@ccslabs/xtend 0.1.0-rc.1

package/security/README.md

@@ -0,0 +1,54 @@
+# XTend Security Contracts
+
+Status: introduced with ER-WP-29 and extended with ER-WP-30 and ER-WP-28
+
+## Purpose
+
+`security/` holds repo-local, machine-readable security contracts. These modules are policy surfaces, not runtime sanitizers.
+
+## Manifest Import Policy
+
+`manifest-import-policy.js` exposes:
+
+- `xtend.security.loader-policy.v1`
+- `xtend.security.manifest-policy.v1`
+- `xtend.security.import-policy.v1`
+- `xtend.security.manifest-import-gate.v1`
+
+The policy classifies Manifest URLs, Manifest Records and dynamic module URLs as local allowed imports or refused security boundaries. It is mirrored by `xtend-loader.js` for runtime Refusals and by `tests/security/manifest_import_policy_suite.js` for local gates.
+
+## Trusted DOM
+
+`trusted-dom-policy.js` exposes:
+
+- `xtend.security.trusted-dom-policy.v1`
+- `xtend.security.sanitizing-boundary.v1`
+- `xtend.security.markup-classification.v1`
+- `xtend.security.trusted-dom-sink.v1`
+
+The policy classifies text, attributes, structured templates, RMT `html_fragment` and Parsedown HTML, then maps them to allowed, restricted or forbidden DOM sinks.
+
+## Supply Chain
+
+`supply-chain-gate-policy.js` exposes:
+
+- `xtend.security.supply-chain-gate-plan.v1`
+- `xtend.security.dependency-audit-gate.v1`
+- `xtend.security.license-policy.v1`
+- `xtend.security.vulnerability-policy.v1`
+- `xtend.security.release-supply-chain-gate.v1`
+
+The policy defines the offline local gate, planned CI audit commands, license rules, vulnerability thresholds and publish boundary for later release automation.
+
+## Gates
+
+```bash
+node --check security/trusted-dom-policy.js
+node --check security/supply-chain-gate-policy.js
+node --check security/manifest-import-policy.js
+node scripts/verify_manifest_import_policy.js --json
+node scripts/verify_supply_chain_policy.js --json
+node scripts/run_xtend_tests.js manifest-import-policy --json
+node scripts/run_xtend_tests.js supply-chain --json
+node scripts/run_xtend_tests.js references --json
+```

package/security/manifest-import-policy.d.ts

@@ -0,0 +1,43 @@
+export * from '../fabric/xtend-policy-public-types';
+import type {
+  XtendPolicyConstant,
+  XtendPolicyOptions,
+  XtendSecurityClassification
+} from '../fabric/xtend-policy-public-types';
+
+export interface XtendManifestImportPolicy {
+  schema: string;
+  loaderPolicy: string;
+  manifestPolicy: string;
+  importPolicy: string;
+  mode: string;
+  allowedProtocols: string[];
+  refusedProtocols: string[];
+  localHosts: string[];
+  manifestExtensions: string[];
+  moduleExtensions: string[];
+  reservedBootstrapKeys: string[];
+  diagnostics: string[];
+  rules: Record<string, string>;
+}
+
+export interface XtendNormalizedManifest extends XtendSecurityClassification {
+  entries: Record<string, string>;
+}
+
+export declare const ALLOWED_IMPORT_PROTOCOLS: XtendPolicyConstant<string[]>;
+export declare const ALLOWED_MANIFEST_EXTENSIONS: XtendPolicyConstant<string[]>;
+export declare const ALLOWED_MODULE_EXTENSIONS: XtendPolicyConstant<string[]>;
+export declare const CUSTOM_ELEMENT_NAME_PATTERN: XtendPolicyConstant<RegExp>;
+export declare const IMPORT_POLICY_CONTRACT: XtendPolicyConstant<string>;
+export declare const LOADER_POLICY_CONTRACT: XtendPolicyConstant<string>;
+export declare const LOCAL_HOSTS: XtendPolicyConstant<string[]>;
+export declare const MANIFEST_IMPORT_GATE_CONTRACT: XtendPolicyConstant<string>;
+export declare const MANIFEST_POLICY_CONTRACT: XtendPolicyConstant<string>;
+export declare const REFUSED_PROTOCOLS: XtendPolicyConstant<string[]>;
+export declare const RESERVED_BOOTSTRAP_KEYS: XtendPolicyConstant<string[]>;
+export declare function classifyManifestRecord(key: string, record: unknown, options?: XtendPolicyOptions): XtendSecurityClassification;
+export declare function classifyPolicyUrl(value: string, options?: XtendPolicyOptions): XtendSecurityClassification;
+export declare function createManifestImportPolicy(options?: XtendPolicyOptions): XtendManifestImportPolicy;
+export declare function isAllowedManifestKey(key: string): boolean;
+export declare function normalizeManifest(rawManifest?: Record<string, unknown>, options?: XtendPolicyOptions): XtendNormalizedManifest;

package/security/manifest-import-policy.js

@@ -0,0 +1,260 @@
+const LOADER_POLICY_CONTRACT = 'xtend.security.loader-policy.v1';
+const MANIFEST_POLICY_CONTRACT = 'xtend.security.manifest-policy.v1';
+const IMPORT_POLICY_CONTRACT = 'xtend.security.import-policy.v1';
+const MANIFEST_IMPORT_GATE_CONTRACT = 'xtend.security.manifest-import-gate.v1';
+
+const LOCAL_HOSTS = ['localhost', '127.0.0.1', '0.0.0.0', '::1'];
+const ALLOWED_IMPORT_PROTOCOLS = ['http:', 'https:', 'file:'];
+const REFUSED_PROTOCOLS = ['javascript:', 'data:', 'vbscript:', 'blob:'];
+const ALLOWED_MANIFEST_EXTENSIONS = ['.json'];
+const ALLOWED_MODULE_EXTENSIONS = ['.js', '.mjs'];
+const RESERVED_BOOTSTRAP_KEYS = ['xstate'];
+const CUSTOM_ELEMENT_NAME_PATTERN = /^[a-z][a-z0-9]*-[a-z0-9-]*[a-z0-9]$/;
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function normalizeHostname(hostname = '') {
+  return String(hostname).replace(/^\[|\]$/g, '').toLowerCase();
+}
+
+function isLocalHost(hostname) {
+  return LOCAL_HOSTS.includes(normalizeHostname(hostname));
+}
+
+function createUrl(value, baseUrl) {
+  try {
+    return new URL(String(value), baseUrl);
+  } catch (_) {
+    return null;
+  }
+}
+
+function hasPathTraversal(url) {
+  try {
+    return decodeURIComponent(url.pathname).split('/').includes('..');
+  } catch (_) {
+    return true;
+  }
+}
+
+function hasTraversalLikeInput(value) {
+  try {
+    const pathPart = decodeURIComponent(String(value)).split(/[?#]/)[0];
+    return pathPart === '..' ||
+      pathPart.startsWith('../') ||
+      pathPart.includes('/../') ||
+      pathPart.endsWith('/..');
+  } catch (_) {
+    return true;
+  }
+}
+
+function hasAllowedExtension(url, kind) {
+  const pathname = url.pathname.toLowerCase();
+  const extensions = kind === 'manifest'
+    ? ALLOWED_MANIFEST_EXTENSIONS
+    : ALLOWED_MODULE_EXTENSIONS;
+  return extensions.some((extension) => pathname.endsWith(extension));
+}
+
+function classifyPolicyUrl(value, options = {}) {
+  const kind = options.kind || 'module';
+  const baseUrl = options.baseUrl || options.currentUrl || 'http://127.0.0.1/';
+  const currentUrl = createUrl(options.currentUrl || baseUrl, baseUrl);
+  const targetUrl = createUrl(value, baseUrl);
+  const diagnostics = [];
+  const source = options.source || kind;
+
+  if (!targetUrl || !currentUrl) {
+    diagnostics.push('xtend.security.import.refused.invalid_url');
+  } else if (hasTraversalLikeInput(value)) {
+    diagnostics.push('xtend.security.import.refused.path_traversal');
+  } else if (REFUSED_PROTOCOLS.includes(targetUrl.protocol)) {
+    diagnostics.push('xtend.security.import.refused.protocol');
+  } else if (!ALLOWED_IMPORT_PROTOCOLS.includes(targetUrl.protocol)) {
+    diagnostics.push('xtend.security.import.refused.protocol');
+  } else if (hasPathTraversal(targetUrl)) {
+    diagnostics.push('xtend.security.import.refused.path_traversal');
+  } else if (!hasAllowedExtension(targetUrl, kind)) {
+    diagnostics.push(kind === 'manifest'
+      ? 'xtend.security.manifest.invalid.extension'
+      : 'xtend.security.import.refused.extension');
+  } else {
+    const sameOrigin = targetUrl.origin === currentUrl.origin;
+    const localLoopback = isLocalHost(targetUrl.hostname) && (
+      isLocalHost(currentUrl.hostname) ||
+      currentUrl.protocol === 'file:'
+    );
+    const localFile = targetUrl.protocol === 'file:' && currentUrl.protocol === 'file:';
+
+    if (!sameOrigin && !localLoopback && !localFile) {
+      diagnostics.push(kind === 'manifest'
+        ? 'xtend.security.loader.refused.external_manifest'
+        : 'xtend.security.import.refused.external_module');
+    }
+  }
+
+  return {
+    schema: IMPORT_POLICY_CONTRACT,
+    ok: diagnostics.length === 0,
+    kind,
+    source,
+    input: String(value),
+    url: targetUrl ? targetUrl.href : null,
+    local: targetUrl && currentUrl
+      ? targetUrl.origin === currentUrl.origin || isLocalHost(targetUrl.hostname) || targetUrl.protocol === 'file:'
+      : false,
+    diagnostics
+  };
+}
+
+function isAllowedManifestKey(key) {
+  if (RESERVED_BOOTSTRAP_KEYS.includes(key)) {
+    return true;
+  }
+  return CUSTOM_ELEMENT_NAME_PATTERN.test(key);
+}
+
+function getManifestRecordUrl(record) {
+  if (typeof record === 'string') {
+    return record;
+  }
+  if (record && typeof record === 'object') {
+    if (typeof record.url === 'string') return record.url;
+    if (typeof record.path === 'string') return record.path;
+  }
+  return null;
+}
+
+function dependenciesAreComponentIds(record) {
+  if (!record || typeof record !== 'object' || !Array.isArray(record.dependencies)) {
+    return true;
+  }
+  return record.dependencies.every((dependency) => (
+    typeof dependency === 'string' &&
+    isAllowedManifestKey(dependency) &&
+    !dependency.includes('/') &&
+    !dependency.includes(':')
+  ));
+}
+
+function classifyManifestRecord(key, record, options = {}) {
+  const diagnostics = [];
+  const normalizedKey = typeof key === 'string' ? key.trim() : '';
+  const recordUrl = getManifestRecordUrl(record);
+
+  if (!normalizedKey || normalizedKey !== normalizedKey.toLowerCase() || !isAllowedManifestKey(normalizedKey)) {
+    diagnostics.push('xtend.security.manifest.invalid.tag');
+  }
+
+  if (!recordUrl) {
+    diagnostics.push('xtend.security.manifest.invalid.url');
+  }
+
+  if (!dependenciesAreComponentIds(record)) {
+    diagnostics.push('xtend.security.manifest.invalid.dependencies');
+  }
+
+  const urlPolicy = recordUrl
+    ? classifyPolicyUrl(recordUrl, {
+      ...options,
+      kind: 'module',
+      source: normalizedKey || 'manifest-record'
+    })
+    : null;
+
+  if (urlPolicy && !urlPolicy.ok) {
+    diagnostics.push(...urlPolicy.diagnostics);
+  }
+
+  return {
+    schema: MANIFEST_POLICY_CONTRACT,
+    ok: diagnostics.length === 0,
+    key: normalizedKey,
+    url: urlPolicy ? urlPolicy.url : null,
+    source: 'manifest-record',
+    diagnostics
+  };
+}
+
+function normalizeManifest(rawManifest, options = {}) {
+  const diagnostics = [];
+  const entries = {};
+
+  if (!rawManifest || typeof rawManifest !== 'object' || Array.isArray(rawManifest)) {
+    return {
+      schema: MANIFEST_POLICY_CONTRACT,
+      ok: false,
+      entries,
+      diagnostics: ['xtend.security.manifest.invalid.shape']
+    };
+  }
+
+  Object.entries(rawManifest).forEach(([key, record]) => {
+    const classification = classifyManifestRecord(key, record, options);
+    if (classification.ok) {
+      entries[classification.key] = classification.url;
+    } else {
+      diagnostics.push({
+        key,
+        codes: classification.diagnostics
+      });
+    }
+  });
+
+  return {
+    schema: MANIFEST_POLICY_CONTRACT,
+    ok: diagnostics.length === 0,
+    entries,
+    diagnostics
+  };
+}
+
+function createManifestImportPolicy(options = {}) {
+  return {
+    schema: MANIFEST_IMPORT_GATE_CONTRACT,
+    loaderPolicy: LOADER_POLICY_CONTRACT,
+    manifestPolicy: MANIFEST_POLICY_CONTRACT,
+    importPolicy: IMPORT_POLICY_CONTRACT,
+    mode: options.mode || 'local-self-and-loopback-only',
+    allowedProtocols: clone(ALLOWED_IMPORT_PROTOCOLS),
+    refusedProtocols: clone(REFUSED_PROTOCOLS),
+    localHosts: clone(LOCAL_HOSTS),
+    manifestExtensions: clone(ALLOWED_MANIFEST_EXTENSIONS),
+    moduleExtensions: clone(ALLOWED_MODULE_EXTENSIONS),
+    reservedBootstrapKeys: clone(RESERVED_BOOTSTRAP_KEYS),
+    diagnostics: [
+      'xtend.security.loader.refused',
+      'xtend.security.manifest.invalid',
+      'xtend.security.import.refused'
+    ],
+    rules: {
+      manifestUrl: 'Must be same-origin, file-local or loopback-local JSON.',
+      moduleUrl: 'Must be same-origin, file-local or loopback-local JavaScript module.',
+      preload: 'Component IDs only; no free URLs.',
+      dependencies: 'Component IDs only; no URL-like dependency values.',
+      cdn: 'External CDN URLs are refused by default.'
+    }
+  };
+}
+
+module.exports = {
+  ALLOWED_IMPORT_PROTOCOLS,
+  ALLOWED_MANIFEST_EXTENSIONS,
+  ALLOWED_MODULE_EXTENSIONS,
+  CUSTOM_ELEMENT_NAME_PATTERN,
+  IMPORT_POLICY_CONTRACT,
+  LOADER_POLICY_CONTRACT,
+  LOCAL_HOSTS,
+  MANIFEST_IMPORT_GATE_CONTRACT,
+  MANIFEST_POLICY_CONTRACT,
+  REFUSED_PROTOCOLS,
+  RESERVED_BOOTSTRAP_KEYS,
+  classifyManifestRecord,
+  classifyPolicyUrl,
+  createManifestImportPolicy,
+  isAllowedManifestKey,
+  normalizeManifest
+};

package/security/supply-chain-gate-policy.d.ts

@@ -0,0 +1,45 @@
+export * from '../fabric/xtend-policy-public-types';
+import type {
+  XtendPolicyConstant,
+  XtendPolicyReport
+} from '../fabric/xtend-policy-public-types';
+
+export interface XtendSupplyChainGatePlan {
+  schema: string;
+  releaseGate: string;
+  localGate: string;
+  localCommands: string[];
+  ciNetworkGates: string[];
+  gates: Record<string, unknown>;
+  dependencySections: string[];
+  lockfileCandidates: string[];
+  scopedReleasePackages: Array<{ name: string; path: string; manifest: string; scope: string }>;
+  license: Record<string, unknown>;
+  vulnerabilities: Record<string, unknown>;
+  publishBoundary: Record<string, unknown>;
+}
+
+export interface XtendPackageSupplyChainReport extends XtendPolicyReport {
+  dependencyCount: number;
+  dependencies: Array<{ section: string; name: string; version: string }>;
+  lockfiles: string[];
+  hasLockfile: boolean;
+  privatePackage: boolean;
+  publicRcPackage: boolean;
+  packageLicense: string | null;
+}
+
+export declare const DEPENDENCY_AUDIT_GATE_CONTRACT: XtendPolicyConstant<string>;
+export declare const DEPENDENCY_SECTIONS: XtendPolicyConstant<string[]>;
+export declare const LICENSE_POLICY: XtendPolicyConstant<Record<string, unknown>>;
+export declare const LICENSE_POLICY_CONTRACT: XtendPolicyConstant<string>;
+export declare const LOCKFILE_CANDIDATES: XtendPolicyConstant<string[]>;
+export declare const SCOPED_RELEASE_PACKAGES: XtendPolicyConstant<Array<{ name: string; path: string; manifest: string; scope: string }>>;
+export declare const RELEASE_SUPPLY_CHAIN_GATE_CONTRACT: XtendPolicyConstant<string>;
+export declare const SUPPLY_CHAIN_GATE_PLAN_CONTRACT: XtendPolicyConstant<string>;
+export declare const SUPPLY_CHAIN_GATES: XtendPolicyConstant<Record<string, unknown>>;
+export declare const VULNERABILITY_POLICY: XtendPolicyConstant<Record<string, unknown>>;
+export declare const VULNERABILITY_POLICY_CONTRACT: XtendPolicyConstant<string>;
+export declare function classifyPackageSupplyChain(packageManifest?: Record<string, unknown>, lockfiles?: string[]): XtendPackageSupplyChainReport;
+export declare function createSupplyChainGatePlan(): XtendSupplyChainGatePlan;
+export declare function listDependencies(packageManifest?: Record<string, unknown>): Array<{ section: string; name: string; version: string }>;

package/security/supply-chain-gate-policy.js

@@ -0,0 +1,249 @@
+const SUPPLY_CHAIN_GATE_PLAN_CONTRACT = 'xtend.security.supply-chain-gate-plan.v1';
+const DEPENDENCY_AUDIT_GATE_CONTRACT = 'xtend.security.dependency-audit-gate.v1';
+const LICENSE_POLICY_CONTRACT = 'xtend.security.license-policy.v1';
+const VULNERABILITY_POLICY_CONTRACT = 'xtend.security.vulnerability-policy.v1';
+const RELEASE_SUPPLY_CHAIN_GATE_CONTRACT = 'xtend.security.release-supply-chain-gate.v1';
+
+const DEPENDENCY_SECTIONS = [
+  'dependencies',
+  'devDependencies',
+  'optionalDependencies',
+  'peerDependencies'
+];
+
+const LOCKFILE_CANDIDATES = [
+  'package-lock.json',
+  'npm-shrinkwrap.json',
+  'pnpm-lock.yaml',
+  'yarn.lock'
+];
+
+const SCOPED_RELEASE_PACKAGES = Object.freeze([
+  {
+    name: '@ccslabs/xtend',
+    path: '.',
+    manifest: 'package.json',
+    scope: 'complete-stack'
+  },
+  {
+    name: '@ccslabs/xtend-rmt',
+    path: 'xtendrmt',
+    manifest: 'xtendrmt/package.json',
+    scope: 'rmt-runtime'
+  },
+  {
+    name: '@ccslabs/xtend-fabric',
+    path: 'fabric',
+    manifest: 'fabric/package.json',
+    scope: 'fabric-runtime'
+  },
+  {
+    name: '@ccslabs/xtend-cli',
+    path: 'xtend-builder',
+    manifest: 'xtend-builder/package.json',
+    scope: 'builder-cli'
+  },
+  {
+    name: '@ccslabs/xtend-compiler',
+    path: 'tools',
+    manifest: 'tools/package.json',
+    scope: 'rmt-compiler-tooling'
+  }
+]);
+
+const LICENSE_POLICY = {
+  currentPackageLicense: 'Apache-2.0',
+  projectLicenseDecision: 'accepted-apache-2.0',
+  privatePackageAllowedLicenses: ['Apache-2.0'],
+  publicReleaseRequiresLicenseDecision: false,
+  publicReleaseLicenseDecision: 'accepted-apache-2.0',
+  allowedDependencyLicenses: [
+    'Apache-2.0',
+    'BSD-2-Clause',
+    'BSD-3-Clause',
+    'ISC',
+    'MIT',
+    'MPL-2.0',
+    'Unicode-DFS-2016'
+  ],
+  reviewRequiredLicenses: [
+    'BlueOak-1.0.0',
+    'CC-BY-4.0',
+    'CC0-1.0',
+    'LGPL-2.1-only',
+    'LGPL-2.1-or-later',
+    'LGPL-3.0-only',
+    'LGPL-3.0-or-later'
+  ],
+  forbiddenDependencyLicenses: [
+    'AGPL-1.0-only',
+    'AGPL-1.0-or-later',
+    'AGPL-3.0-only',
+    'AGPL-3.0-or-later',
+    'GPL-2.0-only',
+    'GPL-2.0-or-later',
+    'GPL-3.0-only',
+    'GPL-3.0-or-later',
+    'UNLICENSED'
+  ]
+};
+
+const VULNERABILITY_POLICY = {
+  productionAuditLevel: 'moderate',
+  developmentAuditLevel: 'high',
+  publishBlockingSeverities: ['critical', 'high'],
+  zeroCriticalForAnyRelease: true,
+  noKnownExploitForReleaseCandidate: true,
+  networkAuditStage: 'ci-release-gate',
+  localGateMode: 'offline-policy-and-inventory'
+};
+
+const SUPPLY_CHAIN_GATES = [
+  {
+    id: 'dependency-inventory',
+    contract: DEPENDENCY_AUDIT_GATE_CONTRACT,
+    stage: 'local',
+    command: 'node scripts/verify_supply_chain_policy.js --json',
+    mode: 'offline-static',
+    blocksPublish: true
+  },
+  {
+    id: 'license-policy',
+    contract: LICENSE_POLICY_CONTRACT,
+    stage: 'local',
+    command: 'node scripts/verify_supply_chain_policy.js --json',
+    mode: 'offline-static',
+    blocksPublish: true
+  },
+  {
+    id: 'vulnerability-policy',
+    contract: VULNERABILITY_POLICY_CONTRACT,
+    stage: 'ci',
+    command: 'npm audit --audit-level=moderate',
+    mode: 'network-audit',
+    blocksPublish: true
+  },
+  {
+    id: 'release-report',
+    contract: RELEASE_SUPPLY_CHAIN_GATE_CONTRACT,
+    stage: 'local',
+    command: 'npm run release:report',
+    mode: 'offline-test-report',
+    blocksPublish: true
+  },
+  {
+    id: 'pack-provenance-dry-run',
+    contract: RELEASE_SUPPLY_CHAIN_GATE_CONTRACT,
+    stage: 'local',
+    command: 'npm run pack:dry-run',
+    mode: 'offline-package-surface',
+    blocksPublish: true
+  }
+];
+
+function clone(value) {
+  return JSON.parse(JSON.stringify(value));
+}
+
+function listDependencies(packageManifest = {}) {
+  return DEPENDENCY_SECTIONS.flatMap((section) => {
+    const entries = packageManifest[section] && typeof packageManifest[section] === 'object'
+      ? Object.entries(packageManifest[section])
+      : [];
+
+    return entries.map(([name, version]) => ({
+      name,
+      version,
+      section
+    }));
+  });
+}
+
+function createSupplyChainGatePlan(options = {}) {
+  return {
+    schema: SUPPLY_CHAIN_GATE_PLAN_CONTRACT,
+    dependencyAuditGate: DEPENDENCY_AUDIT_GATE_CONTRACT,
+    licensePolicy: LICENSE_POLICY_CONTRACT,
+    vulnerabilityPolicy: VULNERABILITY_POLICY_CONTRACT,
+    releaseGate: RELEASE_SUPPLY_CHAIN_GATE_CONTRACT,
+    mode: options.mode || 'plan-and-offline-local-gate',
+    localGate: 'node scripts/verify_supply_chain_policy.js --json',
+    packageScript: 'npm run test:supply-chain',
+    releaseScripts: [
+      'npm test',
+      'npm run test:supply-chain',
+      'npm run release:report',
+      'npm run pack:dry-run'
+    ],
+    ciNetworkGates: [
+      'npm audit --audit-level=moderate',
+      'npm sbom --sbom-format=cyclonedx --json'
+    ],
+    gates: clone(SUPPLY_CHAIN_GATES),
+    dependencySections: clone(DEPENDENCY_SECTIONS),
+    lockfileCandidates: clone(LOCKFILE_CANDIDATES),
+    scopedReleasePackages: clone(SCOPED_RELEASE_PACKAGES),
+    license: clone(LICENSE_POLICY),
+    vulnerabilities: clone(VULNERABILITY_POLICY),
+    publishBoundary: {
+      privateUntil: ['ER-WP-30', 'ER-WP-36', 'ER-WP-38'],
+      currentPublishState: 'owner-approved-public-rc-boundary',
+      provenanceRequired: true,
+      publicReleaseRequiresLicenseDecision: false,
+      licenseDecision: 'accepted-apache-2.0'
+    }
+  };
+}
+
+function classifyPackageSupplyChain(packageManifest = {}, lockfiles = []) {
+  const dependencies = listDependencies(packageManifest);
+  const hasDependencies = dependencies.length > 0;
+  const hasLockfile = Array.isArray(lockfiles) && lockfiles.length > 0;
+  const diagnostics = [];
+
+  if (hasDependencies && !hasLockfile) {
+    diagnostics.push('xtend.security.supply_chain.lockfile.missing');
+  }
+
+  if (packageManifest.private !== false) {
+    diagnostics.push('xtend.security.supply_chain.private_boundary.missing');
+  }
+
+  if (packageManifest.license === 'UNLICENSED' && packageManifest.private !== true) {
+    diagnostics.push('xtend.security.supply_chain.public_license.missing');
+  }
+
+  if (!packageManifest.publishConfig || packageManifest.publishConfig.provenance !== true) {
+    diagnostics.push('xtend.security.supply_chain.provenance.missing');
+  }
+
+  return {
+    schema: DEPENDENCY_AUDIT_GATE_CONTRACT,
+    ok: diagnostics.length === 0,
+    dependencyCount: dependencies.length,
+    dependencies,
+    lockfiles,
+    hasLockfile,
+    privatePackage: packageManifest.private === true,
+    publicRcPackage: packageManifest.private === false,
+    packageLicense: packageManifest.license || null,
+    diagnostics
+  };
+}
+
+module.exports = {
+  DEPENDENCY_AUDIT_GATE_CONTRACT,
+  DEPENDENCY_SECTIONS,
+  LICENSE_POLICY,
+  LICENSE_POLICY_CONTRACT,
+  LOCKFILE_CANDIDATES,
+  SCOPED_RELEASE_PACKAGES,
+  RELEASE_SUPPLY_CHAIN_GATE_CONTRACT,
+  SUPPLY_CHAIN_GATE_PLAN_CONTRACT,
+  SUPPLY_CHAIN_GATES,
+  VULNERABILITY_POLICY,
+  VULNERABILITY_POLICY_CONTRACT,
+  classifyPackageSupplyChain,
+  createSupplyChainGatePlan,
+  listDependencies
+};

package/security/trusted-dom-policy.d.ts

@@ -0,0 +1,36 @@
+export * from '../fabric/xtend-policy-public-types';
+import type {
+  XtendPolicyConstant,
+  XtendPolicyOptions,
+  XtendSecurityClassification
+} from '../fabric/xtend-policy-public-types';
+
+export interface XtendTrustedDomPolicy {
+  schema: string;
+  trustedDomPolicy: string;
+  sanitizerPolicy: string;
+  parsedownDocsPolicy: string;
+  rmtTemplatePolicy: string;
+  sinks: Record<string, unknown>;
+  markupClasses: Record<string, unknown>;
+  urlAttributes: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+export declare const DOM_SINKS: XtendPolicyConstant<Record<string, unknown>>;
+export declare const MARKUP_CLASSES: XtendPolicyConstant<Record<string, unknown>>;
+export declare const MARKUP_CLASSIFICATION_CONTRACT: XtendPolicyConstant<string>;
+export declare const PARSEDOWN_DOCS_POLICY: XtendPolicyConstant<string>;
+export declare const RMT_TEMPLATE_POLICY: XtendPolicyConstant<string>;
+export declare const SANITIZING_BOUNDARY_CONTRACT: XtendPolicyConstant<string>;
+export declare const TRUSTED_DOM_SANITIZER_CONTRACT: XtendPolicyConstant<string>;
+export declare const TRUSTED_DOM_SANITIZER_POLICY: XtendPolicyConstant<string>;
+export declare const TRUSTED_DOM_POLICY_CONTRACT: XtendPolicyConstant<string>;
+export declare const TRUSTED_DOM_SINK_CONTRACT: XtendPolicyConstant<string>;
+export declare const URL_ATTRIBUTE_POLICY: XtendPolicyConstant<string>;
+export declare function classifyTrustedDomUse(input?: XtendPolicyOptions): XtendSecurityClassification;
+export declare function getMarkupClass(markupClass: string): Record<string, unknown> | null;
+export declare function getSinkPolicy(sink: string): Record<string, unknown> | null;
+export declare function getTrustedDomPolicy(options?: XtendPolicyOptions): XtendTrustedDomPolicy;
+export declare function isAllowedTrustedDomUrl(value: string, options?: XtendPolicyOptions): boolean;
+export declare function sanitizeTrustedDomHtml(value: string, options?: XtendPolicyOptions): string;