@neuraloom/contracts 0.0.0-stage → 0.1.22

package/dist/schemas/security/security-finding.schema.js

@@ -0,0 +1,138 @@
+"use strict";
+/**
+ * Canonical security finding contracts (MS-01 graph substrate).
+ * Findings are materialized as `knowledge_nodes` with `kg_ontology_type` = `SecurityFinding`
+ * — no parallel security tables (issues #724, #770).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RouteExposureKindSchema = exports.SecurityScanResultSchema = exports.SecurityScanRunStatusSchema = exports.SecurityFindingSchema = exports.SecurityFindingEvidenceSchema = exports.SecurityFindingAcceptanceSchema = exports.SecurityFindingStatusSchema = exports.SecurityFindingSeveritySchema = exports.SecurityFindingRuleIdSchema = exports.SECURITY_FINDING_RULE_IDS = void 0;
+const zod_1 = require("zod");
+/** Sentinel list: exhaustive rule IDs for scanners / Guardian alignment. */
+exports.SECURITY_FINDING_RULE_IDS = [
+    "MISSING_RLS_ON_PUBLIC_TABLE",
+    "SERVICE_ROLE_IN_BROWSER",
+    "RAW_FETCH_BYPASSING_APICLIENT",
+    "UNSIGNED_WEBHOOK",
+    "PII_TABLE_PUBLIC_ROUTE",
+    "CRITICAL_DEP_VULN",
+    "ENV_FALLBACK_OPERATOR",
+    "DUPLICATE_ROUTE",
+    "SECURITY_DEFINER_VIEW_RISK",
+    "RLS_POLICY_ALWAYS_TRUE",
+    "EXTENSION_IN_PUBLIC_SCHEMA",
+    "AUTH_LEAKED_PASSWORD_PROTECTION_OFF",
+];
+exports.SecurityFindingRuleIdSchema = zod_1.z.enum(exports.SECURITY_FINDING_RULE_IDS);
+exports.SecurityFindingSeveritySchema = zod_1.z.enum([
+    "info",
+    "low",
+    "medium",
+    "high",
+    "critical",
+]);
+exports.SecurityFindingStatusSchema = zod_1.z.enum([
+    "open",
+    "acknowledged",
+    "in_progress",
+    "resolved",
+    "waived",
+    "false_positive",
+    "exception_active",
+]);
+const SecurityFindingAcceptanceKindSchema = zod_1.z.enum(["waiver", "exception"]);
+exports.SecurityFindingAcceptanceSchema = zod_1.z
+    .object({
+    kind: SecurityFindingAcceptanceKindSchema,
+    reason: zod_1.z.string().min(16),
+    approvedByUserId: zod_1.z.string().uuid(),
+    approvedAt: zod_1.z.string().datetime(),
+    /** Required for waivers; omitted for long-lived policy exceptions. */
+    expiresAt: zod_1.z.string().datetime().optional(),
+    /** Traceability to issue / ticket systems. */
+    ticketRef: zod_1.z.string().min(1).max(512).optional(),
+})
+    .strict()
+    .superRefine((v, ctx) => {
+    if (v.kind === "waiver" && v.expiresAt === undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: "waivers require expiresAt (no silent / permanent waivers)",
+            path: ["expiresAt"],
+        });
+    }
+    if (v.kind === "exception" && v.expiresAt !== undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: "exceptions must not use expiresAt; use kind=waiver for time-bound acceptance",
+            path: ["expiresAt"],
+        });
+    }
+});
+/** Evidence anchors existing `knowledge_nodes` / `knowledge_edges` (MS-01). */
+exports.SecurityFindingEvidenceSchema = zod_1.z
+    .object({
+    knowledgeNodeIds: zod_1.z.array(zod_1.z.string().uuid()).optional(),
+    knowledgeEdgeIds: zod_1.z.array(zod_1.z.string().uuid()).optional(),
+    kgStableKeys: zod_1.z.array(zod_1.z.string().min(1).max(4096)).optional(),
+    filePath: zod_1.z.string().min(1).max(4096).optional(),
+    routeTemplate: zod_1.z.string().min(1).max(2048).optional(),
+    lineStart: zod_1.z.number().int().min(1).optional(),
+    lineEnd: zod_1.z.number().int().min(1).optional(),
+    supplementary: zod_1.z.record(zod_1.z.unknown()).optional(),
+})
+    .strict();
+exports.SecurityFindingSchema = zod_1.z
+    .object({
+    id: zod_1.z.string().uuid(),
+    ruleId: exports.SecurityFindingRuleIdSchema,
+    severity: exports.SecurityFindingSeveritySchema,
+    status: exports.SecurityFindingStatusSchema,
+    title: zod_1.z.string().min(1).max(512),
+    description: zod_1.z.string().min(1).max(16_384),
+    evidence: exports.SecurityFindingEvidenceSchema,
+    createdAt: zod_1.z.string().datetime(),
+    updatedAt: zod_1.z.string().datetime().optional(),
+    /** Populated when status ∈ { waived, exception_active }. */
+    acceptance: exports.SecurityFindingAcceptanceSchema.optional(),
+})
+    .strict()
+    .superRefine((f, ctx) => {
+    const needsAcceptance = f.status === "waived" || f.status === "exception_active";
+    if (needsAcceptance && f.acceptance === undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: "waived and exception_active require explicit acceptance metadata",
+            path: ["acceptance"],
+        });
+    }
+    if (!needsAcceptance && f.acceptance !== undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: "acceptance must only be set when status is waived or exception_active",
+            path: ["acceptance"],
+        });
+    }
+});
+exports.SecurityScanRunStatusSchema = zod_1.z.enum([
+    "complete",
+    "failed",
+    "partial",
+]);
+exports.SecurityScanResultSchema = zod_1.z
+    .object({
+    id: zod_1.z.string().uuid(),
+    scannerId: zod_1.z.string().min(1).max(256),
+    startedAt: zod_1.z.string().datetime(),
+    completedAt: zod_1.z.string().datetime(),
+    status: exports.SecurityScanRunStatusSchema,
+    findings: zod_1.z.array(exports.SecurityFindingSchema),
+    metadata: zod_1.z.record(zod_1.z.unknown()).optional(),
+})
+    .strict();
+/** Static classifier for Next.js App Router API handlers (filesystem sweep metadata). */
+exports.RouteExposureKindSchema = zod_1.z.enum([
+    "PUBLIC",
+    "AUTH",
+    "INTERNAL",
+    "UNKNOWN",
+]);

package/dist/schemas/security/security-knowledge-node.schema.d.ts

@@ -0,0 +1,285 @@
+/**
+ * MS-01 — `knowledge_nodes` payload when `kg_ontology_type` is `SecurityFinding`.
+ * Physical row still uses `knowledge_nodes` + KG overlay columns from `node-v2.schema.ts`.
+ */
+import { z } from "zod";
+export declare const KNOWLEDGE_ONTOLOGY_SECURITY_FINDING: "SecurityFinding";
+/** JSON stored in `knowledge_nodes.data` for security finding nodes. */
+export declare const SecurityFindingKnowledgeNodeDataSchema: z.ZodObject<{
+    /** Redundant guard so parsers reject wrong payloads if ontology drifts. */
+    ontologyType: z.ZodLiteral<"SecurityFinding">;
+    layer: z.ZodOptional<z.ZodEnum<["intent", "architecture", "code_reality"]>>;
+    proofRef: z.ZodOptional<z.ZodObject<{
+        proofRef: z.ZodString;
+        layer: z.ZodEnum<["intent", "architecture", "code_reality"]>;
+        ontology_type: z.ZodUnion<[z.ZodEnum<["ProductConcept", "Requirement", "AcceptanceCriterion", "Constraint", "Risk", "DomainEntity", "Workflow", "UserRole", "Policy", "NonFunctionalRequirement", "SecurityRequirement", "ComplianceRequirement"]>, z.ZodEnum<["Package", "Module", "FilePlan", "DBTable", "DBColumn", "DBIndex", "DBConstraint", "RLSPolicy", "APIEndpoint", "APIRoute", "FrontendRoute", "UIComponent", "Component", "Service", "Job", "Event", "Queue", "ExternalIntegration", "EnvVar", "SecretRef", "Permission", "TestPlan", "ConstitutionRule", "GuardianReport", "Task", "CodePatch"]>, z.ZodEnum<["File", "Symbol", "Function", "Class", "Type", "Import", "Export", "RouteHandler", "ServerAction", "ReactComponent", "ZodSchema", "SQLMigration", "SupabaseTable", "RLSActualPolicy", "GitHubIssue", "Branch", "PR", "Commit", "CheckRun", "Deployment", "RuntimeProbe", "SecurityFinding", "Vulnerability", "DriftFinding"]>]>;
+        natural_key: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        proofRef: string;
+        layer: "intent" | "architecture" | "code_reality";
+        ontology_type: "ProductConcept" | "Requirement" | "AcceptanceCriterion" | "Constraint" | "Risk" | "DomainEntity" | "Workflow" | "UserRole" | "Policy" | "NonFunctionalRequirement" | "SecurityRequirement" | "ComplianceRequirement" | "Package" | "Module" | "FilePlan" | "DBTable" | "DBColumn" | "DBIndex" | "DBConstraint" | "RLSPolicy" | "APIEndpoint" | "APIRoute" | "FrontendRoute" | "UIComponent" | "Component" | "Service" | "Job" | "Event" | "Queue" | "ExternalIntegration" | "EnvVar" | "SecretRef" | "Permission" | "TestPlan" | "ConstitutionRule" | "GuardianReport" | "Task" | "CodePatch" | "File" | "Symbol" | "Function" | "Class" | "Type" | "Import" | "Export" | "RouteHandler" | "ServerAction" | "ReactComponent" | "ZodSchema" | "SQLMigration" | "SupabaseTable" | "RLSActualPolicy" | "GitHubIssue" | "Branch" | "PR" | "Commit" | "CheckRun" | "Deployment" | "RuntimeProbe" | "SecurityFinding" | "Vulnerability" | "DriftFinding";
+        natural_key: string;
+    }, {
+        proofRef: string;
+        layer: "intent" | "architecture" | "code_reality";
+        ontology_type: "ProductConcept" | "Requirement" | "AcceptanceCriterion" | "Constraint" | "Risk" | "DomainEntity" | "Workflow" | "UserRole" | "Policy" | "NonFunctionalRequirement" | "SecurityRequirement" | "ComplianceRequirement" | "Package" | "Module" | "FilePlan" | "DBTable" | "DBColumn" | "DBIndex" | "DBConstraint" | "RLSPolicy" | "APIEndpoint" | "APIRoute" | "FrontendRoute" | "UIComponent" | "Component" | "Service" | "Job" | "Event" | "Queue" | "ExternalIntegration" | "EnvVar" | "SecretRef" | "Permission" | "TestPlan" | "ConstitutionRule" | "GuardianReport" | "Task" | "CodePatch" | "File" | "Symbol" | "Function" | "Class" | "Type" | "Import" | "Export" | "RouteHandler" | "ServerAction" | "ReactComponent" | "ZodSchema" | "SQLMigration" | "SupabaseTable" | "RLSActualPolicy" | "GitHubIssue" | "Branch" | "PR" | "Commit" | "CheckRun" | "Deployment" | "RuntimeProbe" | "SecurityFinding" | "Vulnerability" | "DriftFinding";
+        natural_key: string;
+    }>>;
+    finding: z.ZodEffects<z.ZodObject<{
+        id: z.ZodString;
+        ruleId: z.ZodEnum<["MISSING_RLS_ON_PUBLIC_TABLE", "SERVICE_ROLE_IN_BROWSER", "RAW_FETCH_BYPASSING_APICLIENT", "UNSIGNED_WEBHOOK", "PII_TABLE_PUBLIC_ROUTE", "CRITICAL_DEP_VULN", "ENV_FALLBACK_OPERATOR", "DUPLICATE_ROUTE", "SECURITY_DEFINER_VIEW_RISK", "RLS_POLICY_ALWAYS_TRUE", "EXTENSION_IN_PUBLIC_SCHEMA", "AUTH_LEAKED_PASSWORD_PROTECTION_OFF"]>;
+        severity: z.ZodEnum<["info", "low", "medium", "high", "critical"]>;
+        status: z.ZodEnum<["open", "acknowledged", "in_progress", "resolved", "waived", "false_positive", "exception_active"]>;
+        title: z.ZodString;
+        description: z.ZodString;
+        evidence: z.ZodObject<{
+            knowledgeNodeIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            knowledgeEdgeIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            kgStableKeys: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            filePath: z.ZodOptional<z.ZodString>;
+            routeTemplate: z.ZodOptional<z.ZodString>;
+            lineStart: z.ZodOptional<z.ZodNumber>;
+            lineEnd: z.ZodOptional<z.ZodNumber>;
+            supplementary: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, "strict", z.ZodTypeAny, {
+            filePath?: string | undefined;
+            knowledgeNodeIds?: string[] | undefined;
+            knowledgeEdgeIds?: string[] | undefined;
+            kgStableKeys?: string[] | undefined;
+            routeTemplate?: string | undefined;
+            lineStart?: number | undefined;
+            lineEnd?: number | undefined;
+            supplementary?: Record<string, unknown> | undefined;
+        }, {
+            filePath?: string | undefined;
+            knowledgeNodeIds?: string[] | undefined;
+            knowledgeEdgeIds?: string[] | undefined;
+            kgStableKeys?: string[] | undefined;
+            routeTemplate?: string | undefined;
+            lineStart?: number | undefined;
+            lineEnd?: number | undefined;
+            supplementary?: Record<string, unknown> | undefined;
+        }>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodOptional<z.ZodString>;
+        acceptance: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+            kind: z.ZodEnum<["waiver", "exception"]>;
+            reason: z.ZodString;
+            approvedByUserId: z.ZodString;
+            approvedAt: z.ZodString;
+            expiresAt: z.ZodOptional<z.ZodString>;
+            ticketRef: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        }, {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        }>, {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        }, {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        title: string;
+        description: string;
+        status: "open" | "in_progress" | "resolved" | "acknowledged" | "waived" | "false_positive" | "exception_active";
+        severity: "info" | "critical" | "low" | "medium" | "high";
+        createdAt: string;
+        evidence: {
+            filePath?: string | undefined;
+            knowledgeNodeIds?: string[] | undefined;
+            knowledgeEdgeIds?: string[] | undefined;
+            kgStableKeys?: string[] | undefined;
+            routeTemplate?: string | undefined;
+            lineStart?: number | undefined;
+            lineEnd?: number | undefined;
+            supplementary?: Record<string, unknown> | undefined;
+        };
+        ruleId: "MISSING_RLS_ON_PUBLIC_TABLE" | "RLS_POLICY_ALWAYS_TRUE" | "SECURITY_DEFINER_VIEW_RISK" | "EXTENSION_IN_PUBLIC_SCHEMA" | "SERVICE_ROLE_IN_BROWSER" | "RAW_FETCH_BYPASSING_APICLIENT" | "UNSIGNED_WEBHOOK" | "PII_TABLE_PUBLIC_ROUTE" | "CRITICAL_DEP_VULN" | "ENV_FALLBACK_OPERATOR" | "DUPLICATE_ROUTE" | "AUTH_LEAKED_PASSWORD_PROTECTION_OFF";
+        updatedAt?: string | undefined;
+        acceptance?: {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        } | undefined;
+    }, {
+        id: string;
+        title: string;
+        description: string;
+        status: "open" | "in_progress" | "resolved" | "acknowledged" | "waived" | "false_positive" | "exception_active";
+        severity: "info" | "critical" | "low" | "medium" | "high";
+        createdAt: string;
+        evidence: {
+            filePath?: string | undefined;
+            knowledgeNodeIds?: string[] | undefined;
+            knowledgeEdgeIds?: string[] | undefined;
+            kgStableKeys?: string[] | undefined;
+            routeTemplate?: string | undefined;
+            lineStart?: number | undefined;
+            lineEnd?: number | undefined;
+            supplementary?: Record<string, unknown> | undefined;
+        };
+        ruleId: "MISSING_RLS_ON_PUBLIC_TABLE" | "RLS_POLICY_ALWAYS_TRUE" | "SECURITY_DEFINER_VIEW_RISK" | "EXTENSION_IN_PUBLIC_SCHEMA" | "SERVICE_ROLE_IN_BROWSER" | "RAW_FETCH_BYPASSING_APICLIENT" | "UNSIGNED_WEBHOOK" | "PII_TABLE_PUBLIC_ROUTE" | "CRITICAL_DEP_VULN" | "ENV_FALLBACK_OPERATOR" | "DUPLICATE_ROUTE" | "AUTH_LEAKED_PASSWORD_PROTECTION_OFF";
+        updatedAt?: string | undefined;
+        acceptance?: {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        } | undefined;
+    }>, {
+        id: string;
+        title: string;
+        description: string;
+        status: "open" | "in_progress" | "resolved" | "acknowledged" | "waived" | "false_positive" | "exception_active";
+        severity: "info" | "critical" | "low" | "medium" | "high";
+        createdAt: string;
+        evidence: {
+            filePath?: string | undefined;
+            knowledgeNodeIds?: string[] | undefined;
+            knowledgeEdgeIds?: string[] | undefined;
+            kgStableKeys?: string[] | undefined;
+            routeTemplate?: string | undefined;
+            lineStart?: number | undefined;
+            lineEnd?: number | undefined;
+            supplementary?: Record<string, unknown> | undefined;
+        };
+        ruleId: "MISSING_RLS_ON_PUBLIC_TABLE" | "RLS_POLICY_ALWAYS_TRUE" | "SECURITY_DEFINER_VIEW_RISK" | "EXTENSION_IN_PUBLIC_SCHEMA" | "SERVICE_ROLE_IN_BROWSER" | "RAW_FETCH_BYPASSING_APICLIENT" | "UNSIGNED_WEBHOOK" | "PII_TABLE_PUBLIC_ROUTE" | "CRITICAL_DEP_VULN" | "ENV_FALLBACK_OPERATOR" | "DUPLICATE_ROUTE" | "AUTH_LEAKED_PASSWORD_PROTECTION_OFF";
+        updatedAt?: string | undefined;
+        acceptance?: {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        } | undefined;
+    }, {
+        id: string;
+        title: string;
+        description: string;
+        status: "open" | "in_progress" | "resolved" | "acknowledged" | "waived" | "false_positive" | "exception_active";
+        severity: "info" | "critical" | "low" | "medium" | "high";
+        createdAt: string;
+        evidence: {
+            filePath?: string | undefined;
+            knowledgeNodeIds?: string[] | undefined;
+            knowledgeEdgeIds?: string[] | undefined;
+            kgStableKeys?: string[] | undefined;
+            routeTemplate?: string | undefined;
+            lineStart?: number | undefined;
+            lineEnd?: number | undefined;
+            supplementary?: Record<string, unknown> | undefined;
+        };
+        ruleId: "MISSING_RLS_ON_PUBLIC_TABLE" | "RLS_POLICY_ALWAYS_TRUE" | "SECURITY_DEFINER_VIEW_RISK" | "EXTENSION_IN_PUBLIC_SCHEMA" | "SERVICE_ROLE_IN_BROWSER" | "RAW_FETCH_BYPASSING_APICLIENT" | "UNSIGNED_WEBHOOK" | "PII_TABLE_PUBLIC_ROUTE" | "CRITICAL_DEP_VULN" | "ENV_FALLBACK_OPERATOR" | "DUPLICATE_ROUTE" | "AUTH_LEAKED_PASSWORD_PROTECTION_OFF";
+        updatedAt?: string | undefined;
+        acceptance?: {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        } | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    ontologyType: "SecurityFinding";
+    finding: {
+        id: string;
+        title: string;
+        description: string;
+        status: "open" | "in_progress" | "resolved" | "acknowledged" | "waived" | "false_positive" | "exception_active";
+        severity: "info" | "critical" | "low" | "medium" | "high";
+        createdAt: string;
+        evidence: {
+            filePath?: string | undefined;
+            knowledgeNodeIds?: string[] | undefined;
+            knowledgeEdgeIds?: string[] | undefined;
+            kgStableKeys?: string[] | undefined;
+            routeTemplate?: string | undefined;
+            lineStart?: number | undefined;
+            lineEnd?: number | undefined;
+            supplementary?: Record<string, unknown> | undefined;
+        };
+        ruleId: "MISSING_RLS_ON_PUBLIC_TABLE" | "RLS_POLICY_ALWAYS_TRUE" | "SECURITY_DEFINER_VIEW_RISK" | "EXTENSION_IN_PUBLIC_SCHEMA" | "SERVICE_ROLE_IN_BROWSER" | "RAW_FETCH_BYPASSING_APICLIENT" | "UNSIGNED_WEBHOOK" | "PII_TABLE_PUBLIC_ROUTE" | "CRITICAL_DEP_VULN" | "ENV_FALLBACK_OPERATOR" | "DUPLICATE_ROUTE" | "AUTH_LEAKED_PASSWORD_PROTECTION_OFF";
+        updatedAt?: string | undefined;
+        acceptance?: {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        } | undefined;
+    };
+    proofRef?: {
+        proofRef: string;
+        layer: "intent" | "architecture" | "code_reality";
+        ontology_type: "ProductConcept" | "Requirement" | "AcceptanceCriterion" | "Constraint" | "Risk" | "DomainEntity" | "Workflow" | "UserRole" | "Policy" | "NonFunctionalRequirement" | "SecurityRequirement" | "ComplianceRequirement" | "Package" | "Module" | "FilePlan" | "DBTable" | "DBColumn" | "DBIndex" | "DBConstraint" | "RLSPolicy" | "APIEndpoint" | "APIRoute" | "FrontendRoute" | "UIComponent" | "Component" | "Service" | "Job" | "Event" | "Queue" | "ExternalIntegration" | "EnvVar" | "SecretRef" | "Permission" | "TestPlan" | "ConstitutionRule" | "GuardianReport" | "Task" | "CodePatch" | "File" | "Symbol" | "Function" | "Class" | "Type" | "Import" | "Export" | "RouteHandler" | "ServerAction" | "ReactComponent" | "ZodSchema" | "SQLMigration" | "SupabaseTable" | "RLSActualPolicy" | "GitHubIssue" | "Branch" | "PR" | "Commit" | "CheckRun" | "Deployment" | "RuntimeProbe" | "SecurityFinding" | "Vulnerability" | "DriftFinding";
+        natural_key: string;
+    } | undefined;
+    layer?: "intent" | "architecture" | "code_reality" | undefined;
+}, {
+    ontologyType: "SecurityFinding";
+    finding: {
+        id: string;
+        title: string;
+        description: string;
+        status: "open" | "in_progress" | "resolved" | "acknowledged" | "waived" | "false_positive" | "exception_active";
+        severity: "info" | "critical" | "low" | "medium" | "high";
+        createdAt: string;
+        evidence: {
+            filePath?: string | undefined;
+            knowledgeNodeIds?: string[] | undefined;
+            knowledgeEdgeIds?: string[] | undefined;
+            kgStableKeys?: string[] | undefined;
+            routeTemplate?: string | undefined;
+            lineStart?: number | undefined;
+            lineEnd?: number | undefined;
+            supplementary?: Record<string, unknown> | undefined;
+        };
+        ruleId: "MISSING_RLS_ON_PUBLIC_TABLE" | "RLS_POLICY_ALWAYS_TRUE" | "SECURITY_DEFINER_VIEW_RISK" | "EXTENSION_IN_PUBLIC_SCHEMA" | "SERVICE_ROLE_IN_BROWSER" | "RAW_FETCH_BYPASSING_APICLIENT" | "UNSIGNED_WEBHOOK" | "PII_TABLE_PUBLIC_ROUTE" | "CRITICAL_DEP_VULN" | "ENV_FALLBACK_OPERATOR" | "DUPLICATE_ROUTE" | "AUTH_LEAKED_PASSWORD_PROTECTION_OFF";
+        updatedAt?: string | undefined;
+        acceptance?: {
+            kind: "waiver" | "exception";
+            reason: string;
+            approvedAt: string;
+            approvedByUserId: string;
+            expiresAt?: string | undefined;
+            ticketRef?: string | undefined;
+        } | undefined;
+    };
+    proofRef?: {
+        proofRef: string;
+        layer: "intent" | "architecture" | "code_reality";
+        ontology_type: "ProductConcept" | "Requirement" | "AcceptanceCriterion" | "Constraint" | "Risk" | "DomainEntity" | "Workflow" | "UserRole" | "Policy" | "NonFunctionalRequirement" | "SecurityRequirement" | "ComplianceRequirement" | "Package" | "Module" | "FilePlan" | "DBTable" | "DBColumn" | "DBIndex" | "DBConstraint" | "RLSPolicy" | "APIEndpoint" | "APIRoute" | "FrontendRoute" | "UIComponent" | "Component" | "Service" | "Job" | "Event" | "Queue" | "ExternalIntegration" | "EnvVar" | "SecretRef" | "Permission" | "TestPlan" | "ConstitutionRule" | "GuardianReport" | "Task" | "CodePatch" | "File" | "Symbol" | "Function" | "Class" | "Type" | "Import" | "Export" | "RouteHandler" | "ServerAction" | "ReactComponent" | "ZodSchema" | "SQLMigration" | "SupabaseTable" | "RLSActualPolicy" | "GitHubIssue" | "Branch" | "PR" | "Commit" | "CheckRun" | "Deployment" | "RuntimeProbe" | "SecurityFinding" | "Vulnerability" | "DriftFinding";
+        natural_key: string;
+    } | undefined;
+    layer?: "intent" | "architecture" | "code_reality" | undefined;
+}>;
+export type SecurityFindingKnowledgeNodeData = z.infer<typeof SecurityFindingKnowledgeNodeDataSchema>;

package/dist/schemas/security/security-knowledge-node.schema.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * MS-01 — `knowledge_nodes` payload when `kg_ontology_type` is `SecurityFinding`.
+ * Physical row still uses `knowledge_nodes` + KG overlay columns from `node-v2.schema.ts`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityFindingKnowledgeNodeDataSchema = exports.KNOWLEDGE_ONTOLOGY_SECURITY_FINDING = void 0;
+const zod_1 = require("zod");
+const node_v2_schema_1 = require("../graph/node-v2.schema");
+const security_finding_schema_1 = require("./security-finding.schema");
+exports.KNOWLEDGE_ONTOLOGY_SECURITY_FINDING = "SecurityFinding";
+/** JSON stored in `knowledge_nodes.data` for security finding nodes. */
+exports.SecurityFindingKnowledgeNodeDataSchema = zod_1.z
+    .object({
+    /** Redundant guard so parsers reject wrong payloads if ontology drifts. */
+    ontologyType: zod_1.z.literal(exports.KNOWLEDGE_ONTOLOGY_SECURITY_FINDING),
+    layer: node_v2_schema_1.KgLayerSchema.optional(),
+    proofRef: node_v2_schema_1.KgProofSliceRefSchema.optional(),
+    finding: security_finding_schema_1.SecurityFindingSchema,
+})
+    .strict();

package/dist/schemas/task-complexity.schema.d.ts

@@ -0,0 +1,3 @@
+import { z } from 'zod';
+/** Matches `tasks.complexity` CHECK constraint (DB SSOT). */
+export declare const TaskComplexitySchema: z.ZodEnum<["low", "medium", "high", "very_high"]>;

package/dist/schemas/task-complexity.schema.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TaskComplexitySchema = void 0;
+const zod_1 = require("zod");
+/** Matches `tasks.complexity` CHECK constraint (DB SSOT). */
+exports.TaskComplexitySchema = zod_1.z.enum(['low', 'medium', 'high', 'very_high']);

package/dist/schemas/task-evidence-expectations.schema.d.ts

@@ -0,0 +1,174 @@
+import { z } from "zod";
+export declare const TaskExpectedFileSchema: z.ZodObject<{
+    path: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    required: boolean;
+    description?: string | undefined;
+}, {
+    path: string;
+    description?: string | undefined;
+    required?: boolean | undefined;
+}>;
+export type TaskExpectedFile = z.infer<typeof TaskExpectedFileSchema>;
+export declare const TaskExpectedRouteSchema: z.ZodObject<{
+    method: z.ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE"]>;
+    path: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    required: boolean;
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+    description?: string | undefined;
+}, {
+    path: string;
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+    description?: string | undefined;
+    required?: boolean | undefined;
+}>;
+export type TaskExpectedRoute = z.infer<typeof TaskExpectedRouteSchema>;
+export declare const TaskExpectedTableSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    required: boolean;
+    name: string;
+    description?: string | undefined;
+}, {
+    name: string;
+    description?: string | undefined;
+    required?: boolean | undefined;
+}>;
+export type TaskExpectedTable = z.infer<typeof TaskExpectedTableSchema>;
+export declare const TaskExpectedTestSchema: z.ZodObject<{
+    path: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    required: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    path: string;
+    required: boolean;
+    description?: string | undefined;
+}, {
+    path: string;
+    description?: string | undefined;
+    required?: boolean | undefined;
+}>;
+export type TaskExpectedTest = z.infer<typeof TaskExpectedTestSchema>;
+export declare const TaskEvidenceExpectationsSchema: z.ZodObject<{
+    expectedFiles: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        required: boolean;
+        description?: string | undefined;
+    }, {
+        path: string;
+        description?: string | undefined;
+        required?: boolean | undefined;
+    }>, "many">>;
+    expectedRoutes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        method: z.ZodEnum<["GET", "POST", "PUT", "PATCH", "DELETE"]>;
+        path: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        required: boolean;
+        method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+        description?: string | undefined;
+    }, {
+        path: string;
+        method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+        description?: string | undefined;
+        required?: boolean | undefined;
+    }>, "many">>;
+    expectedTables: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        required: boolean;
+        name: string;
+        description?: string | undefined;
+    }, {
+        name: string;
+        description?: string | undefined;
+        required?: boolean | undefined;
+    }>, "many">>;
+    expectedTests: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        required: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        path: string;
+        required: boolean;
+        description?: string | undefined;
+    }, {
+        path: string;
+        description?: string | undefined;
+        required?: boolean | undefined;
+    }>, "many">>;
+    requirementIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    sourceArtifactIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    packetId: z.ZodOptional<z.ZodString>;
+    packetLabel: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    sourceArtifactIds?: string[] | undefined;
+    expectedTests?: {
+        path: string;
+        required: boolean;
+        description?: string | undefined;
+    }[] | undefined;
+    expectedFiles?: {
+        path: string;
+        required: boolean;
+        description?: string | undefined;
+    }[] | undefined;
+    expectedRoutes?: {
+        path: string;
+        required: boolean;
+        method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+        description?: string | undefined;
+    }[] | undefined;
+    expectedTables?: {
+        required: boolean;
+        name: string;
+        description?: string | undefined;
+    }[] | undefined;
+    requirementIds?: string[] | undefined;
+    packetId?: string | undefined;
+    packetLabel?: string | undefined;
+}, {
+    sourceArtifactIds?: string[] | undefined;
+    expectedTests?: {
+        path: string;
+        description?: string | undefined;
+        required?: boolean | undefined;
+    }[] | undefined;
+    expectedFiles?: {
+        path: string;
+        description?: string | undefined;
+        required?: boolean | undefined;
+    }[] | undefined;
+    expectedRoutes?: {
+        path: string;
+        method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+        description?: string | undefined;
+        required?: boolean | undefined;
+    }[] | undefined;
+    expectedTables?: {
+        name: string;
+        description?: string | undefined;
+        required?: boolean | undefined;
+    }[] | undefined;
+    requirementIds?: string[] | undefined;
+    packetId?: string | undefined;
+    packetLabel?: string | undefined;
+}>;
+export type TaskEvidenceExpectations = z.infer<typeof TaskEvidenceExpectationsSchema>;