@integsec/agentic-pentest-proxy 0.2.4 → 0.2.6

package/dist/bin/integsec-agentic-pentest-manifest.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+import { jsx as _jsx } from "react/jsx-runtime";
+import { render } from "ink";
+import fs from "fs";
+import { Wizard } from "../src/builder/wizard.js";
+import { ReviewDisplay } from "../src/builder/review-display.js";
+import { writeManifest } from "../src/builder/manifest-writer.js";
+import { ScopeManifestSchema } from "../src/manifest-schema.js";
+function parseArgs() {
+    const args = process.argv.slice(2);
+    const mode = (args[0] && !args[0].startsWith("--")) ? args[0] : "new";
+    let fromTemplate;
+    let targetFile;
+    let section;
+    let output;
+    if ((mode === "edit" || mode === "review") && args[1] && !args[1].startsWith("--")) {
+        targetFile = args[1];
+    }
+    for (let i = 1; i < args.length; i++) {
+        if (args[i] === "--from" && args[i + 1]) {
+            fromTemplate = args[i + 1];
+            i++;
+        }
+        else if (args[i] === "--template" && args[i + 1]) {
+            fromTemplate = args[i + 1];
+            i++;
+        }
+        else if (args[i] === "--section" && args[i + 1]) {
+            section = args[i + 1];
+            i++;
+        }
+        else if ((args[i] === "--output" || args[i] === "-o") && args[i + 1]) {
+            output = args[i + 1];
+            i++;
+        }
+        else if (args[i] === "--help" || args[i] === "-h") {
+            return { mode: "help" };
+        }
+    }
+    if (args[0] === "--help" || args[0] === "-h")
+        return { mode: "help" };
+    return { mode, fromTemplate, targetFile, section, output };
+}
+function printHelp() {
+    console.log(`
+IntegSec Agentic Pentest MCP Proxy — Manifest Builder
+
+Usage:
+  integsec-agentic-pentest-manifest [mode] [options]
+
+Modes:
+  new                           Create a new scope manifest (default)
+  edit <file>                   Edit an existing manifest
+  review <file>                 Review a client-submitted manifest
+  serve                         Start the client intake web server
+
+Options:
+  --from <template.json>        Pre-fill wizard from a template (new mode)
+  --section <name>              Jump to a specific section (edit mode)
+  -o, --output <file>           Output file path (default: ./scope-manifest.json)
+  -h, --help                    Show this help message
+
+Serve Options:
+  --template <template.json>    Pre-fill form from a template
+  --host <host>                 Bind address (default: 127.0.0.1)
+  --port <port>                 Port (default: 9471)
+  --tls-cert <path>             TLS certificate (required for non-localhost)
+  --tls-key <path>              TLS private key (required for non-localhost)
+  --timeout <minutes>           Auto-shutdown timeout (default: 60)
+
+Examples:
+  integsec-agentic-pentest-manifest new
+  integsec-agentic-pentest-manifest new --from template.json -o scope.json
+  integsec-agentic-pentest-manifest edit scope.json --section targets
+  integsec-agentic-pentest-manifest review submission.pending.json
+  integsec-agentic-pentest-manifest serve --template scope-template.json
+`);
+}
+function loadTemplate(filePath) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    return JSON.parse(content);
+}
+const config = parseArgs();
+if (config.mode === "help") {
+    printHelp();
+    process.exit(0);
+}
+if (config.mode === "new") {
+    const initial = config.fromTemplate ? loadTemplate(config.fromTemplate) : undefined;
+    const outputPath = config.output ?? "./scope-manifest.json";
+    const { unmount } = render(_jsx(Wizard, { initial: initial, onFinish: (manifest) => {
+            unmount();
+            try {
+                writeManifest(manifest, outputPath);
+                console.log(`\n✓ Manifest written to ${outputPath}`);
+            }
+            catch (err) {
+                console.error(`\n✗ ${err.message}`);
+                process.exit(1);
+            }
+        } }));
+}
+else if (config.mode === "edit") {
+    if (!config.targetFile) {
+        console.error("Error: edit mode requires a file path. Usage: integsec-agentic-pentest-manifest edit <file>");
+        process.exit(1);
+    }
+    const content = fs.readFileSync(config.targetFile, "utf-8");
+    const manifest = ScopeManifestSchema.parse(JSON.parse(content));
+    const outputPath = config.output ?? config.targetFile;
+    const { unmount } = render(_jsx(Wizard, { initial: manifest, onFinish: (updated) => {
+            unmount();
+            try {
+                writeManifest(updated, outputPath, { force: true });
+                console.log(`\n✓ Manifest updated at ${outputPath}`);
+            }
+            catch (err) {
+                console.error(`\n✗ ${err.message}`);
+                process.exit(1);
+            }
+        } }));
+}
+else if (config.mode === "review") {
+    if (!config.targetFile) {
+        console.error("Error: review mode requires a file path. Usage: integsec-agentic-pentest-manifest review <file>");
+        process.exit(1);
+    }
+    const content = fs.readFileSync(config.targetFile, "utf-8");
+    const manifest = ScopeManifestSchema.parse(JSON.parse(content));
+    const { unmount } = render(_jsx(ReviewDisplay, { manifest: manifest, sourcePath: config.targetFile, onDone: () => {
+            unmount();
+            process.exit(0);
+        } }));
+}
+else if (config.mode === "serve") {
+    const template = config.fromTemplate ? loadTemplate(config.fromTemplate) : undefined;
+    // Parse serve-specific args
+    const args = process.argv.slice(2);
+    let host = "127.0.0.1";
+    let port = 9471;
+    let tlsCert;
+    let tlsKey;
+    let timeout = 60;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === "--host" && args[i + 1]) {
+            host = args[i + 1];
+            i++;
+        }
+        if (args[i] === "--port" && args[i + 1]) {
+            port = parseInt(args[i + 1], 10);
+            i++;
+        }
+        if (args[i] === "--tls-cert" && args[i + 1]) {
+            tlsCert = args[i + 1];
+            i++;
+        }
+        if (args[i] === "--tls-key" && args[i + 1]) {
+            tlsKey = args[i + 1];
+            i++;
+        }
+        if (args[i] === "--timeout" && args[i + 1]) {
+            timeout = parseInt(args[i + 1], 10);
+            i++;
+        }
+        if (args[i] === "--template" && args[i + 1]) {
+            i++;
+        } // already handled by fromTemplate
+    }
+    const { startServer } = await import("../src/builder/web/server.js");
+    startServer({
+        port,
+        host,
+        template,
+        outputDir: config.output ?? "./submissions",
+        tlsCert,
+        tlsKey,
+        timeoutMinutes: timeout,
+    });
+}
+//# sourceMappingURL=integsec-agentic-pentest-manifest.js.map

package/dist/bin/integsec-agentic-pentest-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integsec-agentic-pentest-manifest.js","sourceRoot":"","sources":["../../bin/integsec-agentic-pentest-manifest.tsx"],"names":[],"mappings":";;AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,SAAS,SAAS;IAOhB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IAE7E,IAAI,YAAgC,CAAC;IACrC,IAAI,UAA8B,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,IAAI,MAA0B,CAAC;IAE/B,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,YAAY,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;aACxE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,YAAY,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;aACjF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;aAC3E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;aAC/F,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC;IACjF,CAAC;IAED,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEtE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCb,CAAC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAA2B,CAAC;AACvD,CAAC;AAED,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;AAE3B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAE,CAAC;IACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,uBAAuB,CAAC;IAE5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CACxB,KAAC,MAAM,IACL,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE;YACrB,OAAO,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,GACD,CACH,CAAC;AACJ,CAAC;KAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,6FAA6F,CAAC,CAAC;QAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC;IAEtD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CACxB,KAAC,MAAM,IACL,OAAO,EAAE,QAAQ,EACjB,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;YACpB,OAAO,EAAE,CAAC;YACV,IAAI,CAAC;gBACH,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,GACD,CACH,CAAC;AACJ,CAAC;KAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,iGAAiG,CAAC,CAAC;QACjH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CACxB,KAAC,aAAa,IACZ,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,MAAM,CAAC,UAAU,EAC7B,MAAM,EAAE,GAAG,EAAE;YACX,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,GACD,CACH,CAAC;AACJ,CAAC;KAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAErF,4BAA4B;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,GAAG,WAAW,CAAC;IACvB,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,IAAI,OAA2B,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAO,GAAG,EAAE,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;QACrE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;QACnF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;QAC5E,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;QAC1E,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC;QACzF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;QAAC,CAAC,CAAC,kCAAkC;IAC1F,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACrE,WAAW,CAAC;QACV,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,eAAe;QAC3C,OAAO;QACP,MAAM;QACN,cAAc,EAAE,OAAO;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/bin/integsec-agentic-pentest-proxy.d.ts

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-export {};
+import "dotenv/config";
 //# sourceMappingURL=integsec-agentic-pentest-proxy.d.ts.map

package/dist/bin/integsec-agentic-pentest-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integsec-agentic-pentest-proxy.d.ts","sourceRoot":"","sources":["../../bin/integsec-agentic-pentest-proxy.ts"],"names":[],"mappings":""}
+{"version":3,"file":"integsec-agentic-pentest-proxy.d.ts","sourceRoot":"","sources":["../../bin/integsec-agentic-pentest-proxy.ts"],"names":[],"mappings":";AAEA,OAAO,eAAe,CAAC"}

package/dist/bin/integsec-agentic-pentest-proxy.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
+import "dotenv/config";
 import { loadConfig } from "../src/config.js";
 import { loadManifest } from "../src/manifest.js";
 import { ScopeEnforcementProxy } from "../src/proxy.js";
 import { runStdioProxy } from "../src/transports/stdio.js";
 import { runHttpProxy } from "../src/transports/http.js";
+import { runSseProxy } from "../src/transports/sse.js";
 import { CloudWatchAuditLogger } from "../src/audit/cloudwatch.js";
 import { AzureMonitorAuditLogger } from "../src/audit/azure-monitor.js";
 import { GcpAuditLogger } from "../src/audit/gcp-logging.js";
@@ -21,8 +23,11 @@ async function main() {
         auditLogger.addBackend(new CloudWatchAuditLogger(config.awsLogGroup, config.awsRegion));
         console.error(`[integsec-agentic-pentest-proxy] CloudWatch logging enabled: ${config.awsLogGroup}`);
     }
-    if (config.azureLogWorkspaceId && config.azureDcrImmutableId) {
-        auditLogger.addBackend(new AzureMonitorAuditLogger(config.azureLogWorkspaceId, config.azureDcrImmutableId, config.azureDcrStreamName));
+    if (config.azureLogWorkspaceId && !config.azureLogIngestionEndpoint) {
+        throw new Error("AZURE_LOG_WORKSPACE_ID cannot be used as an ingestion endpoint; set AZURE_LOG_INGESTION_ENDPOINT from the DCR or DCE");
+    }
+    if (config.azureLogIngestionEndpoint && config.azureDcrImmutableId) {
+        auditLogger.addBackend(new AzureMonitorAuditLogger(config.azureLogIngestionEndpoint, config.azureDcrImmutableId, config.azureDcrStreamName));
         console.error("[integsec-agentic-pentest-proxy] Azure Monitor logging enabled");
     }
     if (config.gcpProject) {
@@ -34,14 +39,21 @@ async function main() {
             console.error("[integsec-agentic-pentest-proxy] ERROR: UPSTREAM_MCP_COMMAND is required for stdio transport");
             process.exit(1);
         }
-        await runStdioProxy(proxy, config.upstreamMcpCommand, config.upstreamMcpArgs);
+        await runStdioProxy(proxy, config.upstreamMcpCommand, config.upstreamMcpArgs, config.upstreamStartupDelayMs);
+    }
+    else if (config.transport === "sse") {
+        if (!config.upstreamMcpUrl) {
+            console.error("[integsec-agentic-pentest-proxy] ERROR: UPSTREAM_MCP_URL is required for SSE transport");
+            process.exit(1);
+        }
+        await runSseProxy(proxy, config.upstreamMcpUrl);
     }
     else {
         if (!config.upstreamMcpUrl) {
             console.error("[integsec-agentic-pentest-proxy] ERROR: UPSTREAM_MCP_URL is required for HTTP transport");
             process.exit(1);
         }
-        await runHttpProxy(proxy, config.upstreamMcpUrl, config.proxyPort);
+        await runHttpProxy(proxy, config.upstreamMcpUrl, config.proxyPort, config.proxyHost, config.proxyAuthToken);
     }
 }
 main().catch((err) => {

package/dist/bin/integsec-agentic-pentest-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"integsec-agentic-pentest-proxy.js","sourceRoot":"","sources":["../../bin/integsec-agentic-pentest-proxy.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IAEtC,OAAO,CAAC,KAAK,CAAC,gEAAgE,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7H,OAAO,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,iBAAiB,CAAC,KAAK,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC;IACnI,OAAO,CAAC,KAAK,CAAC,+CAA+C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAEjF,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAE3C,mCAAmC;IACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,WAAW,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,gEAAgE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC7D,WAAW,CAAC,UAAU,CACpB,IAAI,uBAAuB,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAC/G,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,WAAW,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,yFAAyF,CAAC,CAAC;YACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,iDAAiD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"integsec-agentic-pentest-proxy.js","sourceRoot":"","sources":["../../bin/integsec-agentic-pentest-proxy.ts"],"names":[],"mappings":";AAEA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAE9D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAC;IAEtC,OAAO,CAAC,KAAK,CAAC,gEAAgE,QAAQ,CAAC,aAAa,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7H,OAAO,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,iBAAiB,CAAC,KAAK,OAAO,QAAQ,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC;IACnI,OAAO,CAAC,KAAK,CAAC,+CAA+C,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAEjF,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC;IAE3C,mCAAmC;IACnC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,WAAW,CAAC,UAAU,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,gEAAgE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,sHAAsH,CAAC,CAAC;IAC1I,CAAC;IACD,IAAI,MAAM,CAAC,yBAAyB,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QACnE,WAAW,CAAC,UAAU,CACpB,IAAI,uBAAuB,CAAC,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,CAAC,CACrH,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,WAAW,CAAC,UAAU,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,aAAa,CACjB,KAAK,EACL,MAAM,CAAC,kBAAkB,EACzB,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,sBAAsB,CAC9B,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,wFAAwF,CAAC,CAAC;YACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,yFAAyF,CAAC,CAAC;YACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,iDAAiD,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/src/audit/azure-monitor.d.ts

@@ -9,13 +9,13 @@ import type { AuditBackend } from "./index.js";
  * disabled.
  */
 export declare class AzureMonitorAuditLogger implements AuditBackend {
-    private workspaceId;
+    private endpoint;
     private dcrImmutableId;
     private streamName;
     private buffer;
     /** Set to false when the SDKs cannot be loaded so we never crash. */
     private enabled;
-    constructor(workspaceId: string, dcrImmutableId: string, streamName: string);
+    constructor(endpoint: string, dcrImmutableId: string, streamName: string);
     log(entry: AuditEntry): Promise<void>;
     flush(): Promise<void>;
 }

package/dist/src/audit/azure-monitor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"azure-monitor.d.ts","sourceRoot":"","sources":["../../../src/audit/azure-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;GAOG;AACH,qBAAa,uBAAwB,YAAW,YAAY;IAC1D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAoB;IAClC,qEAAqE;IACrE,OAAO,CAAC,OAAO,CAAQ;gBAEX,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAMrE,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA4C7B"}
+{"version":3,"file":"azure-monitor.d.ts","sourceRoot":"","sources":["../../../src/audit/azure-monitor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;GAOG;AACH,qBAAa,uBAAwB,YAAW,YAAY;IAC1D,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,MAAM,CAAoB;IAClC,qEAAqE;IACrE,OAAO,CAAC,OAAO,CAAQ;gBAEX,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;IAUlE,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA0C7B"}

package/dist/src/audit/azure-monitor.js

@@ -7,14 +7,18 @@
  * disabled.
  */
 export class AzureMonitorAuditLogger {
-    workspaceId;
+    endpoint;
     dcrImmutableId;
     streamName;
     buffer = [];
     /** Set to false when the SDKs cannot be loaded so we never crash. */
     enabled = true;
-    constructor(workspaceId, dcrImmutableId, streamName) {
-        this.workspaceId = workspaceId;
+    constructor(endpoint, dcrImmutableId, streamName) {
+        const parsed = new URL(endpoint);
+        if (parsed.protocol !== "https:" || !parsed.hostname.endsWith(".monitor.azure.com")) {
+            throw new Error("AZURE_LOG_INGESTION_ENDPOINT must be an HTTPS Azure Monitor ingestion endpoint");
+        }
+        this.endpoint = parsed.origin;
         this.dcrImmutableId = dcrImmutableId;
         this.streamName = streamName;
     }
@@ -45,9 +49,8 @@ export class AzureMonitorAuditLogger {
         }
         const { LogsIngestionClient } = ingestionModule;
         const { DefaultAzureCredential } = identityModule;
-        const endpoint = `https://${this.workspaceId}.ingest.monitor.azure.com`;
         const credential = new DefaultAzureCredential();
-        const client = new LogsIngestionClient(endpoint, credential);
+        const client = new LogsIngestionClient(this.endpoint, credential);
         try {
             // The SDK types require Record<string, unknown>[] — cast via unknown.
             await client.upload(this.dcrImmutableId, this.streamName, toSend);

package/dist/src/audit/azure-monitor.js.map

@@ -1 +1 @@
-{"version":3,"file":"azure-monitor.js","sourceRoot":"","sources":["../../../src/audit/azure-monitor.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAC1B,WAAW,CAAS;IACpB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,MAAM,GAAiB,EAAE,CAAC;IAClC,qEAAqE;IAC7D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,WAAmB,EAAE,cAAsB,EAAE,UAAkB;QACzE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,eAA0D,CAAC;QAC/D,IAAI,cAAgD,CAAC;QAErD,IAAI,CAAC;YACH,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpD,MAAM,CAAC,0BAA0B,CAAC;gBAClC,MAAM,CAAC,iBAAiB,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,+EAA+E;gBAC7E,qDAAqD,CACxD,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,eAAe,CAAC;QAChD,MAAM,EAAE,sBAAsB,EAAE,GAAG,cAAc,CAAC;QAElD,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,WAAW,2BAA2B,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,sBAAsB,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAE7D,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,UAAU,EACf,MAA8C,CAC/C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YAChE,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"azure-monitor.js","sourceRoot":"","sources":["../../../src/audit/azure-monitor.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAuB;IAC1B,QAAQ,CAAS;IACjB,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,MAAM,GAAiB,EAAE,CAAC;IAClC,qEAAqE;IAC7D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,QAAgB,EAAE,cAAsB,EAAE,UAAkB;QACtE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,eAA0D,CAAC;QAC/D,IAAI,cAAgD,CAAC;QACrD,IAAI,CAAC;YACH,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACpD,MAAM,CAAC,0BAA0B,CAAC;gBAClC,MAAM,CAAC,iBAAiB,CAAC;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,+EAA+E;gBAC7E,qDAAqD,CACxD,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,mBAAmB,EAAE,GAAG,eAAe,CAAC;QAChD,MAAM,EAAE,sBAAsB,EAAE,GAAG,cAAc,CAAC;QAElD,MAAM,UAAU,GAAG,IAAI,sBAAsB,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAElE,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,MAAM,CAAC,MAAM,CACjB,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,UAAU,EACf,MAA8C,CAC/C,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;YAChE,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF"}

package/dist/src/audit/cloudwatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudwatch.d.ts","sourceRoot":"","sources":["../../../src/audit/cloudwatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,YAAY;IACxD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAAoB;IAClC,oEAAoE;IACpE,OAAO,CAAC,OAAO,CAAQ;gBAEX,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAKvC,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAyE7B"}
+{"version":3,"file":"cloudwatch.d.ts","sourceRoot":"","sources":["../../../src/audit/cloudwatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;GAMG;AACH,qBAAa,qBAAsB,YAAW,YAAY;IACxD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,MAAM,CAAoB;IAClC,oEAAoE;IACpE,OAAO,CAAC,OAAO,CAAQ;gBAEX,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAKvC,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAsE7B"}

package/dist/src/audit/cloudwatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloudwatch.js","sourceRoot":"","sources":["../../../src/audit/cloudwatch.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACxB,QAAQ,CAAS;IACjB,MAAM,CAAqB;IAC3B,MAAM,GAAiB,EAAE,CAAC;IAClC,oEAAoE;IAC5D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,QAAgB,EAAE,MAAe;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,GAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,4EAA4E;gBAC1E,uCAAuC,CAC1C,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EACJ,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,GACpB,GAAG,GAAG,CAAC;QAER,MAAM,MAAM,GAAG,IAAI,oBAAoB,CACrC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAC;QAEF,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;QACjE,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,IAAI,CAAC;YACH,4CAA4C;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;YAC/C,CAAC;YAED,6CAA6C;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,sBAAsB,CAAC;oBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;oBAC3B,aAAa,EAAE,SAAS;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;YAC/C,CAAC;YAED,gCAAgC;YAChC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,aAAa,EAAE,SAAS;gBACxB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAC9C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC/B,CAAC,CAAC;aACJ,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC9D,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,MAAM,IAAI,GAAG;QACZ,GAAwB,CAAC,IAAI,KAAK,gCAAgC,CACpE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cloudwatch.js","sourceRoot":"","sources":["../../../src/audit/cloudwatch.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AACH,MAAM,OAAO,qBAAqB;IACxB,QAAQ,CAAS;IACjB,MAAM,CAAqB;IAC3B,MAAM,GAAiB,EAAE,CAAC;IAClC,oEAAoE;IAC5D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,QAAgB,EAAE,MAAe;QAC3C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,GAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,4EAA4E;gBAC1E,uCAAuC,CAC1C,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EACJ,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,GACpB,GAAG,GAAG,CAAC;QACR,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAEpF,wEAAwE;QACxE,4DAA4D;QAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,IAAI,SAAS,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;QACjE,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;QAE5C,IAAI,CAAC;YACH,4CAA4C;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;YAC/C,CAAC;YAED,6CAA6C;YAC7C,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,sBAAsB,CAAC;oBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;oBAC3B,aAAa,EAAE,SAAS;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;YAC/C,CAAC;YAED,gCAAgC;YAChC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,aAAa,EAAE,SAAS;gBACxB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChC,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE;oBAC9C,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBAC/B,CAAC,CAAC;aACJ,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC9D,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,OAAO,CACL,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,KAAK,IAAI;QACZ,MAAM,IAAI,GAAG;QACZ,GAAyB,CAAC,IAAI,KAAK,gCAAgC,CACrE,CAAC;AACJ,CAAC"}

package/dist/src/audit/gcp-logging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-logging.d.ts","sourceRoot":"","sources":["../../../src/audit/gcp-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,MAAM,CAAoB;IAClC,oEAAoE;IACpE,OAAO,CAAC,OAAO,CAAQ;gBAEX,SAAS,CAAC,EAAE,MAAM;IAIxB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAqD7B"}
+{"version":3,"file":"gcp-logging.d.ts","sourceRoot":"","sources":["../../../src/audit/gcp-logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAI/C;;;;;;;;;;GAUG;AACH,qBAAa,cAAe,YAAW,YAAY;IACjD,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,MAAM,CAAoB;IAClC,oEAAoE;IACpE,OAAO,CAAC,OAAO,CAAQ;gBAEX,SAAS,CAAC,EAAE,MAAM;IAIxB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA+C7B"}

package/dist/src/audit/gcp-logging.js

@@ -49,13 +49,11 @@ export class GcpAuditLogger {
                 const severity = entry.decision.startsWith("BLOCKED") ? "WARNING" : "INFO";
                 return log.entry({
                     severity,
-                    resource: {
-                        type: "global",
-                        labels: {
-                            engagement_id: entry.engagement_id,
-                            client: entry.client,
-                        },
+                    labels: {
+                        engagement_id: entry.engagement_id,
+                        client: entry.client,
                     },
+                    resource: { type: "global" },
                 }, entry);
             });
             await log.write(gcpEntries);

package/dist/src/audit/gcp-logging.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp-logging.js","sourceRoot":"","sources":["../../../src/audit/gcp-logging.ts"],"names":[],"mappings":"AAGA,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,CAAqB;IAC9B,MAAM,GAAiB,EAAE,CAAC;IAClC,oEAAoE;IAC5D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,SAAkB;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,GAA2C,CAAC;QAChD,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,2DAA2D;gBACzD,gCAAgC,CACnC,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QAExB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS;YAClC,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAElB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;gBAE3E,OAAO,GAAG,CAAC,KAAK,CACd;oBACE,QAAQ;oBACR,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,MAAM,EAAE;4BACN,aAAa,EAAE,KAAK,CAAC,aAAa;4BAClC,MAAM,EAAE,KAAK,CAAC,MAAM;yBACrB;qBACF;iBACF,EACD,KAAK,CACN,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"gcp-logging.js","sourceRoot":"","sources":["../../../src/audit/gcp-logging.ts"],"names":[],"mappings":"AAGA,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,CAAqB;IAC9B,MAAM,GAAiB,EAAE,CAAC;IAClC,oEAAoE;IAC5D,OAAO,GAAG,IAAI,CAAC;IAEvB,YAAY,SAAkB;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEtD,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAErC,IAAI,GAA2C,CAAC;QAChD,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CACV,2DAA2D;gBACzD,gCAAgC,CACnC,CAAC;YACF,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,sEAAsE;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC;QACxB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS;YAClC,CAAC,CAAC,IAAI,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;gBAC3E,OAAO,GAAG,CAAC,KAAK,CACd;oBACE,QAAQ;oBACR,MAAM,EAAE;wBACN,aAAa,EAAE,KAAK,CAAC,aAAa;wBAClC,MAAM,EAAE,KAAK,CAAC,MAAM;qBACrB;oBACD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC7B,EACD,KAAK,CACN,CAAC;YACJ,CAAC,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;YACvD,kEAAkE;YAClE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF"}

package/dist/src/audit/index.d.ts

@@ -18,9 +18,16 @@ export interface AuditBackend {
  */
 export declare class AuditLogger {
     private backends;
+    private local;
     private flushIntervalMs;
     private timer;
     constructor(localPath: string, flushIntervalMs?: number);
+    /**
+     * Flush only the local JSONL backend. The proxy calls this after every
+     * decision so the on-disk trail is complete even if the process is killed
+     * (e.g. TerminateProcess on Windows); cloud backends keep batching.
+     */
+    flushLocal(): Promise<void>;
     /**
      * Register an additional backend (e.g. a cloud logging sink).
      */

package/dist/src/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID;;;;;;;;GAQG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,KAAK,CAA+C;gBAEhD,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM;IAMvD;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAIvC;;OAEG;IACH,KAAK,IAAI,IAAI;IASb;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAO5B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,YAAY,EAAE,UAAU,EAAE,CAAC;AAI3B;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAsB;IACtC,OAAO,CAAC,KAAK,CAAmB;IAChC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,KAAK,CAA+C;gBAEhD,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM;IAOvD;;;;OAIG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAIjC;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAIvC;;OAEG;IACH,KAAK,IAAI,IAAI;IASb;;;;OAIG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAO5B"}

package/dist/src/audit/index.js

@@ -11,12 +11,22 @@ const DEFAULT_FLUSH_INTERVAL_MS = 5000;
  */
 export class AuditLogger {
     backends = [];
+    local;
     flushIntervalMs;
     timer = null;
     constructor(localPath, flushIntervalMs) {
         this.flushIntervalMs = flushIntervalMs ?? DEFAULT_FLUSH_INTERVAL_MS;
         // Local backend is always present
-        this.backends.push(new LocalAuditLogger(localPath));
+        this.local = new LocalAuditLogger(localPath);
+        this.backends.push(this.local);
+    }
+    /**
+     * Flush only the local JSONL backend. The proxy calls this after every
+     * decision so the on-disk trail is complete even if the process is killed
+     * (e.g. TerminateProcess on Windows); cloud backends keep batching.
+     */
+    async flushLocal() {
+        await this.local.flush();
     }
     /**
      * Register an additional backend (e.g. a cloud logging sink).

package/dist/src/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAY9C,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACd,QAAQ,GAAmB,EAAE,CAAC;IAC9B,eAAe,CAAS;IACxB,KAAK,GAA0C,IAAI,CAAC;IAE5D,YAAY,SAAiB,EAAE,eAAwB;QACrD,IAAI,CAAC,eAAe,GAAG,eAAe,IAAI,yBAAyB,CAAC;QACpE,kCAAkC;QAClC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAqB;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,kBAAkB;QAC5B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAI9C,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAUvC;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACd,QAAQ,GAAmB,EAAE,CAAC;IAC9B,KAAK,CAAmB;IACxB,eAAe,CAAS;IACxB,KAAK,GAA0C,IAAI,CAAC;IAE5D,YAAY,SAAiB,EAAE,eAAwB;QACrD,IAAI,CAAC,eAAe,GAAG,eAAe,IAAI,yBAAyB,CAAC;QACpE,kCAAkC;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAqB;QAC9B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,kBAAkB;QAC5B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/src/audit/local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../src/audit/local.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,6DAA6D;IAC7D,OAAO,CAAC,MAAM,CAAwC;gBAE1C,QAAQ,EAAE,MAAM;IAI5B;;OAEG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAsB7B"}
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../../src/audit/local.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAS;IACzB,6DAA6D;IAC7D,OAAO,CAAC,MAAM,CAAwC;gBAE1C,QAAQ,EAAE,MAAM;IAI5B;;OAEG;IACG,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ3C;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAkB7B"}

package/dist/src/audit/local.js

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { engagementFileStem } from "../safe-filename.js";
 /**
  * LocalAuditLogger buffers AuditEntry objects in memory, keyed by engagement_id,
  * and writes them to JSONL files on disk when flush() is called.
@@ -39,7 +40,7 @@ export class LocalAuditLogger {
             if (entries.length === 0) {
                 continue;
             }
-            const filePath = path.join(this.basePath, `${engagementId}.jsonl`);
+            const filePath = path.join(this.basePath, `${engagementFileStem(engagementId)}.jsonl`);
             // Build the content to append: one JSON object per line, terminated with \n
             const lines = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
             fs.appendFileSync(filePath, lines, "utf-8");

package/dist/src/audit/local.js.map

@@ -1 +1 @@
-{"version":3,"file":"local.js","sourceRoot":"","sources":["../../../src/audit/local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACnB,QAAQ,CAAS;IACzB,6DAA6D;IACrD,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEtD,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,mCAAmC;QACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjD,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,YAAY,QAAQ,CAAC,CAAC;YACnE,4EAA4E;YAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACtE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF"}
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../../src/audit/local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,OAAO,gBAAgB;IACnB,QAAQ,CAAS;IACzB,6DAA6D;IACrD,MAAM,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEtD,YAAY,QAAgB;QAC1B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,GAAG,CAAC,KAAiB;QACzB,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,mCAAmC;QACnC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvF,4EAA4E;YAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACtE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;QACD,sCAAsC;QACtC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/src/builder/dry-run.d.ts

@@ -0,0 +1,12 @@
+import type { ScopeManifest, Decision } from "../types.js";
+import { DnsResolver } from "../dns-resolver.js";
+export interface DryRunResult {
+    target: string;
+    tool: string;
+    expected: "ALLOWED" | "BLOCKED";
+    actual: Decision;
+    pass: boolean;
+    reason: string;
+}
+export declare function runDryRun(manifest: ScopeManifest, resolver?: DnsResolver): Promise<DryRunResult[]>;
+//# sourceMappingURL=dry-run.d.ts.map

package/dist/src/builder/dry-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dry-run.d.ts","sourceRoot":"","sources":["../../../src/builder/dry-run.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGjD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,SAAS,GAAG,SAAS,CAAC;IAChC,MAAM,EAAE,QAAQ,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,aAAa,EACvB,QAAQ,CAAC,EAAE,WAAW,GACrB,OAAO,CAAC,YAAY,EAAE,CAAC,CA4FzB"}

package/dist/src/builder/dry-run.js

@@ -0,0 +1,103 @@
+import { ScopeValidator } from "../validator.js";
+import { DnsResolver } from "../dns-resolver.js";
+import { isIpInCidr } from "../ip-matcher.js";
+export async function runDryRun(manifest, resolver) {
+    const dnsResolver = resolver ?? new DnsResolver(0);
+    const validator = new ScopeValidator(manifest, dnsResolver);
+    const results = [];
+    // Test each authorized domain
+    for (const domain of manifest.authorized_targets.domains) {
+        const testDomain = domain.startsWith("*.") ? `test-sample.${domain.slice(2)}` : domain;
+        const result = await validator.validate("nmap", { target: testDomain });
+        results.push({
+            target: testDomain,
+            tool: "nmap",
+            expected: "ALLOWED",
+            actual: result.decision,
+            pass: result.decision === "ALLOWED",
+            reason: result.reason,
+        });
+    }
+    // Test a sample IP from each authorized range
+    for (const range of manifest.authorized_targets.ip_ranges) {
+        const sampleIp = sampleIpFromCidr(range);
+        if (!sampleIp)
+            continue;
+        const result = await validator.validate("nmap", { target: sampleIp });
+        results.push({
+            target: sampleIp,
+            tool: "nmap",
+            expected: "ALLOWED",
+            actual: result.decision,
+            pass: result.decision === "ALLOWED",
+            reason: result.reason,
+        });
+    }
+    // Test each excluded target
+    for (const excluded of manifest.excluded_targets) {
+        const result = await validator.validate("nmap", { target: excluded });
+        results.push({
+            target: excluded,
+            tool: "nmap",
+            expected: "BLOCKED",
+            actual: result.decision,
+            pass: result.decision.startsWith("BLOCKED"),
+            reason: result.reason,
+        });
+    }
+    // Test sensitive targets — always expected BLOCKED unless explicitly authorized
+    const sensitiveTargets = ["169.254.169.254", "8.8.8.8"];
+    for (const target of sensitiveTargets) {
+        const isAuthorized = manifest.authorized_targets.ip_ranges.some((range) => isIpInCidr(target, range));
+        const result = await validator.validate("curl", { url: `http://${target}/` });
+        results.push({
+            target,
+            tool: "curl",
+            expected: isAuthorized ? "ALLOWED" : "BLOCKED",
+            actual: result.decision,
+            pass: isAuthorized
+                ? result.decision === "ALLOWED"
+                : result.decision.startsWith("BLOCKED"),
+            reason: result.reason,
+        });
+    }
+    // Universal canary probes: representative targets an operator would normally
+    // authorize. If the manifest does not cover them they will be BLOCKED, which
+    // surfaces as a surprise (pass=false) and signals under-specified scope.
+    const canaryTargets = [
+        { target: "192.168.1.1", tool: "nmap" },
+        { target: "10.0.0.1", tool: "nmap" },
+    ];
+    for (const { target, tool } of canaryTargets) {
+        const isAuthorized = manifest.authorized_targets.ip_ranges.some((range) => isIpInCidr(target, range)) ||
+            manifest.authorized_targets.domains.some((d) => d === target);
+        if (isAuthorized)
+            continue; // already covered by authorized range probes above
+        const result = await validator.validate(tool, { target });
+        results.push({
+            target,
+            tool,
+            expected: "ALLOWED",
+            actual: result.decision,
+            pass: result.decision === "ALLOWED",
+            reason: result.reason,
+        });
+    }
+    return results;
+}
+function sampleIpFromCidr(cidr) {
+    if (!cidr.includes("/"))
+        return cidr;
+    const [base, prefix] = cidr.split("/");
+    const prefixNum = parseInt(prefix, 10);
+    if (prefixNum >= 32 || (base.includes(":") && prefixNum >= 128))
+        return base;
+    if (!base.includes(":")) {
+        const parts = base.split(".");
+        const offset = Math.min(50, Math.pow(2, 32 - prefixNum) - 2);
+        parts[3] = String(parseInt(parts[3], 10) + offset);
+        return parts.join(".");
+    }
+    return base;
+}
+//# sourceMappingURL=dry-run.js.map

package/dist/src/builder/dry-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dry-run.js","sourceRoot":"","sources":["../../../src/builder/dry-run.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAW9C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAuB,EACvB,QAAsB;IAEtB,MAAM,WAAW,GAAG,QAAQ,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,8BAA8B;IAC9B,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QACvF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,8CAA8C;IAC9C,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,kBAAkB,CAAC,SAAS,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IACxD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,QAAQ,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACxE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAC1B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,MAAM,GAAG,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC;YACX,MAAM;YACN,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YAC9C,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,YAAY;gBAChB,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;gBAC/B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,aAAa,GAAG;QACpB,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;QACvC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;KACrC,CAAC;IACF,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;QAC7C,MAAM,YAAY,GAChB,QAAQ,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACnD,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAC1B;YACD,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;QAChE,IAAI,YAAY;YAAE,SAAS,CAAC,mDAAmD;QAC/E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC;YACX,MAAM;YACN,IAAI;YACJ,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,SAAS;YACnC,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,SAAS,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}