@shepai/cli 1.170.0 → 1.171.0-pr527.e2ee839

package/dist/packages/core/src/application/use-cases/security/get-security-state.use-case.js

@@ -0,0 +1,76 @@
+/**
+ * Get Security State Use Case
+ *
+ * Returns the current security state for UI projection:
+ * - Effective mode from settings
+ * - Recent security events (limited)
+ * - Highest-severity open finding
+ * - Last evaluation timestamp
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { injectable, inject } from 'tsyringe';
+import { SecurityMode, SecuritySeverity } from '../../../domain/generated/output.js';
+/** Maximum number of recent events returned. */
+const RECENT_EVENTS_LIMIT = 20;
+/** Severity ordering for comparison (higher = more severe). */
+const SEVERITY_RANK = {
+    [SecuritySeverity.Low]: 0,
+    [SecuritySeverity.Medium]: 1,
+    [SecuritySeverity.High]: 2,
+    [SecuritySeverity.Critical]: 3,
+};
+let GetSecurityStateUseCase = class GetSecurityStateUseCase {
+    eventRepository;
+    settingsRepository;
+    constructor(eventRepository, settingsRepository) {
+        this.eventRepository = eventRepository;
+        this.settingsRepository = settingsRepository;
+    }
+    async execute(repositoryPath) {
+        const settings = await this.settingsRepository.load();
+        const securityConfig = settings?.security;
+        const recentEvents = await this.eventRepository.findByRepository(repositoryPath, {
+            limit: RECENT_EVENTS_LIMIT,
+        });
+        const highestSeverityFinding = this.findHighestSeverity(recentEvents);
+        return {
+            mode: securityConfig?.mode ?? SecurityMode.Advisory,
+            lastEvaluationAt: securityConfig?.lastEvaluationAt ?? null,
+            policySource: securityConfig?.policySource ?? null,
+            recentEvents,
+            highestSeverityFinding,
+        };
+    }
+    findHighestSeverity(events) {
+        if (events.length === 0) {
+            return null;
+        }
+        let highest = events[0];
+        for (const event of events) {
+            const eventRank = SEVERITY_RANK[event.severity] ?? 0;
+            const highestRank = SEVERITY_RANK[highest.severity] ?? 0;
+            if (eventRank > highestRank) {
+                highest = event;
+            }
+        }
+        return highest;
+    }
+};
+GetSecurityStateUseCase = __decorate([
+    injectable(),
+    __param(0, inject('ISecurityEventRepository')),
+    __param(1, inject('ISettingsRepository')),
+    __metadata("design:paramtypes", [Object, Object])
+], GetSecurityStateUseCase);
+export { GetSecurityStateUseCase };

package/dist/packages/core/src/application/use-cases/security/record-security-event.use-case.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Record Security Event Use Case
+ *
+ * Persists a security event and triggers 90-day retention cleanup.
+ * Used by runtime guardrails and enforcement flow to record findings.
+ */
+import type { SecurityEvent } from '../../../domain/generated/output.js';
+import type { ISecurityEventRepository } from '../../ports/output/repositories/security-event.repository.interface.js';
+export declare class RecordSecurityEventUseCase {
+    private readonly eventRepository;
+    constructor(eventRepository: ISecurityEventRepository);
+    execute(event: SecurityEvent): Promise<void>;
+}
+//# sourceMappingURL=record-security-event.use-case.d.ts.map

package/dist/packages/core/src/application/use-cases/security/record-security-event.use-case.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-security-event.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/security/record-security-event.use-case.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wEAAwE,CAAC;AAMvH,qBACa,0BAA0B;IAGnC,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAAf,eAAe,EAAE,wBAAwB;IAGtD,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAcnD"}

package/dist/packages/core/src/application/use-cases/security/record-security-event.use-case.js

@@ -0,0 +1,46 @@
+/**
+ * Record Security Event Use Case
+ *
+ * Persists a security event and triggers 90-day retention cleanup.
+ * Used by runtime guardrails and enforcement flow to record findings.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { injectable, inject } from 'tsyringe';
+import { randomUUID } from 'node:crypto';
+/** Retention window in days for security events. */
+const SECURITY_EVENT_RETENTION_DAYS = 90;
+let RecordSecurityEventUseCase = class RecordSecurityEventUseCase {
+    eventRepository;
+    constructor(eventRepository) {
+        this.eventRepository = eventRepository;
+    }
+    async execute(event) {
+        // Ensure the event has an ID
+        const eventToSave = {
+            ...event,
+            id: event.id || randomUUID(),
+        };
+        await this.eventRepository.save(eventToSave);
+        // Trigger 90-day retention cleanup
+        const cutoff = new Date();
+        cutoff.setDate(cutoff.getDate() - SECURITY_EVENT_RETENTION_DAYS);
+        await this.eventRepository.deleteOlderThan(cutoff);
+    }
+};
+RecordSecurityEventUseCase = __decorate([
+    injectable(),
+    __param(0, inject('ISecurityEventRepository')),
+    __metadata("design:paramtypes", [Object])
+], RecordSecurityEventUseCase);
+export { RecordSecurityEventUseCase };

package/dist/packages/core/src/application/use-cases/upgrade/upgrade-cli.use-case.d.ts

@@ -24,6 +24,7 @@ export declare class UpgradeCliUseCase {
     constructor(versionService: IVersionService, daemonService: IDaemonService);
     execute(onOutput?: (data: string) => void): Promise<UpgradeResult>;
     private getLatestVersion;
+    private preDownloadPackage;
     /**
      * Schedule a daemon self-restart after upgrade.
      * Reads the current daemon port, spawns a new daemon process with the

package/dist/packages/core/src/application/use-cases/upgrade/upgrade-cli.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upgrade-cli.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/upgrade/upgrade-cli.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAE9F,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,qBACa,iBAAiB;IAG1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,cAAc,EAAE,eAAe,EAE/B,aAAa,EAAE,cAAc;IAG1C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IAkCxE,OAAO,CAAC,gBAAgB;IA6CxB;;;;OAIG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B5C,OAAO,CAAC,aAAa;CAuBtB"}
+{"version":3,"file":"upgrade-cli.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/upgrade/upgrade-cli.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0DAA0D,CAAC;AAChG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yDAAyD,CAAC;AAE9F,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAQD,qBACa,iBAAiB;IAG1B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,cAAc,EAAE,eAAe,EAE/B,aAAa,EAAE,cAAc;IAG1C,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC;IAyCxE,OAAO,CAAC,gBAAgB;IA6CxB,OAAO,CAAC,kBAAkB;IAwD1B;;;;OAIG;IACG,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B5C,OAAO,CAAC,aAAa;CAuBtB"}

package/dist/packages/core/src/application/use-cases/upgrade/upgrade-cli.use-case.js

@@ -24,7 +24,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 import { injectable, inject } from 'tsyringe';
 import { spawn } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 const VERSION_CHECK_TIMEOUT_MS = 10_000;
+const NPM_CACHE_ADD_TIMEOUT_MS = 120_000;
 /** Delay (ms) before the current process exits to allow the SSE response to flush. */
 const SELF_RESTART_DELAY_MS = 1_000;
 let UpgradeCliUseCase = class UpgradeCliUseCase {
@@ -43,8 +47,14 @@ let UpgradeCliUseCase = class UpgradeCliUseCase {
             onOutput?.(`Already up to date (v${currentVersion})\n`);
             return { status: 'up-to-date', currentVersion, latestVersion };
         }
-        // 3. Run upgrade
+        // 3. Pre-download the package into npm cache before install
         const target = latestVersion ? `v${latestVersion}` : 'latest';
+        onOutput?.(`Downloading @shepai/cli@latest...\n`);
+        const cached = await this.preDownloadPackage();
+        if (!cached) {
+            onOutput?.('Pre-download did not complete — proceeding with install...\n');
+        }
+        // 4. Run install (fast if cached)
         onOutput?.(`Upgrading from v${currentVersion} to ${target}...\n`);
         try {
             const exitCode = await this.runNpmInstall(onOutput);
@@ -104,6 +114,53 @@ let UpgradeCliUseCase = class UpgradeCliUseCase {
             });
         });
     }
+    preDownloadPackage() {
+        let tmpDir;
+        try {
+            tmpDir = mkdtempSync(join(tmpdir(), 'shep-upgrade-'));
+        }
+        catch {
+            return Promise.resolve(false);
+        }
+        const cleanup = () => {
+            try {
+                rmSync(tmpDir, { recursive: true, force: true });
+            }
+            catch {
+                /* best-effort */
+            }
+        };
+        return new Promise((resolve) => {
+            let settled = false;
+            const child = spawn('npm', ['install', '--prefix', tmpDir, '--ignore-scripts', '@shepai/cli@latest'], {
+                stdio: ['ignore', 'ignore', 'pipe'],
+            });
+            const timeout = setTimeout(() => {
+                if (!settled) {
+                    settled = true;
+                    child.kill();
+                    cleanup();
+                    resolve(false);
+                }
+            }, NPM_CACHE_ADD_TIMEOUT_MS);
+            child.on('close', (code) => {
+                if (!settled) {
+                    settled = true;
+                    clearTimeout(timeout);
+                    cleanup();
+                    resolve(code === 0);
+                }
+            });
+            child.on('error', () => {
+                if (!settled) {
+                    settled = true;
+                    clearTimeout(timeout);
+                    cleanup();
+                    resolve(false);
+                }
+            });
+        });
+    }
     /**
      * Schedule a daemon self-restart after upgrade.
      * Reads the current daemon port, spawns a new daemon process with the
@@ -130,7 +187,7 @@ let UpgradeCliUseCase = class UpgradeCliUseCase {
     }
     runNpmInstall(onOutput) {
         return new Promise((resolve, reject) => {
-            const child = spawn('npm', ['i', '-g', '@shepai/cli@latest'], {
+            const child = spawn('npm', ['i', '-g', '@shepai/cli@latest', '--prefer-offline'], {
                 stdio: ['ignore', 'pipe', 'pipe'],
             });
             child.stdout?.on('data', (data) => {

package/dist/packages/core/src/domain/errors/security-violation.error.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Security Violation Error
+ *
+ * Thrown when a security policy constraint is violated during agent execution.
+ * Contains structured information about the violated rule, the action category,
+ * and actionable remediation guidance.
+ */
+import type { SecurityActionCategory } from '../generated/output.js';
+export declare class SecurityViolationError extends Error {
+    readonly rule: string;
+    readonly category: SecurityActionCategory;
+    readonly remediation: string;
+    constructor(rule: string, category: SecurityActionCategory, remediation: string);
+}
+//# sourceMappingURL=security-violation.error.d.ts.map

package/dist/packages/core/src/domain/errors/security-violation.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-violation.error.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/src/domain/errors/security-violation.error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,IAAI,EAAE,MAAM;aACZ,QAAQ,EAAE,sBAAsB;aAChC,WAAW,EAAE,MAAM;gBAFnB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM;CAMtC"}

package/dist/packages/core/src/domain/errors/security-violation.error.js

@@ -0,0 +1,20 @@
+/**
+ * Security Violation Error
+ *
+ * Thrown when a security policy constraint is violated during agent execution.
+ * Contains structured information about the violated rule, the action category,
+ * and actionable remediation guidance.
+ */
+export class SecurityViolationError extends Error {
+    rule;
+    category;
+    remediation;
+    constructor(rule, category, remediation) {
+        super(`Security policy violation: ${rule}`);
+        this.rule = rule;
+        this.category = category;
+        this.remediation = remediation;
+        this.name = 'SecurityViolationError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}

package/dist/packages/core/src/domain/factories/settings-defaults.factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings-defaults.factory.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/src/domain/factories/settings-defaults.factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,QAAQ,EAWT,MAAM,qBAAqB,CAAC;AAmD7B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,IAAI,QAAQ,CA8IhD"}
+{"version":3,"file":"settings-defaults.factory.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/src/domain/factories/settings-defaults.factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,QAAQ,EAYT,MAAM,qBAAqB,CAAC;AAoD7B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,qBAAqB,IAAI,QAAQ,CAmJhD"}

package/dist/packages/core/src/domain/factories/settings-defaults.factory.js

@@ -11,7 +11,7 @@
  * - Auto-update enabled, log level set to info
  * - Unique IDs and timestamps generated for each instance
  */
-import { AgentType, AgentAuthMethod, EditorType, SkillSourceType, TerminalType, } from '../generated/output.js';
+import { AgentType, AgentAuthMethod, EditorType, SkillSourceType, SecurityMode, TerminalType, } from '../generated/output.js';
 /**
  * Default AI model for all SDLC agents.
  * Provides balanced performance and cost for all workflow stages.
@@ -185,6 +185,9 @@ export function createDefaultSettings() {
         reactFileManager: false,
         inventory: false,
     };
+    const security = {
+        mode: SecurityMode.Advisory,
+    };
     return {
         id: globalThis.crypto.randomUUID(),
         models,
@@ -195,6 +198,7 @@ export function createDefaultSettings() {
         notifications,
         workflow,
         featureFlags,
+        security,
         onboardingComplete: false,
         createdAt: now,
         updatedAt: now,

package/dist/packages/core/src/domain/generated/output.d.ts

@@ -658,6 +658,28 @@ export type FabLayoutConfig = {
      */
     swapPosition: boolean;
 };
+export declare enum SecurityMode {
+    Disabled = "Disabled",
+    Advisory = "Advisory",
+    Enforce = "Enforce"
+}
+/**
+ * Supply-chain security configuration persisted in settings
+ */
+export type SecurityConfig = {
+    /**
+     * Effective security mode (default: Advisory)
+     */
+    mode: SecurityMode;
+    /**
+     * ISO timestamp of last policy evaluation (null if never evaluated)
+     */
+    lastEvaluationAt?: string;
+    /**
+     * Source of the active security policy (null if never evaluated)
+     */
+    policySource?: string;
+};
 /**
  * Global Shep platform settings (singleton)
  */
@@ -706,6 +728,10 @@ export type Settings = BaseEntity & {
      * FAB layout configuration (optional, defaults applied at runtime)
      */
     fabLayout?: FabLayoutConfig;
+    /**
+     * Supply-chain security configuration (optional, defaults applied at runtime)
+     */
+    security?: SecurityConfig;
 };
 export declare enum TaskState {
     Todo = "Todo",
@@ -1669,6 +1695,239 @@ export type Repository = SoftDeletableEntity & {
      */
     remoteUrl?: string;
 };
+export declare enum SecurityActionCategory {
+    DependencyInstall = "DependencyInstall",
+    PackageScriptExec = "PackageScriptExec",
+    CiWorkflowModify = "CiWorkflowModify",
+    PublishRelease = "PublishRelease",
+    SandboxEscalation = "SandboxEscalation"
+}
+export declare enum SecurityActionDisposition {
+    Allowed = "Allowed",
+    Denied = "Denied",
+    ApprovalRequired = "ApprovalRequired"
+}
+/**
+ * Mapping of an action category to its enforcement disposition
+ */
+export type ActionDispositionEntry = {
+    /**
+     * The action category
+     */
+    category: SecurityActionCategory;
+    /**
+     * How this action should be handled
+     */
+    disposition: SecurityActionDisposition;
+};
+/**
+ * Dependency risk evaluation policy rules
+ */
+export type DependencyRules = {
+    /**
+     * Check manifest-lockfile consistency (default: true)
+     */
+    checkLockfileConsistency: boolean;
+    /**
+     * Flag packages with lifecycle scripts (default: true)
+     */
+    checkLifecycleScripts: boolean;
+    /**
+     * Flag non-registry dependency sources (default: true)
+     */
+    checkNonRegistrySource: boolean;
+    /**
+     * Enforce strict version ranges — no ^ or * (default: false)
+     */
+    enforceStrictVersionRanges: boolean;
+    /**
+     * Packages explicitly allowed (empty = allow all)
+     */
+    allowlist: string[];
+    /**
+     * Packages explicitly denied
+     */
+    denylist: string[];
+};
+/**
+ * Release integrity policy rules
+ */
+export type ReleaseRules = {
+    /**
+     * Require publishing from CI only, not local (default: true)
+     */
+    requireCiOnlyPublishing: boolean;
+    /**
+     * Require npm provenance flags on publish (default: true)
+     */
+    requireProvenance: boolean;
+    /**
+     * Check that release workflow has not been tampered with (default: true)
+     */
+    checkWorkflowIntegrity: boolean;
+};
+/**
+ * Security policy configuration from shep.security.yaml
+ */
+export type SecurityPolicy = {
+    /**
+     * Desired security mode for this repository
+     */
+    mode: SecurityMode;
+    /**
+     * Per-action-category enforcement dispositions
+     */
+    actionDispositions: ActionDispositionEntry[];
+    /**
+     * Dependency risk evaluation rules
+     */
+    dependencyRules: DependencyRules;
+    /**
+     * Release integrity check rules
+     */
+    releaseRules: ReleaseRules;
+};
+export declare enum SecuritySeverity {
+    Low = "Low",
+    Medium = "Medium",
+    High = "High",
+    Critical = "Critical"
+}
+/**
+ * Persisted security event for audit and observability
+ */
+export type SecurityEvent = BaseEntity & {
+    /**
+     * Absolute path to the repository this event belongs to
+     */
+    repositoryPath: string;
+    /**
+     * Feature ID if this event occurred during a feature run
+     */
+    featureId?: string;
+    /**
+     * Severity of this security event
+     */
+    severity: SecuritySeverity;
+    /**
+     * Action category that triggered this event
+     */
+    category: SecurityActionCategory;
+    /**
+     * How the action was handled (allowed, denied, approval-required)
+     */
+    disposition: SecurityActionDisposition;
+    /**
+     * Actor or source that triggered this event (agent, user, CI)
+     */
+    actor?: string;
+    /**
+     * Human-readable event description
+     */
+    message?: string;
+    /**
+     * Actionable remediation guidance
+     */
+    remediationSummary?: string;
+};
+export declare enum DependencyRiskType {
+    LockfileInconsistency = "LockfileInconsistency",
+    NonRegistrySource = "NonRegistrySource",
+    LifecycleScript = "LifecycleScript",
+    DenylistViolation = "DenylistViolation",
+    AllowlistViolation = "AllowlistViolation",
+    VersionRangePolicy = "VersionRangePolicy"
+}
+/**
+ * Single dependency risk finding
+ */
+export type DependencyFinding = {
+    /**
+     * Package name (e.g. 'lodash', '@types/node')
+     */
+    packageName: string;
+    /**
+     * Package version or range (e.g. '^4.17.0')
+     */
+    version?: string;
+    /**
+     * Severity of this finding
+     */
+    severity: SecuritySeverity;
+    /**
+     * Type of dependency risk detected
+     */
+    riskType: DependencyRiskType;
+    /**
+     * Human-readable description of the finding
+     */
+    message: string;
+    /**
+     * Actionable remediation guidance
+     */
+    remediation?: string;
+};
+export declare enum ReleaseIntegrityCheckType {
+    CiOnlyPublishing = "CiOnlyPublishing",
+    SecretConfiguration = "SecretConfiguration",
+    ProvenanceConfiguration = "ProvenanceConfiguration",
+    WorkflowIntegrity = "WorkflowIntegrity"
+}
+/**
+ * Result of a single release integrity check
+ */
+export type ReleaseIntegrityCheck = {
+    /**
+     * Type of check performed
+     */
+    checkType: ReleaseIntegrityCheckType;
+    /**
+     * Whether this check passed
+     */
+    passed: boolean;
+    /**
+     * Human-readable description of the result
+     */
+    message: string;
+    /**
+     * Severity when this check fails
+     */
+    severity: SecuritySeverity;
+};
+/**
+ * Aggregated release integrity evaluation result
+ */
+export type ReleaseIntegrityResult = {
+    /**
+     * Individual check results
+     */
+    checks: ReleaseIntegrityCheck[];
+    /**
+     * Whether all checks passed
+     */
+    passed: boolean;
+};
+/**
+ * Computed effective security policy snapshot
+ */
+export type EffectivePolicySnapshot = {
+    /**
+     * Resolved effective security mode
+     */
+    mode: SecurityMode;
+    /**
+     * Where the policy was sourced from (e.g. 'shep.security.yaml', 'settings-default')
+     */
+    source: string;
+    /**
+     * ISO timestamp when this snapshot was computed
+     */
+    evaluatedAt: string;
+    /**
+     * Resolved per-action-category enforcement dispositions
+     */
+    actionDispositions: ActionDispositionEntry[];
+};
 /**
  * Single installation suggestion for a tool
  */