@gsep/core 0.8.0 → 1.0.0

package/dist/security/RBACEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RBACEngine.js","sourceRoot":"","sources":["../../src/security/RBACEngine.ts"],"names":[],"mappings":"AA8FA,MAAM,UAAU,GAAS;IACrB,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,6EAA6E;IAC1F,WAAW,EAAE;QACT,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe;QAC/D,sBAAsB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,eAAe,EAAE,iBAAiB;QAC3G,eAAe,EAAE,gBAAgB,EAAE,gBAAgB;QACnD,mBAAmB,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,eAAe,EAAE,WAAW;QACzG,wBAAwB,EAAE,kBAAkB,EAAE,eAAe;QAC7D,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa;QACvD,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE,aAAa;QACnH,aAAa,EAAE,aAAa,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,0BAA0B;KACvH;IACD,SAAS,EAAE,CAAC;IACZ,qBAAqB,EAAE,GAAG;CAC7B,CAAC;AAEF,MAAM,YAAY,GAAS;IACvB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,2EAA2E;IACxF,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE;QACT,aAAa,EAAE,cAAc,EAAE,eAAe;QAC9C,sBAAsB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,eAAe;QACxF,eAAe,EAAE,gBAAgB;QACjC,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EAAE,eAAe;QAC1E,wBAAwB,EAAE,eAAe;QACzC,WAAW,EAAE,YAAY;QACzB,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU;QAC/D,kBAAkB;KACrB;IACD,SAAS,EAAE,GAAG;IACd,qBAAqB,EAAE,GAAG;CAC7B,CAAC;AAEF,MAAM,aAAa,GAAS;IACxB,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,2DAA2D;IACxE,WAAW,EAAE;QACT,aAAa;QACb,sBAAsB,EAAE,wBAAwB;QAChD,eAAe;QACf,mBAAmB,EAAE,oBAAoB;QACzC,wBAAwB,EAAE,eAAe;QACzC,WAAW;QACX,aAAa,EAAE,eAAe;KACjC;IACD,SAAS,EAAE,GAAG;IACd,qBAAqB,EAAE,GAAG;CAC7B,CAAC;AAEF,MAAM,eAAe,GAAS;IAC1B,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,oDAAoD;IACjE,WAAW,EAAE;QACT,aAAa;QACb,sBAAsB;QACtB,mBAAmB;QACnB,eAAe;QACf,aAAa;KAChB;IACD,SAAS,EAAE,EAAE;IACb,qBAAqB,EAAE,GAAG;CAC7B,CAAC;AAEF,MAAM,YAAY,GAAS;IACvB,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,2EAA2E;IACxF,WAAW,EAAE;QACT,aAAa;QACb,mBAAmB,EAAE,cAAc;QACnC,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB;QACtE,kBAAkB,EAAE,oBAAoB;KAC3C;IACD,SAAS,EAAE,GAAG;IACd,qBAAqB,EAAE,GAAG;CAC7B,CAAC;AAoBF,MAAM,OAAO,UAAU;IACX,QAAQ,CAAmB;IAC3B,KAAK,GAAsB,IAAI,GAAG,EAAE,CAAC;IACrC,WAAW,GAAgC,IAAI,GAAG,EAAE,CAAC;IACrD,eAAe,GAAwD,IAAI,GAAG,EAAE,CAAC;IAEzF,YAAY,QAA0B;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAGzB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IAKD,UAAU,CAAC,MAAc,EAAE,QAA2B,EAAE,UAAkB,EAAE,SAAgB;QACxF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE;YACzB,MAAM;YACN,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,IAAI,IAAI,EAAE;YACtB,UAAU;YACV,SAAS;SACZ,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,sBAAsB;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,KAAK,EAAE,CAAC;YACR,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;YAC7B,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,MAAM,EAAE,EAAE;YACzE,QAAQ,EAAE,MAAM;SACnB,CAAC,CAAC;IACP,CAAC;IAKD,UAAU,CAAC,MAAc;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAKD,WAAW,CAAC,MAAc,EAAE,UAAsB;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAGhD,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,UAAU;gBACV,MAAM,EAAE,uCAAuC;aAClD,CAAC;QACN,CAAC;QAGD,IAAI,UAAU,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5D,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,UAAU;gBACV,MAAM,EAAE,yBAAyB;aACpC,CAAC;QACN,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC3F,CAAC;QAGD,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,EAAE,CAAC,EAAE;gBACpD,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,WAAW;aAChD,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAE1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,wBAAwB,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC;QACnH,CAAC;QAGD,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,4BAA4B,EAAE,CAAC,EAAE;gBACpD,IAAI,EAAE,MAAM;gBACZ,EAAE,EAAE,UAAU;gBACd,MAAM,EAAE,QAAQ,IAAI,CAAC,IAAI,UAAU,UAAU,EAAE;aAClD,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9B,CAAC;QAGD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAE1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,+BAA+B,UAAU,GAAG,EAAE,CAAC;IAClJ,CAAC;IAKD,WAAW,CAAC,MAAc;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACnD,CAAC;IAKD,kBAAkB,CAAC,MAAc;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAKD,YAAY,CAAC,IAAU;QACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;IAKD,QAAQ;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,CAAC;IAKD,cAAc;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,CAAC;IAKD,OAAO,CAAC,MAAc,EAAE,QAAgB;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC;IACzC,CAAC;IAIO,kBAAkB,CAAC,IAAU;QACjC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAE1C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;gBACpD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;oBAC1B,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;wBAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACtD,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC;IACvB,CAAC;IAEO,cAAc,CAAC,MAAc,EAAE,KAAa;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEhD,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,GAAG,SAAS,EAAE,CAAC;YAClD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,OAAO,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,CAAC;IAEO,YAAY,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC;IACL,CAAC;CACJ"}

package/dist/security/SOC2Controls.d.ts

@@ -0,0 +1,37 @@
+import { SecurityEventBus } from './SecurityEventBus.js';
+export type ControlStatus = 'implemented' | 'partial' | 'not-implemented' | 'not-applicable';
+export interface SOC2Control {
+    id: string;
+    criteria: string;
+    description: string;
+    implementation: string;
+    status: ControlStatus;
+    evidence: string[];
+    lastReviewedAt?: Date;
+    genomeShieldModule?: string;
+}
+export interface SOC2Report {
+    generatedAt: Date;
+    period: {
+        from: Date;
+        to: Date;
+    };
+    organization: string;
+    totalControls: number;
+    implemented: number;
+    partial: number;
+    notImplemented: number;
+    controls: SOC2Control[];
+    summary: string;
+}
+export declare class SOC2Controls {
+    private controls;
+    constructor(_eventBus: SecurityEventBus);
+    generateReport(organization: string, from: Date, to: Date): SOC2Report;
+    getControls(): SOC2Control[];
+    getControlsByCriteria(criteria: string): SOC2Control[];
+    getControlsByStatus(status: ControlStatus): SOC2Control[];
+    updateControlStatus(controlId: string, status: ControlStatus): boolean;
+    getCompliancePercentage(): number;
+}
+//# sourceMappingURL=SOC2Controls.d.ts.map

package/dist/security/SOC2Controls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SOC2Controls.d.ts","sourceRoot":"","sources":["../../src/security/SOC2Controls.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAIzD,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,SAAS,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE7F,MAAM,WAAW,WAAW;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACvB,WAAW,EAAE,IAAI,CAAC;IAClB,MAAM,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACnB;AA6ID,qBAAa,YAAY;IACrB,OAAO,CAAC,QAAQ,CAAgB;gBAEpB,SAAS,EAAE,gBAAgB;IAOvC,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,GAAG,UAAU;IAuBtE,WAAW,IAAI,WAAW,EAAE;IAO5B,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE;IAOtD,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,EAAE;IAOzD,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO;IAWtE,uBAAuB,IAAI,MAAM;CAIpC"}

package/dist/security/SOC2Controls.js

@@ -0,0 +1,151 @@
+function buildControls() {
+    return [
+        {
+            id: 'CC1.1', criteria: 'CC1: Control Environment',
+            description: 'Commitment to integrity and ethical values',
+            implementation: 'Enterprise policy engine enforces organization-wide security policies with signed YAML configuration',
+            status: 'implemented', evidence: ['Enterprise policy file', 'Policy signature verification'], genomeShieldModule: 'EnterprisePolicyEngine',
+        },
+        {
+            id: 'CC1.3', criteria: 'CC1: Control Environment',
+            description: 'Organizational structure and authority',
+            implementation: 'RBAC engine with 5 predefined roles (admin/manager/standard/restricted/auditor) and custom role support',
+            status: 'implemented', evidence: ['Role assignments', 'Permission matrix'], genomeShieldModule: 'RBACEngine',
+        },
+        {
+            id: 'CC2.1', criteria: 'CC2: Communication',
+            description: 'Information for internal control functioning',
+            implementation: 'Tamper-proof audit log with hash chain records all security decisions. Weekly security reports auto-generated.',
+            status: 'implemented', evidence: ['Audit log files', 'Weekly reports'], genomeShieldModule: 'TamperProofAuditLog',
+        },
+        {
+            id: 'CC2.3', criteria: 'CC2: Communication',
+            description: 'Communication with external parties',
+            implementation: 'Compliance exporter generates JSON/CSV reports for external auditors. GDPR data portability export.',
+            status: 'implemented', evidence: ['Compliance exports', 'GDPR export files'], genomeShieldModule: 'ComplianceExporter',
+        },
+        {
+            id: 'CC3.2', criteria: 'CC3: Risk Assessment',
+            description: 'Risk identification',
+            implementation: 'C3 Content Firewall scans 53 patterns for prompt injection. Anomaly Detector monitors message patterns.',
+            status: 'implemented', evidence: ['C3 scan logs', 'Anomaly detection history'], genomeShieldModule: 'GenomeSecurityBridge',
+        },
+        {
+            id: 'CC3.4', criteria: 'CC3: Risk Assessment',
+            description: 'Fraud risk assessment',
+            implementation: 'C4 Behavioral Immune System performs 6 output checks. Data exfiltration detection in responses.',
+            status: 'implemented', evidence: ['C4 scan results', 'Quarantine events'], genomeShieldModule: 'GenomeSecurityBridge',
+        },
+        {
+            id: 'CC4.1', criteria: 'CC4: Monitoring',
+            description: 'Ongoing monitoring of controls',
+            implementation: 'SecurityEventBus emits real-time events. NetworkAuditLogger tracks all outbound traffic. Dashboard with Intelligence Sidebar.',
+            status: 'implemented', evidence: ['Event bus history', 'Network traffic logs', 'Dashboard screenshots'], genomeShieldModule: 'SecurityEventBus',
+        },
+        {
+            id: 'CC5.2', criteria: 'CC5: Control Activities',
+            description: 'Technology controls',
+            implementation: 'AES-256-GCM encryption, HKDF key hierarchy, macOS Keychain storage, Ed25519 skill signing, PII redaction.',
+            status: 'implemented', evidence: ['Encryption config', 'Key hierarchy setup', 'PII redaction logs'], genomeShieldModule: 'KeyHierarchy + EncryptedConfigStore',
+        },
+        {
+            id: 'CC6.1', criteria: 'CC6: Access Control',
+            description: 'Logical access security',
+            implementation: 'MFA (TOTP) for gateway authentication. RBAC for permission enforcement. Session timeout per role.',
+            status: 'implemented', evidence: ['MFA setup records', 'Role assignments', 'Session logs'], genomeShieldModule: 'MFAProvider + RBACEngine',
+        },
+        {
+            id: 'CC6.2', criteria: 'CC6: Access Control',
+            description: 'Credential management',
+            implementation: 'Keychain vault with AES-256-GCM. Secret rotation engine with configurable intervals. No plaintext credentials.',
+            status: 'implemented', evidence: ['Keychain entries', 'Rotation history'], genomeShieldModule: 'KeychainAdapter + SecretRotationEngine',
+        },
+        {
+            id: 'CC6.6', criteria: 'CC6: Access Control',
+            description: 'External threat protection',
+            implementation: 'Outbound allowlist blocks unauthorized domains. SSRF prevention blocks private networks. C3 firewall blocks injection.',
+            status: 'implemented', evidence: ['Allowlist config', 'Blocked requests log'], genomeShieldModule: 'OutboundAllowlist',
+        },
+        {
+            id: 'CC6.7', criteria: 'CC6: Access Control',
+            description: 'Data movement restriction',
+            implementation: 'Filesystem boundary with path ACL. PII redaction prevents sensitive data leaving to cloud. Data classifier categorizes content.',
+            status: 'implemented', evidence: ['FS boundary config', 'PII redaction stats'], genomeShieldModule: 'FileSystemBoundary + PIIRedactionEngine',
+        },
+        {
+            id: 'CC6.8', criteria: 'CC6: Access Control',
+            description: 'Unauthorized software prevention',
+            implementation: 'SkillSigner verifies Ed25519 signatures. CapabilityBroker enforces manifest permissions. Unsigned skills blocked in Secure profile.',
+            status: 'implemented', evidence: ['Skill verification logs', 'Capability grants'], genomeShieldModule: 'SkillSigner + CapabilityBroker',
+        },
+        {
+            id: 'CC7.2', criteria: 'CC7: Operations',
+            description: 'Anomaly monitoring',
+            implementation: 'Anomaly Detector monitors message floods, velocity spikes, and coordinated attacks. Enterprise policy alerts on thresholds.',
+            status: 'implemented', evidence: ['Anomaly events', 'Alert history'], genomeShieldModule: 'EnterprisePolicyEngine',
+        },
+        {
+            id: 'CC7.3', criteria: 'CC7: Operations',
+            description: 'Incident evaluation',
+            implementation: 'SecurityEventBus captures all deny decisions. ComplianceExporter generates incident reports with timestamps and evidence.',
+            status: 'implemented', evidence: ['Security incident exports'], genomeShieldModule: 'ComplianceExporter',
+        },
+        {
+            id: 'CC8.1', criteria: 'CC8: Change Management',
+            description: 'Change management process',
+            implementation: 'Enterprise policy versioning with signatures. Audit log records all policy changes. Skill signing ensures code integrity.',
+            status: 'implemented', evidence: ['Policy version history', 'Signature verification'], genomeShieldModule: 'EnterprisePolicyEngine',
+        },
+        {
+            id: 'CC9.1', criteria: 'CC9: Risk Mitigation',
+            description: 'Risk mitigation activities',
+            implementation: '7-layer defense-in-depth. Fail-secure defaults. Secure profile active by default. Paranoid mode for maximum restriction.',
+            status: 'implemented', evidence: ['Security profile config', '7-layer architecture documentation'], genomeShieldModule: 'SecurityPresets',
+        },
+    ];
+}
+export class SOC2Controls {
+    controls;
+    constructor(_eventBus) {
+        this.controls = buildControls();
+    }
+    generateReport(organization, from, to) {
+        const implemented = this.controls.filter(c => c.status === 'implemented').length;
+        const partial = this.controls.filter(c => c.status === 'partial').length;
+        const notImplemented = this.controls.filter(c => c.status === 'not-implemented').length;
+        const coveragePercent = Math.round((implemented / this.controls.length) * 100);
+        return {
+            generatedAt: new Date(),
+            period: { from, to },
+            organization,
+            totalControls: this.controls.length,
+            implemented,
+            partial,
+            notImplemented,
+            controls: this.controls.map(c => ({ ...c, lastReviewedAt: new Date() })),
+            summary: `${coveragePercent}% of SOC 2 controls implemented (${implemented}/${this.controls.length}). ${partial} partially implemented. ${notImplemented} not yet implemented.`,
+        };
+    }
+    getControls() {
+        return [...this.controls];
+    }
+    getControlsByCriteria(criteria) {
+        return this.controls.filter(c => c.criteria.includes(criteria));
+    }
+    getControlsByStatus(status) {
+        return this.controls.filter(c => c.status === status);
+    }
+    updateControlStatus(controlId, status) {
+        const control = this.controls.find(c => c.id === controlId);
+        if (!control)
+            return false;
+        control.status = status;
+        control.lastReviewedAt = new Date();
+        return true;
+    }
+    getCompliancePercentage() {
+        const implemented = this.controls.filter(c => c.status === 'implemented').length;
+        return Math.round((implemented / this.controls.length) * 100);
+    }
+}
+//# sourceMappingURL=SOC2Controls.js.map

package/dist/security/SOC2Controls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SOC2Controls.js","sourceRoot":"","sources":["../../src/security/SOC2Controls.ts"],"names":[],"mappings":"AA0CA,SAAS,aAAa;IAClB,OAAO;QAEH;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,0BAA0B;YACjD,WAAW,EAAE,4CAA4C;YACzD,cAAc,EAAE,sGAAsG;YACtH,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,+BAA+B,CAAC,EAAE,kBAAkB,EAAE,wBAAwB;SAC7I;QACD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,0BAA0B;YACjD,WAAW,EAAE,wCAAwC;YACrD,cAAc,EAAE,yGAAyG;YACzH,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,YAAY;SAC/G;QAGD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB;YAC3C,WAAW,EAAE,8CAA8C;YAC3D,cAAc,EAAE,gHAAgH;YAChI,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,qBAAqB;SACpH;QACD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,oBAAoB;YAC3C,WAAW,EAAE,qCAAqC;YAClD,cAAc,EAAE,qGAAqG;YACrH,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,oBAAoB;SACzH;QAGD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB;YAC7C,WAAW,EAAE,qBAAqB;YAClC,cAAc,EAAE,yGAAyG;YACzH,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,cAAc,EAAE,2BAA2B,CAAC,EAAE,kBAAkB,EAAE,sBAAsB;SAC7H;QACD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB;YAC7C,WAAW,EAAE,uBAAuB;YACpC,cAAc,EAAE,iGAAiG;YACjH,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,sBAAsB;SACxH;QAGD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB;YACxC,WAAW,EAAE,gCAAgC;YAC7C,cAAc,EAAE,+HAA+H;YAC/I,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,EAAE,uBAAuB,CAAC,EAAE,kBAAkB,EAAE,kBAAkB;SAClJ;QAGD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,yBAAyB;YAChD,WAAW,EAAE,qBAAqB;YAClC,cAAc,EAAE,2GAA2G;YAC3H,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,EAAE,kBAAkB,EAAE,qCAAqC;SACjK;QAGD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB;YAC5C,WAAW,EAAE,yBAAyB;YACtC,cAAc,EAAE,mGAAmG;YACnH,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,cAAc,CAAC,EAAE,kBAAkB,EAAE,0BAA0B;SAC7I;QACD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB;YAC5C,WAAW,EAAE,uBAAuB;YACpC,cAAc,EAAE,gHAAgH;YAChI,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,kBAAkB,EAAE,wCAAwC;SAC1I;QACD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB;YAC5C,WAAW,EAAE,4BAA4B;YACzC,cAAc,EAAE,wHAAwH;YACxI,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,EAAE,kBAAkB,EAAE,mBAAmB;SACzH;QACD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB;YAC5C,WAAW,EAAE,2BAA2B;YACxC,cAAc,EAAE,iIAAiI;YACjJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,oBAAoB,EAAE,qBAAqB,CAAC,EAAE,kBAAkB,EAAE,yCAAyC;SAChJ;QACD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,qBAAqB;YAC5C,WAAW,EAAE,kCAAkC;YAC/C,cAAc,EAAE,qIAAqI;YACrJ,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,gCAAgC;SAC1I;QAGD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB;YACxC,WAAW,EAAE,oBAAoB;YACjC,cAAc,EAAE,6HAA6H;YAC7I,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAAE,kBAAkB,EAAE,wBAAwB;SACrH;QACD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB;YACxC,WAAW,EAAE,qBAAqB;YAClC,cAAc,EAAE,2HAA2H;YAC3I,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,2BAA2B,CAAC,EAAE,kBAAkB,EAAE,oBAAoB;SAC3G;QAGD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,wBAAwB;YAC/C,WAAW,EAAE,2BAA2B;YACxC,cAAc,EAAE,2HAA2H;YAC3I,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,wBAAwB,EAAE,wBAAwB,CAAC,EAAE,kBAAkB,EAAE,wBAAwB;SACtI;QAGD;YACI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,sBAAsB;YAC7C,WAAW,EAAE,4BAA4B;YACzC,cAAc,EAAE,0HAA0H;YAC1I,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,yBAAyB,EAAE,oCAAoC,CAAC,EAAE,kBAAkB,EAAE,iBAAiB;SAC5I;KACJ,CAAC;AACN,CAAC;AAeD,MAAM,OAAO,YAAY;IACb,QAAQ,CAAgB;IAEhC,YAAY,SAA2B;QACnC,IAAI,CAAC,QAAQ,GAAG,aAAa,EAAE,CAAC;IACpC,CAAC;IAKD,cAAc,CAAC,YAAoB,EAAE,IAAU,EAAE,EAAQ;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;QACzE,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC,CAAC,MAAM,CAAC;QAExF,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;QAE/E,OAAO;YACH,WAAW,EAAE,IAAI,IAAI,EAAE;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACpB,YAAY;YACZ,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YACnC,WAAW;YACX,OAAO;YACP,cAAc;YACd,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;YACxE,OAAO,EAAE,GAAG,eAAe,oCAAoC,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,MAAM,OAAO,2BAA2B,cAAc,uBAAuB;SAClL,CAAC;IACN,CAAC;IAKD,WAAW;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAKD,qBAAqB,CAAC,QAAgB;QAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAKD,mBAAmB,CAAC,MAAqB;QACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1D,CAAC;IAKD,mBAAmB,CAAC,SAAiB,EAAE,MAAqB;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IAChB,CAAC;IAKD,uBAAuB;QACnB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAClE,CAAC;CACJ"}

package/dist/security/SecretRotationEngine.d.ts

@@ -0,0 +1,46 @@
+import { SecurityEventBus } from './SecurityEventBus.js';
+import { KeychainAdapter } from './KeychainAdapter.js';
+export interface RotationPolicy {
+    keyName: string;
+    intervalDays: number;
+    rotator: () => Promise<string>;
+    lastRotatedAt?: Date;
+    enabled: boolean;
+}
+export interface RotationResult {
+    keyName: string;
+    success: boolean;
+    rotatedAt?: Date;
+    error?: string;
+    nextRotationAt?: Date;
+}
+export interface RotationStatus {
+    totalPolicies: number;
+    enabled: number;
+    overdue: number;
+    lastCheck?: Date;
+    policies: Array<{
+        keyName: string;
+        enabled: boolean;
+        intervalDays: number;
+        lastRotatedAt?: Date;
+        nextRotationAt?: Date;
+        overdue: boolean;
+    }>;
+}
+export declare class SecretRotationEngine {
+    private eventBus;
+    private keychain;
+    private policies;
+    private timer?;
+    constructor(eventBus: SecurityEventBus, keychain: KeychainAdapter);
+    addPolicy(policy: RotationPolicy): void;
+    removePolicy(keyName: string): boolean;
+    rotate(keyName: string): Promise<RotationResult>;
+    rotateOverdue(): Promise<RotationResult[]>;
+    getStatus(): RotationStatus;
+    startAutoRotation(intervalMs?: number): void;
+    stopAutoRotation(): void;
+    private isOverdue;
+}
+//# sourceMappingURL=SecretRotationEngine.d.ts.map

package/dist/security/SecretRotationEngine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretRotationEngine.d.ts","sourceRoot":"","sources":["../../src/security/SecretRotationEngine.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAIvD,MAAM,WAAW,cAAc;IAE3B,OAAO,EAAE,MAAM,CAAC;IAEhB,YAAY,EAAE,MAAM,CAAC;IAErB,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAE/B,aAAa,CAAC,EAAE,IAAI,CAAC;IAErB,OAAO,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,QAAQ,EAAE,KAAK,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,IAAI,CAAC;QACrB,cAAc,CAAC,EAAE,IAAI,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;CACN;AAyBD,qBAAa,oBAAoB;IAC7B,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,QAAQ,CAA0C;IAC1D,OAAO,CAAC,KAAK,CAAC,CAAiC;gBAEnC,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe;IAQjE,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAOvC,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAOhC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA+ChD,aAAa,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAiBhD,SAAS,IAAI,cAAc;IAwB3B,iBAAiB,CAAC,UAAU,SAAa,GAAG,IAAI;IAUhD,gBAAgB,IAAI,IAAI;IASxB,OAAO,CAAC,SAAS;CAMpB"}

package/dist/security/SecretRotationEngine.js

@@ -0,0 +1,102 @@
+export class SecretRotationEngine {
+    eventBus;
+    keychain;
+    policies = new Map();
+    timer;
+    constructor(eventBus, keychain) {
+        this.eventBus = eventBus;
+        this.keychain = keychain;
+    }
+    addPolicy(policy) {
+        this.policies.set(policy.keyName, policy);
+    }
+    removePolicy(keyName) {
+        return this.policies.delete(keyName);
+    }
+    async rotate(keyName) {
+        const policy = this.policies.get(keyName);
+        if (!policy) {
+            return { keyName, success: false, error: 'No policy found for this key' };
+        }
+        try {
+            const newSecret = await policy.rotator();
+            if (!newSecret || newSecret.length === 0) {
+                return { keyName, success: false, error: 'Rotator returned empty secret' };
+            }
+            await this.keychain.set(keyName, newSecret);
+            policy.lastRotatedAt = new Date();
+            const nextRotationAt = new Date(Date.now() + policy.intervalDays * 86_400_000);
+            this.eventBus.emit({
+                type: 'security:audit-entry',
+                timestamp: new Date(),
+                layer: 3,
+                decision: 'info',
+                actor: {},
+                resource: { type: 'credential', id: keyName, detail: `Rotated. Next: ${nextRotationAt.toISOString().slice(0, 10)}` },
+                severity: 'info',
+            });
+            return { keyName, success: true, rotatedAt: policy.lastRotatedAt, nextRotationAt };
+        }
+        catch (err) {
+            const error = err.message;
+            this.eventBus.emitDeny('security:audit-entry', 3, {
+                type: 'credential',
+                id: keyName,
+                detail: `Rotation failed: ${error}`,
+            }, 'high');
+            return { keyName, success: false, error };
+        }
+    }
+    async rotateOverdue() {
+        const results = [];
+        for (const [keyName, policy] of this.policies) {
+            if (!policy.enabled)
+                continue;
+            if (this.isOverdue(policy)) {
+                const result = await this.rotate(keyName);
+                results.push(result);
+            }
+        }
+        return results;
+    }
+    getStatus() {
+        const policies = [...this.policies.values()].map(p => ({
+            keyName: p.keyName,
+            enabled: p.enabled,
+            intervalDays: p.intervalDays,
+            lastRotatedAt: p.lastRotatedAt,
+            nextRotationAt: p.lastRotatedAt
+                ? new Date(p.lastRotatedAt.getTime() + p.intervalDays * 86_400_000)
+                : undefined,
+            overdue: this.isOverdue(p),
+        }));
+        return {
+            totalPolicies: this.policies.size,
+            enabled: policies.filter(p => p.enabled).length,
+            overdue: policies.filter(p => p.overdue).length,
+            lastCheck: new Date(),
+            policies,
+        };
+    }
+    startAutoRotation(intervalMs = 86_400_000) {
+        this.stopAutoRotation();
+        this.timer = setInterval(() => {
+            this.rotateOverdue().catch(() => { });
+        }, intervalMs);
+    }
+    stopAutoRotation() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+    }
+    isOverdue(policy) {
+        if (!policy.enabled)
+            return false;
+        if (!policy.lastRotatedAt)
+            return true;
+        const elapsed = Date.now() - policy.lastRotatedAt.getTime();
+        return elapsed > policy.intervalDays * 86_400_000;
+    }
+}
+//# sourceMappingURL=SecretRotationEngine.js.map

package/dist/security/SecretRotationEngine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretRotationEngine.js","sourceRoot":"","sources":["../../src/security/SecretRotationEngine.ts"],"names":[],"mappings":"AA2EA,MAAM,OAAO,oBAAoB;IACrB,QAAQ,CAAmB;IAC3B,QAAQ,CAAkB;IAC1B,QAAQ,GAAgC,IAAI,GAAG,EAAE,CAAC;IAClD,KAAK,CAAkC;IAE/C,YAAY,QAA0B,EAAE,QAAyB;QAC7D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;IAKD,SAAS,CAAC,MAAsB;QAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAKD,YAAY,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAKD,KAAK,CAAC,MAAM,CAAC,OAAe;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YAEzC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;YAC/E,CAAC;YAGD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAG5C,MAAM,CAAC,aAAa,GAAG,IAAI,IAAI,EAAE,CAAC;YAClC,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,CAAC;YAE/E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,KAAK,EAAE,CAAC;gBACR,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,EAAE;gBACT,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,cAAc,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;gBACpH,QAAQ,EAAE,MAAM;aACnB,CAAC,CAAC;YAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,KAAK,GAAI,GAAa,CAAC,OAAO,CAAC;YAErC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,sBAA+B,EAAE,CAAC,EAAE;gBACvD,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,OAAO;gBACX,MAAM,EAAE,oBAAoB,KAAK,EAAE;aACtC,EAAE,MAAM,CAAC,CAAC;YAEX,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC9C,CAAC;IACL,CAAC;IAKD,KAAK,CAAC,aAAa;QACf,MAAM,OAAO,GAAqB,EAAE,CAAC;QAErC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC9B,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAKD,SAAS;QACL,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnD,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,cAAc,EAAE,CAAC,CAAC,aAAa;gBAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,YAAY,GAAG,UAAU,CAAC;gBACnE,CAAC,CAAC,SAAS;YACf,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;SAC7B,CAAC,CAAC,CAAC;QAEJ,OAAO;YACH,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;YACjC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM;YAC/C,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM;YAC/C,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,QAAQ;SACX,CAAC;IACN,CAAC;IAKD,iBAAiB,CAAC,UAAU,GAAG,UAAU;QACrC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC1B,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,CAAC,EAAE,UAAU,CAAC,CAAC;IACnB,CAAC;IAKD,gBAAgB;QACZ,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QAC3B,CAAC;IACL,CAAC;IAIO,SAAS,CAAC,MAAsB;QACpC,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC5D,OAAO,OAAO,GAAG,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC;IACtD,CAAC;CACJ"}

package/dist/security/SecretsMigrator.d.ts

@@ -0,0 +1,28 @@
+import { KeychainAdapter } from './KeychainAdapter.js';
+import { EncryptedConfigStore } from './EncryptedConfigStore.js';
+export interface MigrationResult {
+    migrated: string[];
+    skipped: string[];
+    errors: Array<{
+        key: string;
+        error: string;
+    }>;
+    sourcesProcessed: string[];
+    backupPath?: string;
+}
+export declare class SecretsMigrator {
+    private keychain;
+    private configStore;
+    constructor(keychain: KeychainAdapter, configStore: EncryptedConfigStore);
+    migrate(options?: {
+        scanPaths?: string[];
+        deleteOriginals?: boolean;
+        dryRun?: boolean;
+    }): Promise<MigrationResult>;
+    needsMigration(): Promise<boolean>;
+    private defaultScanPaths;
+    private parseFile;
+    private flattenJSON;
+    private isSecret;
+}
+//# sourceMappingURL=SecretsMigrator.d.ts.map

package/dist/security/SecretsMigrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsMigrator.d.ts","sourceRoot":"","sources":["../../src/security/SecretsMigrator.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAyCD,qBAAa,eAAe;IACxB,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAuB;gBAE9B,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,oBAAoB;IAQlE,OAAO,CAAC,OAAO,CAAC,EAAE;QACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,eAAe,CAAC;IAyEtB,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC;IAUxC,OAAO,CAAC,gBAAgB;YAQV,SAAS;IAuCvB,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,QAAQ;CAYnB"}

package/dist/security/SecretsMigrator.js

@@ -0,0 +1,170 @@
+import { readFile, rename } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+const SECRET_PATTERNS = [
+    /^sk-/,
+    /^sk-ant-/,
+    /^ghp_/,
+    /^xox[bpsr]-/,
+    /^AKIA/,
+    /^ghs_/,
+    /^glpat-/,
+    /^ntn_/,
+    /^whsec_/,
+];
+const SECRET_KEY_PATTERNS = [
+    /API_KEY$/i,
+    /SECRET$/i,
+    /TOKEN$/i,
+    /PASSWORD$/i,
+    /PRIVATE_KEY$/i,
+    /BOT_TOKEN$/i,
+    /WEBHOOK_SECRET$/i,
+    /AUTH_TOKEN$/i,
+    /ACCESS_KEY$/i,
+];
+export class SecretsMigrator {
+    keychain;
+    configStore;
+    constructor(keychain, configStore) {
+        this.keychain = keychain;
+        this.configStore = configStore;
+    }
+    async migrate(options) {
+        const scanPaths = options?.scanPaths ?? this.defaultScanPaths();
+        const deleteOriginals = options?.deleteOriginals ?? false;
+        const dryRun = options?.dryRun ?? false;
+        const result = {
+            migrated: [],
+            skipped: [],
+            errors: [],
+            sourcesProcessed: [],
+        };
+        for (const filePath of scanPaths) {
+            const resolved = filePath.replace(/^~/, homedir());
+            if (!existsSync(resolved))
+                continue;
+            result.sourcesProcessed.push(filePath);
+            try {
+                const entries = await this.parseFile(resolved);
+                for (const [key, value] of Object.entries(entries)) {
+                    if (!value || value.trim() === '') {
+                        result.skipped.push(key);
+                        continue;
+                    }
+                    const isSecret = this.isSecret(key, value);
+                    if (isSecret) {
+                        if (!dryRun) {
+                            try {
+                                await this.keychain.set(key, value);
+                                result.migrated.push(key);
+                            }
+                            catch (err) {
+                                result.errors.push({ key, error: err.message });
+                            }
+                        }
+                        else {
+                            result.migrated.push(key);
+                        }
+                    }
+                    else {
+                        if (!dryRun) {
+                            try {
+                                await this.configStore.set(key, value);
+                                result.migrated.push(key);
+                            }
+                            catch (err) {
+                                result.errors.push({ key, error: err.message });
+                            }
+                        }
+                        else {
+                            result.migrated.push(key);
+                        }
+                    }
+                }
+                if (!dryRun && deleteOriginals && result.migrated.length > 0) {
+                    const backupPath = `${resolved}.backup.${Date.now()}`;
+                    await rename(resolved, backupPath);
+                    result.backupPath = backupPath;
+                }
+            }
+            catch (err) {
+                result.errors.push({ key: filePath, error: err.message });
+            }
+        }
+        return result;
+    }
+    async needsMigration() {
+        for (const filePath of this.defaultScanPaths()) {
+            const resolved = filePath.replace(/^~/, homedir());
+            if (existsSync(resolved))
+                return true;
+        }
+        return false;
+    }
+    defaultScanPaths() {
+        return [
+            '~/.genome/.env',
+            '~/Genome/.env',
+            './.env',
+        ];
+    }
+    async parseFile(filePath) {
+        const content = await readFile(filePath, 'utf-8');
+        const entries = {};
+        if (filePath.endsWith('.json')) {
+            try {
+                const json = JSON.parse(content);
+                this.flattenJSON(json, '', entries);
+            }
+            catch {
+            }
+        }
+        else {
+            for (const line of content.split('\n')) {
+                const trimmed = line.trim();
+                if (!trimmed || trimmed.startsWith('#'))
+                    continue;
+                const eqIdx = trimmed.indexOf('=');
+                if (eqIdx === -1)
+                    continue;
+                const key = trimmed.slice(0, eqIdx).trim();
+                let value = trimmed.slice(eqIdx + 1).trim();
+                if ((value.startsWith('"') && value.endsWith('"')) ||
+                    (value.startsWith("'") && value.endsWith("'"))) {
+                    value = value.slice(1, -1);
+                }
+                if (key && value) {
+                    entries[key] = value;
+                }
+            }
+        }
+        return entries;
+    }
+    flattenJSON(obj, prefix, result) {
+        if (typeof obj === 'string') {
+            result[prefix] = obj;
+        }
+        else if (typeof obj === 'object' && obj !== null) {
+            for (const [key, value] of Object.entries(obj)) {
+                const fullKey = prefix ? `${prefix}.${key}` : key;
+                if (typeof value === 'string') {
+                    result[fullKey] = value;
+                }
+                else if (typeof value === 'object' && value !== null) {
+                    this.flattenJSON(value, fullKey, result);
+                }
+            }
+        }
+    }
+    isSecret(key, value) {
+        if (SECRET_KEY_PATTERNS.some(p => p.test(key)))
+            return true;
+        if (SECRET_PATTERNS.some(p => p.test(value)))
+            return true;
+        if (value.length > 20 && /^[A-Za-z0-9_\-+/=.]+$/.test(value))
+            return true;
+        return false;
+    }
+}
+//# sourceMappingURL=SecretsMigrator.js.map

package/dist/security/SecretsMigrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsMigrator.js","sourceRoot":"","sources":["../../src/security/SecretsMigrator.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAalC,MAAM,eAAe,GAAG;IACpB,MAAM;IACN,UAAU;IACV,OAAO;IACP,aAAa;IACb,OAAO;IACP,OAAO;IACP,SAAS;IACT,OAAO;IACP,SAAS;CACZ,CAAC;AAGF,MAAM,mBAAmB,GAAG;IACxB,WAAW;IACX,UAAU;IACV,SAAS;IACT,YAAY;IACZ,eAAe;IACf,aAAa;IACb,kBAAkB;IAClB,cAAc;IACd,cAAc;CACjB,CAAC;AAeF,MAAM,OAAO,eAAe;IAChB,QAAQ,CAAkB;IAC1B,WAAW,CAAuB;IAE1C,YAAY,QAAyB,EAAE,WAAiC;QACpE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IAKD,KAAK,CAAC,OAAO,CAAC,OAIb;QACG,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChE,MAAM,eAAe,GAAG,OAAO,EAAE,eAAe,IAAI,KAAK,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAC;QAExC,MAAM,MAAM,GAAoB;YAC5B,QAAQ,EAAE,EAAE;YACZ,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,gBAAgB,EAAE,EAAE;SACvB,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEpC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAEvC,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAE/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;wBAChC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACzB,SAAS;oBACb,CAAC;oBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAE3C,IAAI,QAAQ,EAAE,CAAC;wBACX,IAAI,CAAC,MAAM,EAAE,CAAC;4BAEV,IAAI,CAAC;gCACD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gCACpC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BAC9B,CAAC;4BAAC,OAAO,GAAG,EAAE,CAAC;gCACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;4BAC/D,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACJ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC9B,CAAC;oBACL,CAAC;yBAAM,CAAC;wBACJ,IAAI,CAAC,MAAM,EAAE,CAAC;4BAEV,IAAI,CAAC;gCACD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gCACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;4BAC9B,CAAC;4BAAC,OAAO,GAAG,EAAE,CAAC;gCACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;4BAC/D,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACJ,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAC9B,CAAC;oBACL,CAAC;gBACL,CAAC;gBAGD,IAAI,CAAC,MAAM,IAAI,eAAe,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3D,MAAM,UAAU,GAAG,GAAG,QAAQ,WAAW,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACtD,MAAM,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;oBACnC,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;gBACnC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAKD,KAAK,CAAC,cAAc;QAChB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACnD,IAAI,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1C,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAIO,gBAAgB;QACpB,OAAO;YACH,gBAAgB;YAChB,eAAe;YACf,QAAQ;SACX,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAgB;QACpC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAE7B,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;YAET,CAAC;QACL,CAAC;aAAM,CAAC;YAEJ,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAElD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACnC,IAAI,KAAK,KAAK,CAAC,CAAC;oBAAE,SAAS;gBAE3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAG5C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;oBAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACjD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC/B,CAAC;gBAED,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACzB,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAEO,WAAW,CAAC,GAAY,EAAE,MAAc,EAAE,MAA8B;QAC5E,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC;QACzB,CAAC;aAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;gBACxE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;gBAC5B,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACrD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC7C,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,KAAa;QAEvC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAG5D,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAG1D,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1E,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}

package/dist/security/SecurityEventBus.d.ts

@@ -0,0 +1,48 @@
+export type SecurityEventType = 'security:inbound-scanned' | 'security:inbound-blocked' | 'security:outbound-scanned' | 'security:outbound-quarantined' | 'security:purpose-rejected' | 'security:anomaly-detected' | 'security:pii-redacted' | 'security:data-classified' | 'security:llm-request-filtered' | 'security:local-model-routed' | 'security:keychain-access' | 'security:secret-migrated' | 'security:config-encrypted' | 'security:skill-verified' | 'security:skill-blocked' | 'security:capability-granted' | 'security:capability-denied' | 'security:exec-allowed' | 'security:exec-blocked' | 'security:fs-allowed' | 'security:fs-blocked' | 'security:process-sandboxed' | 'security:net-allowed' | 'security:net-blocked' | 'security:audit-entry' | 'security:audit-tamper-detected' | 'security:profile-changed';
+export interface SecurityEvent {
+    type: SecurityEventType;
+    timestamp: Date;
+    layer: 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    decision: 'allow' | 'deny' | 'info';
+    actor: {
+        userId?: string;
+        skillId?: string;
+        channel?: string;
+    };
+    resource: {
+        type: string;
+        id: string;
+        detail?: string;
+    };
+    evidence?: string;
+    severity: 'info' | 'warning' | 'high' | 'critical';
+}
+type SecurityEventHandler = (event: SecurityEvent) => void | Promise<void>;
+export declare class SecurityEventBus {
+    private subscriptions;
+    private nextId;
+    private history;
+    private maxHistory;
+    on(type: SecurityEventType, handler: SecurityEventHandler): number;
+    onAny(handler: SecurityEventHandler): number;
+    off(subscriptionId: number): boolean;
+    emit(event: SecurityEvent): void;
+    emitDeny(type: SecurityEventType, layer: SecurityEvent['layer'], resource: SecurityEvent['resource'], severity?: SecurityEvent['severity'], actor?: SecurityEvent['actor'], evidence?: string): void;
+    emitAllow(type: SecurityEventType, layer: SecurityEvent['layer'], resource: SecurityEvent['resource'], actor?: SecurityEvent['actor']): void;
+    getHistory(filter?: {
+        type?: SecurityEventType;
+        layer?: SecurityEvent['layer'];
+        decision?: SecurityEvent['decision'];
+        since?: Date;
+        limit?: number;
+    }): SecurityEvent[];
+    getSummary(): {
+        total: number;
+        allowed: number;
+        denied: number;
+        byLayer: Record<number, number>;
+    };
+    reset(): void;
+}
+export {};
+//# sourceMappingURL=SecurityEventBus.d.ts.map