@vibesdotdev/security 0.0.0-stage → 1.0.0-rc.4

package/dist/schemas/contracts/redactor.d.ts

@@ -0,0 +1,99 @@
+import * as z from 'zod/v4';
+export declare const RedactionMatchSchema: z.ZodObject<{
+    pattern: z.ZodString;
+    index: z.ZodNumber;
+    length: z.ZodNumber;
+    replacement: z.ZodString;
+}, z.core.$strip>;
+export type RedactionMatch = z.infer<typeof RedactionMatchSchema>;
+export declare const SecurityRedactorResultSchema: z.ZodObject<{
+    redacted: z.ZodString;
+    matches: z.ZodArray<z.ZodObject<{
+        pattern: z.ZodString;
+        index: z.ZodNumber;
+        length: z.ZodNumber;
+        replacement: z.ZodString;
+    }, z.core.$strip>>;
+    redactorAvailable: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type SecurityRedactorResult = z.infer<typeof SecurityRedactorResultSchema>;
+export declare const SecurityRedactorDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"security/redactor">;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+}, z.core.$strip>;
+export type SecurityRedactorDescriptor = z.output<typeof SecurityRedactorDescriptorSchema>;
+export type { RedactionRule } from '../RedactionRule.ts';
+/** Admission only: optional rules preserve omission; matching budgets belong to implementations. */
+export declare const SecurityRedactorArgumentsSchema: z.ZodTuple<[z.ZodString, z.ZodOptional<z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    pattern: z.ZodString;
+    replacement: z.ZodString;
+    target: z.ZodEnum<{
+        metadata: "metadata";
+        content: "content";
+        header: "header";
+    }>;
+    enabled: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>>>], null>;
+export type SecurityRedactorArguments = z.input<typeof SecurityRedactorArgumentsSchema>;
+export declare const SecurityRedactorServiceSchema: z.ZodObject<{
+    descriptor: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"security/redactor">;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+    }, z.core.$strip>;
+    redact: z.ZodFunction<z.ZodTuple<[z.ZodString, z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        pattern: z.ZodString;
+        replacement: z.ZodString;
+        target: z.ZodEnum<{
+            metadata: "metadata";
+            content: "content";
+            header: "header";
+        }>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>], null>, z.ZodPromise<z.ZodObject<{
+        redacted: z.ZodString;
+        matches: z.ZodArray<z.ZodObject<{
+            pattern: z.ZodString;
+            index: z.ZodNumber;
+            length: z.ZodNumber;
+            replacement: z.ZodString;
+        }, z.core.$strip>>;
+        redactorAvailable: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type SecurityRedactorService = z.infer<typeof SecurityRedactorServiceSchema>;
+export declare const BuiltinRedactionInputSchema: z.ZodObject<{
+    content: z.ZodString;
+    rules: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        pattern: z.ZodString;
+        replacement: z.ZodString;
+        target: z.ZodEnum<{
+            metadata: "metadata";
+            content: "content";
+            header: "header";
+        }>;
+        enabled: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+//# sourceMappingURL=redactor.d.ts.map

package/dist/schemas/contracts/redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.d.ts","sourceRoot":"","sources":["../../../src/schemas/contracts/redactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,eAAO,MAAM,4BAA4B;;;;;;;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,eAAO,MAAM,gCAAgC;;;;;;;;;;;iBAQ3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC3F,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,oGAAoG;AACpG,eAAO,MAAM,+BAA+B;;;;;;;;;;;2BAAiE,CAAC;AAC9G,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACxF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAMxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAGpF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;iBAAqF,CAAC"}

package/dist/schemas/contracts/redactor.js

@@ -0,0 +1,34 @@
+import * as z from 'zod/v4';
+export const RedactionMatchSchema = z.object({
+    pattern: z.string(),
+    index: z.number(),
+    length: z.number(),
+    replacement: z.string(),
+});
+export const SecurityRedactorResultSchema = z.object({
+    redacted: z.string(),
+    matches: z.array(RedactionMatchSchema),
+    redactorAvailable: z.boolean().default(true),
+});
+export const SecurityRedactorDescriptorSchema = z.object({
+    id: z.string(),
+    kind: z.literal('security/redactor'),
+    name: z.string(),
+    description: z.string().optional(),
+    enabled: z.boolean().optional(),
+    tags: z.array(z.string()).optional(),
+    hardware: z.array(z.enum(['consumer', 'cloud'])).optional(),
+});
+import { RedactionRuleSchema } from "../RedactionRule.js";
+/** Admission only: optional rules preserve omission; matching budgets belong to implementations. */
+export const SecurityRedactorArgumentsSchema = z.tuple([z.string(), z.array(RedactionRuleSchema).optional()]);
+export const SecurityRedactorServiceSchema = z.object({
+    descriptor: SecurityRedactorDescriptorSchema,
+    redact: z.function({
+        input: SecurityRedactorArgumentsSchema,
+        output: z.promise(SecurityRedactorResultSchema),
+    }),
+});
+import { SecurityContentSchema } from "./scanner.js";
+export const BuiltinRedactionInputSchema = z.object({ content: SecurityContentSchema, rules: z.array(RedactionRuleSchema).max(64) });
+//# sourceMappingURL=redactor.js.map

package/dist/schemas/contracts/redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.js","sourceRoot":"","sources":["../../../src/schemas/contracts/redactor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACtC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC/C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAC;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,oGAAoG;AACpG,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAE9G,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,UAAU,EAAE,gCAAgC;IAC5C,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;QACf,KAAK,EAAE,+BAA+B;QACtC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC;KAClD,CAAC;CACL,CAAC,CAAC;AAGH,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAC,CAAC,CAAC,MAAM,CAAC,EAAC,OAAO,EAAC,qBAAqB,EAAC,KAAK,EAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAC,CAAC,CAAC"}

package/dist/schemas/contracts/scanner.d.ts

@@ -0,0 +1,112 @@
+import * as z from 'zod/v4';
+/** Optional at call boundaries: omission is allowed; null and malformed fields reject. */
+export declare const SecurityScannerOverridesSchema: z.ZodObject<{
+    detectSecrets: z.ZodOptional<z.ZodBoolean>;
+    detectPII: z.ZodOptional<z.ZodBoolean>;
+    detectPromptInjection: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const SecurityScannerOptionsSchema: z.ZodObject<{
+    detectSecrets: z.ZodDefault<z.ZodBoolean>;
+    detectPII: z.ZodDefault<z.ZodBoolean>;
+    detectPromptInjection: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type SecurityScannerOptions = z.infer<typeof SecurityScannerOptionsSchema>;
+export declare const ThreatMatchSchema: z.ZodObject<{
+    pattern: z.ZodString;
+    index: z.ZodNumber;
+    length: z.ZodNumber;
+}, z.core.$strip>;
+export type ThreatMatch = z.infer<typeof ThreatMatchSchema>;
+export declare const SecurityScannerResultSchema: z.ZodObject<{
+    threats: z.ZodArray<z.ZodObject<{
+        severity: z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            critical: "critical";
+        }>;
+        kind: z.ZodEnum<{
+            prompt_injection: "prompt_injection";
+            secret_leak: "secret_leak";
+            pii: "pii";
+            suspicious_payload: "suspicious_payload";
+        }>;
+        description: z.ZodString;
+        matches: z.ZodArray<z.ZodObject<{
+            pattern: z.ZodString;
+            index: z.ZodNumber;
+            length: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    scanAvailable: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type SecurityScannerResult = z.infer<typeof SecurityScannerResultSchema>;
+export declare const SecurityScannerDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"security/scanner">;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+    options: z.ZodOptional<z.ZodObject<{
+        detectSecrets: z.ZodDefault<z.ZodBoolean>;
+        detectPII: z.ZodDefault<z.ZodBoolean>;
+        detectPromptInjection: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SecurityScannerDescriptor = z.output<typeof SecurityScannerDescriptorSchema>;
+export declare const MAX_SCANNABLE_CONTENT_LENGTH = 262144;
+export declare const SecurityContentSchema: z.ZodString;
+export declare const SecurityScannerServiceSchema: z.ZodObject<{
+    descriptor: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"security/scanner">;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+        options: z.ZodOptional<z.ZodObject<{
+            detectSecrets: z.ZodDefault<z.ZodBoolean>;
+            detectPII: z.ZodDefault<z.ZodBoolean>;
+            detectPromptInjection: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    scan: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodOptional<z.ZodObject<{
+        detectSecrets: z.ZodOptional<z.ZodBoolean>;
+        detectPII: z.ZodOptional<z.ZodBoolean>;
+        detectPromptInjection: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>], null>, z.ZodPromise<z.ZodObject<{
+        threats: z.ZodArray<z.ZodObject<{
+            severity: z.ZodEnum<{
+                low: "low";
+                medium: "medium";
+                high: "high";
+                critical: "critical";
+            }>;
+            kind: z.ZodEnum<{
+                prompt_injection: "prompt_injection";
+                secret_leak: "secret_leak";
+                pii: "pii";
+                suspicious_payload: "suspicious_payload";
+            }>;
+            description: z.ZodString;
+            matches: z.ZodArray<z.ZodObject<{
+                pattern: z.ZodString;
+                index: z.ZodNumber;
+                length: z.ZodNumber;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        scanAvailable: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type SecurityScannerService = z.infer<typeof SecurityScannerServiceSchema>;
+export type SecurityScannerOptionsInput = z.infer<typeof SecurityScannerOverridesSchema>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/schemas/contracts/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../src/schemas/contracts/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,0FAA0F;AAC1F,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AACH,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;iBAQtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;iBAS1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACzF,eAAO,MAAM,4BAA4B,SAAU,CAAC;AACpD,eAAO,MAAM,qBAAqB,aAA+C,CAAC;AAElF,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA6M,CAAC;AACvP,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/schemas/contracts/scanner.js

@@ -0,0 +1,40 @@
+import * as z from 'zod/v4';
+/** Optional at call boundaries: omission is allowed; null and malformed fields reject. */
+export const SecurityScannerOverridesSchema = z.object({
+    detectSecrets: z.boolean().optional(),
+    detectPII: z.boolean().optional(),
+    detectPromptInjection: z.boolean().optional(),
+});
+export const SecurityScannerOptionsSchema = SecurityScannerOverridesSchema.extend({
+    detectSecrets: z.boolean().default(true),
+    detectPII: z.boolean().default(true),
+    detectPromptInjection: z.boolean().default(true),
+});
+export const ThreatMatchSchema = z.object({
+    pattern: z.string(),
+    index: z.number(),
+    length: z.number(),
+});
+export const SecurityScannerResultSchema = z.object({
+    threats: z.array(z.object({
+        severity: z.enum(['low', 'medium', 'high', 'critical']),
+        kind: z.enum(['prompt_injection', 'secret_leak', 'pii', 'suspicious_payload']),
+        description: z.string(),
+        matches: z.array(ThreatMatchSchema),
+    })),
+    scanAvailable: z.boolean().default(true),
+});
+export const SecurityScannerDescriptorSchema = z.object({
+    id: z.string(),
+    kind: z.literal('security/scanner'),
+    name: z.string(),
+    description: z.string().optional(),
+    enabled: z.boolean().optional(),
+    tags: z.array(z.string()).optional(),
+    hardware: z.array(z.enum(['consumer', 'cloud'])).optional(),
+    options: SecurityScannerOptionsSchema.optional(),
+});
+export const MAX_SCANNABLE_CONTENT_LENGTH = 262_144;
+export const SecurityContentSchema = z.string().max(MAX_SCANNABLE_CONTENT_LENGTH);
+export const SecurityScannerServiceSchema = z.object({ descriptor: SecurityScannerDescriptorSchema, scan: z.function({ input: [SecurityContentSchema, SecurityScannerOverridesSchema.optional()], output: z.promise(SecurityScannerResultSchema) }) });
+//# sourceMappingURL=scanner.js.map

package/dist/schemas/contracts/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../../src/schemas/contracts/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,0FAA0F;AAC1F,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC,MAAM,CAAC;IAC9E,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,kBAAkB,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;QAC9E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;KACtC,CAAC,CAAC;IACH,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,OAAO,EAAE,4BAA4B,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAC;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,qBAAqB,EAAE,8BAA8B,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/dist/schemas/contracts/widget.d.ts

@@ -0,0 +1,19 @@
+import * as z from 'zod/v4';
+export declare const SecurityToolValueSchema: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>, z.ZodArray<z.ZodUnknown>]>;
+export type SecurityToolValue = z.infer<typeof SecurityToolValueSchema>;
+export declare const SecurityToolWidgetPropsSchema: z.ZodObject<{
+    toolCall: z.ZodOptional<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        messageId: z.ZodOptional<z.ZodString>;
+        tool: z.ZodOptional<z.ZodString>;
+        events: z.ZodOptional<z.ZodArray<z.ZodUnknown>>;
+        startedAt: z.ZodOptional<z.ZodNumber>;
+        updatedAt: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    status: z.ZodOptional<z.ZodString>;
+    args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>, z.ZodArray<z.ZodUnknown>]>>>;
+    output: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>>, z.ZodArray<z.ZodUnknown>]>>>;
+    error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export type SecurityToolWidgetProps = z.infer<typeof SecurityToolWidgetPropsSchema>;
+//# sourceMappingURL=widget.d.ts.map

package/dist/schemas/contracts/widget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget.d.ts","sourceRoot":"","sources":["../../../src/schemas/contracts/widget.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,uBAAuB,+PAA0F,CAAC;AAC/H,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;iBAKxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC"}

package/dist/schemas/contracts/widget.js

@@ -0,0 +1,10 @@
+import * as z from 'zod/v4';
+const PrimitiveSchema = z.union([z.string(), z.number(), z.boolean(), z.null(), z.undefined()]);
+export const SecurityToolValueSchema = z.union([PrimitiveSchema, z.record(z.string(), PrimitiveSchema), z.array(z.unknown())]);
+export const SecurityToolWidgetPropsSchema = z.object({
+    toolCall: z.object({ id: z.string().optional(), messageId: z.string().optional(), tool: z.string().optional(),
+        events: z.array(z.unknown()).optional(), startedAt: z.number().optional(), updatedAt: z.number().optional() }).optional(),
+    status: z.string().optional(), args: z.record(z.string(), SecurityToolValueSchema).optional(),
+    output: z.record(z.string(), SecurityToolValueSchema).optional(), error: z.string().nullable().optional()
+});
+//# sourceMappingURL=widget.js.map

package/dist/schemas/contracts/widget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget.js","sourceRoot":"","sources":["../../../src/schemas/contracts/widget.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;AAChG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAE/H,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzG,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7H,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,QAAQ,EAAE;IAC7F,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5G,CAAC,CAAC"}

package/dist/schemas/encryption.d.ts

@@ -0,0 +1,25 @@
+import * as z from 'zod/v4';
+export declare const EncryptionKeySchema: z.ZodString;
+export declare const EncryptedSecretSchema: z.ZodObject<{
+    iv: z.ZodBase64;
+    tag: z.ZodBase64;
+    encrypted: z.ZodBase64;
+}, z.core.$strip>;
+export type EncryptedSecret = z.infer<typeof EncryptedSecretSchema>;
+export declare const BinaryCiphertextSchema: z.ZodInstanceOf<Uint8Array<ArrayBuffer>>;
+export declare const StoredCiphertextSchema: z.ZodString;
+export declare function parseEncryptionKey(value: string): string;
+export declare function parseCiphertext<T>(schema: z.ZodType<T>, value: unknown): T;
+export type EncryptionKeyRuntime = Pick<import('@vibesdotdev/kernel').RuntimeRef, 'resolveCredential' | 'scope'> & NonNullable<Parameters<typeof import('@vibesdotdev/paths').getPathRoots>[0]>;
+export declare const KeyFileSystemSchema: z.ZodObject<{
+    readFileSync: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodLiteral<"utf-8">], null>, z.ZodUnion<readonly [z.ZodString, z.ZodInstanceOf<Uint8Array<ArrayBuffer>>]>>;
+    writeFileSync: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString, z.ZodObject<{
+        mode: z.ZodNumber;
+        flag: z.ZodLiteral<"wx">;
+    }, z.core.$strip>], null>, z.ZodVoid>;
+    mkdirSync: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodObject<{
+        recursive: z.ZodLiteral<true>;
+    }, z.core.$strip>], null>, z.ZodOptional<z.ZodString>>;
+}, z.core.$strip>;
+export type KeyFileSystem = z.infer<typeof KeyFileSystemSchema>;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/schemas/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/schemas/encryption.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,mBAAmB,aAAiD,CAAC;AAElF,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,eAAO,MAAM,sBAAsB,0CAAmE,CAAC;AACvG,eAAO,MAAM,sBAAsB,aAGjC,CAAC;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOxD;AACD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,CAK1E;AACD,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,OAAO,qBAAqB,EAAE,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC,GAAG,WAAW,CAAC,UAAU,CAAC,cAAc,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChM,eAAO,MAAM,mBAAmB;;;;;;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/schemas/encryption.js

@@ -0,0 +1,35 @@
+import { HexSchema, Base64Schema } from '@vibesdotdev/crypto/encoding';
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+export const EncryptionKeySchema = HexSchema.refine(value => value.length === 64);
+const BlockSchema = Base64Schema.refine(value => value.length === 24 && value.endsWith('=='));
+export const EncryptedSecretSchema = z.object({
+    iv: BlockSchema,
+    tag: BlockSchema,
+    encrypted: Base64Schema
+});
+export const BinaryCiphertextSchema = z.instanceof(Uint8Array).refine(value => value.byteLength >= 32);
+export const StoredCiphertextSchema = z.string().refine(value => {
+    const parts = value.split(':');
+    return parts.length === 3 && EncryptedSecretSchema.safeParse({ iv: parts[0], tag: parts[1], encrypted: parts[2] }).success;
+});
+export function parseEncryptionKey(value) {
+    const parsed = EncryptionKeySchema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    throw new CapabilityError('Encryption keys must contain exactly 32 hexadecimal bytes.', 'INVALID_INPUT', {
+        reason: 'encryption-key-invalid', retryable: false
+    });
+}
+export function parseCiphertext(schema, value) {
+    const parsed = schema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    throw new CapabilityError('Invalid encrypted data', 'INVALID_INPUT', { reason: 'ciphertext-invalid', retryable: false });
+}
+export const KeyFileSystemSchema = z.object({
+    readFileSync: z.function({ input: [z.string(), z.literal('utf-8')], output: z.union([z.string(), z.instanceof(Uint8Array)]) }),
+    writeFileSync: z.function({ input: [z.string(), z.string(), z.object({ mode: z.number(), flag: z.literal('wx') })], output: z.void() }),
+    mkdirSync: z.function({ input: [z.string(), z.object({ recursive: z.literal(true) })], output: z.string().optional() })
+});
+//# sourceMappingURL=encryption.js.map

package/dist/schemas/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/schemas/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC;AAClF,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,WAAW;IACf,GAAG,EAAE,WAAW;IAChB,SAAS,EAAE,YAAY;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;AACvG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;AAC/H,CAAC,CAAC,CAAC;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC5C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,OAAO;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACvB,MAAM,IAAI,eAAe,CAAC,4DAA4D,EAAE,eAAe,EAAE;QACrG,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,KAAK;KACrD,CAAC,CAAC;AACP,CAAC;AACD,MAAM,UAAU,eAAe,CAAI,MAAoB,EAAE,KAAc;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACvB,MAAM,IAAI,eAAe,CAAC,wBAAwB,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7H,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9H,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACvI,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;CAC1H,CAAC,CAAC"}

package/dist/schemas/index.d.ts

@@ -0,0 +1,6 @@
+export { ReportEventInputSchema, ReportEventOutputSchema, type ReportEventInput, type ReportEventOutput } from './report-event.ts';
+export { SecurityPolicySchema, type SecurityPolicy } from './SecurityPolicy.ts';
+export { ThreatReportSchema, type ThreatReport } from './ThreatReport.ts';
+export { RedactionRuleSchema, type RedactionRule } from './RedactionRule.ts';
+export { AuditEventSchema, AuditQueryOptionsSchema, type AuditEvent, type AuditQueryOptions } from './AuditEvent.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACnI,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,KAAK,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,6 @@
+export { ReportEventInputSchema, ReportEventOutputSchema } from "./report-event.js";
+export { SecurityPolicySchema } from "./SecurityPolicy.js";
+export { ThreatReportSchema } from "./ThreatReport.js";
+export { RedactionRuleSchema } from "./RedactionRule.js";
+export { AuditEventSchema, AuditQueryOptionsSchema } from "./AuditEvent.js";
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAiD,MAAM,mBAAmB,CAAC;AACnI,OAAO,EAAE,oBAAoB,EAAuB,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAqB,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAsB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAA2C,MAAM,iBAAiB,CAAC"}

package/dist/schemas/policy.d.ts

@@ -0,0 +1,2 @@
+export * from './contracts/policy.ts';
+//# sourceMappingURL=policy.d.ts.map

package/dist/schemas/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/schemas/policy.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC"}

package/dist/schemas/policy.js

@@ -0,0 +1,2 @@
+export * from "./contracts/policy.js";
+//# sourceMappingURL=policy.js.map

package/dist/schemas/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/schemas/policy.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC"}

package/dist/schemas/redactor.d.ts

@@ -0,0 +1,2 @@
+export * from './contracts/redactor.ts';
+//# sourceMappingURL=redactor.d.ts.map

package/dist/schemas/redactor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.d.ts","sourceRoot":"","sources":["../../src/schemas/redactor.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC"}

package/dist/schemas/redactor.js

@@ -0,0 +1,2 @@
+export * from "./contracts/redactor.js";
+//# sourceMappingURL=redactor.js.map

package/dist/schemas/redactor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactor.js","sourceRoot":"","sources":["../../src/schemas/redactor.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAC"}

package/dist/schemas/report-event.d.ts

@@ -0,0 +1,29 @@
+import * as z from 'zod/v4';
+export declare const ReportEventInputSchema: z.ZodObject<{
+    event: z.ZodObject<{
+        id: z.ZodString;
+        timestamp: z.ZodString;
+        actor: z.ZodString;
+        action: z.ZodString;
+        resource: z.ZodString;
+        outcome: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+            review: "review";
+        }>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type ReportEventInput = z.infer<typeof ReportEventInputSchema>;
+export declare const ReportEventOutputSchema: z.ZodObject<{
+    recorded: z.ZodBoolean;
+    eventId: z.ZodString;
+    error: z.ZodOptional<z.ZodString>;
+    failure: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        code: z.ZodOptional<z.ZodString>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ReportEventOutput = z.infer<typeof ReportEventOutputSchema>;
+//# sourceMappingURL=report-event.d.ts.map

package/dist/schemas/report-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-event.d.ts","sourceRoot":"","sources":["../../src/schemas/report-event.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAEjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,uBAAuB;;;;;;;;;iBAYlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/schemas/report-event.js

@@ -0,0 +1,19 @@
+import { AuditEventSchema } from "./AuditEvent.js";
+import * as z from 'zod/v4';
+export const ReportEventInputSchema = z.object({
+    event: AuditEventSchema.describe('Audit event to report'),
+});
+export const ReportEventOutputSchema = z.object({
+    recorded: z.boolean().describe('Whether the event was successfully recorded'),
+    eventId: z.string().describe('ID of the recorded event'),
+    error: z.string().optional().describe('Why recording failed: a fixed message naming the failure facts, never the raw error'),
+    failure: z
+        .object({
+        name: z.string().describe('The failure class name'),
+        code: z.string().optional().describe('An errno-shaped or CapabilityError code'),
+        reason: z.string().optional().describe('A CapabilityError reason'),
+    })
+        .optional()
+        .describe('Value-free facts of the failure when recording threw: no message, stack or cause'),
+});
+//# sourceMappingURL=report-event.js.map

package/dist/schemas/report-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-event.js","sourceRoot":"","sources":["../../src/schemas/report-event.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC;CACzD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;IACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qFAAqF,CAAC;IAC5H,OAAO,EAAE,CAAC;SACR,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;QACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;QAC/E,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;KAClE,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CAAC,kFAAkF,CAAC;CAC9F,CAAC,CAAC"}

package/dist/schemas/scanner.d.ts

@@ -0,0 +1,2 @@
+export * from './contracts/scanner.ts';
+//# sourceMappingURL=scanner.d.ts.map

package/dist/schemas/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/schemas/scanner.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC"}

package/dist/schemas/scanner.js

@@ -0,0 +1,2 @@
+export * from "./contracts/scanner.js";
+//# sourceMappingURL=scanner.js.map

package/dist/schemas/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/schemas/scanner.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC"}

package/dist/security-client/index.d.ts

@@ -0,0 +1,3 @@
+export { SecurityClient, default } from './security-client.ts';
+export type { AuditEvent, AuditQueryOptions } from '../kinds/auditor.kind.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/security-client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security-client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/D,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/security-client/index.js

@@ -0,0 +1,2 @@
+export { SecurityClient, default } from "./security-client.js";
+//# sourceMappingURL=index.js.map

package/dist/security-client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security-client/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/security-client/security-client.d.ts

@@ -0,0 +1,34 @@
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient, type RuntimeClientDescriptor } from '@vibesdotdev/kernel/client';
+import type { KindContext } from '@vibesdotdev/kernel';
+import type { AuditEvent, AuditQueryOptions } from '../kinds/auditor.kind.ts';
+/**
+ * The semantic security client: audit emission and querying through the
+ * runtime-selected `security/auditor`.
+ *
+ * The client owns no audit state and no second store — every operation
+ * resolves the selected auditor through `runtime.query('security/auditor')`,
+ * so descriptor selection, the in-memory default and composed sinks keep
+ * their existing ownership. Resolve it through the kernel client owner:
+ *
+ * ```ts
+ * import { getVibesClient } from '@vibesdotdev/kernel/client';
+ * const security = await getVibesClient<SecurityClient>('security', runtime);
+ * await security.emit(event);
+ * const events = await security.queryAuditEvents({ actor: 'agent' });
+ * ```
+ *
+ * Absence is a typed refusal, not a silent skip: when no auditor is
+ * registered, `emit` and `queryAuditEvents` fail with CapabilityError code
+ * `UNAVAILABLE` and reason `security-auditor-unavailable`.
+ */
+export declare class SecurityClient extends BaseRuntimeClient {
+    constructor(descriptor?: RuntimeClientDescriptor, context?: KindContext, runtime?: VibesRuntime);
+    private auditor;
+    /** Record one audit event with the selected security/auditor. */
+    emit(event: AuditEvent): Promise<void>;
+    /** Query recorded audit events with the selected security/auditor. */
+    queryAuditEvents(options?: AuditQueryOptions): Promise<AuditEvent[]>;
+}
+export default SecurityClient;
+//# sourceMappingURL=security-client.d.ts.map

package/dist/security-client/security-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-client.d.ts","sourceRoot":"","sources":["../../src/security-client/security-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,KAAK,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAGX,UAAU,EACV,iBAAiB,EACjB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,cAAe,SAAQ,iBAAiB;gBAEnD,UAAU,GAAE,uBAAoE,EAChF,OAAO,CAAC,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,YAAY;YAKT,OAAO;IAerB,iEAAiE;IAC3D,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAM5C,sEAAsE;IAChE,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CAK9E;AAED,eAAe,cAAc,CAAC"}