@vibesdotdev/security 0.0.0-stage → 1.0.0-rc.4

package/dist/implementations/scanner.impl.js

@@ -0,0 +1,166 @@
+import { SecurityContentSchema, SecurityScannerOverridesSchema, SecurityScannerOptionsSchema } from "../schemas/contracts/scanner.js";
+const SECRET_RULES = [
+    {
+        id: 'secret.named-credential',
+        source: '(?:api[_-]?key|secret[_-]?key|auth[_-]?token|access[_-]?token| bearer)\\s*[:=]\\s*[\'"]?[a-zA-Z0-9_-]{20,}[\'"]?',
+        flags: 'gi',
+        severity: 'critical',
+        kind: 'secret_leak',
+        description: 'Potential secret or API key detected'
+    },
+    {
+        id: 'secret.password',
+        source: '(?:password|passwd|pwd)\\s*[:=]\\s*[\'"]?[^\\s\'"]+[\'"]?',
+        flags: 'gi',
+        severity: 'critical',
+        kind: 'secret_leak',
+        description: 'Potential secret or API key detected'
+    },
+    {
+        id: 'secret.github-token',
+        source: '(?:ghp_|gho_|ghu_|ghs_|ghr_)[a-zA-Z0-9]{36}',
+        flags: 'g',
+        severity: 'critical',
+        kind: 'secret_leak',
+        description: 'Potential secret or API key detected'
+    },
+    {
+        id: 'secret.provider-key',
+        source: '(?:sk-|pk_)[a-zA-Z0-9]{48}',
+        flags: 'g',
+        severity: 'critical',
+        kind: 'secret_leak',
+        description: 'Potential secret or API key detected'
+    }
+];
+const PII_RULES = [
+    {
+        id: 'pii.ssn',
+        source: '\\b\\d{3}[-.\\s]?\\d{2}[-.\\s]?\\d{4}\\b',
+        flags: 'g',
+        severity: 'medium',
+        kind: 'pii',
+        description: 'Potential PII detected (SSN, passport, email)'
+    },
+    {
+        id: 'pii.passport',
+        source: '\\b[A-Z]{2}\\d{6,9}\\b',
+        flags: 'g',
+        severity: 'medium',
+        kind: 'pii',
+        description: 'Potential PII detected (SSN, passport, email)'
+    },
+    {
+        id: 'pii.email',
+        // Both runs are bounded: an address has at most a 64-octet local part and
+        // a 126-octet domain (RFC 5321). An open `[...]+ ` local part made every
+        // start position backtrack across the whole input, so a long run of
+        // ordinary characters with no `@` anywhere cost O(n^2) — a paste of
+        // 200 KB stalled the scanner for seconds.
+        source: '[a-zA-Z0-9._%+-]{1,64}@[a-zA-Z0-9.-]{1,126}\\.[a-zA-Z]{2,}',
+        flags: 'g',
+        severity: 'medium',
+        kind: 'pii',
+        description: 'Potential PII detected (SSN, passport, email)'
+    }
+];
+const PROMPT_INJECTION_RULES = [
+    {
+        id: 'injection.instruction-override',
+        // The modifier is REPEATED, not optional: the canonical phrase is
+        // "ignore ALL PREVIOUS instructions", two words. An alternation of
+        // exactly one modifier never matched the phrase this rule exists to
+        // catch, so the detector reported a clean scan on the most obvious
+        // injection there is. `\s+` between repeats also keeps "ignore previous
+        // instructions" matching.
+        source: '\\b(?:ignore|disregard|forget)\\s+(?:(?:all\\s+)?(?:previous|prior|earlier)\\s+)+(?:instructions?|rules?|directives?|prompts?)\\b',
+        flags: 'gi',
+        severity: 'high',
+        kind: 'prompt_injection',
+        description: 'Potential prompt injection pattern detected'
+    },
+    {
+        id: 'injection.persona-swap',
+        source: '\\b(?:you\\s+are\\s+now|act\\s+as|pretend\\s+to\\s+be|in\\s+the\\s+role\\s+of)\\b',
+        flags: 'gi',
+        severity: 'high',
+        kind: 'prompt_injection',
+        description: 'Potential prompt injection pattern detected'
+    },
+    {
+        id: 'injection.system-prompt',
+        source: 'system\\s*prompt\\s*(?:leak|extraction|injection)',
+        flags: 'gi',
+        severity: 'high',
+        kind: 'prompt_injection',
+        description: 'Potential prompt injection pattern detected'
+    },
+    {
+        id: 'injection.markup',
+        source: '<\\/?(?:script|style)[^>]*>',
+        flags: 'gi',
+        severity: 'high',
+        kind: 'prompt_injection',
+        description: 'Potential prompt injection pattern detected'
+    }
+];
+function scanWith(rules, content, into) {
+    for (const rule of rules) {
+        // A fresh RegExp per rule per call: a shared /g object carries lastIndex
+        // between calls, and a scanner that answers differently the second time
+        // is a scanner that stops finding the thing it exists to find.
+        // Markup consumes through the next terminator once. If none exists, stop:
+        // retrying [^>]* at every '<script' would rescan the same suffix.
+        if (rule.id === 'injection.markup') {
+            const opening = /<\/?(?:script|style)/gi;
+            let start;
+            while ((start = opening.exec(content)) !== null) {
+                const end = content.indexOf('>', opening.lastIndex);
+                if (end < 0)
+                    break;
+                into.push({
+                    severity: rule.severity, kind: rule.kind, description: rule.description,
+                    matches: [{ pattern: rule.id, index: start.index, length: end + 1 - start.index }]
+                });
+                opening.lastIndex = end + 1;
+            }
+            continue;
+        }
+        const pattern = new RegExp(rule.source, rule.flags);
+        let match;
+        while ((match = pattern.exec(content)) !== null) {
+            into.push({
+                severity: rule.severity,
+                kind: rule.kind,
+                description: rule.description,
+                matches: [{ pattern: rule.id, index: match.index, length: match[0].length }]
+            });
+            if (match[0].length === 0)
+                pattern.lastIndex = match.index + 1;
+        }
+    }
+}
+function scanContent(content, options) {
+    const threats = [];
+    if (options?.detectSecrets ?? true)
+        scanWith(SECRET_RULES, content, threats);
+    if (options?.detectPII ?? true)
+        scanWith(PII_RULES, content, threats);
+    if (options?.detectPromptInjection ?? true)
+        scanWith(PROMPT_INJECTION_RULES, content, threats);
+    return threats;
+}
+export default class BuiltinScanner {
+    descriptor;
+    constructor(descriptor) {
+        this.descriptor = descriptor;
+    }
+    async scan(content, options) {
+        content = SecurityContentSchema.parse(content);
+        const overrides = SecurityScannerOverridesSchema.optional().parse(options) ?? {};
+        const supplied = Object.fromEntries(Object.entries(overrides).filter(([, value]) => value !== undefined));
+        const settings = SecurityScannerOptionsSchema.parse({ ...this.descriptor.options, ...supplied });
+        return { threats: scanContent(content, settings), scanAvailable: true };
+    }
+}
+//# sourceMappingURL=scanner.impl.js.map

package/dist/implementations/scanner.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.impl.js","sourceRoot":"","sources":["../../src/implementations/scanner.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAwBtI,MAAM,YAAY,GAA0B;IAC3C;QACC,EAAE,EAAE,yBAAyB;QAC7B,MAAM,EAAE,kHAAkH;QAC1H,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,sCAAsC;KACnD;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,MAAM,EAAE,2DAA2D;QACnE,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,sCAAsC;KACnD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,MAAM,EAAE,6CAA6C;QACrD,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,sCAAsC;KACnD;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,MAAM,EAAE,4BAA4B;QACpC,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,sCAAsC;KACnD;CACD,CAAC;AAEF,MAAM,SAAS,GAA0B;IACxC;QACC,EAAE,EAAE,SAAS;QACb,MAAM,EAAE,0CAA0C;QAClD,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,+CAA+C;KAC5D;IACD;QACC,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,wBAAwB;QAChC,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,+CAA+C;KAC5D;IACD;QACC,EAAE,EAAE,WAAW;QACf,0EAA0E;QAC1E,yEAAyE;QACzE,oEAAoE;QACpE,oEAAoE;QACpE,0CAA0C;QAC1C,MAAM,EAAE,4DAA4D;QACpE,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,+CAA+C;KAC5D;CACD,CAAC;AAEF,MAAM,sBAAsB,GAA0B;IACrD;QACC,EAAE,EAAE,gCAAgC;QACpC,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,wEAAwE;QACxE,0BAA0B;QAC1B,MAAM,EAAE,mIAAmI;QAC3I,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,6CAA6C;KAC1D;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,MAAM,EAAE,mFAAmF;QAC3F,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,6CAA6C;KAC1D;IACD;QACC,EAAE,EAAE,yBAAyB;QAC7B,MAAM,EAAE,mDAAmD;QAC3D,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,6CAA6C;KAC1D;IACD;QACC,EAAE,EAAE,kBAAkB;QACtB,MAAM,EAAE,6BAA6B;QACrC,KAAK,EAAE,IAAI;QACX,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,6CAA6C;KAC1D;CACD,CAAC;AAIF,SAAS,QAAQ,CAAC,KAA4B,EAAE,OAAe,EAAE,IAAsB;IACtF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,yEAAyE;QACzE,wEAAwE;QACxE,+DAA+D;QAC/D,0EAA0E;QACpE,kEAAkE;QAClE,IAAI,IAAI,CAAC,EAAE,KAAK,kBAAkB,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,wBAAwB,CAAC;YACzC,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,IAAI,GAAG,GAAG,CAAC;oBAAE,MAAM;gBACnB,IAAI,CAAC,IAAI,CAAC;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;oBACvE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;iBACrF,CAAC,CAAC;gBACH,OAAO,CAAC,SAAS,GAAG,GAAG,GAAG,CAAC,CAAC;YAChC,CAAC;YACD,SAAS;QACb,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aAC5E,CAAC,CAAC;YACH,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QAChE,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CACnB,OAAe,EACf,OAA2F;IAE3F,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,OAAO,EAAE,aAAa,IAAI,IAAI;QAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7E,IAAI,OAAO,EAAE,SAAS,IAAI,IAAI;QAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,OAAO,EAAE,qBAAqB,IAAI,IAAI;QAAE,QAAQ,CAAC,sBAAsB,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/F,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,cAAc;IACb;IAArB,YAAqB,UAAqC;QAArC,eAAU,GAAV,UAAU,CAA2B;IAAG,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAqC;QAChE,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,8BAA8B,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC;QAC1G,MAAM,QAAQ,GAAG,4BAA4B,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QACjG,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACzE,CAAC;CACD"}

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+export { ValidationError } from './implementations/errors.ts';
+export { generateEncryptionKey, SecretEncryption } from './implementations/encryption.ts';
+export { boundEncryptionKeyHex, readOrCreateKeyFile, resolveEncryptionKeyHex, resolveEncryptionKeyHexForBase, SECRET_ENCRYPTION_KEY_CREDENTIAL, type EncryptionKeyRuntime } from './implementations/keys.ts';
+export type { EncryptedSecret } from './schemas/encryption.ts';
+export { securityScannerKind, securityRedactorKind, securityPolicyKind, securityAuditorKind, securityDepScannerKind, securityIOCFeedKind, securityFreshnessPolicyKind, } from './kinds/index.ts';
+export type { SecurityScannerDescriptor, SecurityScannerService, SecurityScannerOptions, SecurityScannerResult, ThreatMatch, } from './kinds/scanner.kind.ts';
+export type { DepScannerDescriptor, DepScannerService, DepScanReport, IOCEntry, } from './kinds/dep-scanner.kind.ts';
+export type { IOCFeedDescriptor, IOCFeedService, IOCFeedEntry, IOCFeedSyncStatus, } from './kinds/ioc-feed.kind.ts';
+export type { FreshnessPolicyDescriptor, FreshnessPolicyService, FreshnessVerdict, } from './kinds/freshness-policy.kind.ts';
+export type { SecurityRedactorDescriptor, SecurityRedactorService, SecurityRedactorResult, RedactionMatch, } from './kinds/redactor.kind.ts';
+export type { SecurityPolicyDescriptor, SecurityPolicyService, PolicyOutcome, PolicyEvaluationContext, PolicyRule, } from './kinds/policy.kind.ts';
+export type { SecurityAuditorDescriptor, SecurityAuditorService, AuditQueryOptions, } from './kinds/auditor.kind.ts';
+export { SecurityPolicySchema, ThreatReportSchema, RedactionRuleSchema, AuditEventSchema, AuditQueryOptionsSchema, type SecurityPolicy, type ThreatReport, type RedactionRule, type AuditEvent, } from './schemas/index.ts';
+export { matchesPattern, findMatches, isIpInRange, isIpPrivate, extensionToMime, mimeToExtensions, sanitizeFilename, constantTimeEqual, constantTimeEqualBytes, } from './helpers/index.ts';
+export type { SecurityClient } from './security-client/index.ts';
+export type { ScanInputInput, ScanInputOutput, RedactOutputInput, RedactOutputOutput, CheckPolicyInput, CheckPolicyOutput, ReportEventInput, ReportEventOutput, } from './tools/index.ts';
+export type { CLIGroupAssetDescriptor, CLICommandAssetDescriptor, } from './cli/index.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,8BAA8B,EAC9B,gCAAgC,EAChC,KAAK,oBAAoB,EACzB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG/D,OAAO,EACN,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,GAC3B,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACX,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,GACX,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,EACb,QAAQ,GACR,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACX,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACX,yBAAyB,EACzB,sBAAsB,EACtB,gBAAgB,GAChB,MAAM,kCAAkC,CAAC;AAE1C,YAAY,EACX,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,EACtB,cAAc,GACd,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACX,wBAAwB,EACxB,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,UAAU,GACV,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EACX,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACN,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,UAAU,GACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACN,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGjE,YAAY,EACX,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GACjB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACX,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,11 @@
+// Core security exports
+export { ValidationError } from "./implementations/errors.js";
+export { generateEncryptionKey, SecretEncryption } from "./implementations/encryption.js";
+export { boundEncryptionKeyHex, readOrCreateKeyFile, resolveEncryptionKeyHex, resolveEncryptionKeyHexForBase, SECRET_ENCRYPTION_KEY_CREDENTIAL } from "./implementations/keys.js";
+// Runtime kinds
+export { securityScannerKind, securityRedactorKind, securityPolicyKind, securityAuditorKind, securityDepScannerKind, securityIOCFeedKind, securityFreshnessPolicyKind, } from "./kinds/index.js";
+// Schemas
+export { SecurityPolicySchema, ThreatReportSchema, RedactionRuleSchema, AuditEventSchema, AuditQueryOptionsSchema, } from "./schemas/index.js";
+// Helpers
+export { matchesPattern, findMatches, isIpInRange, isIpPrivate, extensionToMime, mimeToExtensions, sanitizeFilename, constantTimeEqual, constantTimeEqualBytes, } from "./helpers/index.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,wBAAwB;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAC1F,OAAO,EACN,qBAAqB,EACrB,mBAAmB,EACnB,uBAAuB,EACvB,8BAA8B,EAC9B,gCAAgC,EAEhC,MAAM,2BAA2B,CAAC;AAGnC,gBAAgB;AAChB,OAAO,EACN,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,GAC3B,MAAM,kBAAkB,CAAC;AAiD1B,UAAU;AACV,OAAO,EACN,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,GAKvB,MAAM,oBAAoB,CAAC;AAE5B,UAAU;AACV,OAAO,EACN,cAAc,EACd,WAAW,EACX,WAAW,EACX,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACtB,MAAM,oBAAoB,CAAC"}

package/dist/kinds/auditor.kind.d.ts

@@ -0,0 +1,31 @@
+import { type SecurityAuditorDescriptor, type SecurityAuditorService } from '../schemas/contracts/auditor.ts';
+export { SecurityAuditorDescriptorSchema, type SecurityAuditorDescriptor, SecurityAuditorServiceSchema, type SecurityAuditorService } from '../schemas/contracts/auditor.ts';
+import { type AuditEvent, type AuditQueryOptions } from '../schemas/AuditEvent.ts';
+export { AuditEventSchema, type AuditEvent, type AuditQueryOptions } from '../schemas/AuditEvent.ts';
+declare class DefaultSecurityAuditorService implements SecurityAuditorService {
+    readonly descriptor: SecurityAuditorDescriptor;
+    private readonly events;
+    constructor(descriptor: SecurityAuditorDescriptor);
+    emit(event: AuditEvent): Promise<void>;
+    query(options?: AuditQueryOptions): Promise<AuditEvent[]>;
+}
+declare function resolveAuditor(candidates: SecurityAuditorDescriptor[]): SecurityAuditorDescriptor | undefined;
+export declare const securityAuditorKind: {
+    readonly id: "security/auditor";
+    readonly descriptorSchema: import("zod/v4").ZodObject<{
+        id: import("zod/v4").ZodString;
+        kind: import("zod/v4").ZodLiteral<"security/auditor">;
+        name: import("zod/v4").ZodString;
+        description: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+        enabled: import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>;
+        tags: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodString>>;
+        hardware: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+    }, import("zod/v4/core").$strip>;
+    readonly defaultImplementation: typeof DefaultSecurityAuditorService;
+    readonly resolve: typeof resolveAuditor;
+    readonly contexts: readonly [];
+};
+//# sourceMappingURL=auditor.kind.d.ts.map

package/dist/kinds/auditor.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditor.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/auditor.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,yBAAyB,EAAE,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAC/I,OAAO,EAAE,+BAA+B,EAAE,KAAK,yBAAyB,EAAE,4BAA4B,EAAE,KAAK,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAG7K,OAAO,EAA6C,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAErG,cAAM,6BAA8B,YAAW,sBAAsB;IACpE,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;gBAE/B,UAAU,EAAE,yBAAyB;IAI3C,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAItC,KAAK,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAgBnE;AAED,iBAAS,cAAc,CACtB,UAAU,EAAE,yBAAyB,EAAE,GACrC,yBAAyB,GAAG,SAAS,CAGvC;AAED,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;CAMgE,CAAC"}

package/dist/kinds/auditor.kind.js

@@ -0,0 +1,48 @@
+import { SecurityAuditorDescriptorSchema } from "../schemas/contracts/auditor.js";
+export { SecurityAuditorDescriptorSchema, SecurityAuditorServiceSchema } from "../schemas/contracts/auditor.js";
+import { AuditEventSchema, AuditQueryOptionsSchema } from "../schemas/AuditEvent.js";
+export { AuditEventSchema } from "../schemas/AuditEvent.js";
+class DefaultSecurityAuditorService {
+    descriptor;
+    events = [];
+    constructor(descriptor) {
+        this.descriptor = descriptor;
+    }
+    async emit(event) {
+        this.events.push(AuditEventSchema.parse(event));
+    }
+    async query(options = {}) {
+        options = AuditQueryOptionsSchema.parse(options);
+        const from = options.from ? Date.parse(options.from) : undefined;
+        const to = options.to ? Date.parse(options.to) : undefined;
+        const results = this.events.filter((event) => {
+            if (options.actor && event.actor !== options.actor)
+                return false;
+            if (options.action && event.action !== options.action)
+                return false;
+            if (options.resource && event.resource !== options.resource)
+                return false;
+            if (options.outcome && event.outcome !== options.outcome)
+                return false;
+            const timestamp = Date.parse(event.timestamp);
+            if (from !== undefined && timestamp < from)
+                return false;
+            if (to !== undefined && timestamp > to)
+                return false;
+            return true;
+        });
+        return options.limit !== undefined ? results.slice(0, options.limit) : results;
+    }
+}
+function resolveAuditor(candidates) {
+    const enabled = candidates.filter((d) => d.enabled !== false);
+    return enabled[0];
+}
+export const securityAuditorKind = {
+    id: 'security/auditor',
+    descriptorSchema: SecurityAuditorDescriptorSchema,
+    defaultImplementation: DefaultSecurityAuditorService,
+    resolve: resolveAuditor,
+    contexts: [],
+};
+//# sourceMappingURL=auditor.kind.js.map

package/dist/kinds/auditor.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auditor.kind.js","sourceRoot":"","sources":["../../src/kinds/auditor.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAA+D,MAAM,iCAAiC,CAAC;AAC/I,OAAO,EAAE,+BAA+B,EAAkC,4BAA4B,EAA+B,MAAM,iCAAiC,CAAC;AAG7K,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAA2C,MAAM,0BAA0B,CAAC;AAC9H,OAAO,EAAE,gBAAgB,EAA2C,MAAM,0BAA0B,CAAC;AAErG,MAAM,6BAA6B;IACzB,UAAU,CAA4B;IAC9B,MAAM,GAAiB,EAAE,CAAC;IAE3C,YAAY,UAAqC;QAChD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAiB;QAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAA6B,EAAE;QAC1C,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5C,IAAI,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACjE,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACpE,IAAI,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1E,IAAI,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACvE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,SAAS,IAAI,SAAS,GAAG,IAAI;gBAAE,OAAO,KAAK,CAAC;YACzD,IAAI,EAAE,KAAK,SAAS,IAAI,SAAS,GAAG,EAAE;gBAAE,OAAO,KAAK,CAAC;YACrD,OAAO,IAAI,CAAC;QACb,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChF,CAAC;CACD;AAED,SAAS,cAAc,CACtB,UAAuC;IAEvC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,EAAE,EAAE,kBAAkB;IACtB,gBAAgB,EAAE,+BAA+B;IACjD,qBAAqB,EAAE,6BAA6B;IACpD,OAAO,EAAE,cAAc;IACvB,QAAQ,EAAE,EAAE;CACmF,CAAC"}

package/dist/kinds/dep-scanner.kind.d.ts

@@ -0,0 +1,27 @@
+import { type DepScanReport, type DepScannerDescriptor, type DepScannerService } from '../schemas/contracts/dep-scanner.ts';
+export { IOCEntrySchema, type IOCEntry, DepScanReportSchema, type DepScanReport, DepScannerDescriptorSchema, type DepScannerDescriptor, DepScannerServiceSchema, type DepScannerService } from '../schemas/contracts/dep-scanner.ts';
+declare class DefaultDepScannerService implements DepScannerService {
+    readonly descriptor: DepScannerDescriptor;
+    constructor(descriptor: DepScannerDescriptor);
+    scan(_manifest: string): Promise<DepScanReport>;
+}
+declare function resolveDepScanner(candidates: DepScannerDescriptor[]): DepScannerDescriptor | undefined;
+export declare const securityDepScannerKind: {
+    readonly id: "security/dep-scanner";
+    readonly descriptorSchema: import("zod/v4").ZodObject<{
+        id: import("zod/v4").ZodString;
+        kind: import("zod/v4").ZodLiteral<"security/dep-scanner">;
+        name: import("zod/v4").ZodString;
+        description: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+        enabled: import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>;
+        tags: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodString>>;
+        hardware: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+    }, import("zod/v4/core").$strip>;
+    readonly defaultImplementation: typeof DefaultDepScannerService;
+    readonly resolve: typeof resolveDepScanner;
+    readonly contexts: readonly [];
+};
+//# sourceMappingURL=dep-scanner.kind.d.ts.map

package/dist/kinds/dep-scanner.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-scanner.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/dep-scanner.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAA8B,KAAK,oBAAoB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxJ,OAAO,EAAE,cAAc,EAAE,KAAK,QAAQ,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,0BAA0B,EAAE,KAAK,oBAAoB,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAGrO,cAAM,wBAAyB,YAAW,iBAAiB;IACzD,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;gBAE9B,UAAU,EAAE,oBAAoB;IAItC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;CAStD;AAED,iBAAS,iBAAiB,CACxB,UAAU,EAAE,oBAAoB,EAAE,GACjC,oBAAoB,GAAG,SAAS,CAGlC;AAED,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;CAMmD,CAAC"}

package/dist/kinds/dep-scanner.kind.js

@@ -0,0 +1,29 @@
+import { DepScannerDescriptorSchema } from "../schemas/contracts/dep-scanner.js";
+export { IOCEntrySchema, DepScanReportSchema, DepScannerDescriptorSchema, DepScannerServiceSchema } from "../schemas/contracts/dep-scanner.js";
+class DefaultDepScannerService {
+    descriptor;
+    constructor(descriptor) {
+        this.descriptor = descriptor;
+    }
+    async scan(_manifest) {
+        return {
+            verdict: 'unknown',
+            findings: [],
+            scannedAt: new Date().toISOString(),
+            packagesChecked: 0,
+            scannerAvailable: false,
+        };
+    }
+}
+function resolveDepScanner(candidates) {
+    const enabled = candidates.filter((d) => d.enabled !== false);
+    return enabled[0];
+}
+export const securityDepScannerKind = {
+    id: 'security/dep-scanner',
+    descriptorSchema: DepScannerDescriptorSchema,
+    defaultImplementation: DefaultDepScannerService,
+    resolve: resolveDepScanner,
+    contexts: [],
+};
+//# sourceMappingURL=dep-scanner.kind.js.map

package/dist/kinds/dep-scanner.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-scanner.kind.js","sourceRoot":"","sources":["../../src/kinds/dep-scanner.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,0BAA0B,EAAqD,MAAM,qCAAqC,CAAC;AACxJ,OAAO,EAAE,cAAc,EAAiB,mBAAmB,EAAsB,0BAA0B,EAA6B,uBAAuB,EAA0B,MAAM,qCAAqC,CAAC;AAGrO,MAAM,wBAAwB;IACnB,UAAU,CAAuB;IAE1C,YAAY,UAAgC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB;QAC1B,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,eAAe,EAAE,CAAC;YAClB,gBAAgB,EAAE,KAAK;SACxB,CAAC;IACJ,CAAC;CACF;AAED,SAAS,iBAAiB,CACxB,UAAkC;IAElC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,EAAE,EAAE,sBAAsB;IAC1B,gBAAgB,EAAE,0BAA0B;IAC5C,qBAAqB,EAAE,wBAAwB;IAC/C,OAAO,EAAE,iBAAiB;IAC1B,QAAQ,EAAE,EAAE;CACwE,CAAC"}

package/dist/kinds/freshness-policy.kind.d.ts

@@ -0,0 +1,34 @@
+import { type FreshnessInput } from '../schemas/contracts/freshness-policy.ts';
+import { type FreshnessVerdict, type FreshnessPolicyDescriptor, type FreshnessPolicyService } from '../schemas/contracts/freshness-policy.ts';
+export { FreshnessVerdictSchema, type FreshnessVerdict, FreshnessPolicyDescriptorSchema, type FreshnessPolicyDescriptor, FreshnessPolicyServiceSchema, type FreshnessPolicyService } from '../schemas/contracts/freshness-policy.ts';
+declare class DefaultFreshnessPolicyService implements FreshnessPolicyService {
+    readonly descriptor: FreshnessPolicyDescriptor;
+    constructor(descriptor: FreshnessPolicyDescriptor);
+    evaluate(packageName: string, version: string, publishedAt: string): Promise<FreshnessVerdict>;
+    private assess;
+    evaluateMany(packages: FreshnessInput[]): Promise<FreshnessVerdict[]>;
+}
+declare function resolveFreshnessPolicy(candidates: FreshnessPolicyDescriptor[]): FreshnessPolicyDescriptor | undefined;
+export declare const securityFreshnessPolicyKind: {
+    readonly id: "security/freshness-policy";
+    readonly descriptorSchema: import("zod/v4").ZodObject<{
+        id: import("zod/v4").ZodString;
+        kind: import("zod/v4").ZodLiteral<"security/freshness-policy">;
+        name: import("zod/v4").ZodString;
+        description: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+        enabled: import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>;
+        tags: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodString>>;
+        hardware: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+        minAgeHours: import("zod/v4").ZodDefault<import("zod/v4").ZodOptional<import("zod/v4").ZodNumber>>;
+        maxAgeDays: import("zod/v4").ZodOptional<import("zod/v4").ZodNumber>;
+        allowlist: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodString>>;
+        breakglass: import("zod/v4").ZodDefault<import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>>;
+    }, import("zod/v4/core").$strip>;
+    readonly defaultImplementation: typeof DefaultFreshnessPolicyService;
+    readonly resolve: typeof resolveFreshnessPolicy;
+    readonly contexts: readonly [];
+};
+//# sourceMappingURL=freshness-policy.kind.d.ts.map

package/dist/kinds/freshness-policy.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness-policy.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/freshness-policy.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+C,KAAK,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC5H,OAAO,EAAE,KAAK,gBAAgB,EAAmC,KAAK,yBAAyB,EAAE,KAAK,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAC/K,OAAO,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,+BAA+B,EAAE,KAAK,yBAAyB,EAAE,4BAA4B,EAAE,KAAK,sBAAsB,EAAE,MAAM,0CAA0C,CAAC;AAGrO,cAAM,6BAA8B,YAAW,sBAAsB;IACnE,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC;gBAEnC,UAAU,EAAE,yBAAyB;IAI3C,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAIpG,OAAO,CAAC,MAAM;IAqBR,YAAY,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;CAG5E;AAED,iBAAS,sBAAsB,CAC7B,UAAU,EAAE,yBAAyB,EAAE,GACtC,yBAAyB,GAAG,SAAS,CAGvC;AAED,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;CAMwD,CAAC"}

package/dist/kinds/freshness-policy.kind.js

@@ -0,0 +1,47 @@
+import { FreshnessInputSchema, FreshnessInputsSchema } from "../schemas/contracts/freshness-policy.js";
+import { FreshnessPolicyDescriptorSchema } from "../schemas/contracts/freshness-policy.js";
+export { FreshnessVerdictSchema, FreshnessPolicyDescriptorSchema, FreshnessPolicyServiceSchema } from "../schemas/contracts/freshness-policy.js";
+class DefaultFreshnessPolicyService {
+    descriptor;
+    constructor(descriptor) {
+        this.descriptor = descriptor;
+    }
+    async evaluate(packageName, version, publishedAt) {
+        return this.assess(FreshnessInputSchema.parse({ name: packageName, version, publishedAt }));
+    }
+    assess({ name: packageName, version, publishedAt }) {
+        const now = new Date();
+        const pub = new Date(publishedAt);
+        const ageHours = Math.floor((now.getTime() - pub.getTime()) / (1000 * 60 * 60));
+        const policy = {
+            minAgeHours: this.descriptor.minAgeHours,
+            maxAgeDays: this.descriptor.maxAgeDays,
+        };
+        const isAllowlisted = this.descriptor.allowlist?.includes(packageName) ?? false;
+        if (isAllowlisted) {
+            return { packageName, version, publishedAt, ageHours, verdict: 'fresh', policy };
+        }
+        if (ageHours < this.descriptor.minAgeHours) {
+            return { packageName, version, publishedAt, ageHours, verdict: 'stale', policy };
+        }
+        if (this.descriptor.maxAgeDays && ageHours > this.descriptor.maxAgeDays * 24) {
+            return { packageName, version, publishedAt, ageHours, verdict: 'stale', policy };
+        }
+        return { packageName, version, publishedAt, ageHours, verdict: 'fresh', policy };
+    }
+    async evaluateMany(packages) {
+        return FreshnessInputsSchema.parse(packages).map(input => this.assess(input));
+    }
+}
+function resolveFreshnessPolicy(candidates) {
+    const enabled = candidates.filter((d) => d.enabled !== false);
+    return enabled[0];
+}
+export const securityFreshnessPolicyKind = {
+    id: 'security/freshness-policy',
+    descriptorSchema: FreshnessPolicyDescriptorSchema,
+    defaultImplementation: DefaultFreshnessPolicyService,
+    resolve: resolveFreshnessPolicy,
+    contexts: [],
+};
+//# sourceMappingURL=freshness-policy.kind.js.map

package/dist/kinds/freshness-policy.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness-policy.kind.js","sourceRoot":"","sources":["../../src/kinds/freshness-policy.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAuB,MAAM,0CAA0C,CAAC;AAC5H,OAAO,EAAyB,+BAA+B,EAA+D,MAAM,0CAA0C,CAAC;AAC/K,OAAO,EAAE,sBAAsB,EAAyB,+BAA+B,EAAkC,4BAA4B,EAA+B,MAAM,0CAA0C,CAAC;AAGrO,MAAM,6BAA6B;IACxB,UAAU,CAA4B;IAE/C,YAAY,UAAqC;QAC/C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAmB,EAAE,OAAe,EAAE,WAAmB;QACtE,OAAO,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAEO,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAkB;QACxE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;YACxC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU;SACvC,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC;QAChF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnF,CAAC;QACD,IAAI,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;YAC3C,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnF,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAA0B;QAC3C,OAAO,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;CACF;AAED,SAAS,sBAAsB,CAC7B,UAAuC;IAEvC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,EAAE,EAAE,2BAA2B;IAC/B,gBAAgB,EAAE,+BAA+B;IACjD,qBAAqB,EAAE,6BAA6B;IACpD,OAAO,EAAE,sBAAsB;IAC/B,QAAQ,EAAE,EAAE;CACkF,CAAC"}

package/dist/kinds/index.d.ts

@@ -0,0 +1,9 @@
+export { securityScannerKind, type SecurityScannerDescriptor, type SecurityScannerService, type SecurityScannerOptions, type SecurityScannerResult, type ThreatMatch, } from './scanner.kind.ts';
+export { securityRedactorKind, type SecurityRedactorDescriptor, type SecurityRedactorService, type SecurityRedactorResult, type RedactionMatch, type RedactionRule, } from './redactor.kind.ts';
+export { securityPolicyKind, type SecurityPolicyDescriptor, type SecurityPolicyService, type PolicyOutcome, type PolicyEvaluationContext, type PolicyRule, } from './policy.kind.ts';
+export { securityAuditorKind, type SecurityAuditorDescriptor, type SecurityAuditorService, type AuditEvent, type AuditQueryOptions, } from './auditor.kind.ts';
+export { AuditEventSchema } from './auditor.kind.ts';
+export { securityDepScannerKind, type DepScannerDescriptor, type DepScannerService, type DepScanReport, type IOCEntry, } from './dep-scanner.kind.ts';
+export { securityIOCFeedKind, type IOCFeedDescriptor, type IOCFeedService, type IOCFeedEntry, type IOCFeedSyncStatus, } from './ioc-feed.kind.ts';
+export { securityFreshnessPolicyKind, type FreshnessPolicyDescriptor, type FreshnessPolicyService, type FreshnessVerdict, } from './freshness-policy.kind.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/kinds/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/kinds/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,WAAW,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,aAAa,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,kBAAkB,EAClB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,uBAAuB,EAC5B,KAAK,UAAU,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,iBAAiB,GACtB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EACN,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,QAAQ,GACb,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACN,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACrB,MAAM,4BAA4B,CAAC"}

package/dist/kinds/index.js

@@ -0,0 +1,9 @@
+export { securityScannerKind, } from "./scanner.kind.js";
+export { securityRedactorKind, } from "./redactor.kind.js";
+export { securityPolicyKind, } from "./policy.kind.js";
+export { securityAuditorKind, } from "./auditor.kind.js";
+export { AuditEventSchema } from "./auditor.kind.js";
+export { securityDepScannerKind, } from "./dep-scanner.kind.js";
+export { securityIOCFeedKind, } from "./ioc-feed.kind.js";
+export { securityFreshnessPolicyKind, } from "./freshness-policy.kind.js";
+//# sourceMappingURL=index.js.map

package/dist/kinds/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/kinds/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,mBAAmB,GAMnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACN,oBAAoB,GAMpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,kBAAkB,GAMlB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,mBAAmB,GAKnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EACN,sBAAsB,GAKtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACN,mBAAmB,GAKnB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACN,2BAA2B,GAI3B,MAAM,4BAA4B,CAAC"}

package/dist/kinds/ioc-feed.kind.d.ts

@@ -0,0 +1,35 @@
+import { type IOCFeedEntry, type IOCFeedSyncStatus, type IOCFeedDescriptor, type IOCFeedService } from '../schemas/contracts/ioc-feed.ts';
+export { IOCFeedEntrySchema, type IOCFeedEntry, IOCFeedSyncStatusSchema, type IOCFeedSyncStatus, IOCFeedDescriptorSchema, type IOCFeedDescriptor, IOCFeedServiceSchema, type IOCFeedService } from '../schemas/contracts/ioc-feed.ts';
+declare class DefaultIOCFeedService implements IOCFeedService {
+    readonly descriptor: IOCFeedDescriptor;
+    constructor(descriptor: IOCFeedDescriptor);
+    sync(): Promise<IOCFeedSyncStatus>;
+    query(_packageName: string, _version: string): Promise<IOCFeedEntry[]>;
+    getStatus(): Promise<IOCFeedSyncStatus>;
+}
+declare function resolveIOCFeed(candidates: IOCFeedDescriptor[]): IOCFeedDescriptor | undefined;
+export declare const securityIOCFeedKind: {
+    readonly id: "security/ioc-feed";
+    readonly descriptorSchema: import("zod/v4").ZodObject<{
+        id: import("zod/v4").ZodString;
+        kind: import("zod/v4").ZodLiteral<"security/ioc-feed">;
+        name: import("zod/v4").ZodString;
+        description: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+        enabled: import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>;
+        tags: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodString>>;
+        hardware: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+        maxStaleness: import("zod/v4").ZodDefault<import("zod/v4").ZodOptional<import("zod/v4").ZodNumber>>;
+        trustTier: import("zod/v4").ZodDefault<import("zod/v4").ZodOptional<import("zod/v4").ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>>;
+    }, import("zod/v4/core").$strip>;
+    readonly defaultImplementation: typeof DefaultIOCFeedService;
+    readonly resolve: typeof resolveIOCFeed;
+    readonly contexts: readonly [];
+};
+//# sourceMappingURL=ioc-feed.kind.d.ts.map

package/dist/kinds/ioc-feed.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ioc-feed.kind.d.ts","sourceRoot":"","sources":["../../src/kinds/ioc-feed.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAA2B,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,kCAAkC,CAAC;AACnK,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAGtO,cAAM,qBAAsB,YAAW,cAAc;IACnD,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;gBAE3B,UAAU,EAAE,iBAAiB;IAInC,IAAI,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAMlC,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAMtE,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC;CAK9C;AAED,iBAAS,cAAc,CACrB,UAAU,EAAE,iBAAiB,EAAE,GAC9B,iBAAiB,GAAG,SAAS,CAG/B;AAED,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;CAMgD,CAAC"}

package/dist/kinds/ioc-feed.kind.js

@@ -0,0 +1,36 @@
+import { IOCFeedDescriptorSchema } from "../schemas/contracts/ioc-feed.js";
+export { IOCFeedEntrySchema, IOCFeedSyncStatusSchema, IOCFeedDescriptorSchema, IOCFeedServiceSchema } from "../schemas/contracts/ioc-feed.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+class DefaultIOCFeedService {
+    descriptor;
+    constructor(descriptor) {
+        this.descriptor = descriptor;
+    }
+    async sync() {
+        throw new CapabilityError('Compose an IOC feed implementation to access indicators.', 'UNAVAILABLE', {
+            reason: 'ioc-feed-unavailable',
+        });
+    }
+    async query(_packageName, _version) {
+        throw new CapabilityError('Compose an IOC feed implementation to access indicators.', 'UNAVAILABLE', {
+            reason: 'ioc-feed-unavailable',
+        });
+    }
+    async getStatus() {
+        throw new CapabilityError('Compose an IOC feed implementation to access indicators.', 'UNAVAILABLE', {
+            reason: 'ioc-feed-unavailable',
+        });
+    }
+}
+function resolveIOCFeed(candidates) {
+    const enabled = candidates.filter((d) => d.enabled !== false);
+    return enabled[0];
+}
+export const securityIOCFeedKind = {
+    id: 'security/ioc-feed',
+    descriptorSchema: IOCFeedDescriptorSchema,
+    defaultImplementation: DefaultIOCFeedService,
+    resolve: resolveIOCFeed,
+    contexts: [],
+};
+//# sourceMappingURL=ioc-feed.kind.js.map

package/dist/kinds/ioc-feed.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ioc-feed.kind.js","sourceRoot":"","sources":["../../src/kinds/ioc-feed.kind.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6C,uBAAuB,EAA+C,MAAM,kCAAkC,CAAC;AACnK,OAAO,EAAE,kBAAkB,EAAqB,uBAAuB,EAA0B,uBAAuB,EAA0B,oBAAoB,EAAuB,MAAM,kCAAkC,CAAC;AACtO,OAAO,EAAE,eAAe,EAAiC,MAAM,qBAAqB,CAAC;AAErF,MAAM,qBAAqB;IAChB,UAAU,CAAoB;IAEvC,YAAY,UAA6B;QACvC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,aAAa,EAAE;YACnG,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,YAAoB,EAAE,QAAgB;QAChD,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,aAAa,EAAE;YACnG,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS;QACb,MAAM,IAAI,eAAe,CAAC,0DAA0D,EAAE,aAAa,EAAE;YACnG,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,cAAc,CACrB,UAA+B;IAE/B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,EAAE,EAAE,mBAAmB;IACvB,gBAAgB,EAAE,uBAAuB;IACzC,qBAAqB,EAAE,qBAAqB;IAC5C,OAAO,EAAE,cAAc;IACvB,QAAQ,EAAE,EAAE;CACkE,CAAC"}