@panguard-ai/atr 1.5.0 → 1.5.5

package/dist/verdict.js

@@ -0,0 +1,127 @@
+/**
+ * Verdict computation from ATR rule matches.
+ *
+ * Pure functions that determine the outcome (allow/ask/deny)
+ * based on severity, confidence, and auto-response thresholds.
+ *
+ * @module agent-threat-rules/verdict
+ */
+/** Severity rank from most severe (0) to least severe (4) */
+export const SEVERITY_RANK = {
+    critical: 0,
+    high: 1,
+    medium: 2,
+    low: 3,
+    informational: 4,
+};
+/**
+ * Check whether auto-response is enabled for a matched rule.
+ * The auto_response_threshold field on ATRResponse indicates the
+ * minimum confidence level at which the action should be taken
+ * automatically (without human approval).
+ */
+export function isAutoResponseEnabled(match) {
+    const threshold = match.rule.response.auto_response_threshold;
+    if (!threshold)
+        return false;
+    const thresholdMap = {
+        high: 0.9,
+        medium: 0.7,
+        low: 0.5,
+    };
+    const requiredConfidence = thresholdMap[threshold];
+    if (requiredConfidence === undefined)
+        return false;
+    return match.confidence >= requiredConfidence;
+}
+/**
+ * Determine the verdict outcome based on severity and confidence.
+ *
+ * Decision matrix:
+ *   - critical severity           -> deny
+ *   - high severity, conf >= 0.8  -> deny
+ *   - high severity, conf < 0.8   -> ask
+ *   - medium severity, conf >= 0.6 -> ask
+ *   - everything else             -> allow
+ */
+function determineOutcome(severity, confidence) {
+    if (severity === 'critical') {
+        return 'deny';
+    }
+    if (severity === 'high') {
+        return confidence >= 0.8 ? 'deny' : 'ask';
+    }
+    if (severity === 'medium' && confidence >= 0.6) {
+        return 'ask';
+    }
+    return 'allow';
+}
+/**
+ * Collect unique actions from all matched rules, preserving order
+ * of first appearance.
+ */
+function collectUniqueActions(matches) {
+    const seen = new Set();
+    const actions = [];
+    for (const match of matches) {
+        for (const action of match.rule.response.actions) {
+            if (!seen.has(action)) {
+                seen.add(action);
+                actions.push(action);
+            }
+        }
+    }
+    return Object.freeze(actions);
+}
+/**
+ * Build a human-readable reason string from the highest severity match.
+ */
+function buildReason(highestMatch, outcome, matchCount) {
+    if (!highestMatch) {
+        return 'No rules matched.';
+    }
+    const { rule, confidence } = highestMatch;
+    const pct = Math.round(confidence * 100);
+    return (`${outcome.toUpperCase()}: ${rule.title} ` +
+        `[${rule.severity}/${pct}% confidence] ` +
+        `(${matchCount} rule${matchCount === 1 ? '' : 's'} matched)`);
+}
+/**
+ * Compute a verdict from an array of ATR matches.
+ *
+ * This is a pure function -- no side effects, no mutation.
+ * Returns a frozen ATRVerdict object.
+ */
+export function computeVerdict(matches) {
+    if (matches.length === 0) {
+        return Object.freeze({
+            outcome: 'allow',
+            reason: 'No rules matched.',
+            matchCount: 0,
+            highestSeverity: null,
+            highestConfidence: 0,
+            actions: Object.freeze([]),
+            matches: Object.freeze([]),
+            timestamp: new Date().toISOString(),
+        });
+    }
+    // Matches are already sorted by the engine (severity desc, confidence desc).
+    // The first match has the highest severity.
+    const highestMatch = matches[0];
+    const highestSeverity = highestMatch.rule.severity;
+    const highestConfidence = highestMatch.confidence;
+    const outcome = determineOutcome(highestSeverity, highestConfidence);
+    const actions = collectUniqueActions(matches);
+    const reason = buildReason(highestMatch, outcome, matches.length);
+    return Object.freeze({
+        outcome,
+        reason,
+        matchCount: matches.length,
+        highestSeverity,
+        highestConfidence,
+        actions,
+        matches: Object.freeze([...matches]),
+        timestamp: new Date().toISOString(),
+    });
+}
+//# sourceMappingURL=verdict.js.map

package/dist/verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAA0C;IAClE,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,aAAa,EAAE,CAAC;CACjB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAe;IAEf,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,YAAY,GAA2B;QAC3C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEnD,OAAO,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,QAAqB,EACrB,UAAkB;IAElB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,OAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAClB,YAAkC,EAClC,OAAuB,EACvB,UAAkB;IAElB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAEzC,OAAO,CACL,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,GAAG;QAC1C,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,gBAAgB;QACxC,IAAI,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA4B;IAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,OAAgB;YACzB,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IACjC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;IACnD,MAAM,iBAAiB,GAAG,YAAY,CAAC,UAAU,CAAC;IAElD,MAAM,OAAO,GAAG,gBAAgB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAElE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,eAAe;QACf,iBAAiB;QACjB,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panguard-ai/atr",
-  "version": "1.5.0",
+  "version": "1.5.5",
   "type": "module",
   "description": "Thin wrapper around agent-threat-rules — re-exports all detection logic for monorepo consumers.",
   "main": "./dist/index.js",
@@ -24,18 +24,17 @@
     "access": "public"
   },
   "license": "MIT",
-  "scripts": {
-    "build": "tsc --build",
-    "clean": "rm -rf dist tsconfig.tsbuildinfo",
-    "typecheck": "tsc --noEmit",
-    "test": "echo 'Tests run in agent-threat-rules upstream'",
-    "prepublishOnly": "npm run build"
-  },
   "dependencies": {
-    "agent-threat-rules": "^1.2.0"
+    "agent-threat-rules": "^2.1.1"
   },
   "devDependencies": {
     "@types/node": "^22.14.0",
     "typescript": "~5.7.3"
+  },
+  "scripts": {
+    "build": "tsc --build",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "typecheck": "tsc --noEmit",
+    "test": "echo 'Tests run in agent-threat-rules upstream'"
   }
-}
+}