@objectstack/spec 0.9.1 → 0.9.2

package/dist/system/plugin-security-advanced.zod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-security-advanced.zod.d.ts","sourceRoot":"","sources":["../../src/system/plugin-security-advanced.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;EAMY,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;EAYU,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;EAiBe,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAuD3B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwB9B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsH9B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6E9B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;iBAqFtC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoEnC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyD/B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;EAMK,CAAC;AAEzC;;;GAGG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2EvC,CAAC;AAGH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC1E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/system/plugin-security-advanced.zod.js

@@ -0,0 +1,606 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PluginSecurityManifestSchema = exports.PluginTrustLevelSchema = exports.SecurityPolicySchema = exports.SecurityScanResultSchema = exports.SecurityVulnerabilitySchema = exports.SandboxConfigSchema = exports.RuntimeConfigSchema = exports.PermissionSetSchema = exports.PermissionSchema = exports.ResourceTypeSchema = exports.PermissionActionSchema = exports.PermissionScopeSchema = void 0;
+const zod_1 = require("zod");
+/**
+ * # Plugin Security and Sandboxing Protocol
+ *
+ * Defines comprehensive security mechanisms for plugin isolation, permission
+ * management, and threat protection in the ObjectStack ecosystem.
+ *
+ * Features:
+ * - Fine-grained permission system
+ * - Resource access control
+ * - Sandboxing and isolation
+ * - Security scanning and verification
+ * - Runtime security monitoring
+ */
+/**
+ * Permission Scope
+ * Defines the scope of a permission
+ */
+exports.PermissionScopeSchema = zod_1.z.enum([
+    'global', // Applies to entire system
+    'tenant', // Applies to specific tenant
+    'user', // Applies to specific user
+    'resource', // Applies to specific resource
+    'plugin', // Applies within plugin boundaries
+]).describe('Scope of permission application');
+/**
+ * Permission Action
+ * Standard CRUD + extended actions
+ */
+exports.PermissionActionSchema = zod_1.z.enum([
+    'create', // Create new resources
+    'read', // Read existing resources
+    'update', // Update existing resources
+    'delete', // Delete resources
+    'execute', // Execute operations/functions
+    'manage', // Full management rights
+    'configure', // Configuration changes
+    'share', // Share with others
+    'export', // Export data
+    'import', // Import data
+    'admin', // Administrative access
+]).describe('Type of action being permitted');
+/**
+ * Resource Type
+ * Types of resources that can be accessed
+ */
+exports.ResourceTypeSchema = zod_1.z.enum([
+    'data.object', // ObjectQL objects
+    'data.record', // Individual records
+    'data.field', // Specific fields
+    'ui.view', // UI views
+    'ui.dashboard', // Dashboards
+    'ui.report', // Reports
+    'system.config', // System configuration
+    'system.plugin', // Other plugins
+    'system.api', // API endpoints
+    'system.service', // System services
+    'storage.file', // File storage
+    'storage.database', // Database access
+    'network.http', // HTTP requests
+    'network.websocket', // WebSocket connections
+    'process.spawn', // Process spawning
+    'process.env', // Environment variables
+]).describe('Type of resource being accessed');
+/**
+ * Permission Definition
+ * Defines a single permission requirement
+ */
+exports.PermissionSchema = zod_1.z.object({
+    /**
+     * Permission identifier
+     */
+    id: zod_1.z.string().describe('Unique permission identifier'),
+    /**
+     * Resource type
+     */
+    resource: exports.ResourceTypeSchema,
+    /**
+     * Allowed actions
+     */
+    actions: zod_1.z.array(exports.PermissionActionSchema),
+    /**
+     * Permission scope
+     */
+    scope: exports.PermissionScopeSchema.default('plugin'),
+    /**
+     * Resource filter
+     */
+    filter: zod_1.z.object({
+        /**
+         * Specific resource IDs
+         */
+        resourceIds: zod_1.z.array(zod_1.z.string()).optional(),
+        /**
+         * Filter condition
+         */
+        condition: zod_1.z.string().optional().describe('Filter expression (e.g., owner = currentUser)'),
+        /**
+         * Field-level access
+         */
+        fields: zod_1.z.array(zod_1.z.string()).optional().describe('Allowed fields for data resources'),
+    }).optional(),
+    /**
+     * Human-readable description
+     */
+    description: zod_1.z.string(),
+    /**
+     * Whether this permission is required or optional
+     */
+    required: zod_1.z.boolean().default(true),
+    /**
+     * Justification for permission
+     */
+    justification: zod_1.z.string().optional().describe('Why this permission is needed'),
+});
+/**
+ * Permission Set
+ * Collection of permissions for a plugin
+ */
+exports.PermissionSetSchema = zod_1.z.object({
+    /**
+     * All permissions required by plugin
+     */
+    permissions: zod_1.z.array(exports.PermissionSchema),
+    /**
+     * Permission groups for easier management
+     */
+    groups: zod_1.z.array(zod_1.z.object({
+        name: zod_1.z.string().describe('Group name'),
+        description: zod_1.z.string(),
+        permissions: zod_1.z.array(zod_1.z.string()).describe('Permission IDs in this group'),
+    })).optional(),
+    /**
+     * Default grant strategy
+     */
+    defaultGrant: zod_1.z.enum([
+        'prompt', // Always prompt user
+        'allow', // Allow by default
+        'deny', // Deny by default
+        'inherit', // Inherit from parent
+    ]).default('prompt'),
+});
+/**
+ * Runtime Configuration
+ * Defines the execution environment for plugin isolation
+ */
+exports.RuntimeConfigSchema = zod_1.z.object({
+    /**
+     * Runtime engine type
+     */
+    engine: zod_1.z.enum([
+        'v8-isolate', // V8 isolate-based isolation (lightweight, fast)
+        'wasm', // WebAssembly-based isolation (secure, portable)
+        'container', // Container-based isolation (Docker, podman)
+        'process', // Process-based isolation (traditional)
+    ]).default('v8-isolate')
+        .describe('Execution environment engine'),
+    /**
+     * Engine-specific configuration
+     */
+    engineConfig: zod_1.z.object({
+        /**
+         * WASM-specific settings (when engine is "wasm")
+         */
+        wasm: zod_1.z.object({
+            /**
+             * Maximum memory pages (64KB per page)
+             */
+            maxMemoryPages: zod_1.z.number().int().min(1).max(65536).optional()
+                .describe('Maximum WASM memory pages (64KB each)'),
+            /**
+             * Instruction execution limit
+             */
+            instructionLimit: zod_1.z.number().int().min(1).optional()
+                .describe('Maximum instructions before timeout'),
+            /**
+             * Enable SIMD instructions
+             */
+            enableSimd: zod_1.z.boolean().default(false)
+                .describe('Enable WebAssembly SIMD support'),
+            /**
+             * Enable threads
+             */
+            enableThreads: zod_1.z.boolean().default(false)
+                .describe('Enable WebAssembly threads'),
+            /**
+             * Enable bulk memory operations
+             */
+            enableBulkMemory: zod_1.z.boolean().default(true)
+                .describe('Enable bulk memory operations'),
+        }).optional(),
+        /**
+         * Container-specific settings (when engine is "container")
+         */
+        container: zod_1.z.object({
+            /**
+             * Container image
+             */
+            image: zod_1.z.string().optional()
+                .describe('Container image to use'),
+            /**
+             * Container runtime
+             */
+            runtime: zod_1.z.enum(['docker', 'podman', 'containerd']).default('docker'),
+            /**
+             * Resource limits
+             */
+            resources: zod_1.z.object({
+                cpuLimit: zod_1.z.string().optional().describe('CPU limit (e.g., "0.5", "2")'),
+                memoryLimit: zod_1.z.string().optional().describe('Memory limit (e.g., "512m", "1g")'),
+            }).optional(),
+            /**
+             * Network mode
+             */
+            networkMode: zod_1.z.enum(['none', 'bridge', 'host']).default('bridge'),
+        }).optional(),
+        /**
+         * V8 Isolate-specific settings (when engine is "v8-isolate")
+         */
+        v8Isolate: zod_1.z.object({
+            /**
+             * Heap size limit in MB
+             */
+            heapSizeMb: zod_1.z.number().int().min(1).optional(),
+            /**
+             * Enable snapshot
+             */
+            enableSnapshot: zod_1.z.boolean().default(true),
+        }).optional(),
+    }).optional(),
+    /**
+     * General resource limits (applies to all engines)
+     */
+    resourceLimits: zod_1.z.object({
+        /**
+         * Maximum memory in bytes
+         */
+        maxMemory: zod_1.z.number().int().optional()
+            .describe('Maximum memory allocation'),
+        /**
+         * Maximum CPU percentage
+         */
+        maxCpu: zod_1.z.number().min(0).max(100).optional()
+            .describe('Maximum CPU usage percentage'),
+        /**
+         * Execution timeout in milliseconds
+         */
+        timeout: zod_1.z.number().int().min(0).optional()
+            .describe('Maximum execution time'),
+    }).optional(),
+});
+/**
+ * Sandbox Configuration
+ * Defines how plugin is isolated
+ */
+exports.SandboxConfigSchema = zod_1.z.object({
+    /**
+     * Enable sandboxing
+     */
+    enabled: zod_1.z.boolean().default(true),
+    /**
+     * Sandboxing level
+     */
+    level: zod_1.z.enum([
+        'none', // No sandboxing
+        'minimal', // Basic isolation
+        'standard', // Standard sandboxing
+        'strict', // Strict isolation
+        'paranoid', // Maximum isolation
+    ]).default('standard'),
+    /**
+     * Runtime environment configuration
+     */
+    runtime: exports.RuntimeConfigSchema.optional()
+        .describe('Execution environment and isolation settings'),
+    /**
+     * File system access
+     */
+    filesystem: zod_1.z.object({
+        mode: zod_1.z.enum(['none', 'readonly', 'restricted', 'full']).default('restricted'),
+        allowedPaths: zod_1.z.array(zod_1.z.string()).optional().describe('Whitelisted paths'),
+        deniedPaths: zod_1.z.array(zod_1.z.string()).optional().describe('Blacklisted paths'),
+        maxFileSize: zod_1.z.number().int().optional().describe('Maximum file size in bytes'),
+    }).optional(),
+    /**
+     * Network access
+     */
+    network: zod_1.z.object({
+        mode: zod_1.z.enum(['none', 'local', 'restricted', 'full']).default('restricted'),
+        allowedHosts: zod_1.z.array(zod_1.z.string()).optional().describe('Whitelisted hosts'),
+        deniedHosts: zod_1.z.array(zod_1.z.string()).optional().describe('Blacklisted hosts'),
+        allowedPorts: zod_1.z.array(zod_1.z.number()).optional().describe('Allowed port numbers'),
+        maxConnections: zod_1.z.number().int().optional(),
+    }).optional(),
+    /**
+     * Process execution
+     */
+    process: zod_1.z.object({
+        allowSpawn: zod_1.z.boolean().default(false).describe('Allow spawning child processes'),
+        allowedCommands: zod_1.z.array(zod_1.z.string()).optional().describe('Whitelisted commands'),
+        timeout: zod_1.z.number().int().optional().describe('Process timeout in ms'),
+    }).optional(),
+    /**
+     * Memory limits
+     */
+    memory: zod_1.z.object({
+        maxHeap: zod_1.z.number().int().optional().describe('Maximum heap size in bytes'),
+        maxStack: zod_1.z.number().int().optional().describe('Maximum stack size in bytes'),
+    }).optional(),
+    /**
+     * CPU limits
+     */
+    cpu: zod_1.z.object({
+        maxCpuPercent: zod_1.z.number().min(0).max(100).optional(),
+        maxThreads: zod_1.z.number().int().optional(),
+    }).optional(),
+    /**
+     * Environment variables
+     */
+    environment: zod_1.z.object({
+        mode: zod_1.z.enum(['none', 'readonly', 'restricted', 'full']).default('readonly'),
+        allowedVars: zod_1.z.array(zod_1.z.string()).optional(),
+        deniedVars: zod_1.z.array(zod_1.z.string()).optional(),
+    }).optional(),
+});
+/**
+ * Security Vulnerability
+ * Represents a known security vulnerability
+ */
+exports.SecurityVulnerabilitySchema = zod_1.z.object({
+    /**
+     * CVE identifier
+     */
+    cve: zod_1.z.string().optional(),
+    /**
+     * Vulnerability identifier
+     */
+    id: zod_1.z.string(),
+    /**
+     * Severity level
+     */
+    severity: zod_1.z.enum(['critical', 'high', 'medium', 'low', 'info']),
+    /**
+     * Category (e.g., SAST, DAST, Dependency)
+     */
+    category: zod_1.z.string().optional(),
+    /**
+     * Title
+     */
+    title: zod_1.z.string(),
+    /**
+     * Location of the vulnerability
+     */
+    location: zod_1.z.string().optional(),
+    /**
+     * Remediation steps
+     */
+    remediation: zod_1.z.string().optional(),
+    /**
+     * Description
+     */
+    description: zod_1.z.string(),
+    /**
+     * Affected versions
+     */
+    affectedVersions: zod_1.z.array(zod_1.z.string()),
+    /**
+     * Fixed in versions
+     */
+    fixedIn: zod_1.z.array(zod_1.z.string()).optional(),
+    /**
+     * CVSS score
+     */
+    cvssScore: zod_1.z.number().min(0).max(10).optional(),
+    /**
+     * Exploit availability
+     */
+    exploitAvailable: zod_1.z.boolean().default(false),
+    /**
+     * Patch available
+     */
+    patchAvailable: zod_1.z.boolean().default(false),
+    /**
+     * Workaround
+     */
+    workaround: zod_1.z.string().optional(),
+    /**
+     * References
+     */
+    references: zod_1.z.array(zod_1.z.string()).optional(),
+    /**
+     * Discovered date
+     */
+    discoveredDate: zod_1.z.string().datetime().optional(),
+    /**
+     * Published date
+     */
+    publishedDate: zod_1.z.string().datetime().optional(),
+});
+/**
+ * Security Scan Result
+ * Result of security scanning
+ */
+exports.SecurityScanResultSchema = zod_1.z.object({
+    /**
+     * Scan timestamp
+     */
+    timestamp: zod_1.z.string().datetime(),
+    /**
+     * Scanner information
+     */
+    scanner: zod_1.z.object({
+        name: zod_1.z.string(),
+        version: zod_1.z.string(),
+    }),
+    /**
+     * Overall status
+     */
+    status: zod_1.z.enum(['passed', 'failed', 'warning']),
+    /**
+     * Vulnerabilities found
+     */
+    vulnerabilities: zod_1.z.array(exports.SecurityVulnerabilitySchema).optional(),
+    /**
+     * Code quality issues
+     */
+    codeIssues: zod_1.z.array(zod_1.z.object({
+        severity: zod_1.z.enum(['error', 'warning', 'info']),
+        type: zod_1.z.string().describe('Issue type (e.g., sql-injection, xss)'),
+        file: zod_1.z.string(),
+        line: zod_1.z.number().int().optional(),
+        message: zod_1.z.string(),
+        suggestion: zod_1.z.string().optional(),
+    })).optional(),
+    /**
+     * Dependency vulnerabilities
+     */
+    dependencyVulnerabilities: zod_1.z.array(zod_1.z.object({
+        package: zod_1.z.string(),
+        version: zod_1.z.string(),
+        vulnerability: exports.SecurityVulnerabilitySchema,
+    })).optional(),
+    /**
+     * License compliance
+     */
+    licenseCompliance: zod_1.z.object({
+        status: zod_1.z.enum(['compliant', 'non-compliant', 'unknown']),
+        issues: zod_1.z.array(zod_1.z.object({
+            package: zod_1.z.string(),
+            license: zod_1.z.string(),
+            reason: zod_1.z.string(),
+        })).optional(),
+    }).optional(),
+    /**
+     * Summary statistics
+     */
+    summary: zod_1.z.object({
+        totalVulnerabilities: zod_1.z.number().int(),
+        criticalCount: zod_1.z.number().int(),
+        highCount: zod_1.z.number().int(),
+        mediumCount: zod_1.z.number().int(),
+        lowCount: zod_1.z.number().int(),
+        infoCount: zod_1.z.number().int(),
+    }),
+});
+/**
+ * Security Policy
+ * Defines security policies for plugin
+ */
+exports.SecurityPolicySchema = zod_1.z.object({
+    /**
+     * Content Security Policy
+     */
+    csp: zod_1.z.object({
+        directives: zod_1.z.record(zod_1.z.string(), zod_1.z.array(zod_1.z.string())).optional(),
+        reportOnly: zod_1.z.boolean().default(false),
+    }).optional(),
+    /**
+     * CORS policy
+     */
+    cors: zod_1.z.object({
+        allowedOrigins: zod_1.z.array(zod_1.z.string()),
+        allowedMethods: zod_1.z.array(zod_1.z.string()),
+        allowedHeaders: zod_1.z.array(zod_1.z.string()),
+        allowCredentials: zod_1.z.boolean().default(false),
+        maxAge: zod_1.z.number().int().optional(),
+    }).optional(),
+    /**
+     * Rate limiting
+     */
+    rateLimit: zod_1.z.object({
+        enabled: zod_1.z.boolean().default(true),
+        maxRequests: zod_1.z.number().int(),
+        windowMs: zod_1.z.number().int().describe('Time window in milliseconds'),
+        strategy: zod_1.z.enum(['fixed', 'sliding', 'token-bucket']).default('sliding'),
+    }).optional(),
+    /**
+     * Authentication requirements
+     */
+    authentication: zod_1.z.object({
+        required: zod_1.z.boolean().default(true),
+        methods: zod_1.z.array(zod_1.z.enum(['jwt', 'oauth2', 'api-key', 'session', 'certificate'])),
+        tokenExpiration: zod_1.z.number().int().optional().describe('Token expiration in seconds'),
+    }).optional(),
+    /**
+     * Encryption requirements
+     */
+    encryption: zod_1.z.object({
+        dataAtRest: zod_1.z.boolean().default(false).describe('Encrypt data at rest'),
+        dataInTransit: zod_1.z.boolean().default(true).describe('Enforce HTTPS/TLS'),
+        algorithm: zod_1.z.string().optional().describe('Encryption algorithm'),
+        minKeyLength: zod_1.z.number().int().optional().describe('Minimum key length in bits'),
+    }).optional(),
+    /**
+     * Audit logging
+     */
+    auditLog: zod_1.z.object({
+        enabled: zod_1.z.boolean().default(true),
+        events: zod_1.z.array(zod_1.z.string()).optional().describe('Events to log'),
+        retention: zod_1.z.number().int().optional().describe('Log retention in days'),
+    }).optional(),
+});
+/**
+ * Plugin Trust Level
+ * Indicates trust level of plugin
+ */
+exports.PluginTrustLevelSchema = zod_1.z.enum([
+    'verified', // Official/verified plugin
+    'trusted', // Trusted third-party
+    'community', // Community plugin
+    'untrusted', // Unverified plugin
+    'blocked', // Blocked/malicious
+]).describe('Trust level of the plugin');
+/**
+ * Plugin Security Manifest
+ * Complete security information for plugin
+ */
+exports.PluginSecurityManifestSchema = zod_1.z.object({
+    /**
+     * Plugin identifier
+     */
+    pluginId: zod_1.z.string(),
+    /**
+     * Trust level
+     */
+    trustLevel: exports.PluginTrustLevelSchema,
+    /**
+     * Required permissions
+     */
+    permissions: exports.PermissionSetSchema,
+    /**
+     * Sandbox configuration
+     */
+    sandbox: exports.SandboxConfigSchema,
+    /**
+     * Security policy
+     */
+    policy: exports.SecurityPolicySchema.optional(),
+    /**
+     * Security scan results
+     */
+    scanResults: zod_1.z.array(exports.SecurityScanResultSchema).optional(),
+    /**
+     * Known vulnerabilities
+     */
+    vulnerabilities: zod_1.z.array(exports.SecurityVulnerabilitySchema).optional(),
+    /**
+     * Code signing
+     */
+    codeSigning: zod_1.z.object({
+        signed: zod_1.z.boolean(),
+        signature: zod_1.z.string().optional(),
+        certificate: zod_1.z.string().optional(),
+        algorithm: zod_1.z.string().optional(),
+        timestamp: zod_1.z.string().datetime().optional(),
+    }).optional(),
+    /**
+     * Security certifications
+     */
+    certifications: zod_1.z.array(zod_1.z.object({
+        name: zod_1.z.string().describe('Certification name (e.g., SOC 2, ISO 27001)'),
+        issuer: zod_1.z.string(),
+        issuedDate: zod_1.z.string().datetime(),
+        expiryDate: zod_1.z.string().datetime().optional(),
+        certificateUrl: zod_1.z.string().url().optional(),
+    })).optional(),
+    /**
+     * Security contact
+     */
+    securityContact: zod_1.z.object({
+        email: zod_1.z.string().email().optional(),
+        url: zod_1.z.string().url().optional(),
+        pgpKey: zod_1.z.string().optional(),
+    }).optional(),
+    /**
+     * Vulnerability disclosure policy
+     */
+    vulnerabilityDisclosure: zod_1.z.object({
+        policyUrl: zod_1.z.string().url().optional(),
+        responseTime: zod_1.z.number().int().optional().describe('Expected response time in hours'),
+        bugBounty: zod_1.z.boolean().default(false),
+    }).optional(),
+});