@cybedefend/vibedefend 1.1.1

package/dist/guards-evaluator/redact.js

@@ -0,0 +1,111 @@
+/**
+ * Secret-pattern redaction and hashing — mirrors Python redact.py.
+ *
+ * redactTarget(text, maxLen?) — strip known secret patterns (replacing each
+ *   match with [REDACTED]) then truncate to maxLen. Redaction happens BEFORE
+ *   truncation so secrets near the end of long strings are caught.
+ *
+ * hashTarget(text) — SHA-256 hex of text (UTF-8). Used to de-duplicate
+ *   guard_violations rows without storing raw target strings.
+ *
+ * Patterns (most-specific first, matching Python order):
+ *   1. JWTs:  eyJ... three base64url segments
+ *   2. GitHub PATs: ghp_ + 36 alphanumeric
+ *   3. Stripe secret keys: sk_(live|test)_...
+ *   4. AWS access key IDs: AKIA + 16 uppercase/digit
+ *   5. Bearer tokens: "Bearer <token>" — the token portion only is replaced
+ *   6. Generic hex tokens >= 32 chars (word-boundary guarded)
+ *   7. Generic base64-ish tokens >= 32 chars with ≥1 uppercase AND ≥1 digit
+ *      (high-entropy gate — file paths almost never have uppercase mid-path)
+ */
+import { createHash } from 'node:crypto';
+const REDACTED = '[REDACTED]';
+const PATTERNS = [
+    // 1. JWT — three base64url segments separated by dots
+    {
+        re: /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+        captureIndex: null,
+    },
+    // 2. GitHub PAT
+    {
+        re: /ghp_[a-zA-Z0-9]{36}/g,
+        captureIndex: null,
+    },
+    // 3. Stripe secret key (live or test)
+    {
+        re: /sk_(?:live|test)_[0-9a-zA-Z]{24,}/g,
+        captureIndex: null,
+    },
+    // 4. AWS access key ID
+    {
+        re: /AKIA[0-9A-Z]{16}/g,
+        captureIndex: null,
+    },
+    // 5. Bearer token — preserve the "Bearer " keyword, replace only the token.
+    //    Group 1 = the prefix ("Bearer "), group 2 = the token value.
+    {
+        re: /((?:bearer\s))([^\s]{10,})/gi,
+        captureIndex: 2,
+    },
+    // 6. Generic hex token >= 32 chars (word boundary so short IDs are skipped)
+    {
+        re: /\b[0-9a-f]{32,}\b/g,
+        captureIndex: null,
+    },
+    // 7. Generic base64-ish >= 32 chars: must contain ≥1 uppercase AND ≥1 digit
+    //    to skip plain file paths.  Negative lookbehind prevents matching runs of
+    //    path chars.  JS lookbehind support is >= V8 6.3 (Node 10+), well within
+    //    our Node >=18.17 requirement.
+    {
+        re: /(?<![/\w])(?=[A-Za-z0-9+/]{32,}={0,2}(?![A-Za-z0-9+/]))(?=[A-Za-z0-9+/]*[A-Z])(?=[A-Za-z0-9+/]*[0-9])[A-Za-z0-9+/]{32,}={0,2}/gm,
+        captureIndex: null,
+    },
+];
+/**
+ * Apply all redaction patterns to `text`, then truncate to `maxLen` chars.
+ */
+export function redactTarget(text, maxLen = 256) {
+    if (!text)
+        return text;
+    let result = text;
+    for (const { re, captureIndex } of PATTERNS) {
+        re.lastIndex = 0;
+        if (captureIndex === null) {
+            result = result.replace(re, REDACTED);
+        }
+        else {
+            // Replace only the captured group, preserving surrounding match content.
+            result = result.replace(re, (...args) => {
+                // args: [fullMatch, g1, g2, ..., offset, input, groups?]
+                const fullMatch = args[0];
+                const groups = args.slice(1, -2);
+                // Rebuild the full match with the target capture replaced
+                let rebuilt = '';
+                let pos = 0;
+                for (let gi = 0; gi < groups.length; gi++) {
+                    const groupVal = groups[gi] ?? '';
+                    const groupStart = fullMatch.indexOf(groupVal, pos);
+                    if (groupStart >= 0) {
+                        rebuilt += fullMatch.slice(pos, groupStart);
+                        rebuilt += gi + 1 === captureIndex ? REDACTED : groupVal;
+                        pos = groupStart + groupVal.length;
+                    }
+                }
+                rebuilt += fullMatch.slice(pos);
+                return rebuilt;
+            });
+        }
+        re.lastIndex = 0;
+    }
+    if (result.length > maxLen) {
+        result = result.slice(0, maxLen);
+    }
+    return result;
+}
+/**
+ * Return the hex SHA-256 digest of `text` encoded as UTF-8.
+ */
+export function hashTarget(text) {
+    return createHash('sha256').update(text, 'utf8').digest('hex');
+}
+//# sourceMappingURL=redact.js.map

package/dist/guards-evaluator/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/guards-evaluator/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAiB9B,MAAM,QAAQ,GAAmB;IAC/B,sDAAsD;IACtD;QACE,EAAE,EAAE,oDAAoD;QACxD,YAAY,EAAE,IAAI;KACnB;IACD,gBAAgB;IAChB;QACE,EAAE,EAAE,sBAAsB;QAC1B,YAAY,EAAE,IAAI;KACnB;IACD,sCAAsC;IACtC;QACE,EAAE,EAAE,oCAAoC;QACxC,YAAY,EAAE,IAAI;KACnB;IACD,uBAAuB;IACvB;QACE,EAAE,EAAE,mBAAmB;QACvB,YAAY,EAAE,IAAI;KACnB;IACD,4EAA4E;IAC5E,kEAAkE;IAClE;QACE,EAAE,EAAE,8BAA8B;QAClC,YAAY,EAAE,CAAC;KAChB;IACD,4EAA4E;IAC5E;QACE,EAAE,EAAE,oBAAoB;QACxB,YAAY,EAAE,IAAI;KACnB;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,mCAAmC;IACnC;QACE,EAAE,EAAE,iIAAiI;QACrI,YAAY,EAAE,IAAI;KACnB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACrD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,MAAM,GAAG,IAAI,CAAC;IAElB,KAAK,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC5C,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QAEjB,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE;gBACjD,yDAAyD;gBACzD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAa,CAAC;gBAC7C,0DAA0D;gBAC1D,IAAI,OAAO,GAAG,EAAE,CAAC;gBACjB,IAAI,GAAG,GAAG,CAAC,CAAC;gBACZ,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;oBAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBAClC,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBACpD,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;wBACpB,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;wBAC5C,OAAO,IAAI,EAAE,GAAG,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;wBACzD,GAAG,GAAG,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;oBACrC,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAChC,OAAO,OAAO,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;IACnB,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/guards-evaluator/regex.js

@@ -0,0 +1,125 @@
+/**
+ * RE2-backed regex compilation with fallback to native RegExp.
+ *
+ * re2-wasm (Google's RE2 library compiled to WASM) guarantees linear-time
+ * matching, providing ReDoS protection for the vast majority of patterns.
+ * RE2 does not support lookaheads ((?!...)/(?=...)) or back-references —
+ * patterns using these constructs automatically fall back to native RegExp
+ * with a per-pattern warning. The overall engine preference order is:
+ *
+ *   1. RE2 (linear-time, ReDoS-safe)          — most patterns
+ *   2. native RegExp (fallback for lookaheads) — small set of patterns
+ *
+ * Note: re2-wasm requires the 'u' (unicode) flag; it is added automatically.
+ */
+// Cache of compiled regexes to avoid recompilation on repeated calls.
+const _cache = new Map();
+let _Re2 = null;
+let _re2Available = false;
+let _initDone = false;
+let _initPromise = null;
+async function _initRe2() {
+    try {
+        // Dynamic import — succeeds when re2-wasm is installed.
+        const mod = await import('re2-wasm');
+        _Re2 = mod.default.RE2;
+        // Smoke test
+        const r = new _Re2('hello', 'u');
+        r.test('hello');
+        _re2Available = true;
+    }
+    catch {
+        console.warn('[guards-evaluator] re2-wasm unavailable — falling back to native RegExp for all patterns. ' +
+            'ReDoS protection is NOT active. Consider installing re2-wasm.');
+        _re2Available = false;
+    }
+    finally {
+        _initDone = true;
+    }
+}
+// Kick off initialisation immediately so the engine is ready by first use.
+_initPromise = _initRe2();
+/**
+ * Returns whether re2-wasm has been successfully loaded.
+ * Exposed for tests.
+ */
+export function isRe2Available() {
+    return _re2Available;
+}
+/**
+ * Wait for the re2 initialisation to complete.
+ * Call this in async contexts (e.g. test setup) to ensure the engine is ready.
+ */
+export async function waitForRe2() {
+    if (!_initDone && _initPromise)
+        await _initPromise;
+}
+/**
+ * Compile a regex pattern and return an object with a `test` method.
+ *
+ * Uses RE2 (linear-time) when available and the pattern is compatible.
+ * Automatically falls back to native RegExp for patterns that use
+ * lookaheads, lookbehinds, or other RE2-unsupported constructs.
+ * Results are cached by pattern string.
+ *
+ * @throws {SyntaxError} if the pattern is syntactically invalid in both engines.
+ */
+export function compileRegex(pattern) {
+    const cached = _cache.get(pattern);
+    if (cached)
+        return cached;
+    let compiled;
+    if (_re2Available && _Re2) {
+        try {
+            // RE2 requires the 'u' flag (Unicode mode).
+            const re2Instance = new _Re2(pattern, 'u');
+            compiled = { test: (text) => re2Instance.test(text) };
+        }
+        catch {
+            // RE2 rejected the pattern — likely a lookahead/lookbehind/back-ref.
+            // Fall back to native RegExp for this specific pattern.
+            try {
+                const native = new RegExp(pattern);
+                compiled = { test: (text) => native.test(text) };
+            }
+            catch (nativeErr) {
+                throw new SyntaxError(`Invalid regex pattern "${pattern}": ${String(nativeErr)}`);
+            }
+        }
+    }
+    else {
+        try {
+            const native = new RegExp(pattern);
+            compiled = { test: (text) => native.test(text) };
+        }
+        catch (err) {
+            throw new SyntaxError(`Invalid regex pattern "${pattern}": ${String(err)}`);
+        }
+    }
+    _cache.set(pattern, compiled);
+    return compiled;
+}
+/**
+ * Returns true if the pattern can be compiled without error.
+ *
+ * Used at validation time to reject user-supplied patterns before they
+ * are stored. With RE2, patterns using lookaheads silently fall through to
+ * native RegExp — both engines must accept the pattern for this to return true.
+ */
+export function isRegexSafe(pattern) {
+    try {
+        compileRegex(pattern);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Clear the internal regex cache.
+ * Exposed for testing.
+ */
+export function clearRegexCache() {
+    _cache.clear();
+}
+//# sourceMappingURL=regex.js.map

package/dist/guards-evaluator/regex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"regex.js","sourceRoot":"","sources":["../../src/guards-evaluator/regex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,sEAAsE;AACtE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;AAIhD,IAAI,IAAI,GAA0B,IAAI,CAAC;AACvC,IAAI,aAAa,GAAG,KAAK,CAAC;AAC1B,IAAI,SAAS,GAAG,KAAK,CAAC;AACtB,IAAI,YAAY,GAAyB,IAAI,CAAC;AAE9C,KAAK,UAAU,QAAQ;IACrB,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAyC,CAAC;QAC7E,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;QACvB,aAAa;QACb,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChB,aAAa,GAAG,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CACV,4FAA4F;YAC5F,+DAA+D,CAChE,CAAC;QACF,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,YAAY,GAAG,QAAQ,EAAE,CAAC;AAE1B;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC,SAAS,IAAI,YAAY;QAAE,MAAM,YAAY,CAAC;AACrD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,QAAuB,CAAC;IAE5B,IAAI,aAAa,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAC3C,QAAQ,GAAG,EAAE,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,wDAAwD;YACxD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnC,QAAQ,GAAG,EAAE,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,MAAM,IAAI,WAAW,CAAC,0BAA0B,OAAO,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;YACnC,QAAQ,GAAG,EAAE,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,WAAW,CAAC,0BAA0B,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,IAAI,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC"}

package/dist/guards-evaluator/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/guards-evaluator/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/guards-evaluator/types.ts"],"names":[],"mappings":""}

package/dist/guards-evaluator/validation.js

@@ -0,0 +1,115 @@
+/**
+ * Rule validation — mirrors the Python matcher_validation.py constraints.
+ *
+ * validateRule(rule) → { ok, errors }
+ *
+ * Checks:
+ *  - Required fields: id, category, subcategory, action, severity
+ *  - At least one matcher field is non-empty
+ *  - commandRegex (if set) is valid (via isRegexSafe)
+ *  - Each glob in glob-list fields: non-empty, <=512 chars, no ** /** sequence
+ */
+import { isRegexSafe } from './regex.js';
+const VALID_ACTIONS = ['deny', 'warn', 'off'];
+const VALID_SEVERITIES = ['critical', 'high', 'medium', 'low'];
+const VALID_CATEGORIES = ['filesystem', 'shell', 'network', 'git', 'process'];
+const VALID_SUBCATEGORIES = [
+    'read', 'write', 'delete', 'list',
+    'privilege', 'install', 'env', 'exec', 'destructive', 'network',
+    'http', 'git', 'process',
+];
+const MAX_GLOB_LEN = 512;
+const REDUNDANT_DOUBLE_STAR = /\*\*\/\*\*/;
+const GLOB_FIELDS = [
+    'filePathGlobs',
+    'filePathExcludes',
+    'envNameGlobs',
+    'httpHostGlobs',
+    'httpHostExcludes',
+    'httpPathGlobs',
+    'gitRemoteGlobs',
+    'gitBranchGlobs',
+];
+function validateGlob(pattern, field) {
+    if (!pattern || pattern.length === 0) {
+        return `${field}: glob pattern must not be empty`;
+    }
+    if (pattern.length > MAX_GLOB_LEN) {
+        return `${field}: glob pattern must not exceed ${MAX_GLOB_LEN} chars (got ${pattern.length})`;
+    }
+    if (REDUNDANT_DOUBLE_STAR.test(pattern)) {
+        return `${field}: glob pattern contains redundant '**/**' sequence; use '**' alone`;
+    }
+    return null;
+}
+/**
+ * Validate a (possibly partial) rule object.
+ *
+ * Returns `{ ok: true, errors: [] }` on success or
+ * `{ ok: false, errors: string[] }` with reasons on failure.
+ */
+export function validateRule(rule) {
+    const errors = [];
+    // Required scalar fields
+    if (!rule.id || typeof rule.id !== 'string' || rule.id.trim() === '') {
+        errors.push('id: required non-empty string');
+    }
+    if (!rule.category || !VALID_CATEGORIES.includes(rule.category)) {
+        errors.push(`category: must be one of ${VALID_CATEGORIES.join(', ')}`);
+    }
+    if (!rule.subcategory || !VALID_SUBCATEGORIES.includes(rule.subcategory)) {
+        errors.push(`subcategory: must be one of ${VALID_SUBCATEGORIES.join(', ')}`);
+    }
+    if (!rule.action || !VALID_ACTIONS.includes(rule.action)) {
+        errors.push(`action: must be one of ${VALID_ACTIONS.join(', ')}`);
+    }
+    if (!rule.severity || !VALID_SEVERITIES.includes(rule.severity)) {
+        errors.push(`severity: must be one of ${VALID_SEVERITIES.join(', ')}`);
+    }
+    // At least one matcher field must be non-empty
+    const hasFile = (rule.filePathGlobs?.length ?? 0) > 0;
+    const hasCmd = !!rule.commandRegex || (rule.commandArgGlobs?.length ?? 0) > 0;
+    const hasEnv = (rule.envNameGlobs?.length ?? 0) > 0;
+    const hasHttp = (rule.httpHostGlobs?.length ?? 0) > 0 ||
+        (rule.httpMethod?.length ?? 0) > 0 ||
+        (rule.httpPathGlobs?.length ?? 0) > 0;
+    const hasGit = (rule.gitRemoteGlobs?.length ?? 0) > 0 ||
+        (rule.gitBranchGlobs?.length ?? 0) > 0 ||
+        (rule.gitSubcommand?.length ?? 0) > 0;
+    if (!hasFile && !hasCmd && !hasEnv && !hasHttp && !hasGit) {
+        errors.push('at least one matcher field (filePathGlobs, commandRegex, envNameGlobs, httpHostGlobs, gitSubcommand, …) must be non-empty');
+    }
+    // HTTP completeness: httpMethod / httpPathGlobs / httpHostExcludes require httpHostGlobs
+    const hasHttpHostGlobs = (rule.httpHostGlobs?.length ?? 0) > 0;
+    const hasHttpMethodOrPath = (rule.httpMethod?.length ?? 0) > 0 ||
+        (rule.httpPathGlobs?.length ?? 0) > 0 ||
+        (rule.httpHostExcludes?.length ?? 0) > 0;
+    if (hasHttpMethodOrPath && !hasHttpHostGlobs) {
+        errors.push('httpHostGlobs is required when httpMethod, httpPathGlobs, or httpHostExcludes is set');
+    }
+    // File completeness: filePathExcludes requires filePathGlobs
+    const hasFilePathGlobs = (rule.filePathGlobs?.length ?? 0) > 0;
+    const hasFilePathExcludes = (rule.filePathExcludes?.length ?? 0) > 0;
+    if (hasFilePathExcludes && !hasFilePathGlobs) {
+        errors.push('filePathGlobs is required when filePathExcludes is set');
+    }
+    // commandRegex validation
+    if (rule.commandRegex) {
+        if (!isRegexSafe(rule.commandRegex)) {
+            errors.push(`commandRegex: invalid or unsafe pattern "${rule.commandRegex}"`);
+        }
+    }
+    // Glob field validation
+    for (const field of GLOB_FIELDS) {
+        const globs = rule[field];
+        if (globs && Array.isArray(globs)) {
+            for (const glob of globs) {
+                const err = validateGlob(glob, String(field));
+                if (err)
+                    errors.push(err);
+            }
+        }
+    }
+    return errors.length === 0 ? { ok: true, errors: [] } : { ok: false, errors };
+}
+//# sourceMappingURL=validation.js.map

package/dist/guards-evaluator/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/guards-evaluator/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,aAAa,GAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAC9D,MAAM,gBAAgB,GAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC5E,MAAM,gBAAgB,GAAgB,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AAC3F,MAAM,mBAAmB,GAAkB;IACzC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;IACjC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS;IAC/D,MAAM,EAAE,KAAK,EAAE,SAAS;CACzB,CAAC;AAEF,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C,MAAM,WAAW,GAAsB;IACrC,eAAe;IACf,kBAAkB;IAClB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,SAAS,YAAY,CAAC,OAAe,EAAE,KAAa;IAClD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,KAAK,kCAAkC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAClC,OAAO,GAAG,KAAK,kCAAkC,YAAY,eAAe,OAAO,CAAC,MAAM,GAAG,CAAC;IAChG,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,KAAK,oEAAoE,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,yBAAyB;IACzB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,4BAA4B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,+BAA+B,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,0BAA0B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC,4BAA4B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,+CAA+C;IAC/C,MAAM,OAAO,GAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAO,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAClF,MAAM,MAAM,GAAO,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,OAAO,GAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACrC,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAClC,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACzD,MAAM,MAAM,GAAO,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACtC,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACtC,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAEzD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,2HAA2H,CAAC,CAAC;IAC3I,CAAC;IAED,yFAAyF;IACzF,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GACvB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAClC,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACrC,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,mBAAmB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CACT,sFAAsF,CACvF,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,mBAAmB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,4CAA4C,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAyB,CAAC;QAClD,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,IAAI,GAAG;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAChF,CAAC"}