@superblocksteam/shared 0.9603.2 → 0.9604.0

package/src/types/audit/ocsf.ts

@@ -163,6 +163,10 @@ export const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[] = [
       'application.git.connect',
       'application.git.disconnect',
       'application.metadata.update',
+      'application.npm_install.blocked',
+      'application.npm_install.overridden',
+      'application.npm_install.substituted',
+      'application.npm_install.triaged',
       'application.policy_gate_check.start',
       'application.settings.update',
       'application.undeploy'
@@ -238,7 +242,6 @@ export const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[] = [
     resource_type: 'Organization',
     operations: [
       'organization.npm_allow_install_scripts_changed',
-      'organization.npm_install.blocked',
       'organization.npm_registry.create',
       'organization.npm_registry.delete',
       'organization.npm_registry.update',
@@ -268,6 +271,14 @@ export const AUDIT_EVENT_TYPE_CATALOG: AuditEventTypeEntry[] = [
       'repository.update'
     ]
   },
+  {
+    class_uid: OCSFClassUid.ENTITY_MANAGEMENT,
+    class_name: 'ENTITY_MANAGEMENT',
+    category_uid: OCSFCategoryUid.APPLICATION_ACTIVITY,
+    category_name: 'APPLICATION_ACTIVITY',
+    resource_type: 'ReviewPolicy',
+    operations: ['reviewpolicy.allowlist.applications.added', 'reviewpolicy.allowlist.applications.removed']
+  },
   {
     class_uid: OCSFClassUid.ENTITY_MANAGEMENT,
     class_name: 'ENTITY_MANAGEMENT',
@@ -347,14 +358,33 @@ export function buildOCSFMetadata(logName: string): OCSFMetadata {
 // ---------------------------------------------------------------------------
 
 /**
- * Wire payload for the `v1.audit.npmInstallBlocked` socket method.
+ * Provisional install-time exploitability decision for a CVE finding.
+ * Shared by the agent triage path and `NpmInstallBlockedAuditReport.triage`.
+ */
+export interface TriageVerdict {
+  advisoryId: string;
+  confidence: 'high' | 'low' | 'medium';
+  evaluatedAt: string;
+  factors?: {
+    appExposure?: string;
+    intendedUse?: string;
+    vulnerableFunctionalityInPlay?: boolean;
+  };
+  model: string;
+  package: string;
+  reasoning: string;
+  stage: 'install';
+  verdict: 'exploitable' | 'not_exploitable' | 'uncertain';
+}
+
+/**
+ * Wire payload for the historical `v1.audit.npmInstallBlocked` socket method.
  *
- * Emitted by the Clark dev-server runtime when the controlled install path
- * reports `NpmInstallBlocked`. The server derives org + actor from the
- * authenticated connection (never trusting the client for identity),
+ * Emitted by the Clark dev-server runtime for blocked installs and successful
+ * security decisions such as substitutions, triage, and user overrides. The
+ * server derives org, actor, and app from the authenticated connection,
  * throttles per-org and globally, sanitizes via the P6.1 telemetry helpers,
- * and writes an OCSF `audit_event` row with operation
- * `organization.npm_install.blocked`.
+ * and writes an application-scoped OCSF `audit_event` row.
  *
  * Carries only structured, low-risk fields — deliberately NO free-text error
  * message, so a registry token embedded in CLI output can never reach the wire.
@@ -377,6 +407,42 @@ export interface NpmInstallBlockedAuditReport {
   runner?: string;
   /** Epoch ms when the block occurred (client clock). */
   occurredAt: number;
+  /**
+   * Vulnerability-index findings when `reason === "vulnerable_package"`. One
+   * block can name several advisories across several packages, so each finding
+   * carries its own package spec and a SIEM query on `advisory_id` matches
+   * every row it should. Server allowlists `kind`, scrubs string fields, drops
+   * off-shape entries rather than coercing them, and caps the array length.
+   */
+  vulnerabilities?: Array<{
+    advisoryId: string;
+    kind: 'cve' | 'malware';
+    package: string;
+    severity?: string;
+    suggestedVersion?: string;
+  }>;
+  /**
+   * Silent version substitution when `reason === "package_substituted"`
+   * (CVE safe-swap or quarantine hold-back). Server scrubs versions and
+   * allowlists `reason`. One row per substitution — the client reports each
+   * one separately with `packages` naming the swapped package, which is why
+   * this object carries no name of its own.
+   */
+  substitution?: {
+    fromVersion: string;
+    toVersion: string;
+    reason: 'cve_swap' | 'quarantine';
+  };
+  /** Provisional install-time exploitability decision for a CVE finding. */
+  triage?: TriageVerdict;
+  /**
+   * Builder-approved proceed-with-reason override when `reason ===
+   * "vulnerability_user_override"`. Server scrubs `reason` and caps lengths.
+   */
+  userOverride?: {
+    packages: string[];
+    reason: string;
+  };
   // application attribution: NOT a wire field. The server derives it from the
   // trusted scoped-JWT claim (`ctx.jwtClaims.app_id`) — a payload-controlled
   // value would let any authenticated caller forge audit rows against another

package/src/types/deployment/deployQueueStatus.ts

@@ -24,11 +24,25 @@ export type LifecycleStageKind = 'provisioning' | 'migrating';
  */
 export type LifecycleStageState = 'pending' | 'in_progress' | 'complete' | 'failed';
 
+/**
+ * Per-datatag row under a parent lifecycle stage when deploy fanned out
+ * across multiple deployed Environments profiles.
+ */
+export interface LifecycleStageTargetProgress {
+  bindingKey: string;
+  profile: string;
+  state: LifecycleStageState;
+  errorCode?: string;
+  errorMessage?: string;
+}
+
 export interface LifecycleStageProgress {
   kind: LifecycleStageKind;
   state: LifecycleStageState;
   errorCode?: string;
   errorMessage?: string;
+  /** Present when multiple profile-scoped bindings participate in this stage. */
+  targets?: LifecycleStageTargetProgress[];
 }
 
 /**

package/src/types/deployment/index.ts

@@ -4,7 +4,8 @@ export {
   type DeployStatusResponseStatus,
   type LifecycleStageKind,
   type LifecycleStageProgress,
-  type LifecycleStageState
+  type LifecycleStageState,
+  type LifecycleStageTargetProgress
 } from './deployQueueStatus.js';
 
 export interface DeploymentDto {

package/src/types/policyGate/index.ts

@@ -1,4 +1,8 @@
-// Single source of truth for the built-in security scan surfaces; flip to `true` to restore the security-scan UI and execution.
+/**
+ * @deprecated Use the `superblocks.policy-gates.security-scans.enabled` LaunchDarkly flag instead.
+ * Kept as `false` to match the fail-closed LD default; create and enable the
+ * LD flag to turn built-in scans on.
+ */
 export const SECURITY_SCANS_ENABLED: boolean = false;
 
 export type PolicyGateReadinessAction =

package/src/types/publishPipeline/plan.test.ts

@@ -106,7 +106,7 @@ describe('applyBlockedByEligibility', () => {
         id: 'policy_gates:before_deploy',
         kind: 'policy_gates',
         status: 'in_progress',
-        displayName: 'Policy Agents'
+        displayName: 'Pre-Publish Policies'
       }),
       step({
         id: 'publish',
@@ -135,12 +135,12 @@ describe('applyBlockedByEligibility', () => {
         id: 'policy_gates:before_deploy',
         kind: 'policy_gates',
         status: 'in_progress',
-        displayName: 'Policy Agents'
+        displayName: 'Pre-Publish Policies'
       })
     ]);
     expect(steps[1].blockedBy).toBeUndefined();
     expect(steps[1].status).toBe('in_progress');
-    expect(steps[1].displayName).toBe('Policy Agents');
+    expect(steps[1].displayName).toBe('Pre-Publish Policies');
   });
 
   test('keeps a pending policy gate idle rather than waiting on the build', () => {

package/src/types/publishPipeline/plan.ts

@@ -51,7 +51,7 @@ const PENDING_DISPLAY_NAMES: Record<PublishStepKind, string> = {
   build: 'Build',
   database_migration: 'Database migration',
   database_provisioning: 'Database provisioning',
-  policy_gates: 'Policy Agents',
+  policy_gates: 'Pre-Publish Policies',
   publish: 'Publish'
 };
 

package/src/types/rbac/index.ts

@@ -187,6 +187,7 @@ export enum ActionTypeEnum {
   RUN = 'run',
   SHARE = 'share',
   UPDATE = 'update',
+  USE = 'use',
   VIEW = 'view'
 }
 
@@ -285,7 +286,8 @@ export const ActionTypeByResourceType = {
     READ: ActionTypeEnum.READ
   },
   NATIVE_DATABASES: {
-    MANAGE: ActionTypeEnum.MANAGE
+    MANAGE: ActionTypeEnum.MANAGE,
+    USE: ActionTypeEnum.USE
   },
   NPM_REGISTRY: {
     MANAGE: ActionTypeEnum.MANAGE

package/src/types/reviewPolicy/index.ts

@@ -3,6 +3,14 @@ export const AI_AGENT_STATUSES = ['active', 'disabled'] as const;
 export const REVIEW_POLICY_NAME_MAX_LENGTH = 120;
 export const REVIEW_POLICY_PROMPT_MAX_LENGTH = 10000;
 
+// Display name of the Superblocks-managed built-in security scan. One per organization.
+export const BUILT_IN_SECURITY_SCAN_NAME = 'Security Scan';
+
+// Display name of the Superblocks-managed security agent. One per organization; its prompt is owned
+// by the platform, so admins can only enable it and choose its mode. No "Superblocks" / "Built-in"
+// prefix until custom policies exist (APPS-5379).
+export const SUPERBLOCKS_SECURITY_AGENT_NAME = 'Security Agent';
+
 export const REVIEW_POLICY_TYPES = ['built_in_security_scan', 'security_agent'] as const;
 export const REVIEW_POLICY_SOURCES = ['admin_configured', 'superblocks_managed'] as const;
 export const REVIEW_POLICY_TRIGGERS = ['before_deploy', 'after_checkpoint', 'manual'] as const;
@@ -22,6 +30,7 @@ export const REVIEW_FINDING_CATEGORIES = [
   'security_agent',
   'secret',
   'sensitive_data',
+  'static_analysis',
   'vulnerability'
 ] as const;
 
@@ -67,6 +76,10 @@ export type ReviewRunTriggeredBy = (typeof REVIEW_RUN_TRIGGERED_BYS)[number];
 
 export type ReviewPolicyScopeType = 'all_apps' | 'limited';
 
+export type ReviewPolicyScopeDto = { type: 'all_apps' } | { type: 'limited'; applicationIds: string[] };
+
+export type ReviewPolicyScopeInput = { type: 'all_apps' } | { type: 'limited'; applicationIds: string[] };
+
 export interface ReviewPolicyLastRunDto {
   id: string;
   status: ReviewRunStatus;
@@ -84,7 +97,7 @@ export interface ReviewPolicyDto {
   name: string;
   status: AiAgentStatus;
   mode: ReviewPolicyMode;
-  scope: { type: ReviewPolicyScopeType };
+  scope: ReviewPolicyScopeDto;
   lastRun: ReviewPolicyLastRunDto | null;
   freshPendingApprovalRunCount: number;
   createdBy: string | null;
@@ -164,10 +177,36 @@ export interface ReviewPolicySummaryDto {
 }
 
 export type CreateReviewPolicyBody =
-  | { policyType: 'built_in_security_scan'; mode?: ReviewPolicyMode }
-  | { policyType: 'security_agent'; mode: ReviewPolicyMode; name: string; prompt: string };
+  | { policyType: 'built_in_security_scan'; mode?: ReviewPolicyMode; scope?: ReviewPolicyScopeInput }
+  | { policyType: 'security_agent'; source: 'superblocks_managed'; scope?: ReviewPolicyScopeInput }
+  | {
+      policyType: 'security_agent';
+      mode: ReviewPolicyMode;
+      name: string;
+      prompt: string;
+      scope?: ReviewPolicyScopeInput;
+    };
 
 export type UpdateReviewPolicyBody = { status: AiAgentStatus };
 export type UpdateReviewPolicyConfigBody =
-  | { activeVersionId: string; policyType: 'built_in_security_scan'; mode: ReviewPolicyMode }
-  | { activeVersionId: string; policyType: 'security_agent'; mode: ReviewPolicyMode; name: string; prompt: string };
+  | {
+      activeVersionId: string;
+      policyType: 'built_in_security_scan';
+      mode: ReviewPolicyMode;
+      scope?: ReviewPolicyScopeInput;
+    }
+  | {
+      activeVersionId: string;
+      policyType: 'security_agent';
+      source: 'superblocks_managed';
+      mode: ReviewPolicyMode;
+      scope?: ReviewPolicyScopeInput;
+    }
+  | {
+      activeVersionId: string;
+      policyType: 'security_agent';
+      mode: ReviewPolicyMode;
+      name: string;
+      prompt: string;
+      scope?: ReviewPolicyScopeInput;
+    };