@promptframe/contracts 0.1.7 → 0.1.9

package/dist/security-policy-evaluator.js

@@ -0,0 +1,253 @@
+import ts from 'typescript';
+import { COMPONENT_SECURITY_POLICY_VERSION, PROMPTFRAME_PUBLIC_SECURITY_POLICY, PROMPTFRAME_PUBLIC_SECURITY_POLICY_DIGEST, } from './index.js';
+export { PROMPTFRAME_PUBLIC_SECURITY_POLICY_DIGEST } from './index.js';
+export function evaluatePromptFrameSecurityPolicySource(input) {
+    const policy = input.policy ?? PROMPTFRAME_PUBLIC_SECURITY_POLICY;
+    const evaluatorMode = input.mode ?? (isAstScannableSourceFile(input.file) ? 'ast' : 'pattern_fallback');
+    const findings = evaluatorMode === 'ast'
+        ? evaluateAstSource(input.file, input.source, collectPublicSecurityRules(policy))
+        : evaluatePatternSource(input.file, input.source, collectPublicSecurityRules(policy));
+    return {
+        policyVersion: COMPONENT_SECURITY_POLICY_VERSION,
+        policyDigest: PROMPTFRAME_PUBLIC_SECURITY_POLICY_DIGEST,
+        evaluatorMode,
+        findings: dedupeFindings(findings),
+    };
+}
+function evaluateAstSource(file, source, rules) {
+    const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true, scriptKindForFile(file));
+    const localDeclarations = new Set();
+    const aliases = new Map();
+    const findings = [];
+    collectLocalDeclarations(sourceFile, localDeclarations);
+    collectAliases(sourceFile, localDeclarations, aliases);
+    const visit = (node) => {
+        for (const rule of rules) {
+            const match = matchAstRule(rule, node, sourceFile, localDeclarations, aliases);
+            if (!match)
+                continue;
+            findings.push(buildFinding({
+                file,
+                sourceFile,
+                node: match.node,
+                rule,
+                evidence: match.node.getText(sourceFile).slice(0, 160),
+                detectionKind: 'ast',
+                confidence: match.confidence,
+                trace: match.trace,
+            }));
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return findings;
+}
+function evaluatePatternSource(file, source, rules) {
+    const findings = [];
+    const sourceFile = ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.Unknown);
+    for (const rule of rules) {
+        const patterns = rule.patterns ?? rule.rawApis?.map(apiToPattern) ?? [];
+        for (const patternSource of patterns) {
+            const pattern = new RegExp(patternSource, 'i');
+            const match = source.match(pattern);
+            if (!match || match.index === undefined)
+                continue;
+            findings.push(buildFinding({
+                file,
+                sourceFile,
+                position: match.index,
+                rule,
+                evidence: match[0].slice(0, 160),
+                detectionKind: 'pattern',
+                confidence: 'medium',
+                trace: [`pattern:${patternSource}`],
+            }));
+        }
+    }
+    return findings;
+}
+function matchAstRule(rule, node, sourceFile, localDeclarations, aliases) {
+    const matcher = rule.astMatchers;
+    if (!matcher)
+        return undefined;
+    if (matcher.dynamicImport && ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword) {
+        return { node, confidence: 'high', trace: ['dynamicImport'] };
+    }
+    if (matcher.stringTimer && ts.isCallExpression(node)) {
+        const name = expressionName(node.expression, sourceFile);
+        if ((name === 'setTimeout' || name === 'setInterval') && isStringLikeExpression(node.arguments[0])) {
+            return { node, confidence: 'high', trace: [`stringTimer:${name}`] };
+        }
+    }
+    const globals = new Set(matcher.globals ?? []);
+    if (globals.size > 0 && (ts.isCallExpression(node) || ts.isNewExpression(node))) {
+        const name = expressionName(node.expression, sourceFile);
+        const resolved = name ? aliases.get(name) ?? name : undefined;
+        if (resolved && globals.has(resolved) && !localDeclarations.has(resolved)) {
+            return { node, confidence: 'high', trace: [`global:${resolved}`] };
+        }
+    }
+    const memberPaths = matcher.memberPaths ?? [];
+    if (memberPaths.length > 0 && (ts.isCallExpression(node) || ts.isNewExpression(node) || ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node))) {
+        const expression = ts.isCallExpression(node) || ts.isNewExpression(node) ? node.expression : node;
+        const path = memberPath(expression, sourceFile);
+        const matchedPath = memberPaths.find((candidate) => path === candidate || path.startsWith(`${candidate}.`));
+        if (matchedPath)
+            return { node, confidence: 'high', trace: [`member:${matchedPath}`] };
+    }
+    return undefined;
+}
+function collectLocalDeclarations(sourceFile, localDeclarations) {
+    const visit = (node) => {
+        if ((ts.isVariableDeclaration(node) || ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node) || ts.isParameter(node))
+            && node.name) {
+            collectBindingNames(node.name, localDeclarations);
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+}
+function collectAliases(sourceFile, localDeclarations, aliases) {
+    const visit = (node) => {
+        if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+            const initializerName = expressionName(node.initializer, sourceFile);
+            if (initializerName && !localDeclarations.has(initializerName))
+                aliases.set(node.name.text, initializerName);
+            const initializerPath = memberPath(node.initializer, sourceFile);
+            if ((initializerPath === 'globalThis' || initializerPath === 'window') && ts.isObjectBindingPattern(node.name)) {
+                collectDestructureAliases(node.name, aliases);
+            }
+        }
+        if (ts.isVariableDeclaration(node) && ts.isObjectBindingPattern(node.name) && node.initializer) {
+            const initializerPath = memberPath(node.initializer, sourceFile);
+            if (initializerPath === 'globalThis' || initializerPath === 'window') {
+                collectDestructureAliases(node.name, aliases);
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+}
+function collectDestructureAliases(binding, aliases) {
+    for (const element of binding.elements) {
+        const propertyName = element.propertyName && ts.isIdentifier(element.propertyName)
+            ? element.propertyName.text
+            : ts.isIdentifier(element.name)
+                ? element.name.text
+                : undefined;
+        if (!propertyName || !ts.isIdentifier(element.name))
+            continue;
+        aliases.set(element.name.text, propertyName);
+    }
+}
+function collectBindingNames(name, output) {
+    if (ts.isIdentifier(name)) {
+        output.add(name.text);
+        return;
+    }
+    for (const element of name.elements) {
+        if (ts.isBindingElement(element))
+            collectBindingNames(element.name, output);
+    }
+}
+function expressionName(expression, sourceFile) {
+    if (ts.isIdentifier(expression))
+        return expression.text;
+    const path = memberPath(expression, sourceFile);
+    return path.includes('.') ? undefined : path || undefined;
+}
+function memberPath(node, sourceFile) {
+    if (ts.isIdentifier(node))
+        return node.text;
+    if (node.kind === ts.SyntaxKind.ThisKeyword)
+        return 'this';
+    if (ts.isPropertyAccessExpression(node)) {
+        const parent = memberPath(node.expression, sourceFile);
+        return parent ? `${parent}.${node.name.text}` : node.name.text;
+    }
+    if (ts.isElementAccessExpression(node)) {
+        const parent = memberPath(node.expression, sourceFile);
+        const key = stringLiteralValue(node.argumentExpression);
+        return parent && key ? `${parent}.${key}` : '';
+    }
+    return '';
+}
+function stringLiteralValue(node) {
+    if (!node)
+        return undefined;
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node))
+        return node.text;
+    return undefined;
+}
+function isStringLikeExpression(node) {
+    return Boolean(node && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)));
+}
+function buildFinding(input) {
+    const position = input.position ?? input.node?.getStart(input.sourceFile) ?? 0;
+    const location = input.sourceFile.getLineAndCharacterOfPosition(position);
+    return {
+        ruleId: input.rule.id,
+        policyVersion: COMPONENT_SECURITY_POLICY_VERSION,
+        policyDigest: PROMPTFRAME_PUBLIC_SECURITY_POLICY_DIGEST,
+        category: input.rule.category ?? 'dynamic_code_execution',
+        severity: input.rule.severity ?? 'high',
+        action: input.rule.action ?? input.rule.defaultAction ?? 'manual_review',
+        message: `${input.rule.label}: ${input.rule.reason}`,
+        file: input.file,
+        line: location.line + 1,
+        column: location.character + 1,
+        evidence: input.evidence,
+        recommendation: input.rule.recommendation,
+        detectionKind: input.detectionKind,
+        confidence: input.confidence,
+        trace: input.trace,
+    };
+}
+function collectPublicSecurityRules(policy) {
+    return [
+        ...policy.forbiddenApis,
+        ...policy.mediatedApis,
+        ...policy.warningApis,
+    ];
+}
+function dedupeFindings(findings) {
+    const seen = new Set();
+    return findings.filter((finding) => {
+        const key = `${finding.ruleId}:${finding.file}:${finding.line ?? ''}:${finding.column ?? ''}:${finding.evidence ?? ''}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+function isAstScannableSourceFile(file) {
+    return /\.(tsx?|jsx?|mjs|cjs)$/i.test(file);
+}
+function scriptKindForFile(file) {
+    if (/\.tsx$/i.test(file))
+        return ts.ScriptKind.TSX;
+    if (/\.ts$/i.test(file) || /\.mts$/i.test(file) || /\.cts$/i.test(file))
+        return ts.ScriptKind.TS;
+    if (/\.jsx$/i.test(file))
+        return ts.ScriptKind.JSX;
+    if (/\.js$/i.test(file) || /\.mjs$/i.test(file) || /\.cjs$/i.test(file))
+        return ts.ScriptKind.JS;
+    return ts.ScriptKind.Unknown;
+}
+function apiToPattern(api) {
+    const escaped = api.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    if (api === 'fetch')
+        return '\\bfetch\\s*\\(';
+    if (api === 'XMLHttpRequest')
+        return '\\bnew\\s+XMLHttpRequest\\b|\\bXMLHttpRequest\\s*\\(';
+    if (api === 'WebSocket')
+        return '\\bnew\\s+WebSocket\\b|\\bWebSocket\\s*\\(';
+    if (api === 'EventSource')
+        return '\\bnew\\s+EventSource\\b|\\bEventSource\\s*\\(';
+    if (api === 'navigator.sendBeacon')
+        return 'navigator\\.sendBeacon\\s*\\(';
+    return api.includes('.')
+        ? `${escaped}\\s*\\(`
+        : `\\b${escaped}\\b`;
+}
+//# sourceMappingURL=security-policy-evaluator.js.map

package/dist/security-policy-evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-evaluator.js","sourceRoot":"","sources":["../src/security-policy-evaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,iCAAiC,EACjC,kCAAkC,EAClC,yCAAyC,GAC1C,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,yCAAyC,EAAE,MAAM,YAAY,CAAC;AA2DvE,MAAM,UAAU,uCAAuC,CACrD,KAAmD;IAEnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,kCAAkC,CAAC;IAClE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,aAAa,KAAK,KAAK;QACtC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAC;QACjF,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC;IAExF,OAAO;QACL,aAAa,EAAE,iCAAiC;QAChD,YAAY,EAAE,yCAAyC;QACvD,aAAa;QACb,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,MAAc,EACd,KAA2B;IAE3B,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAuC,EAAE,CAAC;IAExD,wBAAwB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACxD,cAAc,CAAC,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;gBACzB,IAAI;gBACJ,UAAU;gBACV,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI;gBACJ,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACtD,aAAa,EAAE,KAAK;gBACpB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB,CAAC,CAAC,CAAC;QACN,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,CAAC;IAClB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAY,EACZ,MAAc,EACd,KAA2B;IAE3B,MAAM,QAAQ,GAAuC,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC1G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACxE,KAAK,MAAM,aAAa,IAAI,QAAQ,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClD,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;gBACzB,IAAI;gBACJ,UAAU;gBACV,QAAQ,EAAE,KAAK,CAAC,KAAK;gBACrB,IAAI;gBACJ,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAChC,aAAa,EAAE,SAAS;gBACxB,UAAU,EAAE,QAAQ;gBACpB,KAAK,EAAE,CAAC,WAAW,aAAa,EAAE,CAAC;aACpC,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CACnB,IAAwB,EACxB,IAAa,EACb,UAAyB,EACzB,iBAA8B,EAC9B,OAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAC/G,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,aAAa,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,UAAU,QAAQ,EAAE,CAAC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAC9C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnK,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAClG,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC;QAC5G,IAAI,WAAW;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,UAAU,WAAW,EAAE,CAAC,EAAE,CAAC;IACzF,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAyB,EAAE,iBAA8B;IACzF,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IACE,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;eACtH,IAAI,CAAC,IAAI,EACZ,CAAC;YACD,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACpD,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CACrB,UAAyB,EACzB,iBAA8B,EAC9B,OAA4B;IAE5B,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrF,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACrE,IAAI,eAAe,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC7G,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACjE,IAAI,CAAC,eAAe,KAAK,YAAY,IAAI,eAAe,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/G,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,IAAI,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/F,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACjE,IAAI,eAAe,KAAK,YAAY,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;gBACrE,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,KAAK,CAAC,UAAU,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgC,EAAE,OAA4B;IAC/F,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC;YAChF,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI;YAC3B,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC7B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;gBACnB,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QAC9D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAoB,EAAE,MAAmB;IACpE,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO;IACT,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC;YAAE,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,UAAyB,EAAE,UAAyB;IAC1E,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,UAAyB;IAC1D,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC;IAC3D,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjE,CAAC;IACD,IAAI,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACxD,OAAO,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAA+B;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IAC3F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,sBAAsB,CAAC,IAA+B;IAC7D,OAAO,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,YAAY,CAAC,KAUrB;IACC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IAC1E,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;QACrB,aAAa,EAAE,iCAAiC;QAChD,YAAY,EAAE,yCAAyC;QACvD,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,wBAAwB;QACzD,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM;QACvC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,eAAe;QACxE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE;QACpD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;QACvB,MAAM,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC;QAC9B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc;QACzC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAiD;IACnF,OAAO;QACL,GAAI,MAAM,CAAC,aAA+C;QAC1D,GAAI,MAAM,CAAC,YAA8C;QACzD,GAAI,MAAM,CAAC,WAA6C;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAA4C;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACxH,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IACjG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IACnD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IACjG,OAAO,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC3D,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC;IAC9C,IAAI,GAAG,KAAK,gBAAgB;QAAE,OAAO,sDAAsD,CAAC;IAC5F,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,4CAA4C,CAAC;IAC7E,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,gDAAgD,CAAC;IACnF,IAAI,GAAG,KAAK,sBAAsB;QAAE,OAAO,+BAA+B,CAAC;IAC3E,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QACtB,CAAC,CAAC,GAAG,OAAO,SAAS;QACrB,CAAC,CAAC,MAAM,OAAO,KAAK,CAAC;AACzB,CAAC"}

package/dist/security-policy-fingerprint.d.ts

@@ -0,0 +1,4 @@
+export declare const COMPONENT_SECURITY_POLICY_DIGEST_VERSION: "component-security-policy-digest.v0.1";
+export declare function canonicalizePromptFramePolicy(value: unknown): string;
+export declare function createPromptFramePublicSecurityPolicyDigest(policy: unknown): `${typeof COMPONENT_SECURITY_POLICY_DIGEST_VERSION}:${string}`;
+//# sourceMappingURL=security-policy-fingerprint.d.ts.map

package/dist/security-policy-fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-fingerprint.d.ts","sourceRoot":"","sources":["../src/security-policy-fingerprint.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wCAAwC,EAAG,uCAAgD,CAAC;AAEzG,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgBpE;AAED,wBAAgB,2CAA2C,CACzD,MAAM,EAAE,OAAO,GACd,GAAG,OAAO,wCAAwC,IAAI,MAAM,EAAE,CAIhE"}

package/dist/security-policy-fingerprint.js

@@ -0,0 +1,37 @@
+export const COMPONENT_SECURITY_POLICY_DIGEST_VERSION = 'component-security-policy-digest.v0.1';
+export function canonicalizePromptFramePolicy(value) {
+    if (value === null)
+        return 'null';
+    if (typeof value === 'string')
+        return JSON.stringify(value);
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return JSON.stringify(value);
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => canonicalizePromptFramePolicy(item)).join(',')}]`;
+    }
+    if (typeof value === 'object') {
+        const record = value;
+        const entries = Object.keys(record)
+            .filter((key) => record[key] !== undefined)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonicalizePromptFramePolicy(record[key])}`);
+        return `{${entries.join(',')}}`;
+    }
+    return JSON.stringify(null);
+}
+export function createPromptFramePublicSecurityPolicyDigest(policy) {
+    const canonicalPolicy = canonicalizePromptFramePolicy(policy);
+    const hash = fnv1a64(canonicalPolicy);
+    return `${COMPONENT_SECURITY_POLICY_DIGEST_VERSION}:${hash}`;
+}
+function fnv1a64(input) {
+    let hash = 0xcbf29ce484222325n;
+    const prime = 0x100000001b3n;
+    const mask = 0xffffffffffffffffn;
+    for (let index = 0; index < input.length; index += 1) {
+        hash ^= BigInt(input.charCodeAt(index));
+        hash = (hash * prime) & mask;
+    }
+    return hash.toString(16).padStart(16, '0');
+}
+//# sourceMappingURL=security-policy-fingerprint.js.map

package/dist/security-policy-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-fingerprint.js","sourceRoot":"","sources":["../src/security-policy-fingerprint.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,wCAAwC,GAAG,uCAAgD,CAAC;AAEzG,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;aAC1C,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,6BAA6B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,2CAA2C,CACzD,MAAe;IAEf,MAAM,eAAe,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO,GAAG,wCAAwC,IAAI,IAAI,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,IAAI,GAAG,mBAAmB,CAAC;IAC/B,MAAM,KAAK,GAAG,cAAc,CAAC;IAC7B,MAAM,IAAI,GAAG,mBAAmB,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptframe/contracts",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -15,6 +15,10 @@
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
+    "./security-evaluator": {
+      "import": "./dist/security-policy-evaluator.js",
+      "types": "./dist/security-policy-evaluator.d.ts"
+    },
     "./package.json": {
       "default": "./package.json"
     }
@@ -41,9 +45,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
+    "typescript": "~5.7.0",
     "zod": "^3.24.0"
-  },
-  "devDependencies": {
-    "typescript": "~5.7.0"
   }
 }