
+    get remaining(): ScanCostUnit;
+    get wasHalted(): boolean;
+}
+/**
+ * Filter CVE entries by reachability.
+ * Returns { alertable, suppressed }.
+ * Spec: "Reachability-gated CVE triage — only alert on dependency CVEs whose vulnerable
+ * function is actually reachable in the call graph."
+ */
+export declare function partitionCvesByReachability(cves: readonly CveEntry[]): {
+    alertable: readonly CveEntry[];
+    suppressed: readonly CveEntry[];
+};
+/** Convert a reachable CVE into a Finding (type code-bug-security). */
+export declare function cveToFinding(cve: CveEntry): Finding;
+/**
+ * Check if any canary token values appear in the provided content string.
+ * Used in passive analysis of telemetry/logs without triggering real network calls.
+ */
+export declare function detectCanaryUse(tokens: readonly CanaryToken[], observedContent: string, source: string, nowMs: number): readonly CanaryAlert[];
+/**
+ * Chain ≥2 low/medium findings into attack paths.
+ * Spec: "Chains ≥2 seeded low findings into a correct attack path."
+ *
+ * Strategy: pair any finding that represents an information-leak / enumeration
+ * risk (missing auth, missing header, info-disclosure) with any finding that
+ * represents a direct access path (IDOR, auth bypass, injection) — their
+ * combination forms a kill-chain. We generate at most one path per pair to
+ * avoid exponential blowup.
+ *
+ * Each path is assigned the max severity of its constituent findings.
+ */
+export declare function buildAttackPaths(findings: readonly Finding[]): readonly AttackPath[];
+/**
+ * Check IaC config blobs for known misconfigurations.
+ * Each blob is analysed by keyword pattern matching against community rule
+ * patterns (Checkov/tfsec rule names, not re-implemented here).
+ * Real integration plugs in the Checkov/tfsec JSON output; this layer models
+ * the decision logic that consumes that output.
+ */
+export declare function checkIacBlobs(iacBlobs: Readonly<Record<string, string>>): readonly IacMisconfigFinding[];
+/**
+ * Simulate a proof-of-exploit record for a finding AGAINST STAGING ONLY.
+ *
+ * SAFETY — RUNTIME GUARD (MF-2):
+ *  1. prodBaseUrl and stagingBaseUrl must NOT be equal strings — if they are,
+ *     we cannot tell them apart and refusing to proceed is the only safe choice.
+ *  2. The requestDetail always embeds stagingBaseUrl, never prodBaseUrl.
+ *  3. The return type's environment field is typed as 'staging' (literal),
+ *     guaranteeing the caller cannot pass a prod URL undetected at the type level.
+ *
+ * In production integration, this would invoke ZAP/Nuclei against staging.
+ * Here it models the outcome of that test deterministically from the finding.
+ *
+ * @throws Error if prodBaseUrl === stagingBaseUrl (fail-closed safety rule).
+ */
+export declare function buildProofOfExploit(finding: Finding, stagingBaseUrl: string, nowMs: number, prodBaseUrl?: string): ProofOfExploit;
+/** Draft a WAF rule / mitigation for a finding. For human apply only; never auto-applied. */
+export declare function draftVirtualPatch(finding: Finding): VirtualPatchDraft;
+/** Draft a secret-rotation runbook for a secrets-scanner finding. For human apply only. */
+export declare function draftRotationRunbook(finding: Finding, keyStillActive: boolean | null): SecretRotationRunbook;
+/**
+ * Compute a security posture score 0–100.
+ * Deductions are itemised; score is Math.floor, never rounded up.
+ * Spec: "no gameable scoring"; "show-the-math transparency".
+ *
+ * MF-4 FIX: Replaces per-severity caps with a monotonic diminishing-returns formula.
+ * Each additional finding of the same severity adds a smaller (but nonzero) marginal
+ * penalty using: penalty(n) = perFinding × ∑_{i=1}^{n} (1 / i)  [harmonic series].
+ * This guarantees:
+ *   - penalty is strictly increasing with n (N+1 criticals score strictly below N).
+ *   - No hard cap; any number of criticals keeps reducing the score.
+ *   - Diminishing returns prevent a single category from zeroing the score alone
+ *     while still guaranteeing monotonicity.
+ * Combined with attack-path deductions, the score can still reach 0.
+ */
+export declare function computePostureScore(findings: readonly Finding[], attackPaths: readonly AttackPath[], nowMs: number): PostureScore;
+/**
+ * Rank findings by severity × EPSS × blast-radius (descending).
+ * Show-the-math: each component is preserved on the RankedFinding.
+ * EPSS defaults to 0.5 when unknown (conservative assumption, not zero).
+ *
+ * MF-5 FIX: CVE correlation is done via structured package-name matching
+ * against the Finding.file field (formatted as "pkg:<name>@<version>" by
+ * cveToFinding), NOT substring-of-description. This prevents false matches
+ * for short package names like "os", "fs", "ms".
+ *
+ * For non-CVE findings, EPSS defaults to 0.5.
+ */
+export declare function rankFindings(findings: readonly Finding[], cveIndex: ReadonlyMap<string, CveEntry>, blastRadiusWeight: number): readonly RankedFinding[];
+/**
+ * The Sentinel orchestrates the security engine agents and provides the
+ * continuous production security layer. It is a pure, fixture/event-driven
+ * class — it accepts pre-collected engine findings as inputs and composes
+ * them into a ranked, chained, baseline-diffed SecurityScanResult.
+ *
+ * Rationale: engine agents (07, 34–38) each run I/O (HTTP, FS, browser).
+ * The Sentinel's job is the higher-order logic: deduplicate, chain,
+ * gate on reachability, rank, score, and escalate. Tests inject findings
+ * directly, avoiding live network calls.
+ *
+ * Engine-agent contract (MF-7):
+ *  - MODULE_NAME constants in ENGINE_MODULE are imported from ./types.
+ *    They match the `module` field values emitted by agents 07/34–38
+ *    ('security-headers', 'xss-scanner', 'csrf-tester', 'auth-fuzzer',
+ *     'dependency-scanner', 'secrets-scanner').
+ *  - A rename in an engine agent is NOT compiler-caught here (best-effort string match);
+ *    the ENFORCED coupling is the integration test asserting COMPOSED_ENGINE_AGENTS exist
+ *    as registered 'security'-squad agents (renumber/regroup breaks the build).
+ *  - Integration tests in __tests__/security-audit.test.ts drive realistic
+ *    engine-output shapes (findings with correct module values) through
+ *    the pipeline and assert the composition contract end-to-end.
+ */
+export declare class SecuritySentinel {
+    private readonly config;
+    private readonly now;
+    constructor(config: SentinelConfig);
+    /**
+     * Run a sentinel scan.
+     *
+     * @param target       — scan surface description.
+     * @param engineFindings — pre-collected findings from engine agents 07/34–38.
+     * @param cves         — enriched CVE entries (from KEV/EPSS feeds via The Net).
+     * @param canaryContent — telemetry/log content to check canary tokens against.
+     * @param canarySource  — label describing where canaryContent came from.
+     *
+     * FAIL-CLOSED (MF-3): when budget is exhausted mid-scan, the skipped check name
+     * is appended to skippedChecks[] and budgetTruncated is set to true in the result.
+     * A budget-truncated scan is NEVER treated as clean — callers must check budgetTruncated.
+     *
+     * PROD SAFETY (MF-2): buildProofOfExploit is called with both stagingBaseUrl AND
+     * prodBaseUrl so the runtime guard can reject prod === staging equality.
+     */
+    scan(target: ScanTarget, engineFindings: readonly Finding[], cves: readonly CveEntry[], canaryContent: string, canarySource: string): SecurityScanResult;
+    /**
+     * Clean-target check: run against a known-clean target and assert no findings.
+     * Returns true if no findings, no canary alerts, no IaC findings, no attack paths,
+     * AND the scan was not budget-truncated (an incomplete scan can never be declared clean).
+     *
+     * MF-6 FIX: now includes iacFindings and attackPaths in the soundness check.
+     * A budget-truncated scan also fails isClean (fail-closed).
+     * Spec: "no false alarm on a clean target."
+     */
+    isClean(result: SecurityScanResult): boolean;
+}
+//# sourceMappingURL=sentinel.d.ts.map

package/dist/core/security-audit/sentinel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel.d.ts","sourceRoot":"","sources":["../../../core/security-audit/sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,OAAO,EAAmB,MAAM,UAAU,CAAC;AACzD,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,UAAU,EAEf,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EAEjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EAGlB,MAAM,SAAS,CAAC;AA6IjB;;;;;;;;GAQG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,MAAM,CAAS;gBAEX,UAAU,EAAE,YAAY;IAOpC;;;;OAIG;IACH,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO;IASxC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc;IAUtC,IAAI,SAAS,IAAI,YAAY,CAE5B;IAED,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF;AAMD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,QAAQ,EAAE,GAAG;IACtE,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC/B,UAAU,EAAE,SAAS,QAAQ,EAAE,CAAC;CACjC,CAWA;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,GAAG,EAAE,QAAQ,GAAG,OAAO,CAsBnD;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,SAAS,WAAW,EAAE,CAaxB;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,UAAU,EAAE,CA2DpF;AAMD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACzC,SAAS,mBAAmB,EAAE,CAoDhC;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,cAAc,CAkBhB;AAMD,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB,CAqBrE;AAMD,2FAA2F;AAC3F,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,OAAO,GAAG,IAAI,GAC7B,qBAAqB,CAcvB;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,WAAW,EAAE,SAAS,UAAU,EAAE,EAClC,KAAK,EAAE,MAAM,GACZ,YAAY,CA0Ed;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EACvC,iBAAiB,EAAE,MAAM,GACxB,SAAS,aAAa,EAAE,CAyC1B;AAMD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,MAAM,EAAE,cAAc;IAKlC;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CACF,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,SAAS,OAAO,EAAE,EAClC,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,kBAAkB;IA6HrB;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO;CAU7C"}