@inhuman.tools/policy 0.0.0-stage → 0.1.0

package/dist/run-authorization.d.ts

@@ -0,0 +1,8 @@
+import { type EnvCapability } from "@here.build/arrival";
+export declare function authorize(document: string, options: {
+    readonly capability: EnvCapability;
+    readonly config?: Readonly<Record<string, unknown>>;
+    readonly program?: string;
+    readonly env?: NodeJS.ProcessEnv;
+}): Promise<"allow" | "deny" | null>;
+//# sourceMappingURL=run-authorization.d.ts.map

package/dist/run-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-authorization.d.ts","sourceRoot":"","sources":["../src/run-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAI1E,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE;IACP,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAClC,GACA,OAAO,CAAC,OAAO,GAAG,MAAM,GAAG,IAAI,CAAC,CAUlC"}

package/dist/run-authorization.js

@@ -0,0 +1,16 @@
+import { execState, toJS } from "@here.build/arrival";
+import { authorizationSource } from "./authorize.js";
+export async function authorize(document, options) {
+    const state = await execState(authorizationSource(options.program, options.env), {
+        capabilities: [options.capability],
+        config: { ...options.config, document },
+    });
+    const value = state.values.at(0);
+    if (value === undefined)
+        return null;
+    const decided = toJS(value);
+    if (decided === "allow" || decided === "deny")
+        return decided;
+    return null;
+}
+//# sourceMappingURL=run-authorization.js.map

package/dist/run-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-authorization.js","sourceRoot":"","sources":["../src/run-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,IAAI,EAAsB,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,OAKC;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;QAC/E,YAAY,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;QAClC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE;KACxC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC;IAC9D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/schemas/tirith.d.ts

@@ -0,0 +1,58 @@
+import { z } from "zod";
+export declare const findingEvidenceSchema: z.ZodObject<{
+    matched: z.ZodOptional<z.ZodString>;
+    raw: z.ZodOptional<z.ZodString>;
+    pattern: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const findingSchema: z.ZodObject<{
+    rule_id: z.ZodString;
+    severity: z.ZodEnum<{
+        INFO: "INFO";
+        LOW: "LOW";
+        MEDIUM: "MEDIUM";
+        HIGH: "HIGH";
+        CRITICAL: "CRITICAL";
+    }>;
+    title: z.ZodString;
+    description: z.ZodString;
+    remediation: z.ZodOptional<z.ZodString>;
+    evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        matched: z.ZodOptional<z.ZodString>;
+        raw: z.ZodOptional<z.ZodString>;
+        pattern: z.ZodOptional<z.ZodString>;
+        type: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare const outputSchema: z.ZodObject<{
+    schema_version: z.ZodLiteral<3>;
+    action: z.ZodEnum<{
+        block: "block";
+        allow: "allow";
+        warn: "warn";
+    }>;
+    findings: z.ZodArray<z.ZodObject<{
+        rule_id: z.ZodString;
+        severity: z.ZodEnum<{
+            INFO: "INFO";
+            LOW: "LOW";
+            MEDIUM: "MEDIUM";
+            HIGH: "HIGH";
+            CRITICAL: "CRITICAL";
+        }>;
+        title: z.ZodString;
+        description: z.ZodString;
+        remediation: z.ZodOptional<z.ZodString>;
+        evidence: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            matched: z.ZodOptional<z.ZodString>;
+            raw: z.ZodOptional<z.ZodString>;
+            pattern: z.ZodOptional<z.ZodString>;
+            type: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    bypass_honored: z.ZodLiteral<false>;
+    policy_path_used: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type TirithFinding = z.infer<typeof findingSchema>;
+export type TirithOutput = z.infer<typeof outputSchema>;
+//# sourceMappingURL=tirith.d.ts.map

package/dist/schemas/tirith.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tirith.d.ts","sourceRoot":"","sources":["../../src/schemas/tirith.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,qBAAqB;;;;;iBAKhC,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;iBAOxB,CAAC;AAEH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMvB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAC1D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/schemas/tirith.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+export const findingEvidenceSchema = z.object({
+    matched: z.string().optional(),
+    raw: z.string().optional(),
+    pattern: z.string().optional(),
+    type: z.string().optional(),
+});
+export const findingSchema = z.object({
+    rule_id: z.string(),
+    severity: z.enum(["INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL"]),
+    title: z.string(),
+    description: z.string(),
+    remediation: z.string().optional(),
+    evidence: z.array(findingEvidenceSchema).optional(),
+});
+export const outputSchema = z.object({
+    schema_version: z.literal(3),
+    action: z.enum(["allow", "warn", "block"]),
+    findings: z.array(findingSchema),
+    bypass_honored: z.literal(false),
+    policy_path_used: z.string().nullable().optional(),
+});
+//# sourceMappingURL=tirith.js.map

package/dist/schemas/tirith.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tirith.js","sourceRoot":"","sources":["../../src/schemas/tirith.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC"}

package/dist/tirith-units.d.ts

@@ -0,0 +1,2 @@
+export declare function tirithUnits(source: string): readonly string[];
+//# sourceMappingURL=tirith-units.d.ts.map

package/dist/tirith-units.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tirith-units.d.ts","sourceRoot":"","sources":["../src/tirith-units.ts"],"names":[],"mappings":"AA8BA,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAQ7D"}

package/dist/tirith-units.js

@@ -0,0 +1,227 @@
+/**
+ * Statement units for Tirith. Unbash AST, not regex. A pipeline of
+ * `grep 'fn()' file | head` is two commands; Tirith's nested-body
+ * analyzer treats the `|` as "the RHS might execute the LHS" and
+ * fail-closes. Dropping a proven-pure tail and checking each
+ * statement separately is the host's claim, not Tirith's.
+ *
+ * Do not peel when a function, `source`/`.`/`eval`/`alias`, or a
+ * PATH/ENV assignment is in the script: those rebind the tail name
+ * for later stages. Parse failure keeps the original line.
+ */
+import { parse } from "unbash";
+const SAFE_TAILS = new Set([
+    "head",
+    "tail",
+    "wc",
+    "uniq",
+    "sort",
+    "cut",
+    "tr",
+    "cat",
+    "true",
+    "false",
+]);
+const SEAL_NAMES = new Set(["source", ".", "eval", "alias"]);
+const IDENTITY_VARS = new Set(["PATH", "ENV", "BASH_ENV"]);
+const PARTLESS_FORBIDDEN = /[*?[\\$`]/;
+export function tirithUnits(source) {
+    const script = parse(source);
+    if (script.errors !== undefined && script.errors.length > 0)
+        return [source];
+    if (script.commands.some(sealsNode))
+        return [source];
+    if (!script.commands.some(hasMultiStagePipe))
+        return [source];
+    const units = [];
+    for (const statement of script.commands)
+        collectStatement(statement, source, units);
+    return units.length === 0 ? [source] : units;
+}
+function collectStatement(statement, source, units) {
+    if (statement.redirects.length > 0) {
+        units.push(source.slice(statement.command.pos, statement.command.end));
+        return;
+    }
+    collectNode(statement.command, source, units);
+}
+function collectNode(node, source, units) {
+    switch (node.type) {
+        case "Statement":
+            collectStatement(node, source, units);
+            return;
+        case "CompoundList":
+            for (const statement of node.commands)
+                collectStatement(statement, source, units);
+            return;
+        case "Pipeline":
+            units.push(peelPipeline(node, source));
+            return;
+        case "AndOr":
+            for (const child of node.commands)
+                collectNode(child, source, units);
+            return;
+        case "Subshell":
+        case "BraceGroup":
+            collectNode(node.body, source, units);
+            return;
+        case "If":
+            collectNode(node.clause, source, units);
+            collectNode(node.then, source, units);
+            if (node.else !== undefined)
+                collectNode(node.else, source, units);
+            return;
+        case "For":
+        case "Select":
+            collectNode(node.body, source, units);
+            return;
+        case "ArithmeticFor":
+        case "While":
+            collectNode(node.body, source, units);
+            return;
+        case "Case":
+            for (const item of node.items)
+                collectNode(item.body, source, units);
+            return;
+        case "Command":
+        case "TestCommand":
+        case "ArithmeticCommand":
+            units.push(source.slice(node.pos, node.end));
+            return;
+        case "Function":
+        case "Coproc":
+            units.push(source.slice(node.pos, node.end));
+            return;
+    }
+}
+function peelPipeline(node, source) {
+    let keep = node.commands.length;
+    while (keep > 1 && node.operators[keep - 2] === "|" && isSafeTail(node.commands[keep - 1])) {
+        keep -= 1;
+    }
+    if (keep === node.commands.length)
+        return source.slice(node.pos, node.end);
+    return source.slice(node.pos, node.commands[keep - 1].end);
+}
+function isSafeTail(node) {
+    if (node.type === "Pipeline" && node.commands.length === 1 && node.negated !== true && node.time !== true) {
+        return isSafeTail(node.commands[0]);
+    }
+    if (node.type !== "Command")
+        return false;
+    if (node.redirects.length > 0 || node.prefix.length > 0 || node.name === undefined)
+        return false;
+    if (!isLiteralWord(node.name) || node.name.value.includes("/"))
+        return false;
+    const argv0 = node.name.value;
+    if (!SAFE_TAILS.has(argv0))
+        return false;
+    return argv0 !== "sort" || !sortWrites(node);
+}
+function sortWrites(command) {
+    for (const word of command.suffix) {
+        if (!isLiteralWord(word))
+            return true;
+        const value = word.value;
+        if (value.startsWith("-o") || value === "--output" || value.startsWith("--output="))
+            return true;
+    }
+    return false;
+}
+function hasMultiStagePipe(node) {
+    switch (node.type) {
+        case "Pipeline":
+            return node.commands.length > 1 || node.commands.some(hasMultiStagePipe);
+        case "Statement":
+            return hasMultiStagePipe(node.command);
+        case "CompoundList":
+            return node.commands.some(hasMultiStagePipe);
+        case "AndOr":
+            return node.commands.some(hasMultiStagePipe);
+        case "Subshell":
+        case "BraceGroup":
+            return hasMultiStagePipe(node.body);
+        case "If":
+            return (hasMultiStagePipe(node.clause) ||
+                hasMultiStagePipe(node.then) ||
+                (node.else !== undefined && hasMultiStagePipe(node.else)));
+        case "For":
+        case "Select":
+        case "While":
+        case "ArithmeticFor":
+            return hasMultiStagePipe(node.body);
+        case "Case":
+            return node.items.some((item) => hasMultiStagePipe(item.body));
+        case "Function":
+        case "Coproc":
+        case "Command":
+        case "TestCommand":
+        case "ArithmeticCommand":
+            return false;
+    }
+}
+function sealsNode(node) {
+    switch (node.type) {
+        case "Function":
+        case "Coproc":
+            return true;
+        case "Statement":
+            return sealsNode(node.command);
+        case "CompoundList":
+            return node.commands.some(sealsNode);
+        case "Pipeline":
+        case "AndOr":
+            return node.commands.some(sealsNode);
+        case "Subshell":
+        case "BraceGroup":
+            return sealsNode(node.body);
+        case "If":
+            return sealsNode(node.clause) || sealsNode(node.then) || (node.else !== undefined && sealsNode(node.else));
+        case "For":
+        case "Select":
+        case "While":
+        case "ArithmeticFor":
+            return sealsNode(node.body);
+        case "Case":
+            return node.items.some((item) => sealsNode(item.body));
+        case "Command":
+            return commandSeals(node);
+        case "TestCommand":
+        case "ArithmeticCommand":
+            return false;
+    }
+}
+function commandSeals(command) {
+    if (command.prefix.some((prefix) => prefix.name !== undefined && IDENTITY_VARS.has(prefix.name)))
+        return true;
+    if (command.name === undefined || !isLiteralWord(command.name))
+        return false;
+    if (SEAL_NAMES.has(command.name.value))
+        return true;
+    if (command.name.value !== "export")
+        return false;
+    return command.suffix.some((word) => {
+        const eq = word.value.indexOf("=");
+        return eq > 0 && IDENTITY_VARS.has(word.value.slice(0, eq));
+    });
+}
+function isLiteralWord(word) {
+    if (word.parts === undefined) {
+        return !PARTLESS_FORBIDDEN.test(word.text) && !word.text.startsWith("~");
+    }
+    return word.parts.every(partIsLiteral);
+}
+function partIsLiteral(part) {
+    switch (part.type) {
+        case "Literal":
+        case "SingleQuoted":
+            return true;
+        case "AnsiCQuoted":
+            return !part.value.includes("\0");
+        case "DoubleQuoted":
+            return part.parts.every((child) => child.type === "Literal");
+        default:
+            return false;
+    }
+}
+//# sourceMappingURL=tirith-units.js.map

package/dist/tirith-units.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tirith-units.js","sourceRoot":"","sources":["../src/tirith-units.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,EAAqE,MAAM,QAAQ,CAAC;AAElG,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC9C,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,KAAK;IACL,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAClF,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAChF,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,QAAQ;QAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAoB,EAAE,MAAc,EAAE,KAAe;IAC7E,IAAI,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,MAAc,EAAE,KAAe;IAC9D,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,WAAW;YACd,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,OAAO;QACT,KAAK,cAAc;YACjB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,QAAQ;gBAAE,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YAClF,OAAO;QACT,KAAK,UAAU;YACb,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACvC,OAAO;QACT,KAAK,OAAO;YACV,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ;gBAAE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrE,OAAO;QACT,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY;YACf,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,OAAO;QACT,KAAK,IAAI;YACP,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACxC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO;QACT,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ;YACX,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,OAAO;QACT,KAAK,eAAe,CAAC;QACrB,KAAK,OAAO;YACV,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACtC,OAAO;QACT,KAAK,MAAM;YACT,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrE,OAAO;QACT,KAAK,SAAS,CAAC;QACf,KAAK,aAAa,CAAC;QACnB,KAAK,mBAAmB;YACtB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,OAAO;QACT,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,OAAO;IACX,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAyC,EAAE,MAAc;IAC7E,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAChC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,IAAU;IAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC1G,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACjG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,KAAK,KAAK,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,OAAgB;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAU;IACnC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC3E,KAAK,WAAW;YACd,OAAO,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC/C,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC/C,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY;YACf,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,IAAI;YACP,OAAO,CACL,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC9B,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC5B,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC1D,CAAC;QACJ,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC;QACb,KAAK,eAAe;YAClB,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,aAAa,CAAC;QACnB,KAAK,mBAAmB;YACtB,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAU;IAC3B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY;YACf,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,IAAI;YACP,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7G,KAAK,KAAK,CAAC;QACX,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC;QACb,KAAK,eAAe;YAClB,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,KAAK,SAAS;YACZ,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,aAAa,CAAC;QACnB,KAAK,mBAAmB;YACtB,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9G,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO,EAAE,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAU;IAC/B,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,SAAS,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QAC/D;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/tirith.d.ts

@@ -0,0 +1,24 @@
+import { type TirithFinding, type TirithOutput } from "./schemas/tirith.js";
+import type { Disposition } from "./types.js";
+export type TirithReport = {
+    readonly action: "allow" | "warn" | "block" | "error";
+    readonly findings: readonly TirithFinding[];
+    readonly error?: string;
+};
+export type ShellCheckOptions = {
+    readonly cwd: string;
+    readonly signal?: AbortSignal;
+};
+export type ShellChecker = (command: string, options: ShellCheckOptions) => Promise<TirithReport>;
+export declare function parseTirithOutput(stdout: string, code: number | null): TirithOutput;
+export declare function tirithFailure(error: unknown): TirithReport;
+export type TirithCoverage = "error" | "concrete" | "incomplete" | "intel-gap" | "none";
+export declare function tirithCoverage(report: TirithReport): TirithCoverage;
+export declare function tirithDisposition(report: TirithReport): Disposition;
+/** Model-facing. Scanner identity stays in `policyEvidenceJson`. */
+export declare function tirithMessage(report: TirithReport): string | null;
+/** Classifier PIP. Concrete findings only — no-verdicts are not threats. */
+export declare function tirithPolicyCut(report: TirithReport): string;
+export declare function parseTirithEvidence(json: string | null | undefined): TirithReport | null;
+export declare const checkTirith: ShellChecker;
+//# sourceMappingURL=tirith.d.ts.map

package/dist/tirith.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tirith.d.ts","sourceRoot":"","sources":["../src/tirith.ts"],"names":[],"mappings":"AAaA,OAAO,EAA+B,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;IACtD,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC;AACxF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAMlG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,YAAY,CAInF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAE1D;AASD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,CAAC;AAExF,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAMnE;AA4CD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,YAAY,GAAG,WAAW,CAcnE;AAED,oEAAoE;AACpE,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAejE;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAG5D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CASxF;AAuJD,eAAO,MAAM,WAAW,EAAE,YA8BzB,CAAC"}