@grc-claw/security-graph 0.8.0

package/dist/index.d.ts

@@ -0,0 +1,111 @@
+export type NodeType = 'agent' | 'tool' | 'control' | 'evidence' | 'alert' | 'identity' | 'infrastructure' | 'framework' | 'policy' | 'tenant';
+export type EdgeRelationship = 'invoked' | 'certified_by' | 'violated' | 'produced' | 'mitigates' | 'depends_on' | 'owns' | 'detected' | 'remediates' | 'authenticated_by' | 'scoped_to';
+export type EdgeResult = 'pass' | 'fail' | 'blocked' | 'pending' | 'unknown';
+export interface SecurityNode {
+    id: string;
+    type: NodeType;
+    name: string;
+    riskScore: number;
+    properties: Record<string, unknown>;
+    lastSeen: string;
+    firstSeen: string;
+    tags: string[];
+}
+export interface SecurityEdge {
+    id: string;
+    source: string;
+    target: string;
+    relationship: EdgeRelationship;
+    metadata: {
+        timestamp: string;
+        sessionId?: string;
+        result: EdgeResult;
+        confidence: number;
+        details?: string;
+    };
+}
+export interface AttackPathSegment {
+    node: SecurityNode;
+    edge: SecurityEdge;
+    riskContribution: number;
+}
+export interface AttackPath {
+    id: string;
+    segments: AttackPathSegment[];
+    totalRisk: number;
+    startNode: string;
+    endNode: string;
+    discoveredAt: string;
+}
+export interface RiskAssessment {
+    agentDid: string;
+    overallRisk: number;
+    riskFactors: {
+        factor: string;
+        score: number;
+        weight: number;
+        details: string;
+    }[];
+    recommendedActions: string[];
+    assessedAt: string;
+}
+export interface BlastRadius {
+    controlId: string;
+    affectedNodes: SecurityNode[];
+    affectedEdges: SecurityEdge[];
+    impactScore: number;
+    cascadeDepth: number;
+    assessedAt: string;
+}
+export interface CompliancePosture {
+    tenantId: string;
+    framework: string;
+    overallScore: number;
+    controlScores: {
+        controlId: string;
+        score: number;
+        status: 'pass' | 'fail' | 'partial';
+    }[];
+    trend: {
+        date: string;
+        score: number;
+    }[];
+    lastEvaluated: string;
+}
+export declare class SecurityGraph {
+    private nodes;
+    private edges;
+    private adjacency;
+    private reverseAdjacency;
+    private postureCache;
+    addNode(node: Omit<SecurityNode, 'firstSeen' | 'lastSeen'>): SecurityNode;
+    getNode(id: string): SecurityNode | undefined;
+    getNodesByType(type: NodeType): SecurityNode[];
+    addEdge(edge: Omit<SecurityEdge, 'id'>): SecurityEdge;
+    getEdgesFrom(nodeId: string): SecurityEdge[];
+    getEdgesTo(nodeId: string): SecurityEdge[];
+    /** Trace attack paths from a compromised node using BFS */
+    traceAttackPaths(startNodeId: string, maxDepth?: number): AttackPath[];
+    /** Calculate real-time risk score for an agent */
+    assessAgentRisk(agentDid: string): RiskAssessment;
+    /** Calculate the blast radius if a control fails */
+    calculateBlastRadius(controlId: string, maxDepth?: number): BlastRadius;
+    /** Calculate real-time compliance posture score */
+    calculateCompliancePosture(tenantId: string, framework: string): CompliancePosture;
+    /** Find all agents with access to specific tool types */
+    queryAgentsByToolAccess(toolName: string): SecurityNode[];
+    /** Find all uncertified agents accessing sensitive tools */
+    findUncertifiedAccess(framework: string): {
+        agent: SecurityNode;
+        tool: SecurityNode;
+        edge: SecurityEdge;
+    }[];
+    getStats(): {
+        totalNodes: number;
+        totalEdges: number;
+        nodesByType: Record<string, number>;
+        avgRiskScore: number;
+        highRiskNodes: number;
+    };
+}
+export { SecurityGraphSeeder } from './seeder.js';

package/dist/index.js

@@ -0,0 +1,289 @@
+/**
+ * @grc-claw/security-graph
+ * Real-time Security Graph with attack path analysis and risk scoring
+ *
+ * Connects Agents, Tools, Policies, Evidence, Alerts, Controls, and
+ * Infrastructure into a unified graph. Enables attack path tracing,
+ * blast radius analysis, and continuous risk scoring.
+ */
+import * as crypto from 'crypto';
+// ─── Security Graph Engine ───────────────────────────────────────────
+export class SecurityGraph {
+    nodes = new Map();
+    edges = new Map();
+    adjacency = new Map();
+    reverseAdjacency = new Map();
+    postureCache = new Map();
+    // ── Node Operations ──
+    addNode(node) {
+        const now = new Date().toISOString();
+        const existing = this.nodes.get(node.id);
+        const fullNode = {
+            ...node,
+            firstSeen: existing?.firstSeen ?? now,
+            lastSeen: now,
+        };
+        this.nodes.set(node.id, fullNode);
+        if (!this.adjacency.has(node.id))
+            this.adjacency.set(node.id, new Set());
+        if (!this.reverseAdjacency.has(node.id))
+            this.reverseAdjacency.set(node.id, new Set());
+        return fullNode;
+    }
+    getNode(id) {
+        return this.nodes.get(id);
+    }
+    getNodesByType(type) {
+        return Array.from(this.nodes.values()).filter((n) => n.type === type);
+    }
+    // ── Edge Operations ──
+    addEdge(edge) {
+        const edgeId = `edge_${crypto.randomUUID().substring(0, 8)}`;
+        const fullEdge = { ...edge, id: edgeId };
+        this.edges.set(edgeId, fullEdge);
+        // Update adjacency
+        const fwd = this.adjacency.get(edge.source);
+        if (fwd)
+            fwd.add(edgeId);
+        const rev = this.reverseAdjacency.get(edge.target);
+        if (rev)
+            rev.add(edgeId);
+        return fullEdge;
+    }
+    getEdgesFrom(nodeId) {
+        const edgeIds = this.adjacency.get(nodeId);
+        if (!edgeIds)
+            return [];
+        return Array.from(edgeIds).map((id) => this.edges.get(id)).filter(Boolean);
+    }
+    getEdgesTo(nodeId) {
+        const edgeIds = this.reverseAdjacency.get(nodeId);
+        if (!edgeIds)
+            return [];
+        return Array.from(edgeIds).map((id) => this.edges.get(id)).filter(Boolean);
+    }
+    // ── Attack Path Analysis ──
+    /** Trace attack paths from a compromised node using BFS */
+    traceAttackPaths(startNodeId, maxDepth = 5) {
+        const startNode = this.nodes.get(startNodeId);
+        if (!startNode)
+            return [];
+        const paths = [];
+        const queue = [];
+        const visited = new Set();
+        queue.push({ nodeId: startNodeId, path: [], depth: 0 });
+        while (queue.length > 0) {
+            const current = queue.shift();
+            if (current.depth >= maxDepth)
+                continue;
+            if (visited.has(current.nodeId))
+                continue;
+            visited.add(current.nodeId);
+            const outEdges = this.getEdgesFrom(current.nodeId);
+            for (const edge of outEdges) {
+                const targetNode = this.nodes.get(edge.target);
+                if (!targetNode)
+                    continue;
+                const segment = {
+                    node: targetNode,
+                    edge,
+                    riskContribution: targetNode.riskScore * (1 / (current.depth + 1)),
+                };
+                const newPath = [...current.path, segment];
+                // Record path if it reaches a high-value target
+                if (targetNode.type === 'control' || targetNode.type === 'evidence' || targetNode.type === 'infrastructure') {
+                    const totalRisk = newPath.reduce((sum, s) => sum + s.riskContribution, 0);
+                    paths.push({
+                        id: `attack_path_${crypto.randomUUID().substring(0, 8)}`,
+                        segments: newPath,
+                        totalRisk: Math.min(100, totalRisk),
+                        startNode: startNodeId,
+                        endNode: edge.target,
+                        discoveredAt: new Date().toISOString(),
+                    });
+                }
+                queue.push({ nodeId: edge.target, path: newPath, depth: current.depth + 1 });
+            }
+        }
+        return paths.sort((a, b) => b.totalRisk - a.totalRisk);
+    }
+    // ── Risk Assessment ──
+    /** Calculate real-time risk score for an agent */
+    assessAgentRisk(agentDid) {
+        const agentNode = this.nodes.get(agentDid);
+        const riskFactors = [];
+        // Factor 1: Direct violations
+        const violations = this.getEdgesFrom(agentDid).filter((e) => e.relationship === 'violated');
+        const violationScore = Math.min(40, violations.length * 10);
+        riskFactors.push({
+            factor: 'policy_violations',
+            score: violationScore,
+            weight: 0.35,
+            details: `${violations.length} policy violations detected`,
+        });
+        // Factor 2: Tool invocation pattern
+        const invocations = this.getEdgesFrom(agentDid).filter((e) => e.relationship === 'invoked');
+        const destructiveInvocations = invocations.filter((e) => e.metadata.details?.includes('destructive'));
+        const invocationRisk = Math.min(30, destructiveInvocations.length * 15);
+        riskFactors.push({
+            factor: 'destructive_tool_usage',
+            score: invocationRisk,
+            weight: 0.25,
+            details: `${destructiveInvocations.length} destructive tool invocations`,
+        });
+        // Factor 3: Missing certifications
+        const certEdges = this.getEdgesFrom(agentDid).filter((e) => e.relationship === 'certified_by');
+        const certScore = certEdges.length >= 3 ? 0 : (3 - certEdges.length) * 10;
+        riskFactors.push({
+            factor: 'certification_gaps',
+            score: certScore,
+            weight: 0.2,
+            details: `${certEdges.length} active certifications`,
+        });
+        // Factor 4: Attack path exposure
+        const attackPaths = this.traceAttackPaths(agentDid, 3);
+        const exposureScore = Math.min(30, attackPaths.length * 5);
+        riskFactors.push({
+            factor: 'attack_path_exposure',
+            score: exposureScore,
+            weight: 0.2,
+            details: `${attackPaths.length} potential attack paths`,
+        });
+        const overallRisk = riskFactors.reduce((sum, f) => sum + f.score * f.weight, 0);
+        const recommendedActions = [];
+        if (violationScore > 0)
+            recommendedActions.push('Review and remediate policy violations');
+        if (invocationRisk > 0)
+            recommendedActions.push('Audit destructive tool access permissions');
+        if (certScore > 0)
+            recommendedActions.push('Obtain missing framework certifications');
+        if (exposureScore > 0)
+            recommendedActions.push('Reduce blast radius by applying least-privilege controls');
+        return {
+            agentDid,
+            overallRisk: Math.round(overallRisk * 100) / 100,
+            riskFactors,
+            recommendedActions,
+            assessedAt: new Date().toISOString(),
+        };
+    }
+    // ── Blast Radius ──
+    /** Calculate the blast radius if a control fails */
+    calculateBlastRadius(controlId, maxDepth = 4) {
+        const affectedNodes = [];
+        const affectedEdges = [];
+        const visited = new Set();
+        const queue = [{ nodeId: controlId, depth: 0 }];
+        while (queue.length > 0) {
+            const current = queue.shift();
+            if (current.depth >= maxDepth || visited.has(current.nodeId))
+                continue;
+            visited.add(current.nodeId);
+            const node = this.nodes.get(current.nodeId);
+            if (node && current.nodeId !== controlId)
+                affectedNodes.push(node);
+            // Follow both forward and reverse edges
+            const allEdges = [...this.getEdgesFrom(current.nodeId), ...this.getEdgesTo(current.nodeId)];
+            for (const edge of allEdges) {
+                affectedEdges.push(edge);
+                const nextNodeId = edge.source === current.nodeId ? edge.target : edge.source;
+                if (!visited.has(nextNodeId)) {
+                    queue.push({ nodeId: nextNodeId, depth: current.depth + 1 });
+                }
+            }
+        }
+        const impactScore = Math.min(100, affectedNodes.length * 5 + affectedEdges.length * 2);
+        return {
+            controlId,
+            affectedNodes,
+            affectedEdges,
+            impactScore,
+            cascadeDepth: maxDepth,
+            assessedAt: new Date().toISOString(),
+        };
+    }
+    // ── Compliance Posture ──
+    /** Calculate real-time compliance posture score */
+    calculateCompliancePosture(tenantId, framework) {
+        const controlNodes = this.getNodesByType('control').filter((n) => n.tags.includes(framework) && (n.properties.tenantId === tenantId || !n.properties.tenantId));
+        const controlScores = controlNodes.map((control) => {
+            const edges = this.getEdgesTo(control.id);
+            const passEdges = edges.filter((e) => e.metadata.result === 'pass');
+            const failEdges = edges.filter((e) => e.metadata.result === 'fail');
+            const total = passEdges.length + failEdges.length;
+            const score = total > 0 ? (passEdges.length / total) * 100 : 50;
+            const status = score >= 90 ? 'pass' : score >= 50 ? 'partial' : 'fail';
+            return { controlId: control.id, score: Math.round(score), status };
+        });
+        const overallScore = controlScores.length > 0
+            ? controlScores.reduce((sum, c) => sum + c.score, 0) / controlScores.length
+            : 0;
+        const posture = {
+            tenantId,
+            framework,
+            overallScore: Math.round(overallScore * 100) / 100,
+            controlScores,
+            trend: [],
+            lastEvaluated: new Date().toISOString(),
+        };
+        // Cache for trend analysis
+        const cacheKey = `${tenantId}_${framework}`;
+        const existing = this.postureCache.get(cacheKey);
+        if (existing) {
+            posture.trend = [...existing.trend, { date: new Date().toISOString(), score: posture.overallScore }].slice(-90);
+        }
+        else {
+            posture.trend = [{ date: new Date().toISOString(), score: posture.overallScore }];
+        }
+        this.postureCache.set(cacheKey, posture);
+        return posture;
+    }
+    // ── Graph Queries ──
+    /** Find all agents with access to specific tool types */
+    queryAgentsByToolAccess(toolName) {
+        const toolNode = Array.from(this.nodes.values()).find((n) => n.type === 'tool' && n.name === toolName);
+        if (!toolNode)
+            return [];
+        const edges = this.getEdgesTo(toolNode.id).filter((e) => e.relationship === 'invoked');
+        return edges
+            .map((e) => this.nodes.get(e.source))
+            .filter((n) => n !== undefined && n.type === 'agent');
+    }
+    /** Find all uncertified agents accessing sensitive tools */
+    findUncertifiedAccess(framework) {
+        const results = [];
+        const agents = this.getNodesByType('agent');
+        for (const agent of agents) {
+            const certEdges = this.getEdgesFrom(agent.id).filter((e) => e.relationship === 'certified_by' && e.metadata.details?.includes(framework));
+            if (certEdges.length === 0) {
+                const toolEdges = this.getEdgesFrom(agent.id).filter((e) => e.relationship === 'invoked');
+                for (const edge of toolEdges) {
+                    const tool = this.nodes.get(edge.target);
+                    if (tool && tool.type === 'tool') {
+                        results.push({ agent, tool, edge });
+                    }
+                }
+            }
+        }
+        return results;
+    }
+    // ── Statistics ──
+    getStats() {
+        const allNodes = Array.from(this.nodes.values());
+        const nodesByType = {};
+        for (const n of allNodes) {
+            nodesByType[n.type] = (nodesByType[n.type] ?? 0) + 1;
+        }
+        const avgRisk = allNodes.length > 0
+            ? allNodes.reduce((sum, n) => sum + n.riskScore, 0) / allNodes.length
+            : 0;
+        return {
+            totalNodes: this.nodes.size,
+            totalEdges: this.edges.size,
+            nodesByType,
+            avgRiskScore: Math.round(avgRisk * 100) / 100,
+            highRiskNodes: allNodes.filter((n) => n.riskScore >= 70).length,
+        };
+    }
+}
+export { SecurityGraphSeeder } from './seeder.js';

package/dist/seeder.d.ts

@@ -0,0 +1,21 @@
+import type { SecurityGraph } from './index.js';
+export interface FrameworkPack {
+    code: string;
+    name: string;
+    version: string;
+    controls: {
+        id: string;
+        controlCode: string;
+        title: string;
+        frameworkCode: string;
+        domain?: string;
+    }[];
+}
+export declare class SecurityGraphSeeder {
+    private graph;
+    constructor(graph: SecurityGraph);
+    seedFromFrameworks(frameworks: FrameworkPack[]): void;
+    private seedEdges;
+    seedAttackPaths(): void;
+    seedRiskNetwork(): void;
+}

package/dist/seeder.js

@@ -0,0 +1,264 @@
+const INFRASTRUCTURE_TARGETS = [
+    'prod-auth-db', 'core-api-gateway', 'aws-s3-compliance', 'k8s-cluster-prod',
+    'ci-runner-pool', 'vault-secrets', 'redis-session-cache', 'cdn-edge-proxy',
+    'postgres-primary', 'elasticsearch-logs', 'sqs-event-queue', 'ec2-bastion-host',
+];
+const AGENT_DIDS = [
+    'did:grc:agent-grc-auditor', 'did:grc:agent-compliance-scanner', 'did:grc:agent-evidence-collector',
+    'did:grc:agent-incident-responder', 'did:grc:agent-policy-enforcer', 'did:grc:agent-risk-analyst',
+    'did:grc:agent-soar-orchestrator', 'did:grc:agent-cloud-security', 'did:grc:agent-identity-mgr',
+    'did:grc:agent-vuln-scanner', 'did:grc:agent-log-analyzer', 'did:grc:agent-crypto-guard',
+];
+const TOOL_IDS = [
+    'tool-wazuh-siem', 'tool-suricata-ids', 'tool-elastic-stack', 'tool-snort-ips',
+    'tool-aws-guardduty', 'tool-azure-sentinel', 'tool-gcp-chronicle',
+    'tool-vault-secrets', 'tool-terraform-iac', 'tool-trivy-scanner',
+    'tool-caldera-redteam', 'tool-openvas-vuln', 'tool-splunk-hec',
+];
+const POLICY_IDS = [
+    'policy-acceptable-use', 'policy-access-control', 'policy-data-classification',
+    'policy-incident-response', 'policy-bcp-dr', 'policy-change-management',
+    'policy-vendor-risk', 'policy-encryption-standards', 'policy-logging-monitoring',
+    'policy-remote-access', 'policy-mobile-device', 'policy-physical-security',
+];
+function pick(arr, i) {
+    return arr[i % arr.length];
+}
+function riskFromIndex(i, max = 100) {
+    return ((i * 7 + 13) % max);
+}
+export class SecurityGraphSeeder {
+    graph;
+    constructor(graph) {
+        this.graph = graph;
+    }
+    seedFromFrameworks(frameworks) {
+        const frameworkNodeIds = [];
+        for (const pack of frameworks) {
+            const fwId = `fw-${pack.code}`;
+            this.graph.addNode({
+                id: fwId, type: 'framework', name: pack.name,
+                riskScore: 5,
+                properties: { code: pack.code, version: pack.version, controlCount: pack.controls.length },
+                tags: [pack.code],
+            });
+            frameworkNodeIds.push(fwId);
+            for (let ci = 0; ci < pack.controls.length; ci++) {
+                const ctrl = pack.controls[ci];
+                const ctrlId = `ctrl-${ctrl.id}`;
+                this.graph.addNode({
+                    id: ctrlId, type: 'control', name: ctrl.title,
+                    riskScore: riskFromIndex(ci + frameworks.indexOf(pack) * 17),
+                    properties: { controlCode: ctrl.controlCode, domain: ctrl.domain ?? 'unknown', frameworkCode: ctrl.frameworkCode },
+                    tags: [pack.code, ctrl.domain ?? 'general'],
+                });
+                this.graph.addEdge({
+                    source: fwId, target: ctrlId, relationship: 'depends_on',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.9, details: `Framework ${pack.code} owns control ${ctrl.controlCode}` },
+                });
+                if (ci % 3 === 0) {
+                    const evidenceId = `ev-${ctrl.id}-evidence`;
+                    this.graph.addNode({
+                        id: evidenceId, type: 'evidence', name: `Evidence for ${ctrl.controlCode}`,
+                        riskScore: Math.max(0, 40 - riskFromIndex(ci)),
+                        properties: { controlId: ctrlId, sha256: `sha256_evidence_${ctrl.id}`, status: ci % 5 === 0 ? 'pending' : 'collected' },
+                        tags: [pack.code, 'evidence'],
+                    });
+                    this.graph.addEdge({
+                        source: evidenceId, target: ctrlId, relationship: 'produced',
+                        metadata: { timestamp: new Date().toISOString(), result: ci % 5 === 0 ? 'pending' : 'pass', confidence: 0.85, details: `Evidence produced for control ${ctrl.controlCode}` },
+                    });
+                }
+                if (ci % 4 === 0) {
+                    const riskId = `risk-${ctrl.id}-risk`;
+                    this.graph.addNode({
+                        id: riskId, type: 'alert', name: `Risk: ${ctrl.title}`,
+                        riskScore: riskFromIndex(ci + 50),
+                        properties: { controlId: ctrlId, severity: ci % 3 === 0 ? 'high' : 'medium', description: `Compliance risk for ${ctrl.controlCode}` },
+                        tags: [pack.code, 'risk'],
+                    });
+                    this.graph.addEdge({
+                        source: riskId, target: ctrlId, relationship: 'violated',
+                        metadata: { timestamp: new Date().toISOString(), result: 'fail', confidence: 0.7, details: `Risk detected against control ${ctrl.controlCode}` },
+                    });
+                }
+            }
+        }
+        for (let i = 0; i < INFRASTRUCTURE_TARGETS.length; i++) {
+            this.graph.addNode({
+                id: `infra-${INFRASTRUCTURE_TARGETS[i]}`, type: 'infrastructure', name: INFRASTRUCTURE_TARGETS[i],
+                riskScore: riskFromIndex(i + 100),
+                properties: { host: INFRASTRUCTURE_TARGETS[i], environment: 'production', region: i % 2 === 0 ? 'us-east-1' : 'eu-west-1' },
+                tags: ['infrastructure', 'production'],
+            });
+        }
+        for (let i = 0; i < AGENT_DIDS.length; i++) {
+            const agentId = AGENT_DIDS[i];
+            this.graph.addNode({
+                id: agentId, type: 'agent', name: agentId.split(':').pop(),
+                riskScore: riskFromIndex(i + 200),
+                properties: { did: agentId, role: i % 3 === 0 ? 'admin' : 'operator', tenantScope: ['1'] },
+                tags: ['agent', 'did:grc'],
+            });
+        }
+        for (let i = 0; i < TOOL_IDS.length; i++) {
+            this.graph.addNode({
+                id: TOOL_IDS[i], type: 'tool', name: TOOL_IDS[i],
+                riskScore: riskFromIndex(i + 300),
+                properties: { provider: i % 3 === 0 ? 'aws' : i % 3 === 1 ? 'oss' : 'azure', tier: i % 4 === 0 ? 'destructive' : 'read' },
+                tags: ['tool'],
+            });
+        }
+        for (let i = 0; i < POLICY_IDS.length; i++) {
+            this.graph.addNode({
+                id: POLICY_IDS[i], type: 'policy', name: POLICY_IDS[i],
+                riskScore: riskFromIndex(i + 400) % 30,
+                properties: { policyType: 'organizational', version: '2026.1' },
+                tags: ['policy'],
+            });
+        }
+        this.seedEdges(frameworkNodeIds);
+    }
+    seedEdges(frameworkNodeIds) {
+        const allControlNodes = this.graph.getNodesByType('control');
+        const allAgentNodes = this.graph.getNodesByType('agent');
+        const allToolNodes = this.graph.getNodesByType('tool');
+        const allInfraNodes = this.graph.getNodesByType('infrastructure');
+        const allPolicyNodes = this.graph.getNodesByType('policy');
+        const allRiskNodes = this.graph.getNodesByType('alert');
+        for (let ai = 0; ai < allAgentNodes.length; ai++) {
+            const agent = allAgentNodes[ai];
+            const toolCount = 2 + (ai % 3);
+            for (let t = 0; t < toolCount; t++) {
+                const tool = pick(allToolNodes, ai * 3 + t);
+                this.graph.addEdge({
+                    source: agent.id, target: tool.id, relationship: 'invoked',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.95, details: `Agent ${agent.name} invokes ${tool.name}` },
+                });
+            }
+            const certCount = 1 + (ai % 4);
+            for (let c = 0; c < certCount; c++) {
+                const fw = pick(frameworkNodeIds, ai + c);
+                this.graph.addEdge({
+                    source: agent.id, target: fw, relationship: 'certified_by',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.88, details: `Agent ${agent.name} certified for framework` },
+                });
+            }
+        }
+        for (let ci = 0; ci < allControlNodes.length; ci++) {
+            const ctrl = allControlNodes[ci];
+            if (ci % 2 === 0 && allControlNodes.length > ci + 1) {
+                const dep = allControlNodes[ci + 1];
+                this.graph.addEdge({
+                    source: ctrl.id, target: dep.id, relationship: 'depends_on',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.82, details: 'Control dependency chain' },
+                });
+            }
+            if (ci % 5 === 0) {
+                const infra = pick(allInfraNodes, ci);
+                this.graph.addEdge({
+                    source: ctrl.id, target: infra.id, relationship: 'scoped_to',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.75, details: `Control scoped to infrastructure ${infra.name}` },
+                });
+            }
+            if (ci % 3 === 0) {
+                const policy = pick(allPolicyNodes, ci);
+                this.graph.addEdge({
+                    source: policy.id, target: ctrl.id, relationship: 'mitigates',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.8, details: `Policy mitigates risk for control` },
+                });
+            }
+            if (ci % 7 === 0 && allInfraNodes.length > 0) {
+                const infra = pick(allInfraNodes, ci);
+                this.graph.addEdge({
+                    source: infra.id, target: ctrl.id, relationship: 'owns',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.7, details: `Infrastructure ${infra.name} implements control` },
+                });
+            }
+        }
+        for (let ri = 0; ri < allRiskNodes.length; ri++) {
+            const risk = allRiskNodes[ri];
+            if (ri % 3 === 0) {
+                const agent = pick(allAgentNodes, ri);
+                this.graph.addEdge({
+                    source: agent.id, target: risk.id, relationship: 'detected',
+                    metadata: { timestamp: new Date().toISOString(), result: 'fail', confidence: 0.6, details: 'Agent detected risk event' },
+                });
+            }
+            if (ri % 4 === 0) {
+                const infra = pick(allInfraNodes, ri);
+                this.graph.addEdge({
+                    source: risk.id, target: infra.id, relationship: 'violated',
+                    metadata: { timestamp: new Date().toISOString(), result: 'fail', confidence: 0.65, details: 'Risk violates infrastructure boundary' },
+                });
+            }
+        }
+    }
+    seedAttackPaths() {
+        const agents = this.graph.getNodesByType('agent');
+        const tools = this.graph.getNodesByType('tool');
+        const infra = this.graph.getNodesByType('infrastructure');
+        const controls = this.graph.getNodesByType('control');
+        const entryPoints = agents.slice(0, 5);
+        for (const entry of entryPoints) {
+            const tool1 = tools[0];
+            const tool2 = tools[1];
+            const targetInfra = infra[0];
+            const targetControl = controls[0];
+            if (tool1) {
+                this.graph.addEdge({
+                    source: entry.id, target: tool1.id, relationship: 'invoked',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 1.0, details: 'Attack path: initial credential compromise via tool invocation' },
+                });
+            }
+            if (tool1 && tool2) {
+                this.graph.addEdge({
+                    source: tool1.id, target: tool2.id, relationship: 'depends_on',
+                    metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.8, details: 'Attack path: lateral movement through tool chain' },
+                });
+            }
+            if (tool2 && targetInfra) {
+                this.graph.addEdge({
+                    source: tool2.id, target: targetInfra.id, relationship: 'scoped_to',
+                    metadata: { timestamp: new Date().toISOString(), result: 'fail', confidence: 0.7, details: 'Attack path: infrastructure compromise via lateral movement' },
+                });
+            }
+            if (targetInfra && targetControl) {
+                this.graph.addEdge({
+                    source: targetInfra.id, target: targetControl.id, relationship: 'violated',
+                    metadata: { timestamp: new Date().toISOString(), result: 'fail', confidence: 0.6, details: 'Attack path: control bypass after infrastructure compromise' },
+                });
+            }
+        }
+    }
+    seedRiskNetwork() {
+        const agents = this.graph.getNodesByType('agent');
+        const infra = this.graph.getNodesByType('infrastructure');
+        const policies = this.graph.getNodesByType('policy');
+        const controls = this.graph.getNodesByType('control');
+        for (let i = 0; i < infra.length; i++) {
+            const host = infra[i];
+            const nextHost = infra[(i + 1) % infra.length];
+            this.graph.addEdge({
+                source: host.id, target: nextHost.id, relationship: 'depends_on',
+                metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.75, details: `Network spread: ${host.name} -> ${nextHost.name}` },
+            });
+        }
+        for (let i = 0; i < 6; i++) {
+            const agent = agents[i % agents.length];
+            const host = infra[i % infra.length];
+            this.graph.addEdge({
+                source: agent.id, target: host.id, relationship: 'authenticated_by',
+                metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.85, details: 'Agent authenticated to host' },
+            });
+        }
+        for (let i = 0; i < Math.min(policies.length, controls.length); i++) {
+            const policy = policies[i];
+            const control = controls[i * 7 % controls.length];
+            this.graph.addEdge({
+                source: policy.id, target: control.id, relationship: 'mitigates',
+                metadata: { timestamp: new Date().toISOString(), result: 'pass', confidence: 0.78, details: 'Policy mitigates control risk' },
+            });
+        }
+    }
+}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@grc-claw/security-graph",
+  "version": "0.8.0",
+  "description": "Real-time security graph with attack path analysis and risk scoring for GRC_Claw",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./seeder": {
+      "types": "./dist/seeder.d.ts",
+      "import": "./dist/seeder.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --test dist/**/*.test.js 2>/dev/null || true"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/AAH20/GRC_Claw"
+  }
+}