@interlok/cli 0.0.0-stage → 1.3.0

package/dist/packs.js

@@ -0,0 +1,186 @@
+/**
+ * The change-control-v1 (with its model-change rules) and access-control-v1 packs: deterministic predicates over a normalized
+ * request. A request is held when any rule with `hold: true` fires or its points reach the
+ * threshold (50). Nothing here calls a model or the network, and the same input always yields the
+ * same rules, so a CI run, the console and a test agree.
+ */
+export const HOLD_THRESHOLD = 50;
+/**
+ * A model promotion: what a production AI system will run after this change. Swapping a provider,
+ * a model, its weights, its quantization or its prompt template changes behaviour as surely as a
+ * code deploy, and usually without a diff anyone reads.
+ */
+export const MODEL_CHANGE_KINDS = [
+    "model",
+    "provider",
+    "weights",
+    "fine_tune",
+    "quantization",
+    "prompt_template",
+    "decoding",
+    "alias",
+];
+const IAM = /(^|[._])(aws_iam_|aws_kms_|google_[a-z_]*_iam_|azurerm_role_assignment|azurerm_key_vault|aws_organizations)/i;
+const DATA = /(^|[._])(aws_db_|aws_rds_|aws_dynamodb_|aws_s3_bucket|google_sql_|google_storage_bucket|azurerm_postgresql|azurerm_mssql|azurerm_storage|aws_elasticache|mongodbatlas_)/i;
+const MIGRATION_DEFAULT = [
+    "migrations/",
+    "db/migrate/",
+    "prisma/migrations/",
+    "drizzle/migrations/",
+    "alembic/",
+];
+export function evaluateChange(c, overrides = {}) {
+    const fired = [];
+    const add = (id, reason, points, hold) => fired.push({ id, reason, points, hold });
+    const plan = c.plan;
+    const addresses = plan?.addresses ?? [];
+    const prodTags = (c.production_tags?.length ? c.production_tags : ["production", "prod", "live"]).map((t) => t.toLowerCase());
+    const isProd = !!c.environment && prodTags.includes(c.environment.toLowerCase());
+    if (plan && (plan.destroy > 0 || plan.replace > 0))
+        add("CC-DESTROY", `Plan destroys ${plan.destroy} and replaces ${plan.replace} resource(s)`, 40, true);
+    if (addresses.some((a) => IAM.test(a)))
+        add("CC-IAM", "Plan touches IAM, roles, policies or KMS", 40, true);
+    if (plan?.open_cidrs?.length)
+        add("CC-NET-OPEN", `Opens ${plan.open_cidrs.join(", ")} to the world`, 40, true);
+    if (c.author_kinds.some((k) => k === "agent" || k === "bot")) {
+        const pts = overrides.agent_author_points ?? null;
+        add("CC-AGENT-AUTHOR", "Change authored by a non-human actor", pts ?? 30, pts === null);
+    }
+    if (c.pr_approved_by_human === false)
+        add("CC-NO-REVIEW", "Merged without an approving human review", 30, true);
+    if (c.freeze_active)
+        add("CC-FREEZE", "A change-freeze window is active", 30, true);
+    if (addresses.some((a) => DATA.test(a)))
+        add("CC-DATA-STORE", "Changes a database, bucket or storage resource", 30, false);
+    const globs = c.migration_globs?.length ? c.migration_globs : MIGRATION_DEFAULT;
+    if ((c.changed_paths ?? []).some((p) => globs.some((g) => p.includes(g))))
+        add("CC-MIGRATION", "Changed paths include a database migration", 30, false);
+    if (c.in_change_window === false)
+        add("CC-OUT-OF-WINDOW", "Outside the configured change window", 30, false);
+    if (isProd)
+        add("CC-PROD-ENV", `Target environment ${c.environment} is production`, 20, false);
+    if (c.action === "model.promote" || c.model)
+        modelRules(c.model ?? null, add);
+    const resources = plan ? plan.add + plan.change + plan.destroy + plan.replace : 0;
+    if ((c.files_changed ?? 0) > 50 || resources > 25)
+        add("CC-SIZE", "Large change: more than 50 files or 25 resources", 15, false);
+    const points = fired.reduce((n, f) => n + f.points, 0);
+    return { hold: fired.some((f) => f.hold) || points >= HOLD_THRESHOLD, points, fired };
+}
+/** Floating names: the target can change under you without another promotion. */
+const FLOATING = /(^|[-_:@/.])(latest|preview|default|current|stable|exp(erimental)?)$/i;
+function modelRules(m, add) {
+    if (!m) {
+        add("MC-UNDESCRIBED", "Model promotion without a description of what changes", 40, true);
+        return;
+    }
+    const ch = new Set(m.changes ?? []);
+    const lc = (s) => (s ? s.toLowerCase() : null);
+    if (lc(m.provider_from) && lc(m.provider_to) && lc(m.provider_from) !== lc(m.provider_to))
+        add("MC-PROVIDER-SWAP", `Provider changes from ${m.provider_from} to ${m.provider_to}`, 40, true);
+    else if (ch.has("provider"))
+        add("MC-PROVIDER-SWAP", "Provider changes", 40, true);
+    if ((m.digest_from && m.digest_to && m.digest_from !== m.digest_to) ||
+        ch.has("weights") ||
+        ch.has("fine_tune"))
+        add("MC-WEIGHTS", "Model weights change (new checkpoint or fine-tune)", 30, true);
+    if (ch.has("alias") || FLOATING.test(m.model_to))
+        add("MC-FLOATING", `Target ${m.model_to} is a floating alias, not a pinned version`, 30, true);
+    if (m.eval && (m.eval.passed === false || (m.eval.regressions ?? 0) > 0))
+        add("MC-EVAL-FAIL", `Evaluation ${m.eval.suite ?? ""} ${m.eval.passed === false ? "failed" : `shows ${m.eval.regressions} regression(s)`}`.replace(/\s+/g, " "), 40, true);
+    else if (!m.eval || m.eval.passed === null || m.eval.passed === undefined)
+        add("MC-NO-EVAL", "No evaluation result attached to the promotion", 30, false);
+    if ((m.classification ?? []).length)
+        add("MC-GOVERNED-DATA", `Model serves governed data: ${(m.classification ?? []).join(", ")}`, 30, true);
+    if (ch.has("model") && lc(m.model_from) !== lc(m.model_to))
+        add("MC-MODEL-SWAP", `Model changes from ${m.model_from ?? "unstated"} to ${m.model_to}`, 20, false);
+    if (ch.has("quantization"))
+        add("MC-QUANT", "Quantization changes", 20, false);
+    if (ch.has("prompt_template"))
+        add("MC-PROMPT", "System prompt or template changes", 20, false);
+    if (ch.has("decoding"))
+        add("MC-DECODING", "Decoding parameters change", 10, false);
+}
+export const MAX_DURATION_S = {
+    high: 3600,
+    medium: 4 * 3600,
+    low: 8 * 3600,
+};
+const ADMIN = /(admin|owner|root|superuser)/i;
+export function evaluateAccess(c) {
+    const fired = [];
+    const add = (id, reason, points, hold) => fired.push({ id, reason, points, hold });
+    let deny = false;
+    const cap_s = MAX_DURATION_S[c.sensitivity];
+    if (c.requester_kind !== "human" && c.requester_has_owner === false) {
+        add("AC-ORPHAN-NHI", "Non-human requester has no human owner", 0, true);
+        deny = true;
+    }
+    if (c.requester_kind !== "human")
+        add("AC-NHI-ELEVATE", "Requester is an agent or service account", 30, true);
+    if (ADMIN.test(c.role) && c.is_production)
+        add("AC-PROD-ADMIN", `Admin-level role ${c.role} on a production resource`, 40, true);
+    if (c.sensitivity === "high")
+        add("AC-SENSITIVE", "Resource holds sensitive data", 30, true);
+    if (c.duration_requested_s > cap_s)
+        add("AC-LONG", `Requested ${Math.round(c.duration_requested_s / 60)} min exceeds the ${Math.round(cap_s / 60)} min cap; capped`, 20, true);
+    const [open, close] = c.business_hours ?? [8, 18];
+    if (c.hour_local !== null &&
+        c.hour_local !== undefined &&
+        (c.hour_local < open || c.hour_local >= close))
+        add("AC-OFF-HOURS", "Requested outside business hours", 30, false);
+    if (!c.ticket_ref)
+        add("AC-NO-TICKET", "No ticket reference", 20, false);
+    if ((c.recent_elevations ?? 0) > 3)
+        add("AC-REPEAT", "More than 3 elevations on this resource in 7 days: standing-access candidate", 20, false);
+    const points = fired.reduce((n, f) => n + f.points, 0);
+    return {
+        hold: deny || fired.some((f) => f.hold) || points >= HOLD_THRESHOLD,
+        deny,
+        points,
+        fired,
+        cap_s,
+    };
+}
+/** `terraform show -json` → the summary the CLI sends. Runs in CI; the full plan never leaves it. */
+export function summarizePlan(plan) {
+    const rc = Array.isArray(plan?.resource_changes) ? plan.resource_changes : [];
+    const s = {
+        add: 0,
+        change: 0,
+        destroy: 0,
+        replace: 0,
+        resource_types: [],
+        addresses: [],
+        open_cidrs: [],
+    };
+    const types = new Set();
+    for (const r of rc) {
+        const actions = r?.change?.actions ?? [];
+        if (actions.includes("create") && actions.includes("delete"))
+            s.replace++;
+        else if (actions.includes("delete"))
+            s.destroy++;
+        else if (actions.includes("create"))
+            s.add++;
+        else if (actions.includes("update"))
+            s.change++;
+        else
+            continue;
+        if (r.type)
+            types.add(r.type);
+        if (r.address)
+            s.addresses.push(r.address);
+        const after = r?.change?.after;
+        const text = after ? JSON.stringify(after) : "";
+        if (/aws_security_group|google_compute_firewall|azurerm_network_security/.test(String(r.type ?? "")) &&
+            /"0\.0\.0\.0\/0"|"::\/0"/.test(text))
+            for (const c of ["0.0.0.0/0", "::/0"])
+                if (text.includes(`"${c}"`) && !s.open_cidrs.includes(c))
+                    s.open_cidrs.push(c);
+    }
+    s.resource_types = [...types].sort();
+    return s;
+}
+/** CLI exit codes for the gate step. */
+export const EXIT = { ok: 0, rejected: 10, expired: 11, unreachable: 12, config: 13 };

package/dist/proof-verify.d.ts

@@ -0,0 +1,108 @@
+export declare const PROOF_FORMAT = "interlok.proof/1";
+export declare const DSSE_PAYLOAD_TYPE = "application/vnd.interlok.proof-manifest+json";
+export declare const STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+export declare const PREDICATE_TYPE = "https://interlok.io/attestation/determination/v1";
+export type CheckStatus = "pass" | "fail" | "skipped";
+export interface RecordProblem {
+    seq: number | null;
+    problem: string;
+}
+export interface CheckResult {
+    id: number;
+    name: string;
+    status: CheckStatus;
+    detail: string;
+    records: RecordProblem[];
+}
+export interface VerifyResult {
+    ok: boolean;
+    format: string | null;
+    bundle_id: string | null;
+    org: {
+        id: string;
+        name?: string | null;
+    } | null;
+    record_count: number;
+    checks: CheckResult[];
+}
+export interface VerifyOptions {
+    /** Anchors fetched from the public anchor feed. Absent: check 6 is "not checked". */
+    publicAnchors?: Array<{
+        merkle_root: string;
+        from_seq?: number;
+        to_seq?: number;
+    }> | null;
+    /** Key ids (kid) the customer publishes at /.well-known/interlok-keys.json. Absent: check 7 skipped. */
+    publishedKids?: string[] | null;
+    /** Grace after a key's valid_to (rotation overlap), in ms. */
+    keyGraceMs?: number;
+}
+export interface ChainRecord {
+    seq: number;
+    prev_hash: string;
+    payload_hash: string;
+    entry_hash: string;
+    signature: string;
+    signer_kid: string;
+    /** Present when a v1 record's content is revealed; absent for hash-only records. */
+    payload?: Record<string, unknown>;
+    /** Ledger record v2: per-field reveals or commitments, instead of payload. */
+    record_version?: number;
+    fields?: Record<string, FieldReveal>;
+}
+export interface KeyEntry {
+    jwk: JsonWebKey;
+    valid_from: string | null;
+    valid_to: string | null;
+    custody?: string;
+}
+export interface AnchorEntry {
+    id: string;
+    from_seq: number;
+    to_seq: number;
+    merkle_root: string;
+    head_hash: string;
+    anchor: Record<string, unknown> & {
+        anchor_hash: string;
+        signature: string;
+        signer_kid: string;
+        merkle_root: string;
+    };
+    published_to?: string | null;
+    publish_ref?: string | null;
+}
+export interface ProofStep {
+    hash: string;
+    position: "left" | "right";
+}
+/** Canonical JSON: sorted keys, no whitespace, undefined dropped. Same as the ledger's. */
+export declare function canonicalize(value: unknown): string;
+export declare function sha256Hex(data: string | Uint8Array): Promise<string>;
+export declare function fromB64url(s: string): Uint8Array;
+export declare function toB64(u: Uint8Array): string;
+export declare function fromB64(s: string): Uint8Array;
+export declare function verifySig(jwk: JsonWebKey, sigB64url: string, data: string | Uint8Array): Promise<boolean>;
+/** DSSE pre-authentication encoding: "DSSEv1 <len(type)> <type> <len(body)> <body>". */
+export declare function pae(payloadType: string, body: Uint8Array): Uint8Array;
+export declare function verifyMerkle(leaf: string, proof: ProofStep[], root: string): Promise<boolean>;
+export declare function flattenPayload(value: unknown, path?: string): Array<{
+    path: string;
+    value: unknown;
+}>;
+export declare const leafHash: (salt: string, path: string, value: unknown) => Promise<string>;
+export declare function merkleRootHex(leaves: string[]): Promise<string>;
+export type FieldReveal = {
+    v: unknown;
+    s: string;
+} | {
+    c: string;
+};
+/** The root over a record's fields, revealed or committed. */
+export declare function rootFromFields(fields: Record<string, FieldReveal>): Promise<string>;
+/** The root for a full payload and its salts (one salt per leaf path). */
+export declare function payloadRootV2(payload: unknown, salts: Record<string, string>): Promise<string>;
+/** What an auditor sees: revealed values in place, hidden ones as "[redacted]". */
+export declare function viewFromFields(fields: Record<string, FieldReveal>): Record<string, unknown>;
+/** In-scope record → in-toto Statement v1. Used by the builder and re-derived by the verifier. */
+export declare function statementFor(org: string, r: ChainRecord): Record<string, unknown>;
+export declare function verifyProofBundle(zip: Uint8Array, opts?: VerifyOptions): Promise<VerifyResult>;