@scopebond/hook 0.8.1 → 0.10.0

package/dist/classify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classify.js","sourceRoot":"","sources":["../src/classify.ts"],"names":[],"mappings":"AAAA,qFAAqF;AACrF,gEAAgE;AAChE,EAAE;AACF,qFAAqF;AACrF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,qFAAqF;AACrF,iFAAiF;AACjF,EAAE;AACF,kFAAkF;AAClF,yEAAyE;AAGzE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,eAAe,EAAgB,MAAM,YAAY,CAAC;AAYpG,iFAAiF;AACjF,MAAM,WAAW,GAAG,qIAAqI,CAAC;AAE1J,+EAA+E;AAC/E,MAAM,CAAC,MAAM,QAAQ,GAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAEhG,MAAM,UAAU,cAAc,CAAC,MAAwB,EAAE,KAAc;IACrE,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,QAAoC,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC;QACvF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;aACvF,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;aACnF,IAAI,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;SAAM,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QAC9C,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;;YACnD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5F,CAAC;SAAM,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QAC/C,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;aACtD,CAAC;YACJ,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;iBACpC,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAAC,CAAC;YACzG,MAAM,GAAG,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;YACxE,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;iBAC7F,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;aACpD,CAAC;YACJ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChB,IAAI,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,QAAQ,GAAG,cAAc,CAAC;YAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;+CAC+C;AAC/C,MAAM,UAAU,oBAAoB,CAAC,CAAiB;IACpD,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC","sourcesContent":["// Catalog classification of one mapped intent, from the same typed data the compiled\n// policy is built from (the rule set), so the two cannot drift.\n//\n// Detector ids follow the monitoring catalog: I03 ordinary read, I04 ordinary write,\n// I05 shell inventory; H01 protected push, H02 credential read, H03 CI write,\n// H04 destructive shell, H05 root-escape mutation; C01 protected history rewrite,\n// C02 guardrail modification. `compile()` decides enforcement from the rule set;\n// `classifyIntent()` names what an intent is. `test/parity.test.mjs` asserts that an\n// intent is classified high/critical exactly when the compiled policy denies it.\n//\n// Unknown is not clean: an intent whose destination, program or path could not be\n// resolved is returned in `unknown`, never as an ordinary I-class match.\n\nimport type { NormalizedIntent } from \"./map.js\";\nimport { UNKNOWN_REF } from \"./shell.js\";\nimport { isDestructiveProgram, isProtectedBranch, pathRuleMatches, type RuleSet } from \"./rules.js\";\n\nexport type CatalogId = \"I03\" | \"I04\" | \"I05\" | \"H01\" | \"H02\" | \"H03\" | \"H04\" | \"H05\" | \"C01\" | \"C02\";\n\nexport interface Classification {\n  ids: CatalogId[];\n  /** Why the intent could not be classified (an unresolved ref, program or path). */\n  unknown: string[];\n  /** Set for H04: the classification is from the program name only, not a typed target. */\n  coverage?: \"program_only\";\n}\n\n/** The CI locations: a write to one is H03; any other protected write is C02. */\nconst CI_LOCATION = /github\\/(?:workflows|actions)|gitlab-ci|circleci|azure-pipelines|jenkinsfile|bitbucket-pipelines|travis|drone|cloudbuild|buildkite/i;\n\n/** Ids whose match the default policy blocks. I-classes are inventory only. */\nexport const BLOCKING: readonly CatalogId[] = [\"H01\", \"H02\", \"H03\", \"H04\", \"H05\", \"C01\", \"C02\"];\n\nexport function classifyIntent(intent: NormalizedIntent, rules: RuleSet): Classification {\n  const ids: CatalogId[] = [];\n  const unknown: string[] = [];\n  const params = intent.params;\n  let coverage: Classification[\"coverage\"];\n  const path = typeof params.path === \"string\" ? params.path : \"\";\n\n  if (intent.action_type === \"git.push\") {\n    const ref = typeof params.ref === \"string\" ? params.ref : undefined;\n    const rewrite = params.force === true || params.delete === true || params.all === true;\n    if (ref === undefined || ref === UNKNOWN_REF) unknown.push(\"push destination not resolved\");\n    else if (ref === \"--all\" || ref === \"--mirror\" || ref === \"--branches\") ids.push(\"C01\");\n    else if (isProtectedBranch(rules, ref)) ids.push(rewrite ? \"C01\" : \"H01\");\n  } else if (intent.action_type === \"file.read\") {\n    if (path === \"\") unknown.push(\"read path not resolved\");\n    else ids.push(rules.protected_read.some((r) => pathRuleMatches(r, path)) ? \"H02\" : \"I03\");\n  } else if (intent.action_type === \"file.write\") {\n    if (path === \"\") unknown.push(\"write target not resolved\");\n    else {\n      const scope = params.root_scope;\n      if (scope === \"outside\") ids.push(\"H05\");\n      else if (scope === \"unresolved\") { ids.push(\"H05\"); unknown.push(\"write target could not be resolved\"); }\n      const hit = rules.protected_write.find((r) => pathRuleMatches(r, path));\n      if (hit) ids.push(CI_LOCATION.test(hit.kind === \"raw\" ? hit.pattern : hit.value) ? \"H03\" : \"C02\");\n      else if (ids.length === 0) ids.push(\"I04\");\n    }\n  } else if (intent.action_type === \"shell.exec\") {\n    const program = typeof params.program === \"string\" ? params.program : \"\";\n    if (program === \"\") unknown.push(\"program not resolved\");\n    else {\n      ids.push(\"I05\");\n      if (isDestructiveProgram(rules, program)) { ids.push(\"H04\"); coverage = \"program_only\"; }\n    }\n  }\n  return { ids, unknown, ...(coverage ? { coverage } : {}) };\n}\n\n/** Whether the compiled default policy denies an intent with this classification. Used\n *  by the parity test and the proof runner. */\nexport function classificationBlocks(c: Classification): boolean {\n  return c.unknown.length > 0 || c.ids.some((id) => BLOCKING.includes(id));\n}\n"]}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAojBA,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI,CAS7F"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAgqBA,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI,CAS7F"}