@naylence/advanced-security 0.4.3 → 0.4.5

package/dist/types/naylence/fame/security/auth/policy/expr-builtins.d.ts

@@ -4,11 +4,81 @@
  * Null handling semantics:
  * - Scope predicate builtins (has_scope, has_any_scope, has_all_scopes)
  *   return `false` when passed `null` for required args.
+ * - Security predicate builtins (is_signed, is_encrypted, is_encrypted_at_least)
+ *   return `false` when the envelope lacks the required security posture.
  * - Wrong non-null types still raise BuiltinError to surface real bugs.
  */
 import { type FunctionRegistry } from "../../../expr/index.js";
+/**
+ * Encryption level type for normalized security posture.
+ */
+export type EncryptionLevel = "plaintext" | "channel" | "sealed" | "unknown";
+/**
+ * Normalizes an encryption algorithm string to an EncryptionLevel.
+ *
+ * Mapping rules:
+ * - null/undefined => "plaintext" (no encryption present)
+ * - alg contains "-channel" => "channel" (e.g., "chacha20-poly1305-channel")
+ * - alg contains "-sealed" => "sealed" (explicit sealed marker)
+ * - alg matches ECDH-ES pattern with AEAD cipher => "sealed" (e.g., "ECDH-ES+A256GCM")
+ * - otherwise => "unknown"
+ *
+ * Currently supported algorithms:
+ * - Channel: "chacha20-poly1305-channel"
+ * - Sealed: "ECDH-ES+A256GCM"
+ *
+ * This helper is centralized to ensure consistent mapping across TS and Python.
+ */
+export declare function normalizeEncryptionLevelFromAlg(alg: string | null | undefined): EncryptionLevel;
+/**
+ * Security metadata bindings exposed to expressions.
+ * This is the shape of the `envelope.sec` binding.
+ */
+export interface SecurityBindings {
+    sig: {
+        present: boolean;
+        kid: string | null;
+    };
+    enc: {
+        present: boolean;
+        alg: string | null;
+        kid: string | null;
+        level: EncryptionLevel;
+    };
+}
+/**
+ * Creates security bindings from an envelope's sec header.
+ * Exposes only metadata, never raw values like sig.val or enc.val.
+ */
+export declare function createSecurityBindings(sec: {
+    sig?: {
+        kid?: string;
+    };
+    enc?: {
+        alg?: string;
+        kid?: string;
+    };
+} | undefined): SecurityBindings;
+/**
+ * Options for creating an auth function registry.
+ */
+export interface AuthFunctionRegistryOptions {
+    /**
+     * Granted scopes for scope checking builtins.
+     */
+    grantedScopes?: readonly string[];
+    /**
+     * Security bindings for security posture builtins.
+     * If not provided, is_signed returns false and encryption_level returns "plaintext".
+     */
+    securityBindings?: SecurityBindings;
+}
 /**
  * Creates a function registry with auth helpers installed.
+ *
+ * This registry extends the base builtins with:
+ * - Scope builtins: has_scope, has_any_scope, has_all_scopes
+ * - Security builtins: is_signed, encryption_level, is_encrypted, is_encrypted_at_least
  */
-export declare function createAuthFunctionRegistry(grantedScopes?: readonly string[]): FunctionRegistry;
+export declare function createAuthFunctionRegistry(grantedScopesOrOptions?: readonly string[] | AuthFunctionRegistryOptions): FunctionRegistry;
 //# sourceMappingURL=expr-builtins.d.ts.map

package/dist/types/naylence/fame/security/auth/policy/expr-builtins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"expr-builtins.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/policy/expr-builtins.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAUhC;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,GAAE,SAAS,MAAM,EAAO,GACpC,gBAAgB,CAiElB"}
+{"version":3,"file":"expr-builtins.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/policy/expr-builtins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAGhC;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAqB7E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC7B,eAAe,CAyBjB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE;QACH,OAAO,EAAE,OAAO,CAAC;QACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KACpB,CAAC;IACF,GAAG,EAAE;QACH,OAAO,EAAE,OAAO,CAAC;QACjB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,EAAE,eAAe,CAAC;KACxB,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IAAE,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAAG,SAAS,GAChF,gBAAgB,CAkBlB;AASD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;OAEG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,sBAAsB,GAAE,SAAS,MAAM,EAAE,GAAG,2BAAgC,GAC3E,gBAAgB,CAiKlB"}

package/dist/types/naylence/fame/security/auth/policy/index.d.ts

@@ -6,7 +6,7 @@
  *
  * @packageDocumentation
  */
-export { createAuthFunctionRegistry } from "./expr-builtins.js";
+export { createAuthFunctionRegistry, createSecurityBindings, normalizeEncryptionLevelFromAlg, type AuthFunctionRegistryOptions, type EncryptionLevel, type SecurityBindings, } from "./expr-builtins.js";
 export { AdvancedAuthorizationPolicy, type AdvancedAuthorizationPolicyOptions, } from "./advanced-authorization-policy.js";
 export { AdvancedAuthorizationPolicyFactory, FACTORY_META as ADVANCED_AUTHORIZATION_POLICY_FACTORY_META, type AdvancedAuthorizationPolicyConfig, } from "./advanced-authorization-policy-factory.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/naylence/fame/security/auth/policy/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAGhE,OAAO,EACL,2BAA2B,EAC3B,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,kCAAkC,EAClC,YAAY,IAAI,0CAA0C,EAC1D,KAAK,iCAAiC,GACvC,MAAM,4CAA4C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../src/naylence/fame/security/auth/policy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,+BAA+B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,2BAA2B,EAC3B,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,kCAAkC,EAClC,YAAY,IAAI,0CAA0C,EAC1D,KAAK,iCAAiC,GACvC,MAAM,4CAA4C,CAAC"}

package/dist/types/version.d.ts

@@ -2,5 +2,5 @@
  * The package version, injected at build time.
  * @internal
  */
-export declare const VERSION = "0.4.3";
+export declare const VERSION = "0.4.5";
 //# sourceMappingURL=version.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naylence/advanced-security",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "type": "module",
   "description": "Advanced security utilities for the Naylence Fame runtime implemented in TypeScript.",
   "author": "Naylence Dev <naylencedev@gmail.com>",