@shepai/cli 1.171.0-pr527.e2ee839 → 1.172.0-pr528.108a424

package/web/public/icons/agents/copilot.svg

@@ -0,0 +1,12 @@
+<svg width="128" height="128" viewBox="0 0 128 128" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_731_27445)">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M111.688 83.9677C108.245 89.9488 88.2522 104.062 64 104.062C39.7478 104.062 19.7554 89.9488 16.3123 83.9677C16.0605 83.5303 15.9792 83.031 15.9792 82.5263L15.9792 71.8787C15.9792 71.4373 16.0474 70.9986 16.2107 70.5885C17.6996 66.8499 21.599 61.4192 26.6313 59.9621C27.2985 58.2494 28.2867 55.7456 29.2087 53.8974C29.0543 52.4833 29 51.0248 29 49.5512C29 44.2274 30.1285 39.5576 33.5288 36.0801C35.117 34.4559 37.0876 33.21 39.4246 32.2735C45.0217 27.7264 52.992 23.9011 63.9136 23.9011C74.8352 23.9011 82.9783 27.7264 88.5754 32.2735C90.9124 33.21 92.883 34.4559 94.4712 36.0801C97.8715 39.5576 99 44.2274 99 49.5512C99 51.0248 98.9457 52.4833 98.7913 53.8974C99.7133 55.7456 100.701 58.2494 101.369 59.9621C106.401 61.4192 110.3 66.8499 111.789 70.5885C111.953 70.9986 112.021 71.4373 112.021 71.8787L112.021 82.5263C112.021 83.031 111.939 83.5303 111.688 83.9677ZM67.253 48.2606C67.0828 46.9345 67.0018 45.747 66.9995 44.686L66.9995 44.6021C67.0048 41.5242 67.6776 39.5215 68.7524 38.2914C70.1172 36.7295 72.9379 35.5328 78.8829 36.1762C84.9059 36.828 88.2725 38.3229 90.1812 40.2749C92.0291 42.1648 92.9999 44.9922 92.9999 49.5512C92.9999 54.3951 92.3018 57.2568 90.767 58.9977C89.3075 60.6531 86.4335 62 80.1386 62C75.2994 62 72.5326 60.4261 70.7637 58.2493C68.8644 55.912 67.7955 52.4878 67.253 48.2606ZM60.747 48.2606C60.9172 46.9344 60.9982 45.747 61.0005 44.686L61.0005 44.6021C60.9952 41.5242 60.3224 39.5214 59.2476 38.2914C57.8828 36.7295 55.0621 35.5328 49.1171 36.1762C43.0941 36.828 39.7275 38.3229 37.8188 40.2749C35.9709 42.1647 35.0001 44.9922 35.0001 49.5512C35.0001 54.3951 35.6982 57.2568 37.233 58.9977C38.6925 60.6531 41.5665 62 47.8614 62C52.7006 62 55.4674 60.4261 57.2363 58.2493C59.1356 55.9119 60.2045 52.4878 60.747 48.2606ZM64.6889 59.9983C64.4592 59.9995 64.9185 59.9983 64.6889 59.9983C64.4594 59.9983 63.5408 59.9995 63.3111 59.9983C62.8877 60.7075 62.4168 61.3882 61.8926 62.0332C58.8139 65.8219 54.2182 68 47.8613 68C40.9615 68 35.9049 66.564 32.7324 62.9657C32.552 62.7611 32.3906 62.5469 32.3906 62.5469L32 62.9657L32 89.3023C37.7392 92.4213 50.0576 98.0184 64 98.0184C77.9424 98.0184 90.2608 92.4213 96 89.3023L96 62.9657L95.6094 62.5469C95.6094 62.5469 95.4772 62.728 95.2676 62.9657C92.0951 66.564 87.0385 68 80.1387 68C73.7818 68 69.1861 65.8219 66.1074 62.0332C65.5832 61.3882 65.1123 60.7075 64.6889 59.9983Z" fill="white"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M74 73C76.2091 73 78 74.7909 78 77L78 85C78 87.2092 76.2091 89 74 89C71.7909 89 70 87.2092 70 85L70 77C70 74.7909 71.7909 73 74 73Z" fill="white"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M54 73C56.2091 73 58 74.7909 58 77L58 85C58 87.2092 56.2091 89 54 89C51.7909 89 50 87.2092 50 85L50 77C50 74.7909 51.7909 73 54 73Z" fill="white"/>
+</g>
+<defs>
+<clipPath id="clip0_731_27445">
+<rect width="96" height="96" fill="white" transform="translate(16 16)"/>
+</clipPath>
+</defs>
+</svg>

package/apis/json-schema/ActionDispositionEntry.yaml

@@ -1,14 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: ActionDispositionEntry.yaml
-type: object
-properties:
-  category:
-    $ref: SecurityActionCategory.yaml
-    description: The action category
-  disposition:
-    $ref: SecurityActionDisposition.yaml
-    description: How this action should be handled
-required:
-  - category
-  - disposition
-description: Mapping of an action category to its enforcement disposition

package/apis/json-schema/DependencyFinding.yaml

@@ -1,28 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: DependencyFinding.yaml
-type: object
-properties:
-  packageName:
-    type: string
-    description: Package name (e.g. 'lodash', '@types/node')
-  version:
-    type: string
-    description: Package version or range (e.g. '^4.17.0')
-  severity:
-    $ref: SecuritySeverity.yaml
-    description: Severity of this finding
-  riskType:
-    $ref: DependencyRiskType.yaml
-    description: Type of dependency risk detected
-  message:
-    type: string
-    description: Human-readable description of the finding
-  remediation:
-    type: string
-    description: Actionable remediation guidance
-required:
-  - packageName
-  - severity
-  - riskType
-  - message
-description: Single dependency risk finding

package/apis/json-schema/DependencyRiskType.yaml

@@ -1,11 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: DependencyRiskType.yaml
-type: string
-enum:
-  - LockfileInconsistency
-  - NonRegistrySource
-  - LifecycleScript
-  - DenylistViolation
-  - AllowlistViolation
-  - VersionRangePolicy
-description: Type of dependency risk finding

package/apis/json-schema/DependencyRules.yaml

@@ -1,38 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: DependencyRules.yaml
-type: object
-properties:
-  checkLockfileConsistency:
-    type: boolean
-    default: true
-    description: "Check manifest-lockfile consistency (default: true)"
-  checkLifecycleScripts:
-    type: boolean
-    default: true
-    description: "Flag packages with lifecycle scripts (default: true)"
-  checkNonRegistrySource:
-    type: boolean
-    default: true
-    description: "Flag non-registry dependency sources (default: true)"
-  enforceStrictVersionRanges:
-    type: boolean
-    default: false
-    description: "Enforce strict version ranges — no ^ or * (default: false)"
-  allowlist:
-    type: array
-    items:
-      type: string
-    description: Packages explicitly allowed (empty = allow all)
-  denylist:
-    type: array
-    items:
-      type: string
-    description: Packages explicitly denied
-required:
-  - checkLockfileConsistency
-  - checkLifecycleScripts
-  - checkNonRegistrySource
-  - enforceStrictVersionRanges
-  - allowlist
-  - denylist
-description: Dependency risk evaluation policy rules

package/apis/json-schema/EffectivePolicySnapshot.yaml

@@ -1,24 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: EffectivePolicySnapshot.yaml
-type: object
-properties:
-  mode:
-    $ref: SecurityMode.yaml
-    description: Resolved effective security mode
-  source:
-    type: string
-    description: Where the policy was sourced from (e.g. 'shep.security.yaml', 'settings-default')
-  evaluatedAt:
-    type: string
-    description: ISO timestamp when this snapshot was computed
-  actionDispositions:
-    type: array
-    items:
-      $ref: ActionDispositionEntry.yaml
-    description: Resolved per-action-category enforcement dispositions
-required:
-  - mode
-  - source
-  - evaluatedAt
-  - actionDispositions
-description: Computed effective security policy snapshot

package/apis/json-schema/ReleaseIntegrityCheck.yaml

@@ -1,22 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: ReleaseIntegrityCheck.yaml
-type: object
-properties:
-  checkType:
-    $ref: ReleaseIntegrityCheckType.yaml
-    description: Type of check performed
-  passed:
-    type: boolean
-    description: Whether this check passed
-  message:
-    type: string
-    description: Human-readable description of the result
-  severity:
-    $ref: SecuritySeverity.yaml
-    description: Severity when this check fails
-required:
-  - checkType
-  - passed
-  - message
-  - severity
-description: Result of a single release integrity check

package/apis/json-schema/ReleaseIntegrityCheckType.yaml

@@ -1,9 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: ReleaseIntegrityCheckType.yaml
-type: string
-enum:
-  - CiOnlyPublishing
-  - SecretConfiguration
-  - ProvenanceConfiguration
-  - WorkflowIntegrity
-description: Type of release integrity check

package/apis/json-schema/ReleaseIntegrityResult.yaml

@@ -1,16 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: ReleaseIntegrityResult.yaml
-type: object
-properties:
-  checks:
-    type: array
-    items:
-      $ref: ReleaseIntegrityCheck.yaml
-    description: Individual check results
-  passed:
-    type: boolean
-    description: Whether all checks passed
-required:
-  - checks
-  - passed
-description: Aggregated release integrity evaluation result

package/apis/json-schema/ReleaseRules.yaml

@@ -1,21 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: ReleaseRules.yaml
-type: object
-properties:
-  requireCiOnlyPublishing:
-    type: boolean
-    default: true
-    description: "Require publishing from CI only, not local (default: true)"
-  requireProvenance:
-    type: boolean
-    default: true
-    description: "Require npm provenance flags on publish (default: true)"
-  checkWorkflowIntegrity:
-    type: boolean
-    default: true
-    description: "Check that release workflow has not been tampered with (default: true)"
-required:
-  - requireCiOnlyPublishing
-  - requireProvenance
-  - checkWorkflowIntegrity
-description: Release integrity policy rules

package/apis/json-schema/SecurityActionCategory.yaml

@@ -1,10 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: SecurityActionCategory.yaml
-type: string
-enum:
-  - DependencyInstall
-  - PackageScriptExec
-  - CiWorkflowModify
-  - PublishRelease
-  - SandboxEscalation
-description: Categories of risky agent actions for runtime guardrails

package/apis/json-schema/SecurityActionDisposition.yaml

@@ -1,8 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: SecurityActionDisposition.yaml
-type: string
-enum:
-  - Allowed
-  - Denied
-  - ApprovalRequired
-description: Enforcement disposition for a security action category

package/apis/json-schema/SecurityConfig.yaml

@@ -1,17 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: SecurityConfig.yaml
-type: object
-properties:
-  mode:
-    $ref: SecurityMode.yaml
-    default: Advisory
-    description: "Effective security mode (default: Advisory)"
-  lastEvaluationAt:
-    type: string
-    description: ISO timestamp of last policy evaluation (null if never evaluated)
-  policySource:
-    type: string
-    description: Source of the active security policy (null if never evaluated)
-required:
-  - mode
-description: Supply-chain security configuration persisted in settings

package/apis/json-schema/SecurityEvent.yaml

@@ -1,36 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: SecurityEvent.yaml
-type: object
-properties:
-  repositoryPath:
-    type: string
-    description: Absolute path to the repository this event belongs to
-  featureId:
-    type: string
-    description: Feature ID if this event occurred during a feature run
-  severity:
-    $ref: SecuritySeverity.yaml
-    description: Severity of this security event
-  category:
-    $ref: SecurityActionCategory.yaml
-    description: Action category that triggered this event
-  disposition:
-    $ref: SecurityActionDisposition.yaml
-    description: How the action was handled (allowed, denied, approval-required)
-  actor:
-    type: string
-    description: Actor or source that triggered this event (agent, user, CI)
-  message:
-    type: string
-    description: Human-readable event description
-  remediationSummary:
-    type: string
-    description: Actionable remediation guidance
-required:
-  - repositoryPath
-  - severity
-  - category
-  - disposition
-allOf:
-  - $ref: BaseEntity.yaml
-description: Persisted security event for audit and observability

package/apis/json-schema/SecurityMode.yaml

@@ -1,8 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: SecurityMode.yaml
-type: string
-enum:
-  - Disabled
-  - Advisory
-  - Enforce
-description: Effective security mode for a repository

package/apis/json-schema/SecurityPolicy.yaml

@@ -1,24 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: SecurityPolicy.yaml
-type: object
-properties:
-  mode:
-    $ref: SecurityMode.yaml
-    description: Desired security mode for this repository
-  actionDispositions:
-    type: array
-    items:
-      $ref: ActionDispositionEntry.yaml
-    description: Per-action-category enforcement dispositions
-  dependencyRules:
-    $ref: DependencyRules.yaml
-    description: Dependency risk evaluation rules
-  releaseRules:
-    $ref: ReleaseRules.yaml
-    description: Release integrity check rules
-required:
-  - mode
-  - actionDispositions
-  - dependencyRules
-  - releaseRules
-description: Security policy configuration from shep.security.yaml

package/apis/json-schema/SecuritySeverity.yaml

@@ -1,9 +0,0 @@
-$schema: https://json-schema.org/draft/2020-12/schema
-$id: SecuritySeverity.yaml
-type: string
-enum:
-  - Low
-  - Medium
-  - High
-  - Critical
-description: Severity level for security findings

package/dist/packages/core/src/application/ports/output/repositories/security-event.repository.interface.d.ts

@@ -1,76 +0,0 @@
-/**
- * Security Event Repository Interface
- *
- * Output port for SecurityEvent persistence operations.
- * Implementations handle database-specific logic (SQLite, etc.).
- *
- * Following Clean Architecture:
- * - Domain and Application layers depend on this interface
- * - Infrastructure layer provides concrete implementations
- */
-import type { SecurityEvent, SecuritySeverity } from '../../../../domain/generated/output.js';
-/**
- * Options for querying security events.
- */
-export interface SecurityEventQueryOptions {
-    /** Maximum number of events to return */
-    limit?: number;
-    /** Number of events to skip (for pagination) */
-    offset?: number;
-    /** Filter by minimum severity level */
-    severity?: SecuritySeverity;
-}
-/**
- * Repository interface for SecurityEvent entity persistence.
- *
- * Implementations must:
- * - Handle database connection management
- * - Provide thread-safe operations (SQLite WAL handles concurrency)
- * - Support repository-scoped and feature-scoped queries
- * - Use parameterized queries for all SQL operations
- */
-export interface ISecurityEventRepository {
-    /**
-     * Persist a new security event.
-     *
-     * @param event - The security event to persist
-     */
-    save(event: SecurityEvent): Promise<void>;
-    /**
-     * Find security events for a given repository path.
-     *
-     * Results are ordered by created_at DESC (most recent first).
-     *
-     * @param repositoryPath - Absolute path to the repository
-     * @param options - Optional query filters and pagination
-     * @returns Array of matching security events
-     */
-    findByRepository(repositoryPath: string, options?: SecurityEventQueryOptions): Promise<SecurityEvent[]>;
-    /**
-     * Find security events for a given feature run.
-     *
-     * Results are ordered by created_at DESC (most recent first).
-     *
-     * @param featureId - The feature ID to filter by
-     * @param options - Optional query filters and pagination
-     * @returns Array of matching security events
-     */
-    findByFeature(featureId: string, options?: SecurityEventQueryOptions): Promise<SecurityEvent[]>;
-    /**
-     * Delete security events older than the given date.
-     *
-     * Used for 90-day retention cleanup.
-     *
-     * @param date - Events created before this date will be deleted
-     * @returns Number of events deleted
-     */
-    deleteOlderThan(date: Date): Promise<number>;
-    /**
-     * Count security events for a given repository path.
-     *
-     * @param repositoryPath - Absolute path to the repository
-     * @returns Total count of security events
-     */
-    count(repositoryPath: string): Promise<number>;
-}
-//# sourceMappingURL=security-event.repository.interface.d.ts.map

package/dist/packages/core/src/application/ports/output/repositories/security-event.repository.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-event.repository.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/repositories/security-event.repository.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAE9F;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C;;;;;;;;OAQG;IACH,gBAAgB,CACd,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAE5B;;;;;;;;OAQG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAEhG;;;;;;;OAOG;IACH,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7C;;;;;OAKG;IACH,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChD"}

package/dist/packages/core/src/application/ports/output/repositories/security-event.repository.interface.js

@@ -1,11 +0,0 @@
-/**
- * Security Event Repository Interface
- *
- * Output port for SecurityEvent persistence operations.
- * Implementations handle database-specific logic (SQLite, etc.).
- *
- * Following Clean Architecture:
- * - Domain and Application layers depend on this interface
- * - Infrastructure layer provides concrete implementations
- */
-export {};

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.d.ts

@@ -1,77 +0,0 @@
-/**
- * Security Policy Service Interface
- *
- * Output port for the central security policy engine.
- * Implementations handle policy file reading, validation, merging
- * with persisted settings, and deterministic policy evaluation.
- *
- * Following Clean Architecture:
- * - Application and use-case layers depend on this interface
- * - Infrastructure layer provides the concrete implementation
- * - All consumers (CLI, runtime, CI, UI) resolve the same instance via DI
- */
-import type { EffectivePolicySnapshot, SecurityActionCategory, SecurityActionDisposition } from '../../../../domain/generated/output.js';
-/**
- * Result of validating a security policy file.
- */
-export interface PolicyValidationResult {
-    /** Whether the policy file is valid */
-    valid: boolean;
-    /** Per-field validation error messages (empty when valid) */
-    errors: string[];
-}
-/**
- * Service interface for security policy evaluation.
- *
- * Implementations must:
- * - Read shep.security.yaml from the repository root
- * - Merge repository policy with persisted settings defaults
- * - Apply deterministic precedence (global defaults < repo policy)
- * - Cache effective policy per repository path
- * - Fail fast on invalid policy files with actionable errors
- */
-export interface ISecurityPolicyService {
-    /**
-     * Evaluate and compute the effective security policy for a repository.
-     *
-     * Reads the policy file, merges with persisted settings defaults,
-     * validates, and returns a deterministic snapshot. Re-evaluates
-     * on every call (no cache).
-     *
-     * @param repositoryPath - Absolute path to the repository root
-     * @returns Computed effective policy snapshot
-     * @throws Error if the policy file exists but is invalid
-     */
-    evaluatePolicy(repositoryPath: string): Promise<EffectivePolicySnapshot>;
-    /**
-     * Get the effective security policy for a repository.
-     *
-     * Returns a cached snapshot if available, otherwise computes
-     * and caches the result. Use evaluatePolicy() to force re-evaluation.
-     *
-     * @param repositoryPath - Absolute path to the repository root
-     * @returns Cached or freshly computed effective policy snapshot
-     * @throws Error if the policy file exists but is invalid
-     */
-    getEffectivePolicy(repositoryPath: string): Promise<EffectivePolicySnapshot>;
-    /**
-     * Validate a security policy file without computing effective policy.
-     *
-     * Parses and validates the file against the expected schema.
-     * Returns a structured result with per-field error messages.
-     *
-     * @param filePath - Absolute path to the policy file
-     * @returns Validation result with errors array
-     */
-    validatePolicyFile(filePath: string): Promise<PolicyValidationResult>;
-    /**
-     * Look up the enforcement disposition for a specific action category
-     * within a given effective policy snapshot.
-     *
-     * @param policy - The effective policy snapshot to query
-     * @param actionCategory - The action category to look up
-     * @returns The disposition (Allowed, Denied, or ApprovalRequired)
-     */
-    getActionDisposition(policy: EffectivePolicySnapshot, actionCategory: SecurityActionCategory): SecurityActionDisposition;
-}
-//# sourceMappingURL=security-policy-service.interface.d.ts.map

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-policy-service.interface.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/application/ports/output/services/security-policy-service.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EAC1B,MAAM,wCAAwC,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,uCAAuC;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;OAUG;IACH,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEzE;;;;;;;;;OASG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE7E;;;;;;;;OAQG;IACH,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEtE;;;;;;;OAOG;IACH,oBAAoB,CAClB,MAAM,EAAE,uBAAuB,EAC/B,cAAc,EAAE,sBAAsB,GACrC,yBAAyB,CAAC;CAC9B"}

package/dist/packages/core/src/application/ports/output/services/security-policy-service.interface.js

@@ -1,13 +0,0 @@
-/**
- * Security Policy Service Interface
- *
- * Output port for the central security policy engine.
- * Implementations handle policy file reading, validation, merging
- * with persisted settings, and deterministic policy evaluation.
- *
- * Following Clean Architecture:
- * - Application and use-case layers depend on this interface
- * - Infrastructure layer provides the concrete implementation
- * - All consumers (CLI, runtime, CI, UI) resolve the same instance via DI
- */
-export {};

package/dist/packages/core/src/application/use-cases/security/enforce-security.use-case.d.ts

@@ -1,71 +0,0 @@
-/**
- * Enforce Security Use Case
- *
- * Orchestrates the full security enforcement flow:
- * 1. Evaluate effective policy
- * 2. Run dependency-risk checks
- * 3. Run release-integrity checks
- * 4. Persist findings as security events
- * 5. Return structured enforcement result
- *
- * Supports Advisory (always pass) and Enforce (fail on violations) modes.
- * Disabled mode returns empty pass result.
- */
-import { SecurityMode } from '../../../domain/generated/output.js';
-import type { EffectivePolicySnapshot, DependencyFinding, ReleaseIntegrityResult } from '../../../domain/generated/output.js';
-import type { ISecurityPolicyService } from '../../ports/output/services/security-policy-service.interface.js';
-import type { ISecurityEventRepository } from '../../ports/output/repositories/security-event.repository.interface.js';
-import type { ISettingsRepository } from '../../ports/output/repositories/settings.repository.interface.js';
-import type { IGitHubRepositoryService, GovernanceFinding } from '../../ports/output/services/github-repository-service.interface.js';
-import { DependencyRiskEvaluator } from '../../../infrastructure/services/security/dependency-risk-evaluator.js';
-import { ReleaseIntegrityEvaluator } from '../../../infrastructure/services/security/release-integrity-evaluator.js';
-/**
- * Input for the enforce security use case.
- */
-export interface EnforceSecurityInput {
-    /** Absolute path to the repository to evaluate */
-    repositoryPath: string;
-}
-/**
- * Result of the enforcement flow.
- */
-export interface EnforceSecurityResult {
-    /** Whether all checks passed (Advisory always passes, Enforce fails on violations) */
-    passed: boolean;
-    /** Effective security mode used for evaluation */
-    mode: SecurityMode;
-    /** Effective policy snapshot */
-    policy: EffectivePolicySnapshot;
-    /** Dependency risk findings */
-    dependencyFindings: DependencyFinding[];
-    /** Release integrity result */
-    releaseIntegrity: ReleaseIntegrityResult;
-    /** GitHub governance audit findings (audit-only, do not affect pass/fail) */
-    governanceFindings: GovernanceFinding[];
-    /** Total number of findings (excludes governance — governance is audit-only) */
-    totalFindings: number;
-}
-export declare class EnforceSecurityUseCase {
-    private readonly policyService;
-    private readonly eventRepository;
-    private readonly settingsRepository;
-    private readonly dependencyEvaluator;
-    private readonly releaseEvaluator;
-    private readonly githubService;
-    constructor(policyService: ISecurityPolicyService, eventRepository: ISecurityEventRepository, settingsRepository: ISettingsRepository, dependencyEvaluator: DependencyRiskEvaluator, releaseEvaluator: ReleaseIntegrityEvaluator, githubService: IGitHubRepositoryService);
-    execute(input: EnforceSecurityInput): Promise<EnforceSecurityResult>;
-    /**
-     * Resolve GitHub owner/repo from the repository's git remote and run governance audit.
-     * Returns empty array if the remote cannot be resolved (not a GitHub repo, no remote, etc.).
-     */
-    private runGovernanceAudit;
-    /**
-     * Persist dependency findings, failed release checks, and governance findings as security events.
-     */
-    private persistFindings;
-    /**
-     * Update settings with the latest evaluation timestamp and policy source.
-     */
-    private updateEvaluationTimestamp;
-}
-//# sourceMappingURL=enforce-security.use-case.d.ts.map

package/dist/packages/core/src/application/use-cases/security/enforce-security.use-case.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforce-security.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/security/enforce-security.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,YAAY,EAA0B,MAAM,qCAAqC,CAAC;AAC3F,OAAO,KAAK,EACV,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EAIvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wEAAwE,CAAC;AACvH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAC5G,OAAO,KAAK,EACV,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,oEAAoE,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wEAAwE,CAAC;AACjH,OAAO,EAAE,yBAAyB,EAAE,MAAM,0EAA0E,CAAC;AAOrH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kDAAkD;IAClD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,sFAAsF;IACtF,MAAM,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,IAAI,EAAE,YAAY,CAAC;IACnB,gCAAgC;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,+BAA+B;IAC/B,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,+BAA+B;IAC/B,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,6EAA6E;IAC7E,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;CACvB;AAuBD,qBACa,sBAAsB;IAG/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAEpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAEjC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAVb,aAAa,EAAE,sBAAsB,EAErC,eAAe,EAAE,wBAAwB,EAEzC,kBAAkB,EAAE,mBAAmB,EAEvC,mBAAmB,EAAE,uBAAuB,EAE5C,gBAAgB,EAAE,yBAAyB,EAE3C,aAAa,EAAE,wBAAwB;IAGpD,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IA8D1E;;;OAGG;YACW,kBAAkB;IAgBhC;;OAEG;YACW,eAAe;IA6D7B;;OAEG;YACW,yBAAyB;CAgBxC"}