@shepai/cli 1.171.0-pr527.e2ee839 → 1.172.0-pr528.108a424

package/dist/packages/core/src/infrastructure/services/security/security-policy-validator.js

@@ -1,147 +0,0 @@
-/**
- * Security Policy Validator
- *
- * Validates a parsed security policy object against the expected schema.
- * Checks required fields, valid enum values, contradictory rules,
- * and reasonable input limits. Returns structured validation results
- * with per-field error messages.
- */
-import { SecurityMode, SecurityActionCategory, SecurityActionDisposition, } from '../../../domain/generated/output.js';
-/** Maximum number of action disposition entries allowed */
-const MAX_ACTION_DISPOSITIONS = 100;
-/** Maximum number of entries in allowlist or denylist */
-const MAX_LIST_ENTRIES = 100;
-const VALID_MODES = Object.values(SecurityMode);
-const VALID_CATEGORIES = Object.values(SecurityActionCategory);
-const VALID_DISPOSITIONS = Object.values(SecurityActionDisposition);
-/**
- * Validates parsed security policy objects against the expected schema.
- */
-export class SecurityPolicyValidator {
-    /**
-     * Validate a parsed policy object.
-     *
-     * @param policy - The parsed policy object (from YAML)
-     * @returns Validation result with errors array
-     */
-    validate(policy) {
-        const errors = [];
-        // Validate mode (optional, but if present must be valid)
-        if (policy.mode !== undefined) {
-            if (!VALID_MODES.includes(policy.mode)) {
-                errors.push(`Invalid mode: "${String(policy.mode)}". Valid values: ${VALID_MODES.join(', ')}`);
-            }
-        }
-        // Validate actionDispositions (optional, but if present must be valid)
-        if (policy.actionDispositions !== undefined) {
-            this.validateActionDispositions(policy.actionDispositions, errors);
-        }
-        // Validate dependencyRules (optional, but if present must be valid)
-        if (policy.dependencyRules !== undefined) {
-            this.validateDependencyRules(policy.dependencyRules, errors);
-        }
-        // Validate releaseRules (optional, but if present must be valid)
-        if (policy.releaseRules !== undefined) {
-            this.validateReleaseRules(policy.releaseRules, errors);
-        }
-        return {
-            valid: errors.length === 0,
-            errors,
-        };
-    }
-    validateActionDispositions(value, errors) {
-        if (!Array.isArray(value)) {
-            errors.push('actionDispositions must be an array');
-            return;
-        }
-        if (value.length > MAX_ACTION_DISPOSITIONS) {
-            errors.push(`actionDispositions exceeds limit: ${value.length} entries (max ${MAX_ACTION_DISPOSITIONS})`);
-            return;
-        }
-        // Track categories to detect contradictions
-        const categoryToDisposition = new Map();
-        for (let i = 0; i < value.length; i++) {
-            const entry = value[i];
-            if (!entry || typeof entry !== 'object') {
-                errors.push(`actionDispositions[${i}] must be an object`);
-                continue;
-            }
-            const category = entry.category;
-            const disposition = entry.disposition;
-            if (!VALID_CATEGORIES.includes(category)) {
-                errors.push(`actionDispositions[${i}].category: invalid value "${String(category)}". Valid values: ${VALID_CATEGORIES.join(', ')}`);
-            }
-            if (!VALID_DISPOSITIONS.includes(disposition)) {
-                errors.push(`actionDispositions[${i}].disposition: invalid value "${String(disposition)}". Valid values: ${VALID_DISPOSITIONS.join(', ')}`);
-            }
-            // Check for contradictory entries (same category, different disposition)
-            if (VALID_CATEGORIES.includes(category) &&
-                VALID_DISPOSITIONS.includes(disposition)) {
-                const existing = categoryToDisposition.get(category);
-                if (existing !== undefined && existing !== disposition) {
-                    errors.push(`Contradictory action dispositions for category "${category}": "${existing}" vs "${disposition}"`);
-                }
-                else {
-                    categoryToDisposition.set(category, disposition);
-                }
-            }
-        }
-    }
-    validateDependencyRules(value, errors) {
-        if (!value || typeof value !== 'object') {
-            errors.push('dependencyRules must be an object');
-            return;
-        }
-        const rules = value;
-        // Validate boolean fields
-        const booleanFields = [
-            'checkLockfileConsistency',
-            'checkLifecycleScripts',
-            'checkNonRegistrySource',
-            'enforceStrictVersionRanges',
-        ];
-        for (const field of booleanFields) {
-            if (rules[field] !== undefined && typeof rules[field] !== 'boolean') {
-                errors.push(`dependencyRules.${field} must be a boolean, got ${typeof rules[field]}`);
-            }
-        }
-        // Validate list fields
-        if (rules.allowlist !== undefined) {
-            this.validateStringList('dependencyRules.allowlist', rules.allowlist, errors);
-        }
-        if (rules.denylist !== undefined) {
-            this.validateStringList('dependencyRules.denylist', rules.denylist, errors);
-        }
-    }
-    validateReleaseRules(value, errors) {
-        if (!value || typeof value !== 'object') {
-            errors.push('releaseRules must be an object');
-            return;
-        }
-        const rules = value;
-        const booleanFields = [
-            'requireCiOnlyPublishing',
-            'requireProvenance',
-            'checkWorkflowIntegrity',
-        ];
-        for (const field of booleanFields) {
-            if (rules[field] !== undefined && typeof rules[field] !== 'boolean') {
-                errors.push(`releaseRules.${field} must be a boolean, got ${typeof rules[field]}`);
-            }
-        }
-    }
-    validateStringList(path, value, errors) {
-        if (!Array.isArray(value)) {
-            errors.push(`${path} must be an array`);
-            return;
-        }
-        if (value.length > MAX_LIST_ENTRIES) {
-            errors.push(`${path} exceeds limit: ${value.length} entries (max ${MAX_LIST_ENTRIES})`);
-        }
-        for (let i = 0; i < value.length; i++) {
-            if (typeof value[i] !== 'string') {
-                errors.push(`${path}[${i}] must be a string`);
-            }
-        }
-    }
-}

package/dist/packages/core/src/infrastructure/services/security/security-policy.service.d.ts

@@ -1,44 +0,0 @@
-/**
- * Security Policy Service
- *
- * Central policy engine implementing ISecurityPolicyService.
- * Reads the policy file, validates it, merges with persisted settings defaults
- * using deterministic precedence, and returns an EffectivePolicySnapshot.
- *
- * Precedence: global settings defaults < repository policy file (stricter wins).
- * A lower-precedence layer cannot weaken a stricter higher-precedence rule.
- */
-import { SecurityActionCategory, SecurityActionDisposition } from '../../../domain/generated/output.js';
-import type { EffectivePolicySnapshot } from '../../../domain/generated/output.js';
-import type { ISecurityPolicyService, PolicyValidationResult } from '../../../application/ports/output/services/security-policy-service.interface.js';
-import type { ISettingsRepository } from '../../../application/ports/output/repositories/settings.repository.interface.js';
-import { SecurityPolicyFileReader } from './security-policy-file-reader.js';
-import { SecurityPolicyValidator } from './security-policy-validator.js';
-export declare class SecurityPolicyService implements ISecurityPolicyService {
-    private readonly fileReader;
-    private readonly validator;
-    private readonly settingsRepo;
-    private readonly cache;
-    constructor(fileReader: SecurityPolicyFileReader, validator: SecurityPolicyValidator, settingsRepo: ISettingsRepository);
-    evaluatePolicy(repositoryPath: string): Promise<EffectivePolicySnapshot>;
-    getEffectivePolicy(repositoryPath: string): Promise<EffectivePolicySnapshot>;
-    validatePolicyFile(filePath: string): Promise<PolicyValidationResult>;
-    getActionDisposition(policy: EffectivePolicySnapshot, actionCategory: SecurityActionCategory): SecurityActionDisposition;
-    /**
-     * Build a default snapshot from settings mode only (no policy file).
-     */
-    private buildDefaultSnapshot;
-    /**
-     * Merge settings defaults with policy file, applying strict-wins precedence.
-     */
-    private mergePolicy;
-    /**
-     * Return the stricter of two SecurityMode values.
-     */
-    private stricterMode;
-    /**
-     * Return the stricter of two SecurityActionDisposition values.
-     */
-    private stricterDisposition;
-}
-//# sourceMappingURL=security-policy.service.d.ts.map

package/dist/packages/core/src/infrastructure/services/security/security-policy.service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-policy.service.d.ts","sourceRoot":"","sources":["../../../../../../../packages/core/src/infrastructure/services/security/security-policy.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAEL,sBAAsB,EACtB,yBAAyB,EAC1B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,uBAAuB,EAGxB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EACV,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,iFAAiF,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iFAAiF,CAAC;AAC3H,OAAO,EACL,wBAAwB,EAEzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AA4BzE,qBACa,qBAAsB,YAAW,sBAAsB;IAKhE,OAAO,CAAC,QAAQ,CAAC,UAAU;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAR/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA8C;gBAIjD,UAAU,EAAE,wBAAwB,EAEpC,SAAS,EAAE,uBAAuB,EAElC,YAAY,EAAE,mBAAmB;IAG9C,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA6BxE,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAQ5E,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAY3E,oBAAoB,CAClB,MAAM,EAAE,uBAAuB,EAC/B,cAAc,EAAE,sBAAsB,GACrC,yBAAyB;IAK5B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAY5B;;OAEG;IACH,OAAO,CAAC,WAAW;IAuCnB;;OAEG;IACH,OAAO,CAAC,YAAY;IAMpB;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAQ5B"}

package/dist/packages/core/src/infrastructure/services/security/security-policy.service.js

@@ -1,174 +0,0 @@
-/**
- * Security Policy Service
- *
- * Central policy engine implementing ISecurityPolicyService.
- * Reads the policy file, validates it, merges with persisted settings defaults
- * using deterministic precedence, and returns an EffectivePolicySnapshot.
- *
- * Precedence: global settings defaults < repository policy file (stricter wins).
- * A lower-precedence layer cannot weaken a stricter higher-precedence rule.
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { injectable, inject } from 'tsyringe';
-import { SecurityMode, SecurityActionCategory, SecurityActionDisposition, } from '../../../domain/generated/output.js';
-import { SecurityPolicyFileReader, SECURITY_POLICY_FILENAME, } from './security-policy-file-reader.js';
-import { SecurityPolicyValidator } from './security-policy-validator.js';
-import { dirname } from 'node:path';
-/**
- * Numeric rank for comparing SecurityMode strictness.
- * Higher number = stricter mode.
- */
-const MODE_STRICTNESS = {
-    [SecurityMode.Disabled]: 0,
-    [SecurityMode.Advisory]: 1,
-    [SecurityMode.Enforce]: 2,
-};
-/**
- * Numeric rank for comparing disposition strictness.
- * Higher number = more restrictive.
- */
-const DISPOSITION_STRICTNESS = {
-    [SecurityActionDisposition.Allowed]: 0,
-    [SecurityActionDisposition.ApprovalRequired]: 1,
-    [SecurityActionDisposition.Denied]: 2,
-};
-/**
- * All action categories for building default dispositions.
- */
-const ALL_CATEGORIES = Object.values(SecurityActionCategory);
-let SecurityPolicyService = class SecurityPolicyService {
-    fileReader;
-    validator;
-    settingsRepo;
-    cache = new Map();
-    constructor(fileReader, validator, settingsRepo) {
-        this.fileReader = fileReader;
-        this.validator = validator;
-        this.settingsRepo = settingsRepo;
-    }
-    async evaluatePolicy(repositoryPath) {
-        // Load settings defaults
-        const settings = await this.settingsRepo.load();
-        const settingsMode = settings?.security?.mode ?? SecurityMode.Advisory;
-        // Read policy file
-        const policyFile = await this.fileReader.read(repositoryPath);
-        if (!policyFile) {
-            // No policy file — use settings defaults
-            const snapshot = this.buildDefaultSnapshot(settingsMode);
-            this.cache.set(repositoryPath, snapshot);
-            return snapshot;
-        }
-        // Validate policy file
-        const validation = this.validator.validate(policyFile);
-        if (!validation.valid) {
-            throw new Error(`Security policy validation failed for ${repositoryPath}:\n${validation.errors.join('\n')}`);
-        }
-        // Merge with precedence: settings defaults < policy file (stricter wins)
-        const snapshot = this.mergePolicy(settingsMode, policyFile);
-        this.cache.set(repositoryPath, snapshot);
-        return snapshot;
-    }
-    async getEffectivePolicy(repositoryPath) {
-        const cached = this.cache.get(repositoryPath);
-        if (cached) {
-            return cached;
-        }
-        return this.evaluatePolicy(repositoryPath);
-    }
-    async validatePolicyFile(filePath) {
-        // Read the file from the directory containing it
-        const dirPath = dirname(filePath);
-        const policyFile = await this.fileReader.read(dirPath);
-        if (!policyFile) {
-            return { valid: true, errors: [] };
-        }
-        return this.validator.validate(policyFile);
-    }
-    getActionDisposition(policy, actionCategory) {
-        const entry = policy.actionDispositions.find((d) => d.category === actionCategory);
-        return entry?.disposition ?? SecurityActionDisposition.Allowed;
-    }
-    /**
-     * Build a default snapshot from settings mode only (no policy file).
-     */
-    buildDefaultSnapshot(mode) {
-        return {
-            mode,
-            source: 'settings-default',
-            evaluatedAt: new Date().toISOString(),
-            actionDispositions: ALL_CATEGORIES.map((category) => ({
-                category,
-                disposition: SecurityActionDisposition.Allowed,
-            })),
-        };
-    }
-    /**
-     * Merge settings defaults with policy file, applying strict-wins precedence.
-     */
-    mergePolicy(settingsMode, policyFile) {
-        // Mode: stricter wins
-        const fileMode = policyFile.mode ?? SecurityMode.Advisory;
-        const effectiveMode = this.stricterMode(settingsMode, fileMode);
-        // Action dispositions: merge file entries with defaults, stricter wins
-        const dispositionMap = new Map();
-        // Start with defaults (all Allowed)
-        for (const category of ALL_CATEGORIES) {
-            dispositionMap.set(category, SecurityActionDisposition.Allowed);
-        }
-        // Apply policy file entries (can only make stricter, not weaker)
-        if (policyFile.actionDispositions) {
-            for (const entry of policyFile.actionDispositions) {
-                const current = dispositionMap.get(entry.category);
-                if (current !== undefined) {
-                    dispositionMap.set(entry.category, this.stricterDisposition(current, entry.disposition));
-                }
-            }
-        }
-        const actionDispositions = [];
-        for (const [category, disposition] of dispositionMap) {
-            actionDispositions.push({ category, disposition });
-        }
-        return {
-            mode: effectiveMode,
-            source: SECURITY_POLICY_FILENAME,
-            evaluatedAt: new Date().toISOString(),
-            actionDispositions,
-        };
-    }
-    /**
-     * Return the stricter of two SecurityMode values.
-     */
-    stricterMode(a, b) {
-        const rankA = MODE_STRICTNESS[a] ?? 0;
-        const rankB = MODE_STRICTNESS[b] ?? 0;
-        return rankA >= rankB ? a : b;
-    }
-    /**
-     * Return the stricter of two SecurityActionDisposition values.
-     */
-    stricterDisposition(a, b) {
-        const rankA = DISPOSITION_STRICTNESS[a] ?? 0;
-        const rankB = DISPOSITION_STRICTNESS[b] ?? 0;
-        return rankA >= rankB ? a : b;
-    }
-};
-SecurityPolicyService = __decorate([
-    injectable(),
-    __param(0, inject('SecurityPolicyFileReader')),
-    __param(1, inject('SecurityPolicyValidator')),
-    __param(2, inject('ISettingsRepository')),
-    __metadata("design:paramtypes", [SecurityPolicyFileReader,
-        SecurityPolicyValidator, Object])
-], SecurityPolicyService);
-export { SecurityPolicyService };

package/dist/src/presentation/cli/commands/security.command.d.ts

@@ -1,16 +0,0 @@
-/**
- * Security Command Group
- *
- * Top-level security command with subcommands for supply-chain security
- * policy management and enforcement.
- *
- * Usage:
- *   shep security enforce          Evaluate and enforce security posture
- *   shep security enforce --output json   Machine-readable output for CI
- */
-import { Command } from 'commander';
-/**
- * Create the security command group with all subcommands.
- */
-export declare function createSecurityCommand(): Command;
-//# sourceMappingURL=security.command.d.ts.map

package/dist/src/presentation/cli/commands/security.command.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.command.d.ts","sourceRoot":"","sources":["../../../../../src/presentation/cli/commands/security.command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAqH/C"}

package/dist/src/presentation/cli/commands/security.command.js

@@ -1,118 +0,0 @@
-/**
- * Security Command Group
- *
- * Top-level security command with subcommands for supply-chain security
- * policy management and enforcement.
- *
- * Usage:
- *   shep security enforce          Evaluate and enforce security posture
- *   shep security enforce --output json   Machine-readable output for CI
- */
-import { Command } from 'commander';
-import { container } from '../../../../packages/core/src/infrastructure/di/container.js';
-import { EnforceSecurityUseCase } from '../../../../packages/core/src/application/use-cases/security/enforce-security.use-case.js';
-import { SecurityMode } from '../../../../packages/core/src/domain/generated/output.js';
-import { colors, fmt, messages } from '../ui/index.js';
-import { OutputFormatter } from '../ui/output.js';
-import { getCliI18n } from '../i18n.js';
-/**
- * Create the security command group with all subcommands.
- */
-export function createSecurityCommand() {
-    const t = getCliI18n().t;
-    const security = new Command('security').description(t('cli:commands.security.description'));
-    security
-        .command('enforce')
-        .description(t('cli:commands.security.enforce.description'))
-        .option('-r, --repo <path>', t('cli:commands.security.enforce.repoOption'), process.cwd())
-        .option('-o, --output <format>', t('cli:commands.security.enforce.outputOption'), 'table')
-        .action(async (options) => {
-        try {
-            const useCase = container.resolve(EnforceSecurityUseCase);
-            const result = await useCase.execute({ repositoryPath: options.repo });
-            const outputFormat = options.output;
-            if (outputFormat === 'json' || outputFormat === 'yaml') {
-                // Machine-readable output
-                console.log(OutputFormatter.format(result, outputFormat));
-            }
-            else {
-                // Human-readable table output
-                messages.newline();
-                if (result.mode === SecurityMode.Disabled) {
-                    messages.info(t('cli:commands.security.enforce.disabledNote'));
-                    messages.newline();
-                }
-                else {
-                    // Summary header
-                    console.log(`${fmt.label(t('cli:commands.security.enforce.modeLabel'))}:     ${result.mode}`);
-                    console.log(`${fmt.label(t('cli:commands.security.enforce.sourceLabel'))}:   ${result.policy.source}`);
-                    console.log(`${fmt.label(t('cli:commands.security.enforce.totalFindingsLabel'))}: ${result.totalFindings}`);
-                    messages.newline();
-                    // Dependency findings
-                    if (result.dependencyFindings.length > 0) {
-                        console.log(fmt.heading(t('cli:commands.security.enforce.dependencyFindingsLabel')));
-                        for (const finding of result.dependencyFindings) {
-                            const severityColor = finding.severity === 'Critical' || finding.severity === 'High'
-                                ? colors.error
-                                : colors.warning;
-                            console.log(`  ${severityColor(`[${finding.severity}]`)} ${finding.packageName}: ${finding.message}`);
-                            if (finding.remediation) {
-                                console.log(`    ${colors.muted(finding.remediation)}`);
-                            }
-                        }
-                        messages.newline();
-                    }
-                    // Release integrity
-                    const failedChecks = result.releaseIntegrity.checks.filter((c) => !c.passed);
-                    if (failedChecks.length > 0) {
-                        console.log(fmt.heading(t('cli:commands.security.enforce.releaseIntegrityLabel')));
-                        for (const check of failedChecks) {
-                            const severityColor = check.severity === 'Critical' || check.severity === 'High'
-                                ? colors.error
-                                : colors.warning;
-                            console.log(`  ${severityColor(`[${check.severity}]`)} ${check.message}`);
-                        }
-                        messages.newline();
-                    }
-                    // Governance findings (audit-only)
-                    if (result.governanceFindings.length > 0) {
-                        console.log(fmt.heading(t('cli:commands.security.enforce.governanceFindingsLabel')));
-                        for (const finding of result.governanceFindings) {
-                            const severityColor = finding.severity === 'Critical' || finding.severity === 'High'
-                                ? colors.error
-                                : colors.warning;
-                            console.log(`  ${severityColor(`[${finding.severity}]`)} ${finding.message}`);
-                            if (finding.remediation) {
-                                console.log(`    ${colors.muted(finding.remediation)}`);
-                            }
-                        }
-                        messages.newline();
-                    }
-                    // Result
-                    if (result.totalFindings === 0) {
-                        messages.info(t('cli:commands.security.enforce.noFindings'));
-                    }
-                    if (result.passed) {
-                        messages.success(t('cli:commands.security.enforce.passed'));
-                        if (result.mode === SecurityMode.Advisory && result.totalFindings > 0) {
-                            messages.info(t('cli:commands.security.enforce.advisoryNote'));
-                        }
-                    }
-                    else {
-                        messages.error(t('cli:commands.security.enforce.failed'));
-                    }
-                }
-                messages.newline();
-            }
-            if (!result.passed) {
-                process.exitCode = 1;
-            }
-        }
-        catch (error) {
-            const err = error instanceof Error ? error : new Error(String(error));
-            messages.error(t('cli:commands.security.enforce.failedToEnforce'), err);
-            process.exitCode = 1;
-        }
-    });
-    return security;
-}

package/dist/src/presentation/web/app/actions/security.d.ts

@@ -1,28 +0,0 @@
-import type { SecurityState } from '../../../../../packages/core/src/application/use-cases/security/get-security-state.use-case.js';
-import type { EnforceSecurityResult } from '../../../../../packages/core/src/application/use-cases/security/enforce-security.use-case.js';
-import type { SecurityMode } from '../../../../../packages/core/src/domain/generated/output.js';
-export interface GetSecurityStateResult {
-    state?: SecurityState;
-    error?: string;
-}
-export interface EnforceSecurityActionResult {
-    result?: EnforceSecurityResult;
-    error?: string;
-}
-export interface UpdateSecurityModeResult {
-    success: boolean;
-    error?: string;
-}
-/**
- * Fetches the current security state for a repository.
- */
-export declare function getSecurityStateAction(repositoryPath: string): Promise<GetSecurityStateResult>;
-/**
- * Runs the full security enforcement flow for a repository.
- */
-export declare function enforceSecurityAction(repositoryPath: string): Promise<EnforceSecurityActionResult>;
-/**
- * Updates the security mode in settings.
- */
-export declare function updateSecurityModeAction(mode: SecurityMode): Promise<UpdateSecurityModeResult>;
-//# sourceMappingURL=security.d.ts.map

package/dist/src/presentation/web/app/actions/security.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/security.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,aAAa,EACd,MAAM,yEAAyE,CAAC;AACjF,OAAO,KAAK,EAEV,qBAAqB,EACtB,MAAM,uEAAuE,CAAC;AAC/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEzE,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,CAAC,CASjC;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CACzC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,2BAA2B,CAAC,CAUtC;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,wBAAwB,CAAC,CAyBnC"}

package/dist/src/presentation/web/app/actions/security.js

@@ -1,59 +0,0 @@
-'use server';
-import { revalidatePath } from 'next/cache';
-import { resolve } from '../../lib/server-container.js';
-import { updateSettings as updateSettingsSingleton } from '../../../../../packages/core/src/infrastructure/services/settings.service.js';
-/**
- * Fetches the current security state for a repository.
- */
-export async function getSecurityStateAction(repositoryPath) {
-    try {
-        const useCase = resolve('GetSecurityStateUseCase');
-        const state = await useCase.execute(repositoryPath);
-        return { state };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : 'Failed to load security state';
-        return { error: message };
-    }
-}
-/**
- * Runs the full security enforcement flow for a repository.
- */
-export async function enforceSecurityAction(repositoryPath) {
-    try {
-        const useCase = resolve('EnforceSecurityUseCase');
-        const result = await useCase.execute({ repositoryPath });
-        revalidatePath('/', 'layout');
-        return { result };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : 'Failed to run security enforcement';
-        return { error: message };
-    }
-}
-/**
- * Updates the security mode in settings.
- */
-export async function updateSecurityModeAction(mode) {
-    try {
-        const loadUseCase = resolve('LoadSettingsUseCase');
-        const current = await loadUseCase.execute();
-        const merged = {
-            ...current,
-            security: {
-                ...current.security,
-                mode,
-            },
-            updatedAt: new Date(),
-        };
-        const updateUseCase = resolve('UpdateSettingsUseCase');
-        await updateUseCase.execute(merged);
-        updateSettingsSingleton(merged);
-        revalidatePath('/', 'layout');
-        return { success: true };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : 'Failed to update security mode';
-        return { success: false, error: message };
-    }
-}

package/dist/src/presentation/web/components/common/repository-node/security-panel.d.ts

@@ -1,6 +0,0 @@
-import type { SecurityEvent } from '../../../../../../packages/core/src/domain/generated/output.js';
-export interface SecurityPanelProps {
-    events: SecurityEvent[];
-}
-export declare function SecurityPanel({ events }: SecurityPanelProps): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=security-panel.d.ts.map

package/dist/src/presentation/web/components/common/repository-node/security-panel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-panel.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/repository-node/security-panel.tsx"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAgBD,wBAAgB,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,kBAAkB,2CA6F3D"}

package/dist/src/presentation/web/components/common/repository-node/security-panel.js

@@ -1,29 +0,0 @@
-'use client';
-import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { useState } from 'react';
-import { Shield, ChevronDown, AlertTriangle } from 'lucide-react';
-import { useTranslation } from 'react-i18next';
-import { cn } from '../../../lib/utils.js';
-import { Badge } from '../../ui/badge.js';
-const SEVERITY_COLORS = {
-    Low: 'bg-blue-100 text-blue-700 dark:bg-blue-900/40 dark:text-blue-300',
-    Medium: 'bg-yellow-100 text-yellow-700 dark:bg-yellow-900/40 dark:text-yellow-300',
-    High: 'bg-orange-100 text-orange-700 dark:bg-orange-900/40 dark:text-orange-300',
-    Critical: 'bg-red-100 text-red-700 dark:bg-red-900/40 dark:text-red-300',
-};
-const SEVERITY_ICON_COLORS = {
-    Low: 'text-blue-500',
-    Medium: 'text-yellow-500',
-    High: 'text-orange-500',
-    Critical: 'text-red-500',
-};
-export function SecurityPanel({ events }) {
-    const { t } = useTranslation('web');
-    const hasFindings = events.length > 0;
-    const [expanded, setExpanded] = useState(hasFindings);
-    const severityCounts = events.reduce((acc, event) => {
-        acc[event.severity] = (acc[event.severity] ?? 0) + 1;
-        return acc;
-    }, {});
-    return (_jsxs("div", { "data-testid": "security-panel", children: [_jsxs("button", { type: "button", onClick: () => setExpanded(!expanded), className: "flex w-full cursor-pointer items-center justify-between text-left", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx(Shield, { className: "text-muted-foreground h-3.5 w-3.5" }), _jsx("span", { className: "text-muted-foreground text-xs font-semibold tracking-wider", children: t('settings.security.panel.title').toUpperCase() }), hasFindings ? (_jsx(Badge, { variant: "secondary", className: "bg-red-100 px-1.5 py-0 text-[9px] text-red-700 dark:bg-red-900/40 dark:text-red-300", children: events.length })) : null] }), _jsx(ChevronDown, { className: cn('text-muted-foreground h-3.5 w-3.5 transition-transform', expanded && 'rotate-180') })] }), expanded ? (_jsx("div", { className: "mt-3 flex flex-col gap-2", children: !hasFindings ? (_jsx("p", { className: "text-muted-foreground text-xs", children: t('settings.security.panel.noFindings') })) : (_jsxs(_Fragment, { children: [_jsx("div", { className: "flex flex-wrap gap-1.5", children: Object.entries(severityCounts).map(([severity, count]) => (_jsxs(Badge, { variant: "secondary", className: cn('px-1.5 py-0 text-[9px]', SEVERITY_COLORS[severity]), children: [count, " ", severity] }, severity))) }), _jsx("div", { className: "flex flex-col gap-1.5", children: events.slice(0, 5).map((event) => (_jsxs("div", { className: "flex items-start gap-2 rounded-md border px-2 py-1.5", children: [_jsx(AlertTriangle, { className: cn('mt-0.5 h-3 w-3 shrink-0', SEVERITY_ICON_COLORS[event.severity] ?? 'text-muted-foreground') }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsx("p", { className: "truncate text-[11px]", children: event.message }), event.remediationSummary ? (_jsx("p", { className: "text-muted-foreground mt-0.5 truncate text-[10px]", children: event.remediationSummary })) : null] })] }, event.id))) })] })) })) : null] }));
-}

package/dist/src/presentation/web/components/common/repository-node/security-panel.stories.d.ts

@@ -1,10 +0,0 @@
-import type { Meta, StoryObj } from '@storybook/react';
-import { SecurityPanel } from './security-panel.js';
-declare const meta: Meta<typeof SecurityPanel>;
-export default meta;
-type Story = StoryObj<typeof SecurityPanel>;
-/** No findings — clean repository. */
-export declare const NoFindings: Story;
-/** Mixed governance and dependency findings. */
-export declare const MixedFindings: Story;
-//# sourceMappingURL=security-panel.stories.d.ts.map