@gate-forge/core 0.10.4 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/classifier/bind.d.ts +2 -2
- package/dist/classifier/bind.d.ts.map +1 -1
- package/dist/classifier/classify.d.ts +2 -2
- package/dist/classifier/classify.d.ts.map +1 -1
- package/dist/classifier/classify.js.map +1 -1
- package/dist/config/index.d.ts +286 -3
- package/dist/config/index.d.ts.map +1 -1
- package/dist/config/index.js +109 -0
- package/dist/config/index.js.map +1 -1
- package/dist/index.d.ts +51 -9
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +40 -6
- package/dist/index.js.map +1 -1
- package/dist/policy/business-rules.d.ts +143 -0
- package/dist/policy/business-rules.d.ts.map +1 -0
- package/dist/policy/business-rules.js +314 -0
- package/dist/policy/business-rules.js.map +1 -0
- package/dist/policy/evaluate.d.ts +8 -0
- package/dist/policy/evaluate.d.ts.map +1 -1
- package/dist/policy/index.d.ts +1 -0
- package/dist/policy/index.d.ts.map +1 -1
- package/dist/policy/index.js +1 -0
- package/dist/policy/index.js.map +1 -1
- package/dist/schemas/business-rules.d.ts +215 -0
- package/dist/schemas/business-rules.d.ts.map +1 -0
- package/dist/schemas/business-rules.js +227 -0
- package/dist/schemas/business-rules.js.map +1 -0
- package/dist/schemas/classification-policy.d.ts +74 -11
- package/dist/schemas/classification-policy.d.ts.map +1 -1
- package/dist/schemas/classification-policy.js +62 -28
- package/dist/schemas/classification-policy.js.map +1 -1
- package/dist/schemas/scan-config.d.ts +94 -0
- package/dist/schemas/scan-config.d.ts.map +1 -0
- package/dist/schemas/scan-config.js +101 -0
- package/dist/schemas/scan-config.js.map +1 -0
- package/dist/schemas/test-catalog.d.ts +12 -12
- package/dist/schemas/test-map.d.ts +4 -4
- package/dist/schemas/verdict.d.ts +4 -0
- package/dist/schemas/verdict.d.ts.map +1 -1
- package/dist/schemas/verdict.js +13 -0
- package/dist/schemas/verdict.js.map +1 -1
- package/dist/testing/gate-runner.d.ts +2 -2
- package/dist/testing/gate-runner.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -9,6 +9,7 @@
|
|
|
9
9
|
import { z } from 'zod';
|
|
10
10
|
import { compareStrings } from '../graph/util.js';
|
|
11
11
|
import { SchemaVersionField } from './common.js';
|
|
12
|
+
import { BusinessRulesSchema } from './business-rules.js';
|
|
12
13
|
/** One trusted internal entry-point category (worker, migration, …). */
|
|
13
14
|
export const InternalEntryPointCategorySchema = z
|
|
14
15
|
.object({
|
|
@@ -276,20 +277,58 @@ export const CoverageRuleSchema = z
|
|
|
276
277
|
})
|
|
277
278
|
.strict();
|
|
278
279
|
/**
|
|
279
|
-
*
|
|
280
|
-
*
|
|
281
|
-
* the
|
|
280
|
+
* One owner-declared PLANE rule list — the `planes:` section of the
|
|
281
|
+
* answers document (0.11.0, was `.gateforge/planes.json`). The section
|
|
282
|
+
* keeps the document shape it always had (`{ rules: [...] }`) so
|
|
283
|
+
* `gateforge migrate` is a pure text move, but the RULES themselves stay
|
|
284
|
+
* validated by the pack that applies them (one validation source, the
|
|
285
|
+
* same fail-closed reader that has always guarded them): this schema
|
|
286
|
+
* rejects a wrong document SHAPE and the owning reader rejects a wrong
|
|
287
|
+
* rule. Absent = no plane channel, byte-identical to today.
|
|
288
|
+
*/
|
|
289
|
+
export const PlanesSectionSchema = z
|
|
290
|
+
.object({
|
|
291
|
+
/** Owner-declared plane rules; validated by the SQLAlchemy pack. */
|
|
292
|
+
rules: z.array(z.unknown()),
|
|
293
|
+
})
|
|
294
|
+
.strict();
|
|
295
|
+
/**
|
|
296
|
+
* One owner-declared ENDPOINT-CAPABILITY rule list — the `endpoints:`
|
|
297
|
+
* section of the answers document (0.11.0, was `.gateforge/endpoints.json`).
|
|
298
|
+
* Same posture as {@link PlanesSectionSchema}: shape here, rules validated
|
|
299
|
+
* by the endpoint compiler that applies them.
|
|
300
|
+
*/
|
|
301
|
+
export const EndpointsSectionSchema = z
|
|
302
|
+
.object({
|
|
303
|
+
/** Owner-declared endpoint-capability rules; validated by the compiler. */
|
|
304
|
+
rules: z.array(z.unknown()),
|
|
305
|
+
})
|
|
306
|
+
.strict();
|
|
307
|
+
/**
|
|
308
|
+
* Repo-root-relative location of the ONE owner-answers document. Named
|
|
309
|
+
* once, in the package that owns the document, so every diagnostic that
|
|
310
|
+
* has to point the owner at a declaration — the refusals, the migrator,
|
|
311
|
+
* the packs — names the same path.
|
|
312
|
+
*/
|
|
313
|
+
export const OWNER_ANSWERS_PATH = '.gateforge/classification-policy.yml';
|
|
314
|
+
/**
|
|
315
|
+
* The classification-policy document: the ONE owner-answers file
|
|
316
|
+
* (`.gateforge/classification-policy.yml`, name kept by owner decision).
|
|
317
|
+
* Since 0.11.0 it holds every owner answer — trusted internal
|
|
318
|
+
* entry-point categories, organization internal rules, exact lifecycle
|
|
319
|
+
* disables, delete semantics, plane rules, endpoint capabilities, and
|
|
320
|
+
* the owner's business `rules:`.
|
|
321
|
+
*
|
|
322
|
+
* The SCANNER settings (`scanRoots`, `coverage`, `declarations`,
|
|
323
|
+
* `volatileFields`) MOVED OUT to `.gateforge.yml` under `scan:`, next to
|
|
324
|
+
* the other machine-wide declarations. They are no longer accepted here:
|
|
325
|
+
* a repository still carrying them fails closed naming `gateforge
|
|
326
|
+
* migrate` rather than silently running on a setting the engine cannot
|
|
327
|
+
* see.
|
|
282
328
|
*/
|
|
283
329
|
export const ClassificationPolicySchema = z
|
|
284
330
|
.object({
|
|
285
331
|
schemaVersion: SchemaVersionField,
|
|
286
|
-
/**
|
|
287
|
-
* Repo-root-relative globs defining the scope a closed-world proof
|
|
288
|
-
* must cover. A non-empty list is the prerequisite of every
|
|
289
|
-
* complete-scan attestation (ADR 0003 D4); findings or unresolved
|
|
290
|
-
* entries inside these roots invalidate the attestation.
|
|
291
|
-
*/
|
|
292
|
-
scanRoots: z.array(z.string().min(1)).min(1),
|
|
293
332
|
/** Entry-point categories counted as trusted-internal reachability. */
|
|
294
333
|
trustedInternalEntryPoints: z.array(InternalEntryPointCategorySchema),
|
|
295
334
|
/** Organization internal rules — certificate inputs, never overrides. */
|
|
@@ -301,28 +340,23 @@ export const ClassificationPolicySchema = z
|
|
|
301
340
|
* Declaring semantics ADDS an evidence contract — it can resolve
|
|
302
341
|
* DELETE_SEMANTICS_UNRESOLVED, never remove an obligation: detector
|
|
303
342
|
* evidence that disagrees still blocks as a contradiction.
|
|
343
|
+
*
|
|
344
|
+
* This is the hard/archive answer for a RESOURCE: the rule's `match`
|
|
345
|
+
* glob names a source file, so a DELETE route that links no resource
|
|
346
|
+
* (a link-row teardown, a draft discard) cannot be answered here —
|
|
347
|
+
* that case is declared as `crud-delete`/`crud-archive` in `endpoints:`.
|
|
304
348
|
*/
|
|
305
349
|
deleteRules: DeleteRulesSchema.optional(),
|
|
350
|
+
/** Owner-declared data-plane rules (was `.gateforge/planes.json`). */
|
|
351
|
+
planes: PlanesSectionSchema.optional(),
|
|
352
|
+
/** Owner-declared endpoint capabilities (was `.gateforge/endpoints.json`). */
|
|
353
|
+
endpoints: EndpointsSectionSchema.optional(),
|
|
306
354
|
/**
|
|
307
|
-
*
|
|
308
|
-
|
|
309
|
-
|
|
310
|
-
* file. Declaring none means no scan is provably complete — closed-
|
|
311
|
-
* world proofs stay unavailable (fail closed).
|
|
312
|
-
*/
|
|
313
|
-
coverage: z.array(CoverageRuleSchema).optional(),
|
|
314
|
-
/**
|
|
315
|
-
* Supported source declaration syntax: the machine-readable keys
|
|
316
|
-
* detectors may translate into declaration signals (e.g.
|
|
317
|
-
* `internality: 'gateforge:internal'`). Declarations are assertions
|
|
318
|
-
* consumed by the classifier — contradictory code signals still block.
|
|
319
|
-
*/
|
|
320
|
-
declarations: z.record(z.string(), z.string().min(1)),
|
|
321
|
-
/**
|
|
322
|
-
* Bookkeeping columns that never satisfy an update by themselves
|
|
323
|
-
* (mirrors the verdict engine's `updateableFields` fail-closed rule).
|
|
355
|
+
* The owner's BUSINESS RULES (0.11.0). Each rule names the test type
|
|
356
|
+
* that must prove it and its observable cases. Absent = the feature is
|
|
357
|
+
off, byte for byte: no finding, no report row, no digest change.
|
|
324
358
|
*/
|
|
325
|
-
|
|
359
|
+
rules: BusinessRulesSchema.optional(),
|
|
326
360
|
})
|
|
327
361
|
.strict();
|
|
328
362
|
//# sourceMappingURL=classification-policy.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"classification-policy.js","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"classification-policy.js","sourceRoot":"","sources":["../../src/schemas/classification-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,wEAAwE;AACxE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC9C,MAAM,CAAC;IACN,0DAA0D;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;OAGG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C;;;;;;;OAOG;IACH,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,yFAAyF;IACzF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE;IACvF,OAAO,EAAE,yEAAyE;CACnF,CAAC,CAAC;AAKL,qFAAqF;AACrF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,6BAA6B;IAC7B,KAAK,EAAE,uBAAuB;IAC9B,qFAAqF;IACrF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAKpF,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;KACtC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;IACzC,OAAO,EAAE,yDAAyD;CACnE,CAAC;KACD,KAAK,CACJ,yCAAyC,EACzC,mGAAmG,CACpG;KACA,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IAC5C,OAAO,EAAE,4DAA4D;CACtE,CAAC,CAAC;AAEL,wDAAwD;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,yEAAyE;IACzE,UAAU,EAAE,qBAAqB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,oDAAoD;IACpD,KAAK,EAAE,wBAAwB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,EAAE,oDAAoD,CAAC;SAC5D,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,SAAS,KAAK,SAAS;gBAAE,SAAS;YACtC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,CAAC;oBACb,OAAO,EAAE,2CAA2C,SAAS,GAAG;iBACjE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACJ,uEAAuE;IACvE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;QACzC,OAAO,EAAE,qDAAqD;KAC/D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACvD,OAAO,EAAE,4CAA4C;KACtD,CAAC;CACL,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,KAAK,CAAC,mBAAmB,CAAC;KAC1B,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;gBACpC,OAAO,EACL,iCAAiC,UAAU,gCAAgC,KAAK,KAAK;oBACrF,mDAAmD;aACtD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,KAA+B;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAiB,oBAAoB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,KAAK,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,IAAI;QACP,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;KACrF,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAKjE;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC;KACjC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;IACzC,OAAO,EAAE,oDAAoD;CAC9D,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;IACxC,OAAO,EAAE,qCAAqC;CAC/C,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE;IACzC,OAAO,EAAE,6CAA6C;CACvD,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;IACnD,OAAO,EAAE,sCAAsC;CAChD,CAAC,CAAC;AAEL,sEAAsE;AACtE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAExG,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,uEAAuE;IACvE,KAAK,EAAE,qBAAqB;IAC5B,kEAAkE;IAClE,SAAS,EAAE,qBAAqB;IAChC;;;;;OAKG;IACH,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAC7C,uEAAuE;IACvE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;SAClC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE;QACzC,OAAO,EAAE,qDAAqD;KAC/D,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACvD,OAAO,EAAE,4CAA4C;KACtD,CAAC;CACL,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,mFAAmF;gBACnF,oEAAoE;SACvE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,iFAAiF;gBACjF,gCAAgC;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAKL,wEAAwE;AACxE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,KAAK,CAAC,gBAAgB,CAAC;KACvB,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;gBACtB,OAAO,EACL,8BAA8B,KAAK,gCAAgC,KAAK,KAAK;oBAC7E,wDAAwD;aAC3D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,oEAAoE;IACpE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,2EAA2E;IAC3E,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAEzE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,aAAa,EAAE,kBAAkB;IACjC,uEAAuE;IACvE,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC;IACrE,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IAC1C,8EAA8E;IAC9E,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC/C;;;;;;;;;;OAUG;IACH,WAAW,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACzC,sEAAsE;IACtE,MAAM,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACtC,8EAA8E;IAC9E,SAAS,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAC5C;;;;OAIG;IACH,KAAK,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC"}
|
|
@@ -0,0 +1,94 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `scan:` — the SCANNER settings section of `.gateforge.yml` (0.11.0).
|
|
3
|
+
*
|
|
4
|
+
* These four settings used to live in `classification-policy.yml`
|
|
5
|
+
* (`scanRoots`, `coverage`, `declarations`, `volatileFields`). They moved
|
|
6
|
+
* here for ONE reason: they are not owner ANSWERS, they are machine-wide
|
|
7
|
+
* scan configuration, and the answers file now holds exactly the answers.
|
|
8
|
+
* They are still inside the owner-approved policy digest, because
|
|
9
|
+
* `.gateforge.yml` is a trusted-policy input like every other declaration
|
|
10
|
+
* there — the move changes which document an agent has to edit, never who
|
|
11
|
+
* has to approve it.
|
|
12
|
+
*
|
|
13
|
+
* The section also carries the two detector configuration documents that
|
|
14
|
+
* used to be their own files (`scan.httpClients`, was
|
|
15
|
+
* `.gateforge/http-clients.json`; `scan.fastapi`, was
|
|
16
|
+
* `.gateforge/fastapi.json`), for the same reason and with the same
|
|
17
|
+
* rule: the SHAPE is checked here, the RULES by the detector that applies
|
|
18
|
+
* them (one validation source, unchanged from the readers that have always
|
|
19
|
+
* guarded them).
|
|
20
|
+
*/
|
|
21
|
+
import { z } from 'zod';
|
|
22
|
+
import type { ClassificationPolicy } from './classification-policy.js';
|
|
23
|
+
/**
|
|
24
|
+
* One owner-declared HTTP client-scan section (was
|
|
25
|
+
* `.gateforge/http-clients.json`). Shape here; the client-symbol /
|
|
26
|
+
* wrapper / URL-builder / same-origin rules are validated by pack-http's
|
|
27
|
+
* own reader, which is the single source of truth for that document.
|
|
28
|
+
*/
|
|
29
|
+
export declare const HttpClientsScanSectionSchema: z.ZodObject<{
|
|
30
|
+
clientSymbols: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
31
|
+
wrapperFunctions: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
32
|
+
urlBuilders: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
33
|
+
sameOriginHosts: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
34
|
+
clientScanRoots: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
35
|
+
serverScanRoots: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
36
|
+
}, z.core.$strict>;
|
|
37
|
+
/** Inferred `scan.httpClients` shape. */
|
|
38
|
+
export type HttpClientsScanSection = z.infer<typeof HttpClientsScanSectionSchema>;
|
|
39
|
+
/**
|
|
40
|
+
* One owner-declared FastAPI scan section (was `.gateforge/fastapi.json`):
|
|
41
|
+
* repo-root-relative directories acting as Python import roots.
|
|
42
|
+
*/
|
|
43
|
+
export declare const FastapiScanSectionSchema: z.ZodObject<{
|
|
44
|
+
importRoots: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
45
|
+
}, z.core.$strict>;
|
|
46
|
+
/** Inferred `scan.fastapi` shape. */
|
|
47
|
+
export type FastapiScanSection = z.infer<typeof FastapiScanSectionSchema>;
|
|
48
|
+
/**
|
|
49
|
+
* The `scan:` section of `.gateforge.yml`. REQUIRED: a repository without
|
|
50
|
+
* it has not answered "what does a closed-world proof have to cover", and
|
|
51
|
+
* defaulting that would silently weaken every suppressive decision. The
|
|
52
|
+
* key lives in `.gateforge.yml`, so it is inside the trusted policy
|
|
53
|
+
* digest exactly like the settings it replaces.
|
|
54
|
+
*/
|
|
55
|
+
export declare const ScanConfigSchema: z.ZodObject<{
|
|
56
|
+
scanRoots: z.ZodArray<z.ZodString>;
|
|
57
|
+
coverage: z.ZodOptional<z.ZodArray<z.ZodObject<{
|
|
58
|
+
capability: z.ZodString;
|
|
59
|
+
detector: z.ZodString;
|
|
60
|
+
appliesTo: z.ZodArray<z.ZodString>;
|
|
61
|
+
exhaustive: z.ZodOptional<z.ZodBoolean>;
|
|
62
|
+
}, z.core.$strict>>>;
|
|
63
|
+
declarations: z.ZodRecord<z.ZodString, z.ZodString>;
|
|
64
|
+
volatileFields: z.ZodArray<z.ZodString>;
|
|
65
|
+
httpClients: z.ZodOptional<z.ZodObject<{
|
|
66
|
+
clientSymbols: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
67
|
+
wrapperFunctions: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
68
|
+
urlBuilders: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
69
|
+
sameOriginHosts: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
70
|
+
clientScanRoots: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
71
|
+
serverScanRoots: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
72
|
+
}, z.core.$strict>>;
|
|
73
|
+
fastapi: z.ZodOptional<z.ZodObject<{
|
|
74
|
+
importRoots: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
|
|
75
|
+
}, z.core.$strict>>;
|
|
76
|
+
}, z.core.$strict>;
|
|
77
|
+
/** Inferred `scan:` section shape. */
|
|
78
|
+
export type ScanConfig = z.infer<typeof ScanConfigSchema>;
|
|
79
|
+
/** The scanner keys that used to live in `classification-policy.yml`. */
|
|
80
|
+
export declare const MOVED_SCANNER_KEYS: readonly ["scanRoots", "coverage", "declarations", "volatileFields"];
|
|
81
|
+
/** Union of the moved scanner keys. */
|
|
82
|
+
export type MovedScannerKey = (typeof MOVED_SCANNER_KEYS)[number];
|
|
83
|
+
/** Whether `key` is one of the scanner settings that moved to `.gateforge.yml`. */
|
|
84
|
+
export declare function isMovedScannerKey(key: string): key is MovedScannerKey;
|
|
85
|
+
/**
|
|
86
|
+
* What the classifier ACTUALLY consumes: the owner answers and the
|
|
87
|
+
* scanner settings, composed by the caller from the two documents they
|
|
88
|
+
* now live in. The classifier has always needed both (a suppressive
|
|
89
|
+
* decision needs an owner answer AND the scan scope that makes it
|
|
90
|
+
* provable), and it still gets exactly one object — so nothing in the
|
|
91
|
+
* lattice learned that the two documents were split.
|
|
92
|
+
*/
|
|
93
|
+
export type ClassifierPolicy = ClassificationPolicy & ScanConfig;
|
|
94
|
+
//# sourceMappingURL=scan-config.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scan-config.d.ts","sourceRoot":"","sources":["../../src/schemas/scan-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;;;;;;;kBAe9B,CAAC;AAEZ,yCAAyC;AACzC,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;GAGG;AACH,eAAO,MAAM,wBAAwB;;kBAK1B,CAAC;AAEZ,qCAAqC;AACrC,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAgClB,CAAC;AAEZ,sCAAsC;AACtC,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,yEAAyE;AACzE,eAAO,MAAM,kBAAkB,sEAAuE,CAAC;AAEvG,uCAAuC;AACvC,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,IAAI,eAAe,CAErE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,UAAU,CAAC"}
|
|
@@ -0,0 +1,101 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* `scan:` — the SCANNER settings section of `.gateforge.yml` (0.11.0).
|
|
3
|
+
*
|
|
4
|
+
* These four settings used to live in `classification-policy.yml`
|
|
5
|
+
* (`scanRoots`, `coverage`, `declarations`, `volatileFields`). They moved
|
|
6
|
+
* here for ONE reason: they are not owner ANSWERS, they are machine-wide
|
|
7
|
+
* scan configuration, and the answers file now holds exactly the answers.
|
|
8
|
+
* They are still inside the owner-approved policy digest, because
|
|
9
|
+
* `.gateforge.yml` is a trusted-policy input like every other declaration
|
|
10
|
+
* there — the move changes which document an agent has to edit, never who
|
|
11
|
+
* has to approve it.
|
|
12
|
+
*
|
|
13
|
+
* The section also carries the two detector configuration documents that
|
|
14
|
+
* used to be their own files (`scan.httpClients`, was
|
|
15
|
+
* `.gateforge/http-clients.json`; `scan.fastapi`, was
|
|
16
|
+
* `.gateforge/fastapi.json`), for the same reason and with the same
|
|
17
|
+
* rule: the SHAPE is checked here, the RULES by the detector that applies
|
|
18
|
+
* them (one validation source, unchanged from the readers that have always
|
|
19
|
+
* guarded them).
|
|
20
|
+
*/
|
|
21
|
+
import { z } from 'zod';
|
|
22
|
+
import { CoverageRuleSchema } from './classification-policy.js';
|
|
23
|
+
/**
|
|
24
|
+
* One owner-declared HTTP client-scan section (was
|
|
25
|
+
* `.gateforge/http-clients.json`). Shape here; the client-symbol /
|
|
26
|
+
* wrapper / URL-builder / same-origin rules are validated by pack-http's
|
|
27
|
+
* own reader, which is the single source of truth for that document.
|
|
28
|
+
*/
|
|
29
|
+
export const HttpClientsScanSectionSchema = z
|
|
30
|
+
.object({
|
|
31
|
+
/** Instance symbols exposing verb methods, e.g. `['apiClient']`. */
|
|
32
|
+
clientSymbols: z.array(z.unknown()).optional(),
|
|
33
|
+
/** Wrapper callables with the concrete method they always issue. */
|
|
34
|
+
wrapperFunctions: z.array(z.unknown()).optional(),
|
|
35
|
+
/** Pure URL builders with an optional literal base. */
|
|
36
|
+
urlBuilders: z.array(z.unknown()).optional(),
|
|
37
|
+
/** Absolute-URL hosts treated as same-origin. */
|
|
38
|
+
sameOriginHosts: z.array(z.unknown()).optional(),
|
|
39
|
+
/** Globs limiting client-call scanning. */
|
|
40
|
+
clientScanRoots: z.array(z.unknown()).optional(),
|
|
41
|
+
/** Globs limiting generic server-route scanning. */
|
|
42
|
+
serverScanRoots: z.array(z.unknown()).optional(),
|
|
43
|
+
})
|
|
44
|
+
.strict();
|
|
45
|
+
/**
|
|
46
|
+
* One owner-declared FastAPI scan section (was `.gateforge/fastapi.json`):
|
|
47
|
+
* repo-root-relative directories acting as Python import roots.
|
|
48
|
+
*/
|
|
49
|
+
export const FastapiScanSectionSchema = z
|
|
50
|
+
.object({
|
|
51
|
+
/** Repo-root-relative import roots for ABSOLUTE imports. */
|
|
52
|
+
importRoots: z.array(z.unknown()).optional(),
|
|
53
|
+
})
|
|
54
|
+
.strict();
|
|
55
|
+
/**
|
|
56
|
+
* The `scan:` section of `.gateforge.yml`. REQUIRED: a repository without
|
|
57
|
+
* it has not answered "what does a closed-world proof have to cover", and
|
|
58
|
+
* defaulting that would silently weaken every suppressive decision. The
|
|
59
|
+
* key lives in `.gateforge.yml`, so it is inside the trusted policy
|
|
60
|
+
* digest exactly like the settings it replaces.
|
|
61
|
+
*/
|
|
62
|
+
export const ScanConfigSchema = z
|
|
63
|
+
.object({
|
|
64
|
+
/**
|
|
65
|
+
* Repo-root-relative globs defining the scope a closed-world proof
|
|
66
|
+
* must cover. A non-empty list is the prerequisite of every
|
|
67
|
+
* complete-scan attestation (ADR 0003 D4).
|
|
68
|
+
*/
|
|
69
|
+
scanRoots: z.array(z.string().min(1)).min(1),
|
|
70
|
+
/**
|
|
71
|
+
* Coverage requirements for COMPLETE-scan proofs (ADR 0003 D4). A
|
|
72
|
+
* closed-world attestation holds only when every rule's detector is
|
|
73
|
+
* configured, reports coverage, and covers every applicable requested
|
|
74
|
+
* file. Declaring none means no scan is provably complete — closed-
|
|
75
|
+
* world proofs stay unavailable (fail closed).
|
|
76
|
+
*/
|
|
77
|
+
coverage: z.array(CoverageRuleSchema).optional(),
|
|
78
|
+
/**
|
|
79
|
+
* Supported source declaration syntax: the machine-readable keys
|
|
80
|
+
* detectors may translate into declaration signals (e.g.
|
|
81
|
+
* `internality: 'gateforge:internal'`).
|
|
82
|
+
*/
|
|
83
|
+
declarations: z.record(z.string(), z.string().min(1)),
|
|
84
|
+
/**
|
|
85
|
+
* Bookkeeping columns that never satisfy an update by themselves
|
|
86
|
+
* (mirrors the verdict engine's `updateableFields` fail-closed rule).
|
|
87
|
+
*/
|
|
88
|
+
volatileFields: z.array(z.string().min(1)),
|
|
89
|
+
/** HTTP client-scan settings (was `.gateforge/http-clients.json`). */
|
|
90
|
+
httpClients: HttpClientsScanSectionSchema.optional(),
|
|
91
|
+
/** FastAPI import roots (was `.gateforge/fastapi.json`). */
|
|
92
|
+
fastapi: FastapiScanSectionSchema.optional(),
|
|
93
|
+
})
|
|
94
|
+
.strict();
|
|
95
|
+
/** The scanner keys that used to live in `classification-policy.yml`. */
|
|
96
|
+
export const MOVED_SCANNER_KEYS = ['scanRoots', 'coverage', 'declarations', 'volatileFields'];
|
|
97
|
+
/** Whether `key` is one of the scanner settings that moved to `.gateforge.yml`. */
|
|
98
|
+
export function isMovedScannerKey(key) {
|
|
99
|
+
return MOVED_SCANNER_KEYS.includes(key);
|
|
100
|
+
}
|
|
101
|
+
//# sourceMappingURL=scan-config.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"scan-config.js","sourceRoot":"","sources":["../../src/schemas/scan-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,oEAAoE;IACpE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjD,uDAAuD;IACvD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,iDAAiD;IACjD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,2CAA2C;IAC3C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD,oDAAoD;IACpD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,4DAA4D;IAC5D,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN;;;;OAIG;IACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAChD;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1C,sEAAsE;IACtE,WAAW,EAAE,4BAA4B,CAAC,QAAQ,EAAE;IACpD,4DAA4D;IAC5D,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,yEAAyE;AACzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,CAAU,CAAC;AAKvG,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC"}
|
|
@@ -55,10 +55,10 @@ export declare const TestKindSchema: z.ZodEnum<{
|
|
|
55
55
|
unknown: "unknown";
|
|
56
56
|
"browser-e2e": "browser-e2e";
|
|
57
57
|
"observed-e2e": "observed-e2e";
|
|
58
|
-
"server-e2e": "server-e2e";
|
|
59
|
-
"api-e2e": "api-e2e";
|
|
60
58
|
unit: "unit";
|
|
61
59
|
integration: "integration";
|
|
60
|
+
"server-e2e": "server-e2e";
|
|
61
|
+
"api-e2e": "api-e2e";
|
|
62
62
|
component: "component";
|
|
63
63
|
}>;
|
|
64
64
|
/** Inferred test-kind type. */
|
|
@@ -109,10 +109,10 @@ export declare const KindSignalSchema: z.ZodObject<{
|
|
|
109
109
|
unknown: "unknown";
|
|
110
110
|
"browser-e2e": "browser-e2e";
|
|
111
111
|
"observed-e2e": "observed-e2e";
|
|
112
|
-
"server-e2e": "server-e2e";
|
|
113
|
-
"api-e2e": "api-e2e";
|
|
114
112
|
unit: "unit";
|
|
115
113
|
integration: "integration";
|
|
114
|
+
"server-e2e": "server-e2e";
|
|
115
|
+
"api-e2e": "api-e2e";
|
|
116
116
|
component: "component";
|
|
117
117
|
}>;
|
|
118
118
|
}, z.core.$strict>;
|
|
@@ -217,10 +217,10 @@ export declare const TestCatalogEntrySchema: z.ZodObject<{
|
|
|
217
217
|
unknown: "unknown";
|
|
218
218
|
"browser-e2e": "browser-e2e";
|
|
219
219
|
"observed-e2e": "observed-e2e";
|
|
220
|
-
"server-e2e": "server-e2e";
|
|
221
|
-
"api-e2e": "api-e2e";
|
|
222
220
|
unit: "unit";
|
|
223
221
|
integration: "integration";
|
|
222
|
+
"server-e2e": "server-e2e";
|
|
223
|
+
"api-e2e": "api-e2e";
|
|
224
224
|
component: "component";
|
|
225
225
|
}>;
|
|
226
226
|
kindSignals: z.ZodArray<z.ZodObject<{
|
|
@@ -235,10 +235,10 @@ export declare const TestCatalogEntrySchema: z.ZodObject<{
|
|
|
235
235
|
unknown: "unknown";
|
|
236
236
|
"browser-e2e": "browser-e2e";
|
|
237
237
|
"observed-e2e": "observed-e2e";
|
|
238
|
-
"server-e2e": "server-e2e";
|
|
239
|
-
"api-e2e": "api-e2e";
|
|
240
238
|
unit: "unit";
|
|
241
239
|
integration: "integration";
|
|
240
|
+
"server-e2e": "server-e2e";
|
|
241
|
+
"api-e2e": "api-e2e";
|
|
242
242
|
component: "component";
|
|
243
243
|
}>;
|
|
244
244
|
}, z.core.$strict>>;
|
|
@@ -357,10 +357,10 @@ export declare const TestCatalogSchema: z.ZodObject<{
|
|
|
357
357
|
unknown: "unknown";
|
|
358
358
|
"browser-e2e": "browser-e2e";
|
|
359
359
|
"observed-e2e": "observed-e2e";
|
|
360
|
-
"server-e2e": "server-e2e";
|
|
361
|
-
"api-e2e": "api-e2e";
|
|
362
360
|
unit: "unit";
|
|
363
361
|
integration: "integration";
|
|
362
|
+
"server-e2e": "server-e2e";
|
|
363
|
+
"api-e2e": "api-e2e";
|
|
364
364
|
component: "component";
|
|
365
365
|
}>;
|
|
366
366
|
kindSignals: z.ZodArray<z.ZodObject<{
|
|
@@ -375,10 +375,10 @@ export declare const TestCatalogSchema: z.ZodObject<{
|
|
|
375
375
|
unknown: "unknown";
|
|
376
376
|
"browser-e2e": "browser-e2e";
|
|
377
377
|
"observed-e2e": "observed-e2e";
|
|
378
|
-
"server-e2e": "server-e2e";
|
|
379
|
-
"api-e2e": "api-e2e";
|
|
380
378
|
unit: "unit";
|
|
381
379
|
integration: "integration";
|
|
380
|
+
"server-e2e": "server-e2e";
|
|
381
|
+
"api-e2e": "api-e2e";
|
|
382
382
|
component: "component";
|
|
383
383
|
}>;
|
|
384
384
|
}, z.core.$strict>>;
|
|
@@ -54,10 +54,10 @@ export declare const TestMapEntrySchema: z.ZodObject<{
|
|
|
54
54
|
unknown: "unknown";
|
|
55
55
|
"browser-e2e": "browser-e2e";
|
|
56
56
|
"observed-e2e": "observed-e2e";
|
|
57
|
-
"server-e2e": "server-e2e";
|
|
58
|
-
"api-e2e": "api-e2e";
|
|
59
57
|
unit: "unit";
|
|
60
58
|
integration: "integration";
|
|
59
|
+
"server-e2e": "server-e2e";
|
|
60
|
+
"api-e2e": "api-e2e";
|
|
61
61
|
component: "component";
|
|
62
62
|
}>>;
|
|
63
63
|
source: z.ZodOptional<z.ZodLiteral<"annotation">>;
|
|
@@ -88,10 +88,10 @@ export declare const TestMapSchema: z.ZodObject<{
|
|
|
88
88
|
unknown: "unknown";
|
|
89
89
|
"browser-e2e": "browser-e2e";
|
|
90
90
|
"observed-e2e": "observed-e2e";
|
|
91
|
-
"server-e2e": "server-e2e";
|
|
92
|
-
"api-e2e": "api-e2e";
|
|
93
91
|
unit: "unit";
|
|
94
92
|
integration: "integration";
|
|
93
|
+
"server-e2e": "server-e2e";
|
|
94
|
+
"api-e2e": "api-e2e";
|
|
95
95
|
component: "component";
|
|
96
96
|
}>>;
|
|
97
97
|
source: z.ZodOptional<z.ZodLiteral<"annotation">>;
|
|
@@ -87,6 +87,10 @@ export declare const CauseCodeSchema: z.ZodEnum<{
|
|
|
87
87
|
RESOURCE_SINGLETON_PER_TENANT: "RESOURCE_SINGLETON_PER_TENANT";
|
|
88
88
|
RESPONSE_FIELD_MISSING_FROM_MODEL: "RESPONSE_FIELD_MISSING_FROM_MODEL";
|
|
89
89
|
TWIN_PATH_DIVERGENT: "TWIN_PATH_DIVERGENT";
|
|
90
|
+
BUSINESS_RULE_TEST_MISSING: "BUSINESS_RULE_TEST_MISSING";
|
|
91
|
+
BUSINESS_RULE_TEST_TYPE_MISMATCH: "BUSINESS_RULE_TEST_TYPE_MISMATCH";
|
|
92
|
+
BUSINESS_RULE_TEST_UNPROVEN: "BUSINESS_RULE_TEST_UNPROVEN";
|
|
93
|
+
BUSINESS_RULE_TEST_FAILING: "BUSINESS_RULE_TEST_FAILING";
|
|
90
94
|
}>;
|
|
91
95
|
/** Inferred cause-code union. */
|
|
92
96
|
export type CauseCode = z.infer<typeof CauseCodeSchema>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../src/schemas/verdict.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;EAQxB,CAAC;AAEH,8BAA8B;AAC9B,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB;;;;;;;;kBASxB,CAAC;AAEZ,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe
|
|
1
|
+
{"version":3,"file":"verdict.d.ts","sourceRoot":"","sources":["../../src/schemas/verdict.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;EAQxB,CAAC;AAEH,8BAA8B;AAC9B,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB;;;;;;;;kBASxB,CAAC;AAEZ,wCAAwC;AACxC,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmD1B,CAAC;AAEH,iCAAiC;AACjC,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CA8FjE,CAAC"}
|
package/dist/schemas/verdict.js
CHANGED
|
@@ -85,6 +85,10 @@ export const CauseCodeSchema = z.enum([
|
|
|
85
85
|
'RESOURCE_SINGLETON_PER_TENANT',
|
|
86
86
|
'RESPONSE_FIELD_MISSING_FROM_MODEL',
|
|
87
87
|
'TWIN_PATH_DIVERGENT',
|
|
88
|
+
'BUSINESS_RULE_TEST_MISSING',
|
|
89
|
+
'BUSINESS_RULE_TEST_TYPE_MISMATCH',
|
|
90
|
+
'BUSINESS_RULE_TEST_UNPROVEN',
|
|
91
|
+
'BUSINESS_RULE_TEST_FAILING',
|
|
88
92
|
]);
|
|
89
93
|
/**
|
|
90
94
|
* The plan §5.4 next action per cause code. Text, JSON, and SARIF
|
|
@@ -152,5 +156,14 @@ export const CAUSE_NEXT_ACTIONS = Object.freeze({
|
|
|
152
156
|
'response model (or read the one it declares). A test that mocks the response proves nothing ' +
|
|
153
157
|
'about this read',
|
|
154
158
|
TWIN_PATH_DIVERGENT: 'Make the raw test and its witnessed twin send the same request: align the shared helper defaults, or map the pair with `twinOf`',
|
|
159
|
+
BUSINESS_RULE_TEST_MISSING: 'Write the test the rule names (a starter is printed by `gateforge next`), then map it with ' +
|
|
160
|
+
'`gateforge tests mark --rule <rule>/<case> --test <file>#<title> --kind <kind> --reason "…"`. ' +
|
|
161
|
+
'A mapping alone is a declaration, never a proof.',
|
|
162
|
+
BUSINESS_RULE_TEST_TYPE_MISMATCH: 'Map a test of the type the rule names (`gateforge tests explain` lists the accepted kinds): a ' +
|
|
163
|
+
'weaker test kind never satisfies a stronger rule type.',
|
|
164
|
+
BUSINESS_RULE_TEST_UNPROVEN: 'Run the mapped test under supervision for this exact candidate (`gateforge test-gates`). A case ' +
|
|
165
|
+
'with no passing, witnessed run is `unproven`, never satisfied.',
|
|
166
|
+
BUSINESS_RULE_TEST_FAILING: 'Fix the mapped test or the behaviour it proves: every mapped test of a case must pass (a green ' +
|
|
167
|
+
'sibling never forgives a red one).',
|
|
155
168
|
});
|
|
156
169
|
//# sourceMappingURL=verdict.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../../src/schemas/verdict.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,WAAW;IACX,SAAS;IACT,SAAS;IACT,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,OAAO;CACR,CAAC,CAAC;AAKH,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,kEAAkE;IAClE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,uDAAuD;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,4CAA4C;IAC5C,QAAQ,EAAE,cAAc;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,2BAA2B;IAC3B,mBAAmB;IACnB,sBAAsB;IACtB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,wBAAwB;IACxB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,uBAAuB;IACvB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,2BAA2B;IAC3B,0BAA0B;IAC1B,wBAAwB;IACxB,uBAAuB;IACvB,2BAA2B;IAC3B,0BAA0B;IAC1B,8BAA8B;IAC9B,4BAA4B;IAC5B,iCAAiC;IACjC,4BAA4B;IAC5B,0BAA0B;IAC1B,oBAAoB;IACpB,mBAAmB;IACnB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;IACpB,0BAA0B;IAC1B,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,mCAAmC;IACnC,qBAAqB;
|
|
1
|
+
{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../../src/schemas/verdict.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,WAAW;IACX,SAAS;IACT,SAAS;IACT,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,OAAO;CACR,CAAC,CAAC;AAKH,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,kEAAkE;IAClE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,uDAAuD;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,4CAA4C;IAC5C,QAAQ,EAAE,cAAc;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,2BAA2B;IAC3B,mBAAmB;IACnB,sBAAsB;IACtB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,wBAAwB;IACxB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,2BAA2B;IAC3B,uBAAuB;IACvB,yBAAyB;IACzB,0BAA0B;IAC1B,uBAAuB;IACvB,yBAAyB;IACzB,2BAA2B;IAC3B,yBAAyB;IACzB,2BAA2B;IAC3B,0BAA0B;IAC1B,wBAAwB;IACxB,uBAAuB;IACvB,2BAA2B;IAC3B,0BAA0B;IAC1B,8BAA8B;IAC9B,4BAA4B;IAC5B,iCAAiC;IACjC,4BAA4B;IAC5B,0BAA0B;IAC1B,oBAAoB;IACpB,mBAAmB;IACnB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;IACpB,0BAA0B;IAC1B,wBAAwB;IACxB,gCAAgC;IAChC,+BAA+B;IAC/B,mCAAmC;IACnC,qBAAqB;IACrB,4BAA4B;IAC5B,kCAAkC;IAClC,6BAA6B;IAC7B,4BAA4B;CAC7B,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwC,MAAM,CAAC,MAAM,CAAC;IACnF,yBAAyB,EAAE,kDAAkD;IAC7E,iBAAiB,EAAE,8BAA8B;IACjD,oBAAoB,EAClB,6FAA6F;QAC7F,uCAAuC;IACzC,sBAAsB,EAAE,2BAA2B;IACnD,kBAAkB,EAAE,2BAA2B;IAC/C,oBAAoB,EAAE,sBAAsB;IAC5C,sBAAsB,EACpB,yFAAyF;QACzF,uFAAuF;QACvF,uCAAuC;IACzC,oBAAoB,EAClB,yFAAyF;IAC3F,iBAAiB,EAAE,kCAAkC;IACrD,WAAW,EAAE,kCAAkC;IAC/C,cAAc,EAAE,kCAAkC;IAClD,cAAc,EAAE,+BAA+B;IAC/C,eAAe,EACb,4FAA4F;QAC5F,6EAA6E;QAC7E,sFAAsF;QACtF,uBAAuB;IACzB,yBAAyB,EACvB,oFAAoF;QACpF,oDAAoD;IACtD,qBAAqB,EAAE,0BAA0B;IACjD,uBAAuB,EAAE,8CAA8C;IACvE,wBAAwB,EACtB,0GAA0G;IAC5G,qBAAqB,EACnB,kFAAkF;QAClF,wCAAwC;IAC1C,uBAAuB,EAAE,kEAAkE;IAC3F,yBAAyB,EACvB,wEAAwE;IAC1E,uBAAuB,EAAE,oDAAoD;IAC7E,yBAAyB,EAAE,0DAA0D;IACrF,wBAAwB,EAAE,sCAAsC;IAChE,sBAAsB,EAAE,sDAAsD;IAC9E,qBAAqB,EAAE,+CAA+C;IACtE,yBAAyB,EAAE,6DAA6D;IACxF,wBAAwB,EAAE,mDAAmD;IAC7E,4BAA4B,EAAE,qDAAqD;IACnF,0BAA0B,EAAE,6BAA6B;IACzD,+BAA+B,EAAE,mCAAmC;IACpE,0BAA0B,EACxB,iGAAiG;QACjG,yEAAyE;IAC3E,kBAAkB,EAChB,sJAAsJ;IACxJ,wBAAwB,EACtB,mFAAmF;QACnF,sDAAsD;IACxD,iBAAiB,EAAE,6EAA6E;IAChG,wBAAwB,EACtB,sHAAsH;IACxH,wBAAwB,EACtB,2HAA2H;IAC7H,eAAe,EAAE,2EAA2E;IAC5F,0BAA0B,EACxB,6HAA6H;IAC/H,mBAAmB,EAAE,6EAA6E;IAClG,kBAAkB,EAAE,uFAAuF;IAC3G,wBAAwB,EACtB,kIAAkI;IACpI,sBAAsB,EACpB,sJAAsJ;IACxJ,8BAA8B,EAC5B,sKAAsK;IACxK,6BAA6B,EAC3B,6FAA6F;QAC7F,yEAAyE;QACzE,sDAAsD;IACxD,iCAAiC,EAC/B,2FAA2F;QAC3F,8FAA8F;QAC9F,iBAAiB;IACnB,mBAAmB,EACjB,iIAAiI;IACnI,0BAA0B,EACxB,6FAA6F;QAC7F,gGAAgG;QAChG,kDAAkD;IACpD,gCAAgC,EAC9B,gGAAgG;QAChG,wDAAwD;IAC1D,2BAA2B,EACzB,kGAAkG;QAClG,gEAAgE;IAClE,0BAA0B,EACxB,iGAAiG;QACjG,oCAAoC;CACvC,CAAC,CAAC"}
|
|
@@ -2,7 +2,7 @@ import type { DetectorOutput, GraphFinding, ResourceGraph } from '../graph/index
|
|
|
2
2
|
import type { PolicyEvaluationResult } from '../policy/index.js';
|
|
3
3
|
import type { Claim } from '../schemas/claim.js';
|
|
4
4
|
import type { Classification } from '../schemas/classification.js';
|
|
5
|
-
import type {
|
|
5
|
+
import type { ClassifierPolicy } from '../schemas/scan-config.js';
|
|
6
6
|
import type { PolicyFile } from '../schemas/policy.js';
|
|
7
7
|
import type { EvidenceRecord } from '../schemas/evidence.js';
|
|
8
8
|
import type { Obligation } from '../schemas/obligation.js';
|
|
@@ -60,7 +60,7 @@ export interface RunGatesInput {
|
|
|
60
60
|
* deterministically from detector signals on every run — there is no
|
|
61
61
|
* manual classifications document.
|
|
62
62
|
*/
|
|
63
|
-
classificationPolicy:
|
|
63
|
+
classificationPolicy: ClassifierPolicy;
|
|
64
64
|
/** Policies document (`.gateforge/policies.yml` content). */
|
|
65
65
|
policies: PolicyFile;
|
|
66
66
|
/** The obligation evaluator (pin #9). */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"gate-runner.d.ts","sourceRoot":"","sources":["../../src/testing/gate-runner.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAIjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,
|
|
1
|
+
{"version":3,"file":"gate-runner.d.ts","sourceRoot":"","sources":["../../src/testing/gate-runner.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAIjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,oDAAoD;IACpD,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,qCAAqC;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,4EAA4E;IAC5E,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC,sDAAsD;IACtD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,gBAAgB;IAC/B,iCAAiC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAChC,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,wBAAwB,KAC5B,gBAAgB,CAAC;AAEtB,sEAAsE;AACtE,MAAM,WAAW,oBAAqB,SAAQ,cAAc;IAC1D,oEAAoE;IACpE,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,yCAAyC;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,oBAAoB,EAAE,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,EAAE,gBAAgB,CAAC;IACvC,6DAA6D;IAC7D,QAAQ,EAAE,UAAU,CAAC;IACrB,yCAAyC;IACzC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,qEAAqE;IACrE,KAAK,EAAE,SAAS,CAAC;IACjB,uDAAuD;IACvD,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;IAC3B,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,mBAAmB,CAAC;IACtC,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAc;IAC7B,iCAAiC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,QAAQ,EAAE,WAAW,CAAC;IACtB,wDAAwD;IACxD,KAAK,EAAE,aAAa,CAAC;IACrB,8EAA8E;IAC9E,MAAM,EAAE,sBAAsB,CAAC;IAC/B,wDAAwD;IACxD,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,2EAA2E;IAC3E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAyI5D"}
|