@ninelives/agent-governance-sdk 5.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +363 -0
- package/dist/audit.d.ts +26 -0
- package/dist/audit.d.ts.map +1 -0
- package/dist/audit.js +107 -0
- package/dist/audit.js.map +1 -0
- package/dist/cascade-containment.d.ts +84 -0
- package/dist/cascade-containment.d.ts.map +1 -0
- package/dist/cascade-containment.js +387 -0
- package/dist/cascade-containment.js.map +1 -0
- package/dist/client.d.ts +34 -0
- package/dist/client.d.ts.map +1 -0
- package/dist/client.js +112 -0
- package/dist/client.js.map +1 -0
- package/dist/context-poisoning.d.ts +58 -0
- package/dist/context-poisoning.d.ts.map +1 -0
- package/dist/context-poisoning.js +410 -0
- package/dist/context-poisoning.js.map +1 -0
- package/dist/credential-vault.d.ts +213 -0
- package/dist/credential-vault.d.ts.map +1 -0
- package/dist/credential-vault.js +567 -0
- package/dist/credential-vault.js.map +1 -0
- package/dist/discovery.d.ts +80 -0
- package/dist/discovery.d.ts.map +1 -0
- package/dist/discovery.js +404 -0
- package/dist/discovery.js.map +1 -0
- package/dist/encryption/channel.d.ts +29 -0
- package/dist/encryption/channel.d.ts.map +1 -0
- package/dist/encryption/channel.js +78 -0
- package/dist/encryption/channel.js.map +1 -0
- package/dist/encryption/index.d.ts +9 -0
- package/dist/encryption/index.d.ts.map +1 -0
- package/dist/encryption/index.js +23 -0
- package/dist/encryption/index.js.map +1 -0
- package/dist/encryption/mesh-client.d.ts +281 -0
- package/dist/encryption/mesh-client.d.ts.map +1 -0
- package/dist/encryption/mesh-client.js +1110 -0
- package/dist/encryption/mesh-client.js.map +1 -0
- package/dist/encryption/ratchet.d.ts +38 -0
- package/dist/encryption/ratchet.d.ts.map +1 -0
- package/dist/encryption/ratchet.js +223 -0
- package/dist/encryption/ratchet.js.map +1 -0
- package/dist/encryption/registry-client.d.ts +136 -0
- package/dist/encryption/registry-client.d.ts.map +1 -0
- package/dist/encryption/registry-client.js +369 -0
- package/dist/encryption/registry-client.js.map +1 -0
- package/dist/encryption/x3dh.d.ts +80 -0
- package/dist/encryption/x3dh.d.ts.map +1 -0
- package/dist/encryption/x3dh.js +238 -0
- package/dist/encryption/x3dh.js.map +1 -0
- package/dist/framework-adapter.d.ts +63 -0
- package/dist/framework-adapter.d.ts.map +1 -0
- package/dist/framework-adapter.js +253 -0
- package/dist/framework-adapter.js.map +1 -0
- package/dist/identity.d.ts +124 -0
- package/dist/identity.d.ts.map +1 -0
- package/dist/identity.js +446 -0
- package/dist/identity.js.map +1 -0
- package/dist/index.d.ts +39 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +95 -0
- package/dist/index.js.map +1 -0
- package/dist/kill-switch.d.ts +22 -0
- package/dist/kill-switch.d.ts.map +1 -0
- package/dist/kill-switch.js +60 -0
- package/dist/kill-switch.js.map +1 -0
- package/dist/lifecycle.d.ts +50 -0
- package/dist/lifecycle.d.ts.map +1 -0
- package/dist/lifecycle.js +113 -0
- package/dist/lifecycle.js.map +1 -0
- package/dist/mcp.d.ts +41 -0
- package/dist/mcp.d.ts.map +1 -0
- package/dist/mcp.js +233 -0
- package/dist/mcp.js.map +1 -0
- package/dist/metrics.d.ts +123 -0
- package/dist/metrics.d.ts.map +1 -0
- package/dist/metrics.js +289 -0
- package/dist/metrics.js.map +1 -0
- package/dist/oci-manifest.d.ts +49 -0
- package/dist/oci-manifest.d.ts.map +1 -0
- package/dist/oci-manifest.js +182 -0
- package/dist/oci-manifest.js.map +1 -0
- package/dist/policy-backends/cedar.d.ts +15 -0
- package/dist/policy-backends/cedar.d.ts.map +1 -0
- package/dist/policy-backends/cedar.js +88 -0
- package/dist/policy-backends/cedar.js.map +1 -0
- package/dist/policy-backends/opa.d.ts +17 -0
- package/dist/policy-backends/opa.d.ts.map +1 -0
- package/dist/policy-backends/opa.js +74 -0
- package/dist/policy-backends/opa.js.map +1 -0
- package/dist/policy.d.ts +77 -0
- package/dist/policy.d.ts.map +1 -0
- package/dist/policy.js +760 -0
- package/dist/policy.js.map +1 -0
- package/dist/prompt-defense.d.ts +37 -0
- package/dist/prompt-defense.d.ts.map +1 -0
- package/dist/prompt-defense.js +229 -0
- package/dist/prompt-defense.js.map +1 -0
- package/dist/protocol-facets.d.ts +87 -0
- package/dist/protocol-facets.d.ts.map +1 -0
- package/dist/protocol-facets.js +728 -0
- package/dist/protocol-facets.js.map +1 -0
- package/dist/rings.d.ts +17 -0
- package/dist/rings.d.ts.map +1 -0
- package/dist/rings.js +61 -0
- package/dist/rings.js.map +1 -0
- package/dist/sandbox.d.ts +61 -0
- package/dist/sandbox.d.ts.map +1 -0
- package/dist/sandbox.js +199 -0
- package/dist/sandbox.js.map +1 -0
- package/dist/surface-parity.d.ts +45 -0
- package/dist/surface-parity.d.ts.map +1 -0
- package/dist/surface-parity.js +216 -0
- package/dist/surface-parity.js.map +1 -0
- package/dist/trust.d.ts +28 -0
- package/dist/trust.d.ts.map +1 -0
- package/dist/trust.js +209 -0
- package/dist/trust.js.map +1 -0
- package/dist/types.d.ts +422 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +29 -0
- package/dist/types.js.map +1 -0
- package/dist/verify.d.ts +135 -0
- package/dist/verify.d.ts.map +1 -0
- package/dist/verify.js +356 -0
- package/dist/verify.js.map +1 -0
- package/package.json +66 -0
package/dist/verify.js
ADDED
|
@@ -0,0 +1,356 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
// Copyright (c) Microsoft Corporation.
|
|
3
|
+
// Licensed under the MIT License.
|
|
4
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
5
|
+
exports.ShadowDiscovery = exports.INTEGRITY_MANIFEST_SCHEMA = exports.RUNTIME_EVIDENCE_SCHEMA = exports.GovernanceVerifier = void 0;
|
|
6
|
+
const crypto_1 = require("crypto");
|
|
7
|
+
const fs_1 = require("fs");
|
|
8
|
+
const js_yaml_1 = require("js-yaml");
|
|
9
|
+
const audit_1 = require("./audit");
|
|
10
|
+
const identity_1 = require("./identity");
|
|
11
|
+
const kill_switch_1 = require("./kill-switch");
|
|
12
|
+
const lifecycle_1 = require("./lifecycle");
|
|
13
|
+
const mcp_1 = require("./mcp");
|
|
14
|
+
const policy_1 = require("./policy");
|
|
15
|
+
const prompt_defense_1 = require("./prompt-defense");
|
|
16
|
+
const rings_1 = require("./rings");
|
|
17
|
+
const discovery_1 = require("./discovery");
|
|
18
|
+
Object.defineProperty(exports, "ShadowDiscovery", { enumerable: true, get: function () { return discovery_1.ShadowDiscovery; } });
|
|
19
|
+
const trust_1 = require("./trust");
|
|
20
|
+
const RUNTIME_EVIDENCE_SCHEMA = 'agt-runtime-evidence/v1';
|
|
21
|
+
exports.RUNTIME_EVIDENCE_SCHEMA = RUNTIME_EVIDENCE_SCHEMA;
|
|
22
|
+
const INTEGRITY_MANIFEST_SCHEMA = 'agt-typescript-integrity/v1';
|
|
23
|
+
exports.INTEGRITY_MANIFEST_SCHEMA = INTEGRITY_MANIFEST_SCHEMA;
|
|
24
|
+
const DEFAULT_CONTROLS = {
|
|
25
|
+
'ASI-01': { name: 'Prompt Injection', component: prompt_defense_1.PromptDefenseEvaluator },
|
|
26
|
+
'ASI-02': { name: 'Insecure Tool Use', component: mcp_1.McpSecurityScanner },
|
|
27
|
+
'ASI-03': { name: 'Excessive Agency', component: rings_1.RingEnforcer },
|
|
28
|
+
'ASI-04': { name: 'Unauthorized Escalation', component: kill_switch_1.KillSwitch },
|
|
29
|
+
'ASI-05': { name: 'Trust Boundary Violation', component: trust_1.TrustManager },
|
|
30
|
+
'ASI-06': { name: 'Insufficient Logging', component: audit_1.AuditLogger },
|
|
31
|
+
'ASI-07': { name: 'Insecure Identity', component: identity_1.AgentIdentity },
|
|
32
|
+
'ASI-08': { name: 'Policy Bypass', component: policy_1.PolicyConflictResolver },
|
|
33
|
+
'ASI-09': { name: 'Supply Chain Integrity', component: policy_1.PolicyEngine },
|
|
34
|
+
'ASI-10': { name: 'Behavioral Anomaly', component: lifecycle_1.LifecycleManager },
|
|
35
|
+
};
|
|
36
|
+
const DEFAULT_INTEGRITY_TARGETS = [
|
|
37
|
+
{ targetId: 'INT-01', label: 'Policy Engine', modulePath: './policy' },
|
|
38
|
+
{ targetId: 'INT-02', label: 'Audit Logger', modulePath: './audit' },
|
|
39
|
+
{ targetId: 'INT-03', label: 'Trust Manager', modulePath: './trust' },
|
|
40
|
+
{ targetId: 'INT-04', label: 'Agent Identity', modulePath: './identity' },
|
|
41
|
+
{ targetId: 'INT-05', label: 'Lifecycle Manager', modulePath: './lifecycle' },
|
|
42
|
+
{ targetId: 'INT-06', label: 'MCP Security Scanner', modulePath: './mcp' },
|
|
43
|
+
{ targetId: 'INT-07', label: 'Prompt Defense', modulePath: './prompt-defense' },
|
|
44
|
+
{ targetId: 'INT-08', label: 'Execution Rings', modulePath: './rings' },
|
|
45
|
+
{ targetId: 'INT-09', label: 'Kill Switch', modulePath: './kill-switch' },
|
|
46
|
+
{ targetId: 'INT-10', label: 'Shadow Discovery', modulePath: './discovery' },
|
|
47
|
+
{ targetId: 'INT-11', label: 'Governance Client', modulePath: './client' },
|
|
48
|
+
];
|
|
49
|
+
class GovernanceAttestationImpl {
|
|
50
|
+
passed;
|
|
51
|
+
controls;
|
|
52
|
+
toolkitVersion;
|
|
53
|
+
runtime;
|
|
54
|
+
verifiedAt;
|
|
55
|
+
attestationHash;
|
|
56
|
+
controlsPassed;
|
|
57
|
+
controlsTotal;
|
|
58
|
+
mode;
|
|
59
|
+
strict;
|
|
60
|
+
evidenceSource;
|
|
61
|
+
evidenceChecks;
|
|
62
|
+
fileIntegrityResults;
|
|
63
|
+
failures;
|
|
64
|
+
constructor(passed, controls, toolkitVersion, runtime, verifiedAt, attestationHash, controlsPassed, controlsTotal, mode, strict, evidenceSource, evidenceChecks, fileIntegrityResults, failures) {
|
|
65
|
+
this.passed = passed;
|
|
66
|
+
this.controls = controls;
|
|
67
|
+
this.toolkitVersion = toolkitVersion;
|
|
68
|
+
this.runtime = runtime;
|
|
69
|
+
this.verifiedAt = verifiedAt;
|
|
70
|
+
this.attestationHash = attestationHash;
|
|
71
|
+
this.controlsPassed = controlsPassed;
|
|
72
|
+
this.controlsTotal = controlsTotal;
|
|
73
|
+
this.mode = mode;
|
|
74
|
+
this.strict = strict;
|
|
75
|
+
this.evidenceSource = evidenceSource;
|
|
76
|
+
this.evidenceChecks = evidenceChecks;
|
|
77
|
+
this.fileIntegrityResults = fileIntegrityResults;
|
|
78
|
+
this.failures = failures;
|
|
79
|
+
}
|
|
80
|
+
coveragePct() {
|
|
81
|
+
if (this.controlsTotal === 0) {
|
|
82
|
+
return 0;
|
|
83
|
+
}
|
|
84
|
+
return Math.round((this.controlsPassed / this.controlsTotal) * 100);
|
|
85
|
+
}
|
|
86
|
+
complianceGrade() {
|
|
87
|
+
const pct = this.coveragePct();
|
|
88
|
+
if (pct >= 90)
|
|
89
|
+
return 'A';
|
|
90
|
+
if (pct >= 80)
|
|
91
|
+
return 'B';
|
|
92
|
+
if (pct >= 70)
|
|
93
|
+
return 'C';
|
|
94
|
+
if (pct >= 60)
|
|
95
|
+
return 'D';
|
|
96
|
+
return 'F';
|
|
97
|
+
}
|
|
98
|
+
summary() {
|
|
99
|
+
const headline = this.mode === 'components'
|
|
100
|
+
? `TypeScript governance component attestation ${this.passed ? 'PASSED' : 'FAILED'}`
|
|
101
|
+
: `TypeScript governance verification ${this.passed ? 'PASSED' : 'FAILED'}`;
|
|
102
|
+
const lines = [
|
|
103
|
+
headline,
|
|
104
|
+
`OWASP ASI coverage: ${this.controlsPassed}/${this.controlsTotal} (${this.coveragePct()}%)`,
|
|
105
|
+
`Runtime: ${this.runtime}`,
|
|
106
|
+
`Verified: ${this.verifiedAt}`,
|
|
107
|
+
`Mode: ${this.mode}`,
|
|
108
|
+
];
|
|
109
|
+
if (this.evidenceChecks.length > 0) {
|
|
110
|
+
const passingChecks = this.evidenceChecks.filter((check) => check.status === 'pass').length;
|
|
111
|
+
lines.push(`Runtime evidence: ${passingChecks}/${this.evidenceChecks.length} checks passed`);
|
|
112
|
+
if (this.evidenceSource) {
|
|
113
|
+
lines.push(`Evidence source: ${this.evidenceSource}`);
|
|
114
|
+
}
|
|
115
|
+
}
|
|
116
|
+
if (this.fileIntegrityResults.length > 0) {
|
|
117
|
+
const passingFiles = this.fileIntegrityResults.filter((result) => result.passed).length;
|
|
118
|
+
lines.push(`Integrity manifest: ${passingFiles}/${this.fileIntegrityResults.length} files verified`);
|
|
119
|
+
}
|
|
120
|
+
if (this.failures.length > 0) {
|
|
121
|
+
lines.push('Failures:');
|
|
122
|
+
for (const failure of this.failures) {
|
|
123
|
+
lines.push(`- ${failure}`);
|
|
124
|
+
}
|
|
125
|
+
}
|
|
126
|
+
return lines.join('\n');
|
|
127
|
+
}
|
|
128
|
+
}
|
|
129
|
+
class GovernanceVerifier {
|
|
130
|
+
controls;
|
|
131
|
+
toolkitVersion;
|
|
132
|
+
integrityTargets;
|
|
133
|
+
constructor(controls = DEFAULT_CONTROLS, toolkitVersion = 'typescript-sdk', integrityTargets = DEFAULT_INTEGRITY_TARGETS) {
|
|
134
|
+
this.controls = controls;
|
|
135
|
+
this.toolkitVersion = toolkitVersion;
|
|
136
|
+
this.integrityTargets = integrityTargets;
|
|
137
|
+
}
|
|
138
|
+
static loadRuntimeEvidence(evidencePath) {
|
|
139
|
+
const raw = (0, fs_1.readFileSync)(evidencePath, 'utf-8');
|
|
140
|
+
const parsed = evidencePath.endsWith('.yaml') || evidencePath.endsWith('.yml')
|
|
141
|
+
? (0, js_yaml_1.load)(raw)
|
|
142
|
+
: JSON.parse(raw);
|
|
143
|
+
if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
|
|
144
|
+
throw new Error('Runtime evidence must contain a top-level object.');
|
|
145
|
+
}
|
|
146
|
+
const candidate = parsed;
|
|
147
|
+
if (candidate.schema !== RUNTIME_EVIDENCE_SCHEMA) {
|
|
148
|
+
throw new Error(`Unsupported runtime evidence schema ${String(candidate.schema)}.`);
|
|
149
|
+
}
|
|
150
|
+
if (!candidate.deployment || typeof candidate.deployment !== 'object' || Array.isArray(candidate.deployment)) {
|
|
151
|
+
throw new Error("Runtime evidence missing required 'deployment' object.");
|
|
152
|
+
}
|
|
153
|
+
return {
|
|
154
|
+
sourcePath: evidencePath,
|
|
155
|
+
schema: String(candidate.schema),
|
|
156
|
+
generatedAt: String(candidate.generatedAt ?? ''),
|
|
157
|
+
toolkitVersion: String(candidate.toolkitVersion ?? ''),
|
|
158
|
+
deployment: candidate.deployment,
|
|
159
|
+
};
|
|
160
|
+
}
|
|
161
|
+
generateIntegrityManifest() {
|
|
162
|
+
return {
|
|
163
|
+
schema: INTEGRITY_MANIFEST_SCHEMA,
|
|
164
|
+
generatedAt: new Date().toISOString(),
|
|
165
|
+
toolkitVersion: this.toolkitVersion,
|
|
166
|
+
files: this.integrityTargets.map((target) => {
|
|
167
|
+
const filePath = this.resolveModuleFile(target.modulePath);
|
|
168
|
+
return {
|
|
169
|
+
targetId: target.targetId,
|
|
170
|
+
label: target.label,
|
|
171
|
+
modulePath: target.modulePath,
|
|
172
|
+
filePath,
|
|
173
|
+
sha256: this.hashFile(filePath),
|
|
174
|
+
};
|
|
175
|
+
}),
|
|
176
|
+
};
|
|
177
|
+
}
|
|
178
|
+
verify(options = {}) {
|
|
179
|
+
const strict = options.strict ?? false;
|
|
180
|
+
const verifiedAt = new Date().toISOString();
|
|
181
|
+
const failures = [];
|
|
182
|
+
let runtimeEvidence = options.runtimeEvidence;
|
|
183
|
+
if (!runtimeEvidence && options.evidencePath) {
|
|
184
|
+
try {
|
|
185
|
+
runtimeEvidence = GovernanceVerifier.loadRuntimeEvidence(options.evidencePath);
|
|
186
|
+
}
|
|
187
|
+
catch (error) {
|
|
188
|
+
failures.push(error instanceof Error ? error.message : String(error));
|
|
189
|
+
}
|
|
190
|
+
}
|
|
191
|
+
if (options.requireRuntimeEvidence && !runtimeEvidence) {
|
|
192
|
+
failures.push('Runtime evidence is required but was not provided.');
|
|
193
|
+
}
|
|
194
|
+
if (options.requireIntegrityManifest && !options.integrityManifest) {
|
|
195
|
+
failures.push('Integrity manifest is required but was not provided.');
|
|
196
|
+
}
|
|
197
|
+
const controls = Object.entries(this.controls).map(([controlId, spec]) => ({
|
|
198
|
+
controlId,
|
|
199
|
+
name: spec.name,
|
|
200
|
+
present: spec.component !== undefined && spec.component !== null,
|
|
201
|
+
component: this.componentName(spec.component),
|
|
202
|
+
error: spec.component !== undefined && spec.component !== null ? undefined : 'Component missing',
|
|
203
|
+
}));
|
|
204
|
+
const evidenceChecks = runtimeEvidence ? this.evaluateRuntimeEvidence(runtimeEvidence) : [];
|
|
205
|
+
const fileIntegrityResults = options.integrityManifest
|
|
206
|
+
? this.verifyIntegrityManifest(options.integrityManifest)
|
|
207
|
+
: [];
|
|
208
|
+
if (options.integrityManifest && options.integrityManifest.schema !== INTEGRITY_MANIFEST_SCHEMA) {
|
|
209
|
+
failures.push(`Unsupported integrity manifest schema ${options.integrityManifest.schema}.`);
|
|
210
|
+
}
|
|
211
|
+
for (const check of evidenceChecks) {
|
|
212
|
+
if (check.status === 'fail') {
|
|
213
|
+
failures.push(`${check.title}: ${check.message}`);
|
|
214
|
+
}
|
|
215
|
+
}
|
|
216
|
+
for (const result of fileIntegrityResults) {
|
|
217
|
+
if (!result.passed) {
|
|
218
|
+
failures.push(`${result.label}: ${result.error ?? 'hash mismatch'}`);
|
|
219
|
+
}
|
|
220
|
+
}
|
|
221
|
+
const controlsPassed = controls.filter((control) => control.present).length;
|
|
222
|
+
const controlsTotal = controls.length;
|
|
223
|
+
const mode = runtimeEvidence
|
|
224
|
+
? 'runtime-evidence'
|
|
225
|
+
: fileIntegrityResults.length > 0
|
|
226
|
+
? 'integrity'
|
|
227
|
+
: 'components';
|
|
228
|
+
const passed = controlsPassed === controlsTotal && failures.length === 0;
|
|
229
|
+
const attestationHash = (0, crypto_1.createHash)('sha256')
|
|
230
|
+
.update(JSON.stringify({
|
|
231
|
+
verifiedAt,
|
|
232
|
+
toolkitVersion: this.toolkitVersion,
|
|
233
|
+
mode,
|
|
234
|
+
strict,
|
|
235
|
+
controls: controls.map((control) => ({
|
|
236
|
+
id: control.controlId,
|
|
237
|
+
present: control.present,
|
|
238
|
+
component: control.component,
|
|
239
|
+
})),
|
|
240
|
+
evidenceChecks: evidenceChecks.map((check) => ({
|
|
241
|
+
id: check.checkId,
|
|
242
|
+
status: check.status,
|
|
243
|
+
observed: check.observed,
|
|
244
|
+
})),
|
|
245
|
+
fileIntegrityResults: fileIntegrityResults.map((result) => ({
|
|
246
|
+
id: result.targetId,
|
|
247
|
+
passed: result.passed,
|
|
248
|
+
actualHash: result.actualHash,
|
|
249
|
+
})),
|
|
250
|
+
}))
|
|
251
|
+
.digest('hex');
|
|
252
|
+
return new GovernanceAttestationImpl(passed, controls, this.toolkitVersion, `Node ${process.version}`, verifiedAt, attestationHash, controlsPassed, controlsTotal, mode, strict, runtimeEvidence?.sourcePath, evidenceChecks, fileIntegrityResults, failures);
|
|
253
|
+
}
|
|
254
|
+
evaluateRuntimeEvidence(evidence) {
|
|
255
|
+
const deployment = evidence.deployment;
|
|
256
|
+
const identity = deployment.identity ?? {};
|
|
257
|
+
const policy = deployment.policy ?? {};
|
|
258
|
+
const audit = deployment.audit ?? {};
|
|
259
|
+
const execution = deployment.execution ?? {};
|
|
260
|
+
const promptDefense = deployment.promptDefense ?? {};
|
|
261
|
+
const sre = deployment.sre ?? {};
|
|
262
|
+
const discovery = deployment.discovery ?? {};
|
|
263
|
+
return [
|
|
264
|
+
this.makeEvidenceCheck('EVI-01', 'Runtime evidence schema', evidence.schema === RUNTIME_EVIDENCE_SCHEMA, evidence.schema === RUNTIME_EVIDENCE_SCHEMA
|
|
265
|
+
? 'Runtime evidence schema is recognized.'
|
|
266
|
+
: 'Runtime evidence schema is unsupported.', { schema: evidence.schema }),
|
|
267
|
+
this.makeEvidenceCheck('EVI-02', 'Cryptographic identity', Boolean(identity.did || identity.spiffeId || identity.enabled === true), identity.did || identity.spiffeId || identity.enabled === true
|
|
268
|
+
? 'Identity evidence present.'
|
|
269
|
+
: 'Missing DID, SPIFFE ID, or explicit identity enablement.', { did: identity.did, spiffeId: identity.spiffeId, enabled: identity.enabled ?? false }),
|
|
270
|
+
this.makeEvidenceCheck('EVI-03', 'Fail-closed policy', policy.failClosed === true || policy.defaultAction === 'deny', policy.failClosed === true || policy.defaultAction === 'deny'
|
|
271
|
+
? 'Policy evidence shows deny-by-default or fail-closed evaluation.'
|
|
272
|
+
: 'Policy evidence does not demonstrate deny-by-default enforcement.', { failClosed: policy.failClosed ?? false, defaultAction: policy.defaultAction ?? 'unset' }),
|
|
273
|
+
this.makeEvidenceCheck('EVI-04', 'Policy backend coverage', Array.isArray(policy.backends) && policy.backends.length > 0, Array.isArray(policy.backends) && policy.backends.length > 0
|
|
274
|
+
? 'At least one policy backend is configured.'
|
|
275
|
+
: 'No policy backends were recorded in runtime evidence.', { backends: policy.backends ?? [] }),
|
|
276
|
+
this.makeEvidenceCheck('EVI-05', 'Audit logging', audit.enabled === true, audit.enabled === true
|
|
277
|
+
? 'Audit evidence is enabled.'
|
|
278
|
+
: 'Audit logging is not marked as enabled.', { enabled: audit.enabled ?? false, destination: audit.destination ?? 'unset' }),
|
|
279
|
+
this.makeEvidenceCheck('EVI-06', 'Execution rings', execution.rings === true, execution.rings === true
|
|
280
|
+
? 'Execution ring enforcement is enabled.'
|
|
281
|
+
: 'Execution ring enforcement is missing from runtime evidence.', { rings: execution.rings ?? false }),
|
|
282
|
+
this.makeEvidenceCheck('EVI-07', 'Kill switch', execution.killSwitch === true, execution.killSwitch === true
|
|
283
|
+
? 'Kill switch evidence is present.'
|
|
284
|
+
: 'Kill switch coverage is missing from runtime evidence.', { killSwitch: execution.killSwitch ?? false }),
|
|
285
|
+
this.makeEvidenceCheck('EVI-08', 'Prompt defense', promptDefense.enabled === true, promptDefense.enabled === true
|
|
286
|
+
? 'Prompt defense evidence is present.'
|
|
287
|
+
: 'Prompt defense is not recorded as enabled.', { enabled: promptDefense.enabled ?? false, vectorsCovered: promptDefense.vectorsCovered ?? [] }),
|
|
288
|
+
this.makeEvidenceCheck('EVI-09', 'SRE telemetry', sre.metrics === true && sre.traces === true, sre.metrics === true && sre.traces === true
|
|
289
|
+
? 'Metrics and traces are enabled.'
|
|
290
|
+
: 'Metrics and trace capture are not both enabled.', { metrics: sre.metrics ?? false, traces: sre.traces ?? false, sloTargets: sre.sloTargets ?? [] }),
|
|
291
|
+
this.makeEvidenceCheck('EVI-10', 'Shadow discovery', discovery.enabled === true, discovery.enabled === true
|
|
292
|
+
? 'Shadow discovery evidence is present.'
|
|
293
|
+
: 'Shadow discovery is not recorded as enabled.', { enabled: discovery.enabled ?? false, shadowAgents: discovery.shadowAgents ?? 0 }),
|
|
294
|
+
];
|
|
295
|
+
}
|
|
296
|
+
verifyIntegrityManifest(manifest) {
|
|
297
|
+
return manifest.files.map((file) => {
|
|
298
|
+
try {
|
|
299
|
+
const manifestPath = file.filePath || this.resolveModuleFile(file.modulePath);
|
|
300
|
+
const actualHash = this.hashFile(manifestPath);
|
|
301
|
+
const passed = file.sha256 === actualHash;
|
|
302
|
+
return {
|
|
303
|
+
targetId: file.targetId,
|
|
304
|
+
label: file.label,
|
|
305
|
+
modulePath: file.modulePath,
|
|
306
|
+
filePath: manifestPath,
|
|
307
|
+
expectedHash: file.sha256,
|
|
308
|
+
actualHash,
|
|
309
|
+
passed,
|
|
310
|
+
error: passed ? undefined : 'hash mismatch',
|
|
311
|
+
};
|
|
312
|
+
}
|
|
313
|
+
catch (error) {
|
|
314
|
+
return {
|
|
315
|
+
targetId: file.targetId,
|
|
316
|
+
label: file.label,
|
|
317
|
+
modulePath: file.modulePath,
|
|
318
|
+
filePath: file.filePath,
|
|
319
|
+
expectedHash: file.sha256,
|
|
320
|
+
actualHash: '',
|
|
321
|
+
passed: false,
|
|
322
|
+
error: error instanceof Error ? error.message : String(error),
|
|
323
|
+
};
|
|
324
|
+
}
|
|
325
|
+
});
|
|
326
|
+
}
|
|
327
|
+
makeEvidenceCheck(checkId, title, passed, message, observed) {
|
|
328
|
+
return {
|
|
329
|
+
checkId,
|
|
330
|
+
title,
|
|
331
|
+
status: passed ? 'pass' : 'fail',
|
|
332
|
+
message,
|
|
333
|
+
observed,
|
|
334
|
+
};
|
|
335
|
+
}
|
|
336
|
+
resolveModuleFile(modulePath) {
|
|
337
|
+
return require.resolve(modulePath);
|
|
338
|
+
}
|
|
339
|
+
hashFile(filePath) {
|
|
340
|
+
return (0, crypto_1.createHash)('sha256').update((0, fs_1.readFileSync)(filePath)).digest('hex');
|
|
341
|
+
}
|
|
342
|
+
componentName(component) {
|
|
343
|
+
if (typeof component === 'function' && component.name) {
|
|
344
|
+
return component.name;
|
|
345
|
+
}
|
|
346
|
+
if (typeof component === 'object' && component && 'constructor' in component) {
|
|
347
|
+
const constructor = component.constructor;
|
|
348
|
+
if (constructor?.name) {
|
|
349
|
+
return constructor.name;
|
|
350
|
+
}
|
|
351
|
+
}
|
|
352
|
+
return 'unknown';
|
|
353
|
+
}
|
|
354
|
+
}
|
|
355
|
+
exports.GovernanceVerifier = GovernanceVerifier;
|
|
356
|
+
//# sourceMappingURL=verify.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC,mCAAoC;AACpC,2BAAkC;AAClC,qCAA2C;AAC3C,mCAAsC;AACtC,yCAA2C;AAC3C,+CAA2C;AAC3C,2CAA+C;AAC/C,+BAA2C;AAC3C,qCAAgE;AAChE,qDAA0D;AAC1D,mCAAuC;AACvC,2CAA8C;AAgjBe,gGAhjBpD,2BAAe,OAgjBoD;AA/iB5E,mCAAuC;AAgIvC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AA+ajD,0DAAuB;AA9ahC,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AA8a9B,8DAAyB;AA5a3D,MAAM,gBAAgB,GAAwC;IAC5D,QAAQ,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,uCAAsB,EAAE;IACzE,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,wBAAkB,EAAE;IACtE,QAAQ,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,oBAAY,EAAE;IAC/D,QAAQ,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,SAAS,EAAE,wBAAU,EAAE;IACpE,QAAQ,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,SAAS,EAAE,oBAAY,EAAE;IACvE,QAAQ,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,mBAAW,EAAE;IAClE,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,EAAE,wBAAa,EAAE;IACjE,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,+BAAsB,EAAE;IACtE,QAAQ,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,SAAS,EAAE,qBAAY,EAAE;IACrE,QAAQ,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,SAAS,EAAE,4BAAgB,EAAE;CACtE,CAAC;AAEF,MAAM,yBAAyB,GAA0B;IACvD,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE;IACtE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE;IACpE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE;IACrE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,YAAY,EAAE;IACzE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,aAAa,EAAE;IAC7E,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,OAAO,EAAE;IAC1E,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,EAAE;IAC/E,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE;IACvE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,eAAe,EAAE;IACzE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,aAAa,EAAE;IAC5E,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,UAAU,EAAE;CAC3E,CAAC;AAEF,MAAM,yBAAyB;IAElB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAdX,YACW,MAAe,EACf,QAAyB,EACzB,cAAsB,EACtB,OAAe,EACf,UAAkB,EAClB,eAAuB,EACvB,cAAsB,EACtB,aAAqB,EACrB,IAAqD,EACrD,MAAe,EACf,cAAkC,EAClC,cAAsC,EACtC,oBAA2C,EAC3C,QAAkB;QAblB,WAAM,GAAN,MAAM,CAAS;QACf,aAAQ,GAAR,QAAQ,CAAiB;QACzB,mBAAc,GAAd,cAAc,CAAQ;QACtB,YAAO,GAAP,OAAO,CAAQ;QACf,eAAU,GAAV,UAAU,CAAQ;QAClB,oBAAe,GAAf,eAAe,CAAQ;QACvB,mBAAc,GAAd,cAAc,CAAQ;QACtB,kBAAa,GAAb,aAAa,CAAQ;QACrB,SAAI,GAAJ,IAAI,CAAiD;QACrD,WAAM,GAAN,MAAM,CAAS;QACf,mBAAc,GAAd,cAAc,CAAoB;QAClC,mBAAc,GAAd,cAAc,CAAwB;QACtC,yBAAoB,GAApB,oBAAoB,CAAuB;QAC3C,aAAQ,GAAR,QAAQ,CAAU;IAC1B,CAAC;IAEJ,WAAW;QACT,IAAI,IAAI,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,eAAe;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,GAAG,IAAI,EAAE;YAAE,OAAO,GAAG,CAAC;QAC1B,IAAI,GAAG,IAAI,EAAE;YAAE,OAAO,GAAG,CAAC;QAC1B,IAAI,GAAG,IAAI,EAAE;YAAE,OAAO,GAAG,CAAC;QAC1B,IAAI,GAAG,IAAI,EAAE;YAAE,OAAO,GAAG,CAAC;QAC1B,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,KAAK,YAAY;YACzC,CAAC,CAAC,+CAA+C,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;YACpF,CAAC,CAAC,sCAAsC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG;YACZ,QAAQ;YACR,uBAAuB,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,WAAW,EAAE,IAAI;YAC3F,YAAY,IAAI,CAAC,OAAO,EAAE;YAC1B,aAAa,IAAI,CAAC,UAAU,EAAE;YAC9B,SAAS,IAAI,CAAC,IAAI,EAAE;SACrB,CAAC;QAEF,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAC5F,KAAK,CAAC,IAAI,CAAC,qBAAqB,aAAa,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,gBAAgB,CAAC,CAAC;YAC7F,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;YACxF,KAAK,CAAC,IAAI,CAAC,uBAAuB,YAAY,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACvG,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF;AAED,MAAa,kBAAkB;IAEV;IACA;IACA;IAHnB,YACmB,WAAgD,gBAAgB,EAChE,iBAAyB,gBAAgB,EACzC,mBAA0C,yBAAyB;QAFnE,aAAQ,GAAR,QAAQ,CAAwD;QAChE,mBAAc,GAAd,cAAc,CAA2B;QACzC,qBAAgB,GAAhB,gBAAgB,CAAmD;IACnF,CAAC;IAEJ,MAAM,CAAC,mBAAmB,CAAC,YAAoB;QAC7C,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAC,IAAA,cAAQ,EAAC,GAAG,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,SAAS,GAAG,MAAiC,CAAC;QACpD,IAAI,SAAS,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7G,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO;YACL,UAAU,EAAE,YAAY;YACxB,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAChC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC;YAChD,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE,CAAC;YACtD,UAAU,EAAE,SAAS,CAAC,UAAuC;SAC9D,CAAC;IACJ,CAAC;IAED,yBAAyB;QACvB,OAAO;YACL,MAAM,EAAE,yBAAyB;YACjC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC3D,OAAO;oBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,QAAQ;oBACR,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAChC,CAAC;YACJ,CAAC,CAAC;SACH,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,UAAyC,EAAE;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACvC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAE9C,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,eAAe,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,sBAAsB,IAAI,CAAC,eAAe,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,OAAO,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAChE,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC;YAC7C,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB;SACjG,CAAC,CAAC,CAAC;QAEJ,MAAM,cAAc,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,oBAAoB,GAAG,OAAO,CAAC,iBAAiB;YACpD,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACzD,CAAC,CAAC,EAAE,CAAC;QAEP,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;YAChG,QAAQ,CAAC,IAAI,CAAC,yCAAyC,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9F,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC;QACtC,MAAM,IAAI,GAAG,eAAe;YAC1B,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBAC/B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,YAAY,CAAC;QACnB,MAAM,MAAM,GAAG,cAAc,KAAK,aAAa,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;QAEzE,MAAM,eAAe,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;aACzC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,UAAU;YACV,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,IAAI;YACJ,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,OAAO,CAAC,SAAS;gBACrB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;YACH,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC7C,EAAE,EAAE,KAAK,CAAC,OAAO;gBACjB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAC;YACH,oBAAoB,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1D,EAAE,EAAE,MAAM,CAAC,QAAQ;gBACnB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;SACJ,CAAC,CAAC;aACF,MAAM,CAAC,KAAK,CAAC,CAAC;QAEjB,OAAO,IAAI,yBAAyB,CAClC,MAAM,EACN,QAAQ,EACR,IAAI,CAAC,cAAc,EACnB,QAAQ,OAAO,CAAC,OAAO,EAAE,EACzB,UAAU,EACV,eAAe,EACf,cAAc,EACd,aAAa,EACb,IAAI,EACJ,MAAM,EACN,eAAe,EAAE,UAAU,EAC3B,cAAc,EACd,oBAAoB,EACpB,QAAQ,CACT,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,QAAyB;QACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,IAAI,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QAE7C,OAAO;YACL,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,yBAAyB,EACzB,QAAQ,CAAC,MAAM,KAAK,uBAAuB,EAC3C,QAAQ,CAAC,MAAM,KAAK,uBAAuB;gBACzC,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,yCAAyC,EAC7C,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,wBAAwB,EACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,EACvE,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI;gBAC5D,CAAC,CAAC,4BAA4B;gBAC9B,CAAC,CAAC,0DAA0D,EAC9D,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,KAAK,EAAE,CACvF;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,oBAAoB,EACpB,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAC7D,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM;gBAC3D,CAAC,CAAC,kEAAkE;gBACpE,CAAC,CAAC,mEAAmE,EACvE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,OAAO,EAAE,CAC3F;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,yBAAyB,EACzB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAC5D,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAC1D,CAAC,CAAC,4CAA4C;gBAC9C,CAAC,CAAC,uDAAuD,EAC3D,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CACpC;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,eAAe,EACf,KAAK,CAAC,OAAO,KAAK,IAAI,EACtB,KAAK,CAAC,OAAO,KAAK,IAAI;gBACpB,CAAC,CAAC,4BAA4B;gBAC9B,CAAC,CAAC,yCAAyC,EAC7C,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,OAAO,EAAE,CAC/E;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,iBAAiB,EACjB,SAAS,CAAC,KAAK,KAAK,IAAI,EACxB,SAAS,CAAC,KAAK,KAAK,IAAI;gBACtB,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,8DAA8D,EAClE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,KAAK,EAAE,CACpC;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,aAAa,EACb,SAAS,CAAC,UAAU,KAAK,IAAI,EAC7B,SAAS,CAAC,UAAU,KAAK,IAAI;gBAC3B,CAAC,CAAC,kCAAkC;gBACpC,CAAC,CAAC,wDAAwD,EAC5D,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,IAAI,KAAK,EAAE,CAC9C;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,gBAAgB,EAChB,aAAa,CAAC,OAAO,KAAK,IAAI,EAC9B,aAAa,CAAC,OAAO,KAAK,IAAI;gBAC5B,CAAC,CAAC,qCAAqC;gBACvC,CAAC,CAAC,4CAA4C,EAChD,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,IAAI,KAAK,EAAE,cAAc,EAAE,aAAa,CAAC,cAAc,IAAI,EAAE,EAAE,CAChG;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,eAAe,EACf,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAC3C,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;gBACzC,CAAC,CAAC,iCAAiC;gBACnC,CAAC,CAAC,iDAAiD,EACrD,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,CACjG;YACD,IAAI,CAAC,iBAAiB,CACpB,QAAQ,EACR,kBAAkB,EAClB,SAAS,CAAC,OAAO,KAAK,IAAI,EAC1B,SAAS,CAAC,OAAO,KAAK,IAAI;gBACxB,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,8CAA8C,EAClD,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,CAAC,EAAE,CACnF;SACF,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,QAA2B;QACzD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC9E,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC;gBAC1C,OAAO;oBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,YAAY;oBACtB,YAAY,EAAE,IAAI,CAAC,MAAM;oBACzB,UAAU;oBACV,MAAM;oBACN,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe;iBAC5C,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,MAAM;oBACzB,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,KAAK;oBACb,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB,CACvB,OAAe,EACf,KAAa,EACb,MAAe,EACf,OAAe,EACf,QAAiC;QAEjC,OAAO;YACL,OAAO;YACP,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAChC,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,UAAkB;QAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAEO,QAAQ,CAAC,QAAgB;QAC/B,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAA,iBAAY,EAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IAEO,aAAa,CAAC,SAAkB;QACtC,IAAI,OAAO,SAAS,KAAK,UAAU,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;QAED,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,aAAa,IAAI,SAAS,EAAE,CAAC;YAC7E,MAAM,WAAW,GAAI,SAAiD,CAAC,WAAW,CAAC;YACnF,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;gBACtB,OAAO,WAAW,CAAC,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAxUD,gDAwUC"}
|
package/package.json
ADDED
|
@@ -0,0 +1,66 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@ninelives/agent-governance-sdk",
|
|
3
|
+
"version": "5.0.1",
|
|
4
|
+
"description": "Public Preview — TypeScript SDK for the Agent Governance Toolkit: agent identity, trust scoring, policy evaluation, and audit logging",
|
|
5
|
+
"main": "dist/index.js",
|
|
6
|
+
"types": "dist/index.d.ts",
|
|
7
|
+
"files": [
|
|
8
|
+
"dist/"
|
|
9
|
+
],
|
|
10
|
+
"scripts": {
|
|
11
|
+
"build": "tsc",
|
|
12
|
+
"test": "jest --config jest.config.js",
|
|
13
|
+
"lint": "eslint src/ tests/ --ext .ts",
|
|
14
|
+
"clean": "rimraf dist",
|
|
15
|
+
"prepublishOnly": "npm run build"
|
|
16
|
+
},
|
|
17
|
+
"keywords": [
|
|
18
|
+
"agentmesh",
|
|
19
|
+
"agent",
|
|
20
|
+
"governance",
|
|
21
|
+
"trust",
|
|
22
|
+
"identity",
|
|
23
|
+
"policy",
|
|
24
|
+
"audit"
|
|
25
|
+
],
|
|
26
|
+
"author": {
|
|
27
|
+
"name": "NineLives",
|
|
28
|
+
"email": "github@ninelives.me"
|
|
29
|
+
},
|
|
30
|
+
"license": "MIT",
|
|
31
|
+
"repository": {
|
|
32
|
+
"type": "git",
|
|
33
|
+
"url": "https://github.com/NineLivesDemo/agent-governance-toolkit.git",
|
|
34
|
+
"directory": "agent-governance-typescript"
|
|
35
|
+
},
|
|
36
|
+
"devDependencies": {
|
|
37
|
+
"@types/jest": "30.0.0",
|
|
38
|
+
"@types/node": "26.1.2",
|
|
39
|
+
"@typescript-eslint/eslint-plugin": "8.66.0",
|
|
40
|
+
"@typescript-eslint/parser": "8.66.0",
|
|
41
|
+
"eslint": "10.8.0",
|
|
42
|
+
"jest": "30.4.2",
|
|
43
|
+
"rimraf": "6.1.3",
|
|
44
|
+
"ts-jest": "29.4.12",
|
|
45
|
+
"typescript": "6.0.3"
|
|
46
|
+
},
|
|
47
|
+
"dependencies": {
|
|
48
|
+
"@noble/ciphers": "2.2.0",
|
|
49
|
+
"@noble/curves": "2.2.0",
|
|
50
|
+
"@noble/ed25519": "3.1.0",
|
|
51
|
+
"@noble/hashes": "2.2.0",
|
|
52
|
+
"js-yaml": "5.2.3"
|
|
53
|
+
},
|
|
54
|
+
"engines": {
|
|
55
|
+
"node": ">=18.0.0"
|
|
56
|
+
},
|
|
57
|
+
"exports": {
|
|
58
|
+
".": {
|
|
59
|
+
"types": "./dist/index.d.ts",
|
|
60
|
+
"import": "./dist/index.js",
|
|
61
|
+
"require": "./dist/index.js"
|
|
62
|
+
},
|
|
63
|
+
"./package.json": "./package.json"
|
|
64
|
+
},
|
|
65
|
+
"homepage": "https://github.com/NineLivesDemo/agent-governance-toolkit/tree/main/agent-governance-typescript"
|
|
66
|
+
}
|