@runhalo/engine 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (33) hide show
  1. package/dist/ast-engine.d.ts +60 -0
  2. package/dist/ast-engine.js +653 -0
  3. package/dist/ast-engine.js.map +1 -0
  4. package/dist/context-analyzer.d.ts +209 -0
  5. package/dist/context-analyzer.js +401 -0
  6. package/dist/context-analyzer.js.map +1 -0
  7. package/dist/data-flow-tracer.d.ts +106 -0
  8. package/dist/data-flow-tracer.js +506 -0
  9. package/dist/data-flow-tracer.js.map +1 -0
  10. package/dist/frameworks/django.d.ts +11 -0
  11. package/dist/frameworks/django.js +57 -0
  12. package/dist/frameworks/django.js.map +1 -0
  13. package/dist/frameworks/index.d.ts +59 -0
  14. package/dist/frameworks/index.js +93 -0
  15. package/dist/frameworks/index.js.map +1 -0
  16. package/dist/frameworks/nextjs.d.ts +11 -0
  17. package/dist/frameworks/nextjs.js +59 -0
  18. package/dist/frameworks/nextjs.js.map +1 -0
  19. package/dist/frameworks/rails.d.ts +11 -0
  20. package/dist/frameworks/rails.js +58 -0
  21. package/dist/frameworks/rails.js.map +1 -0
  22. package/dist/frameworks/types.d.ts +29 -0
  23. package/dist/frameworks/types.js +11 -0
  24. package/dist/frameworks/types.js.map +1 -0
  25. package/dist/index.d.ts +24 -0
  26. package/dist/index.js +105 -7
  27. package/dist/index.js.map +1 -1
  28. package/dist/scope-analyzer.d.ts +91 -0
  29. package/dist/scope-analyzer.js +300 -0
  30. package/dist/scope-analyzer.js.map +1 -0
  31. package/package.json +6 -2
  32. package/rules/rules.json +1699 -72
  33. package/rules/validation-report.json +58 -0
package/rules/validation-report.json ADDED
@@ -0,0 +1,58 @@
1
+ {
2
+ "audit": "Richard CCO Validation Pass",
3
+ "date": "2026-03-03",
4
+ "auditor": "Richard (CCO Agent)",
5
+ "methodology": "Audit A — Rule Validity: regex pattern analysis against regulation text. Static confidence scoring.",
6
+ "summary": {
7
+ "total_rules": 42,
8
+ "validity": { "valid": 18, "overly_broad": 10, "too_narrow": 8, "misaligned": 1 },
9
+ "confidence": { "high": 7, "medium": 16, "low": 19 },
10
+ "recommendation": { "none": 6, "refine_pattern": 17, "add_context": 14, "deprecate": 0 },
11
+ "estimated_fp_rate": "12-18% (weighted by scan volume — high-fire rules like tracking-003, geo-004, notif-013 carry low confidence)",
12
+ "gate_status": "CONDITIONAL PASS — FP rate exceeds 5% target. Mitigations: confidence scores displayed in output, low-confidence rules flagged as advisory"
13
+ },
14
+ "rules": [
15
+ { "rule_id": "coppa-auth-001", "validity": "overly_broad", "confidence": "low", "recommendation": "refine_pattern" },
16
+ { "rule_id": "coppa-data-002", "validity": "valid", "confidence": "medium", "recommendation": "refine_pattern" },
17
+ { "rule_id": "coppa-tracking-003", "validity": "valid", "confidence": "low", "recommendation": "add_context" },
18
+ { "rule_id": "coppa-geo-004", "validity": "valid", "confidence": "low", "recommendation": "add_context" },
19
+ { "rule_id": "coppa-retention-005", "validity": "too_narrow", "confidence": "low", "recommendation": "refine_pattern" },
20
+ { "rule_id": "coppa-sec-006", "validity": "overly_broad", "confidence": "medium", "recommendation": "refine_pattern" },
21
+ { "rule_id": "coppa-audio-007", "validity": "valid", "confidence": "low", "recommendation": "add_context" },
22
+ { "rule_id": "coppa-ui-008", "validity": "too_narrow", "confidence": "medium", "recommendation": "refine_pattern" },
23
+ { "rule_id": "coppa-flow-009", "validity": "valid", "confidence": "high", "recommendation": "none" },
24
+ { "rule_id": "coppa-sec-010", "validity": "valid", "confidence": "high", "recommendation": "none" },
25
+ { "rule_id": "coppa-ext-011", "validity": "valid", "confidence": "medium", "recommendation": "add_context" },
26
+ { "rule_id": "coppa-bio-012", "validity": "valid", "confidence": "medium", "recommendation": "refine_pattern" },
27
+ { "rule_id": "coppa-notif-013", "validity": "overly_broad", "confidence": "low", "recommendation": "add_context" },
28
+ { "rule_id": "coppa-ugc-014", "validity": "overly_broad", "confidence": "low", "recommendation": "add_context" },
29
+ { "rule_id": "coppa-sec-015", "validity": "valid", "confidence": "medium", "recommendation": "refine_pattern" },
30
+ { "rule_id": "coppa-cookies-016", "validity": "overly_broad", "confidence": "low", "recommendation": "refine_pattern" },
31
+ { "rule_id": "coppa-ext-017", "validity": "misaligned", "confidence": "medium", "recommendation": "refine_pattern" },
32
+ { "rule_id": "coppa-analytics-018", "validity": "valid", "confidence": "medium", "recommendation": "add_context" },
33
+ { "rule_id": "coppa-edu-019", "validity": "too_narrow", "confidence": "low", "recommendation": "refine_pattern" },
34
+ { "rule_id": "coppa-default-020", "validity": "valid", "confidence": "medium", "recommendation": "add_context" },
35
+ { "rule_id": "ETHICAL-001", "validity": "valid", "confidence": "medium", "recommendation": "refine_pattern" },
36
+ { "rule_id": "ETHICAL-002", "validity": "valid", "confidence": "medium", "recommendation": "refine_pattern" },
37
+ { "rule_id": "ETHICAL-003", "validity": "valid", "confidence": "medium", "recommendation": "add_context" },
38
+ { "rule_id": "ETHICAL-004", "validity": "overly_broad", "confidence": "low", "recommendation": "refine_pattern" },
39
+ { "rule_id": "ETHICAL-005", "validity": "overly_broad", "confidence": "low", "recommendation": "add_context" },
40
+ { "rule_id": "AI-AUDIT-001", "validity": "valid", "confidence": "high", "recommendation": "none" },
41
+ { "rule_id": "AI-AUDIT-002", "validity": "valid", "confidence": "medium", "recommendation": "refine_pattern" },
42
+ { "rule_id": "AI-AUDIT-003", "validity": "valid", "confidence": "high", "recommendation": "none" },
43
+ { "rule_id": "AI-AUDIT-004", "validity": "valid", "confidence": "medium", "recommendation": "refine_pattern" },
44
+ { "rule_id": "AI-AUDIT-005", "validity": "valid", "confidence": "high", "recommendation": "none" },
45
+ { "rule_id": "AI-AUDIT-006", "validity": "valid", "confidence": "high", "recommendation": "none" },
46
+ { "rule_id": "AU-SBD-001", "validity": "overly_broad", "confidence": "low", "recommendation": "add_context" },
47
+ { "rule_id": "AU-SBD-002", "validity": "overly_broad", "confidence": "low", "recommendation": "refine_pattern" },
48
+ { "rule_id": "AU-SBD-003", "validity": "overly_broad", "confidence": "low", "recommendation": "add_context" },
49
+ { "rule_id": "AU-SBD-004", "validity": "overly_broad", "confidence": "low", "recommendation": "add_context" },
50
+ { "rule_id": "AU-SBD-005", "validity": "overly_broad", "confidence": "low", "recommendation": "add_context" },
51
+ { "rule_id": "AU-SBD-006", "validity": "overly_broad", "confidence": "low", "recommendation": "refine_pattern" },
52
+ { "rule_id": "ut-sb142-001", "validity": "too_narrow", "confidence": "low", "recommendation": "refine_pattern" },
53
+ { "rule_id": "ut-sb142-002", "validity": "too_narrow", "confidence": "low", "recommendation": "refine_pattern" },
54
+ { "rule_id": "ut-sb142-003", "validity": "valid", "confidence": "medium", "recommendation": "add_context" },
55
+ { "rule_id": "ut-sb142-004", "validity": "too_narrow", "confidence": "low", "recommendation": "refine_pattern" },
56
+ { "rule_id": "ut-sb142-005", "validity": "valid", "confidence": "medium", "recommendation": "refine_pattern" }
57
+ ]
58
+ }