@telora/daemon 0.15.36 → 0.15.40

package/dist/scanners/workflow.js

@@ -0,0 +1,239 @@
+/**
+ * GitHub Actions workflow scanner -- security-scan engine plugin.
+ *
+ * Detects the `pull_request_target` + checkout-head + cache-write pattern
+ * that lets a fork PR's untrusted code execute with the base repo's
+ * elevated permissions and secrets, and persists artifacts (caches)
+ * back to the base repo. This is the canonical "pwn request" supply
+ * chain vulnerability.
+ *
+ * Matched when ALL three are true for a single job:
+ *   1. Workflow `on:` includes `pull_request_target` (string | array | object).
+ *   2. The job contains an `actions/checkout@*` step whose `with.ref` is
+ *      one of `${{ github.event.pull_request.head.sha }}` or
+ *      `${{ github.event.pull_request.head.ref }}`.
+ *   3. The job contains a cache-write step:
+ *        - `actions/cache@*` (any non-`restore`-suffixed action), or
+ *        - `actions/setup-*` step with `with.cache: true` (or any truthy
+ *          string), or
+ *        - any step after the head-ref checkout whose `with.cache` is truthy.
+ *
+ * Pattern reference: verification-engine.ts (Deps + default factory).
+ *
+ * @module scanners/workflow
+ */
+import { readdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parse as parseYaml } from 'yaml';
+const WORKFLOW_EXTENSIONS = ['.yml', '.yaml'];
+const CHECKOUT_REF_HEAD_SHA = '${{ github.event.pull_request.head.sha }}';
+const CHECKOUT_REF_HEAD_REF = '${{ github.event.pull_request.head.ref }}';
+// ---------------------------------------------------------------------------
+// Defaults -- real fs
+// ---------------------------------------------------------------------------
+const defaultDeps = {
+    readWorkflowsDir: async (repoPath) => {
+        const dir = join(repoPath, '.github', 'workflows');
+        let entries;
+        try {
+            entries = await readdir(dir);
+        }
+        catch {
+            return [];
+        }
+        return entries
+            .filter((name) => WORKFLOW_EXTENSIONS.some((ext) => name.endsWith(ext)))
+            .map((name) => join(dir, name));
+    },
+    readFile: (path) => readFile(path, 'utf8'),
+};
+// ---------------------------------------------------------------------------
+// Type guards -- narrow `unknown` parsed YAML
+// ---------------------------------------------------------------------------
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((v) => typeof v === 'string');
+}
+/** Returns true when the workflow `on:` declaration includes pull_request_target. */
+function hasPullRequestTargetTrigger(on) {
+    if (typeof on === 'string')
+        return on === 'pull_request_target';
+    if (isStringArray(on))
+        return on.includes('pull_request_target');
+    if (isRecord(on))
+        return Object.prototype.hasOwnProperty.call(on, 'pull_request_target');
+    return false;
+}
+function asStep(value) {
+    if (!isRecord(value))
+        return null;
+    const step = {};
+    if (typeof value.uses === 'string')
+        step.uses = value.uses;
+    if (typeof value.run === 'string')
+        step.run = value.run;
+    if (typeof value.name === 'string')
+        step.name = value.name;
+    if (isRecord(value.with))
+        step.with = value.with;
+    return step;
+}
+function getActionName(uses) {
+    // Strip @ref and any subpath after a slash beyond owner/repo. We only need
+    // the canonical `owner/repo` (or `owner/repo/path`) for prefix matching.
+    const atIdx = uses.indexOf('@');
+    return atIdx >= 0 ? uses.slice(0, atIdx) : uses;
+}
+function isCheckoutAction(step) {
+    if (!step.uses)
+        return false;
+    return getActionName(step.uses) === 'actions/checkout';
+}
+function getCheckoutRef(step) {
+    const ref = step.with?.ref;
+    return typeof ref === 'string' ? ref : null;
+}
+function checkoutTargetsForkHead(step) {
+    const ref = getCheckoutRef(step);
+    if (ref === null)
+        return false;
+    return ref === CHECKOUT_REF_HEAD_SHA || ref === CHECKOUT_REF_HEAD_REF;
+}
+/** True when `with.cache` is set to a truthy value (boolean true or any non-empty/non-false string). */
+function hasTruthyCacheInput(step) {
+    const cache = step.with?.cache;
+    if (cache === true)
+        return true;
+    if (typeof cache === 'string') {
+        const normalized = cache.trim().toLowerCase();
+        return normalized.length > 0 && normalized !== 'false' && normalized !== '0';
+    }
+    return false;
+}
+function isCacheWriteStep(step) {
+    if (step.uses) {
+        const action = getActionName(step.uses);
+        // `actions/cache@v4` writes by default. `actions/cache/restore` only restores.
+        if (action === 'actions/cache')
+            return true;
+        // `actions/setup-node`, `actions/setup-python`, etc. with cache: true.
+        if (action.startsWith('actions/setup-') && hasTruthyCacheInput(step))
+            return true;
+    }
+    // Any step that opts into a cache via with.cache (e.g. third-party setup actions).
+    if (hasTruthyCacheInput(step))
+        return true;
+    return false;
+}
+function analyzeJob(job) {
+    const result = {
+        hasCheckoutOfForkHead: false,
+        cacheWriteAfterCheckout: false,
+        matchedLines: [],
+    };
+    if (!isRecord(job))
+        return result;
+    const steps = job.steps;
+    if (!Array.isArray(steps))
+        return result;
+    let sawForkHeadCheckout = false;
+    for (const raw of steps) {
+        const step = asStep(raw);
+        if (!step)
+            continue;
+        if (isCheckoutAction(step) && checkoutTargetsForkHead(step)) {
+            sawForkHeadCheckout = true;
+            result.hasCheckoutOfForkHead = true;
+            const ref = getCheckoutRef(step) ?? '';
+            result.matchedLines.push(`uses: ${step.uses} with ref: ${ref}`);
+            continue;
+        }
+        if (sawForkHeadCheckout && isCacheWriteStep(step)) {
+            result.cacheWriteAfterCheckout = true;
+            if (step.uses) {
+                const cache = step.with?.cache;
+                const cacheNote = cache !== undefined ? ` (cache: ${String(cache)})` : '';
+                result.matchedLines.push(`uses: ${step.uses}${cacheNote}`);
+            }
+            else {
+                result.matchedLines.push(`step: ${step.name ?? '(unnamed)'} with cache`);
+            }
+        }
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+const PATTERN_LABEL = 'pull_request_target + checkout-head + cache-write';
+export function createWorkflowScanner(deps = defaultDeps) {
+    return {
+        iocClass: 'workflow',
+        async scan(ctx) {
+            const files = await deps.readWorkflowsDir(ctx.repoPath);
+            const findings = [];
+            let parseErrors = 0;
+            for (const file of files) {
+                let raw;
+                try {
+                    raw = await deps.readFile(file);
+                }
+                catch {
+                    parseErrors += 1;
+                    continue;
+                }
+                let parsed;
+                try {
+                    parsed = parseYaml(raw);
+                }
+                catch {
+                    parseErrors += 1;
+                    continue;
+                }
+                if (!isRecord(parsed))
+                    continue;
+                if (!hasPullRequestTargetTrigger(parsed.on))
+                    continue;
+                const jobs = parsed.jobs;
+                if (!isRecord(jobs))
+                    continue;
+                const workflowFileName = baseName(file);
+                for (const [jobName, jobValue] of Object.entries(jobs)) {
+                    const analysis = analyzeJob(jobValue);
+                    if (!analysis.hasCheckoutOfForkHead || !analysis.cacheWriteAfterCheckout)
+                        continue;
+                    findings.push({
+                        iocClass: 'workflow',
+                        severity: 'high',
+                        identifier: `${workflowFileName}:${jobName}`,
+                        payload: {
+                            workflow: workflowFileName,
+                            job: jobName,
+                            pattern: PATTERN_LABEL,
+                            matched_lines: analysis.matchedLines,
+                        },
+                    });
+                }
+            }
+            return {
+                findings,
+                coverage: {
+                    workflows_scanned: files.length,
+                    risky_patterns: findings.length,
+                    parse_errors: parseErrors,
+                },
+            };
+        },
+    };
+}
+function baseName(p) {
+    const slash = p.lastIndexOf('/');
+    return slash >= 0 ? p.slice(slash + 1) : p;
+}
+// ---------------------------------------------------------------------------
+// Default scanner -- real fs IO
+// ---------------------------------------------------------------------------
+export const workflowScanner = createWorkflowScanner();
+//# sourceMappingURL=workflow.js.map

package/dist/scanners/workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../src/scanners/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAc1C,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,qBAAqB,GAAG,2CAA2C,CAAC;AAC1E,MAAM,qBAAqB,GAAG,2CAA2C,CAAC;AAE1E,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,WAAW,GAAwB;IACvC,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;aACvE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CAC3C,CAAC;AAEF,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,qFAAqF;AACrF,SAAS,2BAA2B,CAAC,EAAW;IAC9C,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,qBAAqB,CAAC;IAChE,IAAI,aAAa,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAYD,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3D,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACxD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3D,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,IAAkB;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;IAC3B,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAkB;IACjD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,GAAG,KAAK,qBAAqB,IAAI,GAAG,KAAK,qBAAqB,CAAC;AACxE,CAAC;AAED,wGAAwG;AACxG,SAAS,mBAAmB,CAAC,IAAkB;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;IAC/B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,GAAG,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAkB;IAC1C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,+EAA+E;QAC/E,IAAI,MAAM,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAC5C,uEAAuE;QACvE,IAAI,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpF,CAAC;IACD,mFAAmF;IACnF,IAAI,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,KAAK,CAAC;AACf,CAAC;AAQD,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,MAAM,GAAgB;QAC1B,qBAAqB,EAAE,KAAK;QAC5B,uBAAuB,EAAE,KAAK;QAC9B,YAAY,EAAE,EAAE;KACjB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAEzC,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,mBAAmB,GAAG,IAAI,CAAC;YAC3B,MAAM,CAAC,qBAAqB,GAAG,IAAI,CAAC;YACpC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,cAAc,GAAG,EAAE,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QAED,IAAI,mBAAmB,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;gBAC/B,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1E,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,IAAI,WAAW,aAAa,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAE1E,MAAM,UAAU,qBAAqB,CAAC,OAA4B,WAAW;IAC3E,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,CAAC,IAAI,CAAC,GAAgB;YACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAmB,EAAE,CAAC;YACpC,IAAI,WAAW,GAAG,CAAC,CAAC;YAEpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,GAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,IAAI,CAAC,CAAC;oBACjB,SAAS;gBACX,CAAC;gBAED,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,IAAI,CAAC,CAAC;oBACjB,SAAS;gBACX,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAChC,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,EAAE,CAAC;oBAAE,SAAS;gBAEtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAE9B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACxC,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;oBACtC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,IAAI,CAAC,QAAQ,CAAC,uBAAuB;wBAAE,SAAS;oBAEnF,QAAQ,CAAC,IAAI,CAAC;wBACZ,QAAQ,EAAE,UAAU;wBACpB,QAAQ,EAAE,MAAM;wBAChB,UAAU,EAAE,GAAG,gBAAgB,IAAI,OAAO,EAAE;wBAC5C,OAAO,EAAE;4BACP,QAAQ,EAAE,gBAAgB;4BAC1B,GAAG,EAAE,OAAO;4BACZ,OAAO,EAAE,aAAa;4BACtB,aAAa,EAAE,QAAQ,CAAC,YAAY;yBACrC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO;gBACL,QAAQ;gBACR,QAAQ,EAAE;oBACR,iBAAiB,EAAE,KAAK,CAAC,MAAM;oBAC/B,cAAc,EAAE,QAAQ,CAAC,MAAM;oBAC/B,YAAY,EAAE,WAAW;iBAC1B;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,eAAe,GAAY,qBAAqB,EAAE,CAAC"}

package/dist/security-auto-inject.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Severity-gated auto-injection for security findings.
+ *
+ * When the scanner engine writes a finding at or above the configured
+ * auto_inject_severity_threshold, this module:
+ *   1. Resolves the product's Security focus (focus_kind='security').
+ *   2. Creates or reuses an entity node representing the vulnerable surface.
+ *   3. Creates an injection node on the focus's reality tree with
+ *      statement = advisory summary; targets the entity node via a
+ *      reality_tree_edge of kind 'targets'.
+ *   4. Creates a delivery on the Security focus linked to the injection
+ *      via the delivery's injection_id column.
+ *   5. Sets finding.linked_injection_id.
+ *   6. Writes a security_finding_audit row with action='auto_injected'.
+ *
+ * Below-threshold findings are not auto-injected; the FindingsView UI
+ * offers click-to-remediate that calls this same function with a
+ * `force: true` flag (single code path for both auto and manual).
+ *
+ * Suppressed findings (suppression jsonb non-null and not expired) are
+ * skipped entirely.
+ *
+ * @module security-auto-inject
+ */
+import type { Severity } from './security-scan-engine.js';
+export interface FindingForInjection {
+    id: string;
+    organizationId: string;
+    productId: string;
+    iocClass: string;
+    severity: Severity;
+    identifier: string;
+    payload: Record<string, unknown>;
+    status: 'open' | 'resolved' | 'suppressed';
+    suppression: Record<string, unknown> | null;
+    linkedInjectionId: string | null;
+}
+export interface AutoInjectOptions {
+    /** Threshold from the scan config (default 'critical'). */
+    autoInjectThreshold: Severity;
+    /**
+     * When true, bypass the severity threshold (used by the UI's
+     * 'Click to remediate' button on below-threshold findings). The
+     * suppression and already-linked checks still apply.
+     */
+    force?: boolean;
+    /** Actor user id, if the action came from a UI button rather than the daemon. */
+    actorUserId?: string;
+}
+export interface AutoInjectDeps {
+    /** Look up the Security focus id + tree id for a product. */
+    resolveSecurityFocus: (productId: string) => Promise<{
+        focusId: string;
+        treeId: string;
+    } | null>;
+    /**
+     * Create or find an entity node representing the vulnerable surface
+     * (one per identifier per focus, deduplicated server-side).
+     */
+    upsertEntityNode: (input: {
+        treeId: string;
+        organizationId: string;
+        label: string;
+        payload: Record<string, unknown>;
+    }) => Promise<{
+        nodeId: string;
+    }>;
+    /**
+     * Create an injection node + targets edge in a single compound op.
+     */
+    createInjection: (input: {
+        treeId: string;
+        organizationId: string;
+        statement: string;
+        targetNodeId: string;
+        sourcePayload: Record<string, unknown>;
+    }) => Promise<{
+        nodeId: string;
+    }>;
+    /**
+     * Materialize a delivery on the Security focus, linked to the injection.
+     */
+    createDelivery: (input: {
+        focusId: string;
+        productId: string;
+        organizationId: string;
+        name: string;
+        description: string;
+        injectionNodeId: string;
+    }) => Promise<{
+        deliveryId: string;
+    }>;
+    /** Update the finding row with its new linked_injection_id. */
+    linkFinding: (findingId: string, injectionNodeId: string) => Promise<void>;
+    /** Append a finding audit row. */
+    writeAudit: (input: {
+        findingId: string;
+        organizationId: string;
+        action: 'auto_injected' | 'manually_remediated';
+        actorUserId?: string;
+        reason?: string;
+        payload?: Record<string, unknown>;
+    }) => Promise<void>;
+}
+/** Returns true when `severity` is at or above `threshold`. */
+export declare function meetsThreshold(severity: Severity, threshold: Severity): boolean;
+export interface ProcessNewFindingResult {
+    status: 'injected' | 'skipped_below_threshold' | 'skipped_already_linked' | 'skipped_suppressed' | 'skipped_no_security_focus';
+    injectionNodeId?: string;
+    deliveryId?: string;
+}
+export declare function processNewFinding(finding: FindingForInjection, options: AutoInjectOptions, deps: AutoInjectDeps): Promise<ProcessNewFindingResult>;
+export declare function buildDefaultAutoInjectDeps(): AutoInjectDeps;
+//# sourceMappingURL=security-auto-inject.d.ts.map

package/dist/security-auto-inject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-auto-inject.d.ts","sourceRoot":"","sources":["../src/security-auto-inject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAM1D,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;IAC3C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,2DAA2D;IAC3D,mBAAmB,EAAE,QAAQ,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,oBAAoB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;QACnD,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI,CAAC,CAAC;IACV;;;OAGG;IACH,gBAAgB,EAAE,CAAC,KAAK,EAAE;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC;;OAEG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC;;OAEG;IACH,cAAc,EAAE,CAAC,KAAK,EAAE;QACtB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;KACzB,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtC,+DAA+D;IAC/D,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,kCAAkC;IAClC,UAAU,EAAE,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,eAAe,GAAG,qBAAqB,CAAC;QAChD,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAaD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,GAAG,OAAO,CAE/E;AAyCD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,UAAU,GAAG,yBAAyB,GAAG,wBAAwB,GAAG,oBAAoB,GAAG,2BAA2B,CAAC;IAC/H,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,mBAAmB,EAC5B,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,uBAAuB,CAAC,CA4DlC;AAMD,wBAAgB,0BAA0B,IAAI,cAAc,CAyB3D"}

package/dist/security-auto-inject.js

@@ -0,0 +1,148 @@
+/**
+ * Severity-gated auto-injection for security findings.
+ *
+ * When the scanner engine writes a finding at or above the configured
+ * auto_inject_severity_threshold, this module:
+ *   1. Resolves the product's Security focus (focus_kind='security').
+ *   2. Creates or reuses an entity node representing the vulnerable surface.
+ *   3. Creates an injection node on the focus's reality tree with
+ *      statement = advisory summary; targets the entity node via a
+ *      reality_tree_edge of kind 'targets'.
+ *   4. Creates a delivery on the Security focus linked to the injection
+ *      via the delivery's injection_id column.
+ *   5. Sets finding.linked_injection_id.
+ *   6. Writes a security_finding_audit row with action='auto_injected'.
+ *
+ * Below-threshold findings are not auto-injected; the FindingsView UI
+ * offers click-to-remediate that calls this same function with a
+ * `force: true` flag (single code path for both auto and manual).
+ *
+ * Suppressed findings (suppression jsonb non-null and not expired) are
+ * skipped entirely.
+ *
+ * @module security-auto-inject
+ */
+import { callApi } from './queries/shared.js';
+// ---------------------------------------------------------------------------
+// Severity comparison
+// ---------------------------------------------------------------------------
+const SEVERITY_RANK = {
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+/** Returns true when `severity` is at or above `threshold`. */
+export function meetsThreshold(severity, threshold) {
+    return SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
+}
+function isSuppressedAndActive(finding, now = new Date()) {
+    if (finding.status !== 'suppressed')
+        return false;
+    if (!finding.suppression)
+        return false;
+    const s = finding.suppression;
+    if (!s.expires_at)
+        return true;
+    return new Date(s.expires_at).getTime() > now.getTime();
+}
+// ---------------------------------------------------------------------------
+// Statement + label builders
+// ---------------------------------------------------------------------------
+function buildAdvisorySummary(finding) {
+    const payload = finding.payload;
+    const candidates = [
+        typeof payload.title === 'string' ? payload.title : null,
+        typeof payload.summary === 'string' ? payload.summary : null,
+        typeof payload.advisory_text === 'string' ? payload.advisory_text : null,
+    ].filter((s) => Boolean(s));
+    const head = candidates[0] ?? `Security finding ${finding.identifier}`;
+    return `${head} (${finding.iocClass}, severity=${finding.severity})`;
+}
+function buildEntityLabel(finding) {
+    return `${finding.iocClass}:${finding.identifier}`;
+}
+export async function processNewFinding(finding, options, deps) {
+    if (finding.linkedInjectionId)
+        return { status: 'skipped_already_linked' };
+    if (isSuppressedAndActive(finding))
+        return { status: 'skipped_suppressed' };
+    if (!options.force && !meetsThreshold(finding.severity, options.autoInjectThreshold)) {
+        return { status: 'skipped_below_threshold' };
+    }
+    const focus = await deps.resolveSecurityFocus(finding.productId);
+    if (!focus)
+        return { status: 'skipped_no_security_focus' };
+    const entity = await deps.upsertEntityNode({
+        treeId: focus.treeId,
+        organizationId: finding.organizationId,
+        label: buildEntityLabel(finding),
+        payload: { ioc_class: finding.iocClass, identifier: finding.identifier },
+    });
+    const injection = await deps.createInjection({
+        treeId: focus.treeId,
+        organizationId: finding.organizationId,
+        statement: buildAdvisorySummary(finding),
+        targetNodeId: entity.nodeId,
+        sourcePayload: {
+            finding_id: finding.id,
+            ioc_class: finding.iocClass,
+            severity: finding.severity,
+            identifier: finding.identifier,
+        },
+    });
+    const delivery = await deps.createDelivery({
+        focusId: focus.focusId,
+        productId: finding.productId,
+        organizationId: finding.organizationId,
+        name: `Remediate ${buildEntityLabel(finding)}`,
+        description: buildAdvisorySummary(finding),
+        injectionNodeId: injection.nodeId,
+    });
+    await deps.linkFinding(finding.id, injection.nodeId);
+    await deps.writeAudit({
+        findingId: finding.id,
+        organizationId: finding.organizationId,
+        action: options.force ? 'manually_remediated' : 'auto_injected',
+        actorUserId: options.actorUserId,
+        reason: options.force ? 'click_to_remediate' : 'severity_threshold_met',
+        payload: {
+            severity: finding.severity,
+            threshold: options.autoInjectThreshold,
+            delivery_id: delivery.deliveryId,
+            injection_node_id: injection.nodeId,
+        },
+    });
+    return {
+        status: 'injected',
+        injectionNodeId: injection.nodeId,
+        deliveryId: delivery.deliveryId,
+    };
+}
+// ---------------------------------------------------------------------------
+// Default Deps -- daemon-side wiring via callApi.
+// ---------------------------------------------------------------------------
+export function buildDefaultAutoInjectDeps() {
+    return {
+        resolveSecurityFocus: async (productId) => {
+            const res = await callApi('daemon_resolve_security_focus', { productId });
+            return res?.focus ?? null;
+        },
+        upsertEntityNode: async (input) => {
+            return callApi('daemon_upsert_security_entity_node', input);
+        },
+        createInjection: async (input) => {
+            return callApi('daemon_create_security_injection', input);
+        },
+        createDelivery: async (input) => {
+            return callApi('daemon_create_security_delivery', input);
+        },
+        linkFinding: async (findingId, injectionNodeId) => {
+            await callApi('daemon_link_finding_to_injection', { findingId, injectionNodeId });
+        },
+        writeAudit: async (input) => {
+            await callApi('daemon_write_security_finding_audit', input);
+        },
+    };
+}
+//# sourceMappingURL=security-auto-inject.js.map

package/dist/security-auto-inject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-auto-inject.js","sourceRoot":"","sources":["../src/security-auto-inject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAmF9C,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,aAAa,GAA6B;IAC9C,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,SAAmB;IACpE,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;AAC7D,CAAC;AAUD,SAAS,qBAAqB,CAAC,OAA4B,EAAE,MAAY,IAAI,IAAI,EAAE;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,CAAC,GAAG,OAAO,CAAC,WAA+B,CAAC;IAClD,IAAI,CAAC,CAAC,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,oBAAoB,CAAC,OAA4B;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAkC,CAAC;IAC3D,MAAM,UAAU,GAAG;QACjB,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACxD,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAC5D,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;KACzE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,oBAAoB,OAAO,CAAC,UAAU,EAAE,CAAC;IACvE,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,QAAQ,cAAc,OAAO,CAAC,QAAQ,GAAG,CAAC;AACvE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA4B;IACpD,OAAO,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;AACrD,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAA4B,EAC5B,OAA0B,EAC1B,IAAoB;IAEpB,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IAC3E,IAAI,qBAAqB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC5E,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrF,OAAO,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/C,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAE3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAChC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;KACzE,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC;QAC3C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,oBAAoB,CAAC,OAAO,CAAC;QACxC,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,aAAa,EAAE;YACb,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,SAAS,EAAE,OAAO,CAAC,QAAQ;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;QACzC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,IAAI,EAAE,aAAa,gBAAgB,CAAC,OAAO,CAAC,EAAE;QAC9C,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC;QAC1C,eAAe,EAAE,SAAS,CAAC,MAAM;KAClC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,IAAI,CAAC,UAAU,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe;QAC/D,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,wBAAwB;QACvE,OAAO,EAAE;YACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,mBAAmB;YACtC,WAAW,EAAE,QAAQ,CAAC,UAAU;YAChC,iBAAiB,EAAE,SAAS,CAAC,MAAM;SACpC;KACF,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,SAAS,CAAC,MAAM;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,MAAM,OAAO,CACvB,+BAA+B,EAC/B,EAAE,SAAS,EAAE,CACd,CAAC;YACF,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;QAC5B,CAAC;QACD,gBAAgB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,OAAO,OAAO,CAAqB,oCAAoC,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,OAAO,OAAO,CAAqB,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;QACD,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC9B,OAAO,OAAO,CAAyB,iCAAiC,EAAE,KAAK,CAAC,CAAC;QACnF,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE;YAChD,MAAM,OAAO,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC1B,MAAM,OAAO,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/security-rescan-resolution.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Re-scan resolution: when a scan run completes that covered a finding's
+ * IOC class but did not re-produce a previously-open finding, flip the
+ * finding to 'resolved' and (if the linked injection's delivery is done)
+ * auto-verify the injection.
+ *
+ * Called by the scanner engine immediately after a run finishes writing
+ * its findings, before suppression-expiry sweeps and before the next
+ * tick begins.
+ *
+ * @module security-rescan-resolution
+ */
+export interface OpenFindingRow {
+    id: string;
+    organizationId: string;
+    productId: string;
+    iocClass: string;
+    identifier: string;
+    linkedInjectionId: string | null;
+}
+export interface ResolutionDeps {
+    /**
+     * Find all 'open' findings for the product that match the IOC classes
+     * the just-completed scan run covered. The engine knows which classes
+     * ran so the caller filters down to those.
+     */
+    listOpenFindings: (productId: string, iocClasses: string[]) => Promise<OpenFindingRow[]>;
+    /** Set the finding to 'resolved' with resolved_at = now(). */
+    markFindingResolved: (findingId: string) => Promise<void>;
+    /** Append audit row for the resolution. */
+    writeAudit: (input: {
+        findingId: string;
+        organizationId: string;
+        action: 'resolved';
+        payload: Record<string, unknown>;
+    }) => Promise<void>;
+    /**
+     * Returns the execution_status of the delivery linked to the injection,
+     * or null if there is no such delivery.
+     */
+    getInjectionDeliveryStatus: (injectionNodeId: string) => Promise<string | null>;
+    /** Compound op: retire the injection + promote FRT overlays to CRT. */
+    verifyInjection: (injectionNodeId: string) => Promise<void>;
+}
+/**
+ * Map of identifiers that the current run did emit, per IOC class.
+ */
+export interface ScanRunFindingSet {
+    iocClass: string;
+    identifiers: Set<string>;
+}
+/**
+ * Resolve previously-open findings that didn't re-appear in this run.
+ *
+ * @returns the list of finding ids that were flipped to 'resolved'.
+ */
+export declare function resolveStaleFindings(productId: string, observedSets: ScanRunFindingSet[], deps: ResolutionDeps): Promise<string[]>;
+export declare function buildDefaultResolutionDeps(): ResolutionDeps;
+export interface SuppressionExpirySweepDeps {
+    /** Returns findings where status='suppressed' and suppression.expires_at < now(). */
+    listExpiredSuppressions: () => Promise<Array<{
+        id: string;
+        organizationId: string;
+    }>>;
+    /** Set status='open', suppression=null. */
+    unsuppressFinding: (findingId: string) => Promise<void>;
+    /** Append audit row with action='unsuppressed' and reason='suppression_expired'. */
+    writeAudit: (input: {
+        findingId: string;
+        organizationId: string;
+        action: 'unsuppressed';
+        payload: Record<string, unknown>;
+    }) => Promise<void>;
+}
+/**
+ * Sweep suppressions whose expires_at has passed and flip them back to
+ * 'open'. Idempotent: a suppression already expired is a no-op on the
+ * second call because the predicate now matches status='open'.
+ *
+ * @returns the finding ids whose suppression was lifted.
+ */
+export declare function runSuppressionExpirySweep(deps: SuppressionExpirySweepDeps): Promise<string[]>;
+export declare function buildDefaultSuppressionExpirySweepDeps(): SuppressionExpirySweepDeps;
+//# sourceMappingURL=security-rescan-resolution.d.ts.map

package/dist/security-rescan-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-rescan-resolution.d.ts","sourceRoot":"","sources":["../src/security-rescan-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACzF,8DAA8D;IAC9D,mBAAmB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,2CAA2C;IAC3C,UAAU,EAAE,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB;;;OAGG;IACH,0BAA0B,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChF,uEAAuE;IACvE,eAAe,EAAE,CAAC,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,iBAAiB,EAAE,EACjC,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,MAAM,EAAE,CAAC,CAqCnB;AAMD,wBAAgB,0BAA0B,IAAI,cAAc,CA0B3D;AAMD,MAAM,WAAW,0BAA0B;IACzC,qFAAqF;IACrF,uBAAuB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IACtF,2CAA2C;IAC3C,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,oFAAoF;IACpF,UAAU,EAAE,CAAC,KAAK,EAAE;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,cAAc,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,MAAM,EAAE,CAAC,CAcnB;AAED,wBAAgB,sCAAsC,IAAI,0BAA0B,CAgBnF"}