@shepai/cli 1.171.0-pr527.e2ee839 → 1.172.0-pr528.108a424

package/dist/packages/core/src/infrastructure/persistence/sqlite/migrations/053-add-security-settings-columns.js

@@ -1,31 +0,0 @@
-/**
- * Migration 053: Add security settings columns to the settings table.
- *
- * Adds three columns for supply-chain security configuration:
- *  - security_mode          TEXT NOT NULL DEFAULT 'Advisory'
- *  - security_last_evaluation_at  TEXT (nullable)
- *  - security_policy_source       TEXT (nullable)
- *
- * These columns store the effective security mode, last evaluation
- * timestamp, and policy source origin for the SecurityConfig model.
- *
- * Migration is idempotent: checks column existence before ALTER.
- */
-export async function up({ context: db }) {
-    const columns = db.pragma('table_info(settings)');
-    const existingNames = new Set(columns.map((c) => c.name));
-    if (!existingNames.has('security_mode')) {
-        db.exec("ALTER TABLE settings ADD COLUMN security_mode TEXT NOT NULL DEFAULT 'Advisory'");
-    }
-    if (!existingNames.has('security_last_evaluation_at')) {
-        db.exec('ALTER TABLE settings ADD COLUMN security_last_evaluation_at TEXT');
-    }
-    if (!existingNames.has('security_policy_source')) {
-        db.exec('ALTER TABLE settings ADD COLUMN security_policy_source TEXT');
-    }
-}
-export async function down({ context: db }) {
-    // Additive-only migration — columns are nullable/defaulted and ignored
-    // by older code. No-op per LESSONS.md backward compatibility rules.
-    void db;
-}

package/dist/packages/core/src/infrastructure/persistence/sqlite/migrations/054-create-security-events-table.d.ts

@@ -1,29 +0,0 @@
-/**
- * Migration 054: Create security_events table.
- *
- * Creates the security_events table for persisting security audit events
- * (policy violations, approval decisions, enforcement outcomes).
- *
- * Columns:
- *  - id                 TEXT PRIMARY KEY
- *  - repository_path    TEXT NOT NULL
- *  - feature_id         TEXT (nullable)
- *  - severity           TEXT NOT NULL
- *  - category           TEXT NOT NULL
- *  - disposition        TEXT NOT NULL
- *  - actor              TEXT (nullable)
- *  - message            TEXT (nullable)
- *  - remediation_summary TEXT (nullable)
- *  - created_at         TEXT NOT NULL
- *
- * Indexes:
- *  - idx_security_events_repo_created  ON (repository_path, created_at)
- *  - idx_security_events_feature       ON (feature_id)
- *
- * Migration is idempotent: uses IF NOT EXISTS on CREATE TABLE and indexes.
- */
-import type { MigrationParams } from 'umzug';
-import type Database from 'better-sqlite3';
-export declare function up({ context: db }: MigrationParams<Database.Database>): Promise<void>;
-export declare function down({ context: db }: MigrationParams<Database.Database>): Promise<void>;
-//# sourceMappingURL=054-create-security-events-table.d.ts.map

package/dist/packages/core/src/infrastructure/persistence/sqlite/migrations/054-create-security-events-table.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"054-create-security-events-table.d.ts","sourceRoot":"","sources":["../../../../../../../../packages/core/src/infrastructure/persistence/sqlite/migrations/054-create-security-events-table.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,wBAAsB,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyB3F;AAED,wBAAsB,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7F"}

package/dist/packages/core/src/infrastructure/persistence/sqlite/migrations/054-create-security-events-table.js

@@ -1,53 +0,0 @@
-/**
- * Migration 054: Create security_events table.
- *
- * Creates the security_events table for persisting security audit events
- * (policy violations, approval decisions, enforcement outcomes).
- *
- * Columns:
- *  - id                 TEXT PRIMARY KEY
- *  - repository_path    TEXT NOT NULL
- *  - feature_id         TEXT (nullable)
- *  - severity           TEXT NOT NULL
- *  - category           TEXT NOT NULL
- *  - disposition        TEXT NOT NULL
- *  - actor              TEXT (nullable)
- *  - message            TEXT (nullable)
- *  - remediation_summary TEXT (nullable)
- *  - created_at         TEXT NOT NULL
- *
- * Indexes:
- *  - idx_security_events_repo_created  ON (repository_path, created_at)
- *  - idx_security_events_feature       ON (feature_id)
- *
- * Migration is idempotent: uses IF NOT EXISTS on CREATE TABLE and indexes.
- */
-export async function up({ context: db }) {
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS security_events (
-      id TEXT PRIMARY KEY,
-      repository_path TEXT NOT NULL,
-      feature_id TEXT,
-      severity TEXT NOT NULL,
-      category TEXT NOT NULL,
-      disposition TEXT NOT NULL,
-      actor TEXT,
-      message TEXT,
-      remediation_summary TEXT,
-      created_at TEXT NOT NULL
-    )
-  `);
-    db.exec(`
-    CREATE INDEX IF NOT EXISTS idx_security_events_repo_created
-    ON security_events(repository_path, created_at)
-  `);
-    db.exec(`
-    CREATE INDEX IF NOT EXISTS idx_security_events_feature
-    ON security_events(feature_id)
-  `);
-}
-export async function down({ context: db }) {
-    // Additive-only migration — table is new and ignored by older code.
-    // No-op per LESSONS.md backward compatibility rules.
-    void db;
-}

package/dist/packages/core/src/infrastructure/repositories/sqlite-security-event.repository.d.ts

@@ -1,24 +0,0 @@
-/**
- * SQLite Security Event Repository Implementation
- *
- * Implements ISecurityEventRepository using SQLite database.
- * Uses prepared statements to prevent SQL injection.
- * Supports 90-day retention cleanup.
- */
-import type Database from 'better-sqlite3';
-import type { ISecurityEventRepository, SecurityEventQueryOptions } from '../../application/ports/output/repositories/security-event.repository.interface.js';
-import type { SecurityEvent } from '../../domain/generated/output.js';
-/**
- * SQLite implementation of ISecurityEventRepository.
- * Manages SecurityEvent persistence with repository-scoped queries.
- */
-export declare class SQLiteSecurityEventRepository implements ISecurityEventRepository {
-    private readonly db;
-    constructor(db: Database.Database);
-    save(event: SecurityEvent): Promise<void>;
-    findByRepository(repositoryPath: string, options?: SecurityEventQueryOptions): Promise<SecurityEvent[]>;
-    findByFeature(featureId: string, options?: SecurityEventQueryOptions): Promise<SecurityEvent[]>;
-    deleteOlderThan(date: Date): Promise<number>;
-    count(repositoryPath: string): Promise<number>;
-}
-//# sourceMappingURL=sqlite-security-event.repository.d.ts.map

package/dist/packages/core/src/infrastructure/repositories/sqlite-security-event.repository.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sqlite-security-event.repository.d.ts","sourceRoot":"","sources":["../../../../../../packages/core/src/infrastructure/repositories/sqlite-security-event.repository.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EAC1B,MAAM,oFAAoF,CAAC;AAC5F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAOtE;;;GAGG;AACH,qBACa,6BAA8B,YAAW,wBAAwB;IAChE,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAE5C,IAAI,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBzC,gBAAgB,CACpB,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,aAAa,EAAE,CAAC;IA2BrB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,aAAa,EAAE,CAAC;IA2BrB,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAM5C,KAAK,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAOrD"}

package/dist/packages/core/src/infrastructure/repositories/sqlite-security-event.repository.js

@@ -1,96 +0,0 @@
-/**
- * SQLite Security Event Repository Implementation
- *
- * Implements ISecurityEventRepository using SQLite database.
- * Uses prepared statements to prevent SQL injection.
- * Supports 90-day retention cleanup.
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { injectable } from 'tsyringe';
-import { toDatabase, fromDatabase, } from '../persistence/sqlite/mappers/security-event.mapper.js';
-/**
- * SQLite implementation of ISecurityEventRepository.
- * Manages SecurityEvent persistence with repository-scoped queries.
- */
-let SQLiteSecurityEventRepository = class SQLiteSecurityEventRepository {
-    db;
-    constructor(db) {
-        this.db = db;
-    }
-    async save(event) {
-        const row = toDatabase(event);
-        const stmt = this.db.prepare(`
-      INSERT INTO security_events (
-        id, repository_path, feature_id, severity, category,
-        disposition, actor, message, remediation_summary, created_at
-      ) VALUES (
-        @id, @repository_path, @feature_id, @severity, @category,
-        @disposition, @actor, @message, @remediation_summary, @created_at
-      )
-    `);
-        stmt.run(row);
-    }
-    async findByRepository(repositoryPath, options) {
-        let sql = 'SELECT * FROM security_events WHERE repository_path = ?';
-        const params = [repositoryPath];
-        if (options?.severity) {
-            sql += ' AND severity = ?';
-            params.push(options.severity);
-        }
-        sql += ' ORDER BY created_at DESC';
-        if (options?.limit) {
-            sql += ' LIMIT ?';
-            params.push(options.limit);
-        }
-        if (options?.offset) {
-            sql += ' OFFSET ?';
-            params.push(options.offset);
-        }
-        const stmt = this.db.prepare(sql);
-        const rows = stmt.all(...params);
-        return rows.map(fromDatabase);
-    }
-    async findByFeature(featureId, options) {
-        let sql = 'SELECT * FROM security_events WHERE feature_id = ?';
-        const params = [featureId];
-        if (options?.severity) {
-            sql += ' AND severity = ?';
-            params.push(options.severity);
-        }
-        sql += ' ORDER BY created_at DESC';
-        if (options?.limit) {
-            sql += ' LIMIT ?';
-            params.push(options.limit);
-        }
-        if (options?.offset) {
-            sql += ' OFFSET ?';
-            params.push(options.offset);
-        }
-        const stmt = this.db.prepare(sql);
-        const rows = stmt.all(...params);
-        return rows.map(fromDatabase);
-    }
-    async deleteOlderThan(date) {
-        const stmt = this.db.prepare('DELETE FROM security_events WHERE created_at < ?');
-        const result = stmt.run(date.toISOString());
-        return result.changes;
-    }
-    async count(repositoryPath) {
-        const stmt = this.db.prepare('SELECT COUNT(*) as cnt FROM security_events WHERE repository_path = ?');
-        const row = stmt.get(repositoryPath);
-        return row.cnt;
-    }
-};
-SQLiteSecurityEventRepository = __decorate([
-    injectable(),
-    __metadata("design:paramtypes", [Object])
-], SQLiteSecurityEventRepository);
-export { SQLiteSecurityEventRepository };

package/dist/packages/core/src/infrastructure/services/agents/common/executors/security-constraint-validator.d.ts

@@ -1,22 +0,0 @@
-/**
- * Security Constraint Validator
- *
- * Pure function that validates security constraints against executor capabilities.
- * Reusable across all executor types. Throws SecurityViolationError in Enforce mode
- * when constraints are incompatible. Logs warnings in Advisory mode.
- */
-import type { SecurityConstraints } from '../../../../../application/ports/output/agents/agent-executor.interface.js';
-export interface ExecutorCapabilities {
-    /** Whether this executor requires --dangerously-skip-permissions or equivalent */
-    requiresPermissiveMode: boolean;
-    /** Human-readable executor name for error messages */
-    executorName: string;
-}
-/**
- * Validate security constraints against executor capabilities.
- *
- * @returns A warning message if Advisory mode detects an issue, or undefined if clean.
- * @throws SecurityViolationError in Enforce mode when constraints are incompatible.
- */
-export declare function validateSecurityConstraints(constraints: SecurityConstraints | undefined, capabilities: ExecutorCapabilities): string | undefined;
-//# sourceMappingURL=security-constraint-validator.d.ts.map

package/dist/packages/core/src/infrastructure/services/agents/common/executors/security-constraint-validator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-constraint-validator.d.ts","sourceRoot":"","sources":["../../../../../../../../../packages/core/src/infrastructure/services/agents/common/executors/security-constraint-validator.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4EAA4E,CAAC;AAGtH,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,sBAAsB,EAAE,OAAO,CAAC;IAChC,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,mBAAmB,GAAG,SAAS,EAC5C,YAAY,EAAE,oBAAoB,GACjC,MAAM,GAAG,SAAS,CAiBpB"}

package/dist/packages/core/src/infrastructure/services/agents/common/executors/security-constraint-validator.js

@@ -1,30 +0,0 @@
-/**
- * Security Constraint Validator
- *
- * Pure function that validates security constraints against executor capabilities.
- * Reusable across all executor types. Throws SecurityViolationError in Enforce mode
- * when constraints are incompatible. Logs warnings in Advisory mode.
- */
-import { SecurityMode, SecurityActionCategory } from '../../../../../domain/generated/output.js';
-import { SecurityViolationError } from '../../../../../domain/errors/security-violation.error.js';
-/**
- * Validate security constraints against executor capabilities.
- *
- * @returns A warning message if Advisory mode detects an issue, or undefined if clean.
- * @throws SecurityViolationError in Enforce mode when constraints are incompatible.
- */
-export function validateSecurityConstraints(constraints, capabilities) {
-    if (!constraints)
-        return undefined;
-    if (constraints.mode === SecurityMode.Disabled)
-        return undefined;
-    if (constraints.sandboxLevel === 'strict' && capabilities.requiresPermissiveMode) {
-        const rule = `Executor "${capabilities.executorName}" requires permissive mode but policy demands strict sandbox`;
-        const remediation = 'Either switch to an executor that supports strict sandboxing, or relax the sandbox policy to permissive.';
-        if (constraints.mode === SecurityMode.Enforce) {
-            throw new SecurityViolationError(rule, SecurityActionCategory.SandboxEscalation, remediation);
-        }
-        return `[security:advisory] ${rule}. ${remediation}`;
-    }
-    return undefined;
-}

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/nodes/security-pre-check.d.ts

@@ -1,45 +0,0 @@
-/**
- * Security Pre-Check for Feature Agent Nodes
- *
- * Classifies node actions by SecurityActionCategory and evaluates
- * the effective disposition based on the security policy mode and
- * per-category overrides from FeatureAgentState.
- *
- * Used by executeNode() to enforce or warn about security policy
- * before executing agent prompts.
- */
-import { SecurityActionCategory, SecurityActionDisposition, SecurityMode } from '../../../../../domain/generated/output.js';
-/**
- * Classify a node name into its SecurityActionCategory.
- * Returns null for read-only nodes (requirements, research, plan, analyze)
- * that have no security-sensitive actions.
- */
-export declare function classifyNodeAction(nodeName: string): SecurityActionCategory | null;
-/** Result of a security disposition check. */
-export type SecurityCheckResult = {
-    action: 'skip';
-} | {
-    action: 'allow';
-} | {
-    action: 'warn';
-    category: SecurityActionCategory;
-    nodeName: string;
-} | {
-    action: 'deny';
-    category: SecurityActionCategory;
-    nodeName: string;
-} | {
-    action: 'approval_required';
-    category: SecurityActionCategory;
-    nodeName: string;
-};
-/**
- * Check the security disposition for a node based on the effective policy.
- *
- * @param nodeName - The graph node name (e.g. 'implement', 'merge')
- * @param securityMode - Effective security mode from state
- * @param actionDispositions - Per-category disposition overrides from state
- * @returns The action to take: skip, allow, warn, deny, or approval_required
- */
-export declare function checkSecurityDisposition(nodeName: string, securityMode: SecurityMode, actionDispositions: Partial<Record<SecurityActionCategory, SecurityActionDisposition>>): SecurityCheckResult;
-//# sourceMappingURL=security-pre-check.d.ts.map

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/nodes/security-pre-check.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-pre-check.d.ts","sourceRoot":"","sources":["../../../../../../../../../packages/core/src/infrastructure/services/agents/feature-agent/nodes/security-pre-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,YAAY,EACb,MAAM,8BAA8B,CAAC;AAWtC;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAElF;AAED,8CAA8C;AAC9C,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAClB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,mBAAmB,CAAC;IAAC,QAAQ,EAAE,sBAAsB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,YAAY,EAC1B,kBAAkB,EAAE,OAAO,CAAC,MAAM,CAAC,sBAAsB,EAAE,yBAAyB,CAAC,CAAC,GACrF,mBAAmB,CAyCrB"}

package/dist/packages/core/src/infrastructure/services/agents/feature-agent/nodes/security-pre-check.js

@@ -1,70 +0,0 @@
-/**
- * Security Pre-Check for Feature Agent Nodes
- *
- * Classifies node actions by SecurityActionCategory and evaluates
- * the effective disposition based on the security policy mode and
- * per-category overrides from FeatureAgentState.
- *
- * Used by executeNode() to enforce or warn about security policy
- * before executing agent prompts.
- */
-import { SecurityActionCategory, SecurityActionDisposition, SecurityMode, } from '../../../../../domain/generated/output.js';
-/** Map node names to the security action category they represent. */
-const NODE_ACTION_MAP = {
-    implement: SecurityActionCategory.PackageScriptExec,
-    'fast-implement': SecurityActionCategory.PackageScriptExec,
-    evidence: SecurityActionCategory.PackageScriptExec,
-    merge: SecurityActionCategory.CiWorkflowModify,
-    'ci-fix': SecurityActionCategory.CiWorkflowModify,
-};
-/**
- * Classify a node name into its SecurityActionCategory.
- * Returns null for read-only nodes (requirements, research, plan, analyze)
- * that have no security-sensitive actions.
- */
-export function classifyNodeAction(nodeName) {
-    return NODE_ACTION_MAP[nodeName] ?? null;
-}
-/**
- * Check the security disposition for a node based on the effective policy.
- *
- * @param nodeName - The graph node name (e.g. 'implement', 'merge')
- * @param securityMode - Effective security mode from state
- * @param actionDispositions - Per-category disposition overrides from state
- * @returns The action to take: skip, allow, warn, deny, or approval_required
- */
-export function checkSecurityDisposition(nodeName, securityMode, actionDispositions) {
-    // Disabled mode — no checks
-    if (securityMode === SecurityMode.Disabled) {
-        return { action: 'skip' };
-    }
-    // Read-only nodes have no security-sensitive actions
-    const category = classifyNodeAction(nodeName);
-    if (!category) {
-        return { action: 'skip' };
-    }
-    // Look up the disposition for this category
-    const disposition = actionDispositions[category];
-    // No disposition configured — default to allow
-    if (!disposition) {
-        return { action: 'allow' };
-    }
-    if (disposition === SecurityActionDisposition.Allowed) {
-        return { action: 'allow' };
-    }
-    if (disposition === SecurityActionDisposition.Denied) {
-        // In Enforce mode, deny the action; in Advisory mode, just warn
-        if (securityMode === SecurityMode.Enforce) {
-            return { action: 'deny', category, nodeName };
-        }
-        return { action: 'warn', category, nodeName };
-    }
-    if (disposition === SecurityActionDisposition.ApprovalRequired) {
-        // In Enforce mode, require approval; in Advisory mode, just warn
-        if (securityMode === SecurityMode.Enforce) {
-            return { action: 'approval_required', category, nodeName };
-        }
-        return { action: 'warn', category, nodeName };
-    }
-    return { action: 'allow' };
-}

package/dist/packages/core/src/infrastructure/services/security/dependency-risk-evaluator.d.ts

@@ -1,53 +0,0 @@
-/**
- * Dependency Risk Evaluator
- *
- * Evaluates repository-local dependency risk signals without
- * external services. Checks:
- * - Manifest-lockfile consistency (package.json vs lockfile)
- * - Dependency source types (registry vs git vs file)
- * - Risky lifecycle scripts (preinstall, postinstall, prepare)
- * - Allowlist/denylist enforcement
- * - Version-range strictness
- *
- * Returns an array of DependencyFinding objects with severity and remediation.
- */
-import type { DependencyFinding, DependencyRules } from '../../../domain/generated/output.js';
-export declare class DependencyRiskEvaluator {
-    /**
-     * Evaluate dependency risk for a repository.
-     *
-     * @param repositoryPath - Absolute path to the repository root
-     * @param rules - Dependency risk policy rules
-     * @returns Array of dependency findings
-     */
-    evaluate(repositoryPath: string, rules: DependencyRules): DependencyFinding[];
-    /**
-     * Collect all dependencies from package.json (dependencies + devDependencies).
-     */
-    private collectDependencies;
-    /**
-     * Check that a lockfile exists when there are dependencies.
-     */
-    private checkLockfileConsistency;
-    /**
-     * Check for dependencies installed from non-registry sources.
-     */
-    private checkNonRegistrySources;
-    /**
-     * Check installed packages for risky lifecycle scripts.
-     */
-    private checkLifecycleScripts;
-    /**
-     * Check dependencies against the denylist.
-     */
-    private checkDenylist;
-    /**
-     * Check dependencies against the allowlist (non-empty allowlist = only listed packages allowed).
-     */
-    private checkAllowlist;
-    /**
-     * Check version ranges for strictness (no ^, ~, *, >= patterns).
-     */
-    private checkVersionRangeStrictness;
-}
-//# sourceMappingURL=dependency-risk-evaluator.d.ts.map

package/dist/packages/core/src/infrastructure/services/security/dependency-risk-evaluator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dependency-risk-evaluator.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/security/dependency-risk-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAsB9F,qBAAa,uBAAuB;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,iBAAiB,EAAE;IAmD7E;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAqB/B;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA8C7B;;OAEG;IACH,OAAO,CAAC,aAAa;IAoBrB;;OAEG;IACH,OAAO,CAAC,cAAc;IAoBtB;;OAEG;IACH,OAAO,CAAC,2BAA2B;CAwBpC"}