@shepai/cli 1.171.0-pr527.e2ee839 → 1.172.0-pr528.108a424

package/dist/packages/core/src/application/use-cases/security/enforce-security.use-case.js

@@ -1,215 +0,0 @@
-/**
- * Enforce Security Use Case
- *
- * Orchestrates the full security enforcement flow:
- * 1. Evaluate effective policy
- * 2. Run dependency-risk checks
- * 3. Run release-integrity checks
- * 4. Persist findings as security events
- * 5. Return structured enforcement result
- *
- * Supports Advisory (always pass) and Enforce (fail on violations) modes.
- * Disabled mode returns empty pass result.
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { injectable, inject } from 'tsyringe';
-import { SecurityMode, SecurityActionCategory } from '../../../domain/generated/output.js';
-import { DependencyRiskEvaluator } from '../../../infrastructure/services/security/dependency-risk-evaluator.js';
-import { ReleaseIntegrityEvaluator } from '../../../infrastructure/services/security/release-integrity-evaluator.js';
-import { randomUUID } from 'node:crypto';
-import { execFile as execFileCb } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFileCb);
-/**
- * Default dependency rules when no policy file defines them.
- */
-const DEFAULT_DEPENDENCY_RULES = {
-    checkLockfileConsistency: true,
-    checkLifecycleScripts: true,
-    checkNonRegistrySource: true,
-    enforceStrictVersionRanges: false,
-    allowlist: [],
-    denylist: [],
-};
-/**
- * Default release rules when no policy file defines them.
- */
-const DEFAULT_RELEASE_RULES = {
-    requireCiOnlyPublishing: true,
-    requireProvenance: true,
-    checkWorkflowIntegrity: true,
-};
-let EnforceSecurityUseCase = class EnforceSecurityUseCase {
-    policyService;
-    eventRepository;
-    settingsRepository;
-    dependencyEvaluator;
-    releaseEvaluator;
-    githubService;
-    constructor(policyService, eventRepository, settingsRepository, dependencyEvaluator, releaseEvaluator, githubService) {
-        this.policyService = policyService;
-        this.eventRepository = eventRepository;
-        this.settingsRepository = settingsRepository;
-        this.dependencyEvaluator = dependencyEvaluator;
-        this.releaseEvaluator = releaseEvaluator;
-        this.githubService = githubService;
-    }
-    async execute(input) {
-        // Evaluate effective policy
-        const policy = await this.policyService.evaluatePolicy(input.repositoryPath);
-        // Disabled mode — return empty pass result
-        if (policy.mode === SecurityMode.Disabled) {
-            return {
-                passed: true,
-                mode: SecurityMode.Disabled,
-                policy,
-                dependencyFindings: [],
-                releaseIntegrity: { checks: [], passed: true },
-                governanceFindings: [],
-                totalFindings: 0,
-            };
-        }
-        // Run dependency-risk checks
-        const dependencyFindings = this.dependencyEvaluator.evaluate(input.repositoryPath, DEFAULT_DEPENDENCY_RULES);
-        // Run release-integrity checks
-        const releaseIntegrity = this.releaseEvaluator.evaluate(input.repositoryPath, DEFAULT_RELEASE_RULES);
-        // Run governance audit (audit-only — does not affect pass/fail)
-        const governanceFindings = await this.runGovernanceAudit(input.repositoryPath);
-        // Count total findings (governance excluded — audit-only per FR-15)
-        const failedReleaseChecks = releaseIntegrity.checks.filter((c) => !c.passed);
-        const totalFindings = dependencyFindings.length + failedReleaseChecks.length;
-        // Persist findings as security events
-        await this.persistFindings(input.repositoryPath, dependencyFindings, releaseIntegrity, governanceFindings);
-        // Update settings with evaluation timestamp
-        await this.updateEvaluationTimestamp(policy.source);
-        // Determine pass/fail based on mode (governance is always advisory)
-        const hasFailures = totalFindings > 0;
-        const passed = policy.mode === SecurityMode.Advisory ? true : !hasFailures;
-        return {
-            passed,
-            mode: policy.mode,
-            policy,
-            dependencyFindings,
-            releaseIntegrity,
-            governanceFindings,
-            totalFindings,
-        };
-    }
-    /**
-     * Resolve GitHub owner/repo from the repository's git remote and run governance audit.
-     * Returns empty array if the remote cannot be resolved (not a GitHub repo, no remote, etc.).
-     */
-    async runGovernanceAudit(repositoryPath) {
-        try {
-            const { stdout } = await execFileAsync('git', ['remote', 'get-url', 'origin'], {
-                cwd: repositoryPath,
-            });
-            const remoteUrl = stdout.trim();
-            if (!remoteUrl)
-                return [];
-            const parsed = this.githubService.parseGitHubUrl(remoteUrl);
-            return await this.githubService.auditRepositoryGovernance(parsed.owner, parsed.repo);
-        }
-        catch {
-            // Not a GitHub repository, no remote configured, or parse failure — skip governance audit
-            return [];
-        }
-    }
-    /**
-     * Persist dependency findings, failed release checks, and governance findings as security events.
-     */
-    async persistFindings(repositoryPath, depFindings, releaseResult, govFindings) {
-        const now = new Date().toISOString();
-        for (const finding of depFindings) {
-            const event = {
-                id: randomUUID(),
-                repositoryPath,
-                severity: finding.severity,
-                category: SecurityActionCategory.DependencyInstall,
-                disposition: 'Denied',
-                message: finding.message,
-                remediationSummary: finding.remediation,
-                createdAt: now,
-                updatedAt: now,
-            };
-            await this.eventRepository.save(event);
-        }
-        for (const check of releaseResult.checks) {
-            if (!check.passed) {
-                const event = {
-                    id: randomUUID(),
-                    repositoryPath,
-                    severity: check.severity,
-                    category: SecurityActionCategory.PublishRelease,
-                    disposition: 'Denied',
-                    message: check.message,
-                    createdAt: now,
-                    updatedAt: now,
-                };
-                await this.eventRepository.save(event);
-            }
-        }
-        // Persist governance findings as advisory events
-        for (const finding of govFindings) {
-            // Map governance severity to SecuritySeverity (Unknown → Low for persistence)
-            const severity = finding.severity === 'Unknown'
-                ? 'Low'
-                : finding.severity;
-            const event = {
-                id: randomUUID(),
-                repositoryPath,
-                severity,
-                category: SecurityActionCategory.CiWorkflowModify,
-                disposition: 'Allowed',
-                message: `[Governance Audit] ${finding.message}`,
-                remediationSummary: finding.remediation,
-                createdAt: now,
-                updatedAt: now,
-            };
-            await this.eventRepository.save(event);
-        }
-    }
-    /**
-     * Update settings with the latest evaluation timestamp and policy source.
-     */
-    async updateEvaluationTimestamp(policySource) {
-        try {
-            const settings = await this.settingsRepository.load();
-            if (settings) {
-                settings.security = {
-                    ...settings.security,
-                    mode: settings.security?.mode ?? SecurityMode.Advisory,
-                    lastEvaluationAt: new Date().toISOString(),
-                    policySource,
-                };
-                await this.settingsRepository.update(settings);
-            }
-        }
-        catch {
-            // Non-fatal — evaluation results are still returned even if settings update fails
-        }
-    }
-};
-EnforceSecurityUseCase = __decorate([
-    injectable(),
-    __param(0, inject('ISecurityPolicyService')),
-    __param(1, inject('ISecurityEventRepository')),
-    __param(2, inject('ISettingsRepository')),
-    __param(3, inject('DependencyRiskEvaluator')),
-    __param(4, inject('ReleaseIntegrityEvaluator')),
-    __param(5, inject('IGitHubRepositoryService')),
-    __metadata("design:paramtypes", [Object, Object, Object, DependencyRiskEvaluator,
-        ReleaseIntegrityEvaluator, Object])
-], EnforceSecurityUseCase);
-export { EnforceSecurityUseCase };

package/dist/packages/core/src/application/use-cases/security/evaluate-security-policy.use-case.d.ts

@@ -1,24 +0,0 @@
-/**
- * Evaluate Security Policy Use Case
- *
- * Wraps ISecurityPolicyService.evaluatePolicy() as a use case.
- * Updates settings with the latest evaluation timestamp and policy source.
- * Returns the effective policy snapshot.
- */
-import type { EffectivePolicySnapshot } from '../../../domain/generated/output.js';
-import type { ISecurityPolicyService } from '../../ports/output/services/security-policy-service.interface.js';
-import type { ISettingsRepository } from '../../ports/output/repositories/settings.repository.interface.js';
-/**
- * Input for the evaluate security policy use case.
- */
-export interface EvaluateSecurityPolicyInput {
-    /** Absolute path to the repository to evaluate */
-    repositoryPath: string;
-}
-export declare class EvaluateSecurityPolicyUseCase {
-    private readonly policyService;
-    private readonly settingsRepository;
-    constructor(policyService: ISecurityPolicyService, settingsRepository: ISettingsRepository);
-    execute(input: EvaluateSecurityPolicyInput): Promise<EffectivePolicySnapshot>;
-}
-//# sourceMappingURL=evaluate-security-policy.use-case.d.ts.map

package/dist/packages/core/src/application/use-cases/security/evaluate-security-policy.use-case.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"evaluate-security-policy.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/security/evaluate-security-policy.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kEAAkE,CAAC;AAC/G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAE5G;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,kDAAkD;IAClD,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,qBACa,6BAA6B;IAGtC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAFlB,aAAa,EAAE,sBAAsB,EAErC,kBAAkB,EAAE,mBAAmB;IAGpD,OAAO,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAqBpF"}

package/dist/packages/core/src/application/use-cases/security/evaluate-security-policy.use-case.js

@@ -1,56 +0,0 @@
-/**
- * Evaluate Security Policy Use Case
- *
- * Wraps ISecurityPolicyService.evaluatePolicy() as a use case.
- * Updates settings with the latest evaluation timestamp and policy source.
- * Returns the effective policy snapshot.
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { injectable, inject } from 'tsyringe';
-import { SecurityMode } from '../../../domain/generated/output.js';
-let EvaluateSecurityPolicyUseCase = class EvaluateSecurityPolicyUseCase {
-    policyService;
-    settingsRepository;
-    constructor(policyService, settingsRepository) {
-        this.policyService = policyService;
-        this.settingsRepository = settingsRepository;
-    }
-    async execute(input) {
-        const policy = await this.policyService.evaluatePolicy(input.repositoryPath);
-        // Update settings with evaluation timestamp and source
-        try {
-            const settings = await this.settingsRepository.load();
-            if (settings) {
-                settings.security = {
-                    ...settings.security,
-                    mode: settings.security?.mode ?? SecurityMode.Advisory,
-                    lastEvaluationAt: new Date().toISOString(),
-                    policySource: policy.source,
-                };
-                await this.settingsRepository.update(settings);
-            }
-        }
-        catch {
-            // Non-fatal — policy is still returned even if settings update fails
-        }
-        return policy;
-    }
-};
-EvaluateSecurityPolicyUseCase = __decorate([
-    injectable(),
-    __param(0, inject('ISecurityPolicyService')),
-    __param(1, inject('ISettingsRepository')),
-    __metadata("design:paramtypes", [Object, Object])
-], EvaluateSecurityPolicyUseCase);
-export { EvaluateSecurityPolicyUseCase };

package/dist/packages/core/src/application/use-cases/security/get-security-state.use-case.d.ts

@@ -1,36 +0,0 @@
-/**
- * Get Security State Use Case
- *
- * Returns the current security state for UI projection:
- * - Effective mode from settings
- * - Recent security events (limited)
- * - Highest-severity open finding
- * - Last evaluation timestamp
- */
-import { SecurityMode } from '../../../domain/generated/output.js';
-import type { SecurityEvent } from '../../../domain/generated/output.js';
-import type { ISecurityEventRepository } from '../../ports/output/repositories/security-event.repository.interface.js';
-import type { ISettingsRepository } from '../../ports/output/repositories/settings.repository.interface.js';
-/**
- * Security state summary for UI projection.
- */
-export interface SecurityState {
-    /** Effective security mode */
-    mode: SecurityMode;
-    /** Last evaluation timestamp (ISO string) or null */
-    lastEvaluationAt: string | null;
-    /** Policy source or null */
-    policySource: string | null;
-    /** Recent security events (most recent first, limited) */
-    recentEvents: SecurityEvent[];
-    /** Highest-severity finding from recent events, or null */
-    highestSeverityFinding: SecurityEvent | null;
-}
-export declare class GetSecurityStateUseCase {
-    private readonly eventRepository;
-    private readonly settingsRepository;
-    constructor(eventRepository: ISecurityEventRepository, settingsRepository: ISettingsRepository);
-    execute(repositoryPath: string): Promise<SecurityState>;
-    private findHighestSeverity;
-}
-//# sourceMappingURL=get-security-state.use-case.d.ts.map

package/dist/packages/core/src/application/use-cases/security/get-security-state.use-case.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"get-security-state.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/security/get-security-state.use-case.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAoB,MAAM,qCAAqC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wEAAwE,CAAC;AACvH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AAK5G;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,4BAA4B;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,0DAA0D;IAC1D,YAAY,EAAE,aAAa,EAAE,CAAC;IAC9B,2DAA2D;IAC3D,sBAAsB,EAAE,aAAa,GAAG,IAAI,CAAC;CAC9C;AAUD,qBACa,uBAAuB;IAGhC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEhC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAFlB,eAAe,EAAE,wBAAwB,EAEzC,kBAAkB,EAAE,mBAAmB;IAGpD,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAmB7D,OAAO,CAAC,mBAAmB;CAgB5B"}

package/dist/packages/core/src/application/use-cases/security/get-security-state.use-case.js

@@ -1,76 +0,0 @@
-/**
- * Get Security State Use Case
- *
- * Returns the current security state for UI projection:
- * - Effective mode from settings
- * - Recent security events (limited)
- * - Highest-severity open finding
- * - Last evaluation timestamp
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { injectable, inject } from 'tsyringe';
-import { SecurityMode, SecuritySeverity } from '../../../domain/generated/output.js';
-/** Maximum number of recent events returned. */
-const RECENT_EVENTS_LIMIT = 20;
-/** Severity ordering for comparison (higher = more severe). */
-const SEVERITY_RANK = {
-    [SecuritySeverity.Low]: 0,
-    [SecuritySeverity.Medium]: 1,
-    [SecuritySeverity.High]: 2,
-    [SecuritySeverity.Critical]: 3,
-};
-let GetSecurityStateUseCase = class GetSecurityStateUseCase {
-    eventRepository;
-    settingsRepository;
-    constructor(eventRepository, settingsRepository) {
-        this.eventRepository = eventRepository;
-        this.settingsRepository = settingsRepository;
-    }
-    async execute(repositoryPath) {
-        const settings = await this.settingsRepository.load();
-        const securityConfig = settings?.security;
-        const recentEvents = await this.eventRepository.findByRepository(repositoryPath, {
-            limit: RECENT_EVENTS_LIMIT,
-        });
-        const highestSeverityFinding = this.findHighestSeverity(recentEvents);
-        return {
-            mode: securityConfig?.mode ?? SecurityMode.Advisory,
-            lastEvaluationAt: securityConfig?.lastEvaluationAt ?? null,
-            policySource: securityConfig?.policySource ?? null,
-            recentEvents,
-            highestSeverityFinding,
-        };
-    }
-    findHighestSeverity(events) {
-        if (events.length === 0) {
-            return null;
-        }
-        let highest = events[0];
-        for (const event of events) {
-            const eventRank = SEVERITY_RANK[event.severity] ?? 0;
-            const highestRank = SEVERITY_RANK[highest.severity] ?? 0;
-            if (eventRank > highestRank) {
-                highest = event;
-            }
-        }
-        return highest;
-    }
-};
-GetSecurityStateUseCase = __decorate([
-    injectable(),
-    __param(0, inject('ISecurityEventRepository')),
-    __param(1, inject('ISettingsRepository')),
-    __metadata("design:paramtypes", [Object, Object])
-], GetSecurityStateUseCase);
-export { GetSecurityStateUseCase };

package/dist/packages/core/src/application/use-cases/security/record-security-event.use-case.d.ts

@@ -1,14 +0,0 @@
-/**
- * Record Security Event Use Case
- *
- * Persists a security event and triggers 90-day retention cleanup.
- * Used by runtime guardrails and enforcement flow to record findings.
- */
-import type { SecurityEvent } from '../../../domain/generated/output.js';
-import type { ISecurityEventRepository } from '../../ports/output/repositories/security-event.repository.interface.js';
-export declare class RecordSecurityEventUseCase {
-    private readonly eventRepository;
-    constructor(eventRepository: ISecurityEventRepository);
-    execute(event: SecurityEvent): Promise<void>;
-}
-//# sourceMappingURL=record-security-event.use-case.d.ts.map

package/dist/packages/core/src/application/use-cases/security/record-security-event.use-case.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"record-security-event.use-case.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/application/use-cases/security/record-security-event.use-case.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wEAAwE,CAAC;AAMvH,qBACa,0BAA0B;IAGnC,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAAf,eAAe,EAAE,wBAAwB;IAGtD,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAcnD"}

package/dist/packages/core/src/application/use-cases/security/record-security-event.use-case.js

@@ -1,46 +0,0 @@
-/**
- * Record Security Event Use Case
- *
- * Persists a security event and triggers 90-day retention cleanup.
- * Used by runtime guardrails and enforcement flow to record findings.
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { injectable, inject } from 'tsyringe';
-import { randomUUID } from 'node:crypto';
-/** Retention window in days for security events. */
-const SECURITY_EVENT_RETENTION_DAYS = 90;
-let RecordSecurityEventUseCase = class RecordSecurityEventUseCase {
-    eventRepository;
-    constructor(eventRepository) {
-        this.eventRepository = eventRepository;
-    }
-    async execute(event) {
-        // Ensure the event has an ID
-        const eventToSave = {
-            ...event,
-            id: event.id || randomUUID(),
-        };
-        await this.eventRepository.save(eventToSave);
-        // Trigger 90-day retention cleanup
-        const cutoff = new Date();
-        cutoff.setDate(cutoff.getDate() - SECURITY_EVENT_RETENTION_DAYS);
-        await this.eventRepository.deleteOlderThan(cutoff);
-    }
-};
-RecordSecurityEventUseCase = __decorate([
-    injectable(),
-    __param(0, inject('ISecurityEventRepository')),
-    __metadata("design:paramtypes", [Object])
-], RecordSecurityEventUseCase);
-export { RecordSecurityEventUseCase };

package/dist/packages/core/src/domain/errors/security-violation.error.d.ts

@@ -1,15 +0,0 @@
-/**
- * Security Violation Error
- *
- * Thrown when a security policy constraint is violated during agent execution.
- * Contains structured information about the violated rule, the action category,
- * and actionable remediation guidance.
- */
-import type { SecurityActionCategory } from '../generated/output.js';
-export declare class SecurityViolationError extends Error {
-    readonly rule: string;
-    readonly category: SecurityActionCategory;
-    readonly remediation: string;
-    constructor(rule: string, category: SecurityActionCategory, remediation: string);
-}
-//# sourceMappingURL=security-violation.error.d.ts.map

package/dist/packages/core/src/domain/errors/security-violation.error.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-violation.error.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/src/domain/errors/security-violation.error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAElE,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,IAAI,EAAE,MAAM;aACZ,QAAQ,EAAE,sBAAsB;aAChC,WAAW,EAAE,MAAM;gBAFnB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,MAAM;CAMtC"}

package/dist/packages/core/src/domain/errors/security-violation.error.js

@@ -1,20 +0,0 @@
-/**
- * Security Violation Error
- *
- * Thrown when a security policy constraint is violated during agent execution.
- * Contains structured information about the violated rule, the action category,
- * and actionable remediation guidance.
- */
-export class SecurityViolationError extends Error {
-    rule;
-    category;
-    remediation;
-    constructor(rule, category, remediation) {
-        super(`Security policy violation: ${rule}`);
-        this.rule = rule;
-        this.category = category;
-        this.remediation = remediation;
-        this.name = 'SecurityViolationError';
-        Object.setPrototypeOf(this, new.target.prototype);
-    }
-}

package/dist/packages/core/src/infrastructure/persistence/sqlite/mappers/security-event.mapper.d.ts

@@ -1,44 +0,0 @@
-/**
- * Security Event Database Mapper
- *
- * Maps between SecurityEvent domain objects and SQLite database rows.
- *
- * Mapping Rules:
- * - TypeScript objects (camelCase) <-> SQL columns (snake_case)
- * - Dates stored as ISO 8601 strings (matching settings pattern)
- * - Optional fields stored as NULL when missing
- * - Enum values stored as string values
- */
-import type { SecurityEvent } from '../../../../domain/generated/output.js';
-/**
- * Database row type matching the security_events table schema.
- * Uses snake_case column names.
- */
-export interface SecurityEventRow {
-    id: string;
-    repository_path: string;
-    feature_id: string | null;
-    severity: string;
-    category: string;
-    disposition: string;
-    actor: string | null;
-    message: string | null;
-    remediation_summary: string | null;
-    created_at: string;
-}
-/**
- * Maps SecurityEvent domain object to database row.
- *
- * @param event - SecurityEvent domain object
- * @returns Database row object with snake_case columns
- */
-export declare function toDatabase(event: SecurityEvent): SecurityEventRow;
-/**
- * Maps database row to SecurityEvent domain object.
- * Converts ISO strings back to Date objects.
- *
- * @param row - Database row with snake_case columns
- * @returns SecurityEvent domain object with camelCase properties
- */
-export declare function fromDatabase(row: SecurityEventRow): SecurityEvent;
-//# sourceMappingURL=security-event.mapper.d.ts.map

package/dist/packages/core/src/infrastructure/persistence/sqlite/mappers/security-event.mapper.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-event.mapper.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/persistence/sqlite/mappers/security-event.mapper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAO5E;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,GAAG,gBAAgB,CAcjE;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAgBjE"}

package/dist/packages/core/src/infrastructure/persistence/sqlite/mappers/security-event.mapper.js

@@ -1,55 +0,0 @@
-/**
- * Security Event Database Mapper
- *
- * Maps between SecurityEvent domain objects and SQLite database rows.
- *
- * Mapping Rules:
- * - TypeScript objects (camelCase) <-> SQL columns (snake_case)
- * - Dates stored as ISO 8601 strings (matching settings pattern)
- * - Optional fields stored as NULL when missing
- * - Enum values stored as string values
- */
-/**
- * Maps SecurityEvent domain object to database row.
- *
- * @param event - SecurityEvent domain object
- * @returns Database row object with snake_case columns
- */
-export function toDatabase(event) {
-    return {
-        id: event.id,
-        repository_path: event.repositoryPath,
-        feature_id: event.featureId ?? null,
-        severity: event.severity,
-        category: event.category,
-        disposition: event.disposition,
-        actor: event.actor ?? null,
-        message: event.message ?? null,
-        remediation_summary: event.remediationSummary ?? null,
-        created_at: event.createdAt instanceof Date ? event.createdAt.toISOString() : String(event.createdAt),
-    };
-}
-/**
- * Maps database row to SecurityEvent domain object.
- * Converts ISO strings back to Date objects.
- *
- * @param row - Database row with snake_case columns
- * @returns SecurityEvent domain object with camelCase properties
- */
-export function fromDatabase(row) {
-    return {
-        id: row.id,
-        repositoryPath: row.repository_path,
-        severity: row.severity,
-        category: row.category,
-        disposition: row.disposition,
-        createdAt: new Date(row.created_at),
-        updatedAt: new Date(row.created_at),
-        ...(row.feature_id !== null && { featureId: row.feature_id }),
-        ...(row.actor !== null && { actor: row.actor }),
-        ...(row.message !== null && { message: row.message }),
-        ...(row.remediation_summary !== null && {
-            remediationSummary: row.remediation_summary,
-        }),
-    };
-}

package/dist/packages/core/src/infrastructure/persistence/sqlite/migrations/053-add-security-settings-columns.d.ts

@@ -1,18 +0,0 @@
-/**
- * Migration 053: Add security settings columns to the settings table.
- *
- * Adds three columns for supply-chain security configuration:
- *  - security_mode          TEXT NOT NULL DEFAULT 'Advisory'
- *  - security_last_evaluation_at  TEXT (nullable)
- *  - security_policy_source       TEXT (nullable)
- *
- * These columns store the effective security mode, last evaluation
- * timestamp, and policy source origin for the SecurityConfig model.
- *
- * Migration is idempotent: checks column existence before ALTER.
- */
-import type { MigrationParams } from 'umzug';
-import type Database from 'better-sqlite3';
-export declare function up({ context: db }: MigrationParams<Database.Database>): Promise<void>;
-export declare function down({ context: db }: MigrationParams<Database.Database>): Promise<void>;
-//# sourceMappingURL=053-add-security-settings-columns.d.ts.map

package/dist/packages/core/src/infrastructure/persistence/sqlite/migrations/053-add-security-settings-columns.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"053-add-security-settings-columns.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/persistence/sqlite/migrations/053-add-security-settings-columns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,wBAAsB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAe3F;AAED,wBAAsB,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7F"}