@vibesdotdev/security 0.0.0-stage → 1.0.0-rc.5

package/dist/security-client/security-client.js

@@ -0,0 +1,54 @@
+import { AuditEventSchema, AuditQueryOptionsSchema } from "../schemas/AuditEvent.js";
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { BaseRuntimeClient } from '@vibesdotdev/kernel/client';
+/**
+ * The semantic security client: audit emission and querying through the
+ * runtime-selected `security/auditor`.
+ *
+ * The client owns no audit state and no second store — every operation
+ * resolves the selected auditor through `runtime.query('security/auditor')`,
+ * so descriptor selection, the in-memory default and composed sinks keep
+ * their existing ownership. Resolve it through the kernel client owner:
+ *
+ * ```ts
+ * import { getVibesClient } from '@vibesdotdev/kernel/client';
+ * const security = await getVibesClient<SecurityClient>('security', runtime);
+ * await security.emit(event);
+ * const events = await security.queryAuditEvents({ actor: 'agent' });
+ * ```
+ *
+ * Absence is a typed refusal, not a silent skip: when no auditor is
+ * registered, `emit` and `queryAuditEvents` fail with CapabilityError code
+ * `UNAVAILABLE` and reason `security-auditor-unavailable`.
+ */
+export class SecurityClient extends BaseRuntimeClient {
+    constructor(descriptor = { id: 'security', kind: 'runtime/client' }, context, runtime) {
+        super(descriptor, context, runtime);
+    }
+    async auditor() {
+        const selected = await this.runtime
+            .query('security/auditor')
+            .enabled()
+            .select();
+        if (!selected) {
+            throw new CapabilityError('No security auditor is registered.', 'UNAVAILABLE', {
+                reason: 'security-auditor-unavailable'
+            });
+        }
+        return selected.impl;
+    }
+    /** Record one audit event with the selected security/auditor. */
+    async emit(event) {
+        const admitted = AuditEventSchema.parse(event);
+        const auditor = await this.auditor();
+        await auditor.emit(admitted);
+    }
+    /** Query recorded audit events with the selected security/auditor. */
+    async queryAuditEvents(options = {}) {
+        const admitted = AuditQueryOptionsSchema.parse(options);
+        const auditor = await this.auditor();
+        return auditor.query(admitted);
+    }
+}
+export default SecurityClient;
+//# sourceMappingURL=security-client.js.map

package/dist/security-client/security-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-client.js","sourceRoot":"","sources":["../../src/security-client/security-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAgC,MAAM,4BAA4B,CAAC;AAS7F;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,cAAe,SAAQ,iBAAiB;IACpD,YACC,aAAsC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAChF,OAAqB,EACrB,OAAsB;QAEtB,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAEO,KAAK,CAAC,OAAO;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO;aACjC,KAAK,CAAoD,kBAAkB,CAAC;aAC5E,OAAO,EAAE;aACT,MAAM,EAAE,CAAC;QAEX,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,aAAa,EAAE;gBAC9E,MAAM,EAAE,8BAA8B;aACtC,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACtB,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,IAAI,CAAC,KAAiB;QAC3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,gBAAgB,CAAC,UAA6B,EAAE;QACrD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACD;AAED,eAAe,cAAc,CAAC"}

package/dist/security.consumer.plugin.d.ts

@@ -0,0 +1,3 @@
+export declare const securityConsumerPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default securityConsumerPlugin;
+//# sourceMappingURL=security.consumer.plugin.d.ts.map

package/dist/security.consumer.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.consumer.plugin.d.ts","sourceRoot":"","sources":["../src/security.consumer.plugin.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,sBAAsB,6CAoBjC,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/dist/security.consumer.plugin.js

@@ -0,0 +1,28 @@
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel/factory';
+/**
+ * The security consumer plugin: the four AI tool implementations
+ * (`security.scan-input`, `security.redact-output`, `security.check-policy`,
+ * `security.report-event`) as `tools/tool` loaders.
+ *
+ * Compose this beside `securityPlugin` (from `@vibesdotdev/security/plugin`)
+ * on consumer surfaces that expose the Tools owner. It must never be imported
+ * by the universal plugin: a runtime `scope` tag stops runtime resolution but
+ * not static bundler traversal, so an inline consumer loader would ship this
+ * code into every cloud Worker and browser bundle that composes security.
+ * Cloud and browser hosts compose the universal plugin alone.
+ */
+const SECURITY_TOOL_CONSUMER = { kind: 'tools/tool', scope: 'consumer' };
+export const securityConsumerPlugin = createRuntimePlugin({
+    id: 'security.consumer',
+    name: 'Security — consumer tools',
+    description: 'Consumer-scope implementations for the four security AI tools. Compose beside the universal security plugin on consumer surfaces; cloud and browser bundles never import this slice.',
+    dependencies: ['security'],
+    loaders: [
+        loader('security.scan-input', SECURITY_TOOL_CONSUMER, () => import("./tools/scan-input/scan-input.impl.consumer.js")),
+        loader('security.redact-output', SECURITY_TOOL_CONSUMER, () => import("./tools/redact-output/redact-output.impl.consumer.js")),
+        loader('security.check-policy', SECURITY_TOOL_CONSUMER, () => import("./tools/check-policy/check-policy.impl.consumer.js")),
+        loader('security.report-event', SECURITY_TOOL_CONSUMER, () => import("./tools/report-event/report-event.impl.consumer.js")),
+    ],
+});
+export default securityConsumerPlugin;
+//# sourceMappingURL=security.consumer.plugin.js.map

package/dist/security.consumer.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.consumer.plugin.js","sourceRoot":"","sources":["../src/security.consumer.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,sBAAsB,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAW,CAAC;AAElF,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;IACzD,EAAE,EAAE,mBAAmB;IACvB,IAAI,EAAE,2BAA2B;IACjC,WAAW,EACV,sLAAsL;IACvL,YAAY,EAAE,CAAC,UAAU,CAAC;IAC1B,OAAO,EAAE;QACR,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAC1D,MAAM,CAAC,gDAAgD,CAAC,CACxD;QACD,MAAM,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAC7D,MAAM,CAAC,sDAAsD,CAAC,CAC9D;QACD,MAAM,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAC5D,MAAM,CAAC,oDAAoD,CAAC,CAC5D;QACD,MAAM,CAAC,uBAAuB,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAC5D,MAAM,CAAC,oDAAoD,CAAC,CAC5D;KACD;CACD,CAAC,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/dist/security.plugin.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The universal security plugin: kinds, tool and Shield descriptors, the
+ * semantic SecurityClient and the lazy built-in scanner/redactor loaders.
+ *
+ * Scope purity: this plugin is composed into cloud workers and browsers, so it
+ * carries no `*.impl.consumer.*` or CLI implementation loader inline — a
+ * runtime `scope` tag does not stop static bundler traversal. The four
+ * consumer tool implementations live in `./consumer.plugin.ts`
+ * (`securityConsumerPlugin`), and the Shield command implementations live in
+ * `./cli/plugin` (`securityCliPlugin`). Hosts compose those slices for the
+ * surfaces their scope supports. The universal plugin does not load Svelte or
+ * TUI either; those are separate surface plugins.
+ */
+export declare const securityPlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default securityPlugin;
+//# sourceMappingURL=security.plugin.d.ts.map

package/dist/security.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.plugin.d.ts","sourceRoot":"","sources":["../src/security.plugin.ts"],"names":[],"mappings":"AA0CA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,6CAqCzB,CAAC;AAEH,eAAe,cAAc,CAAC"}

package/dist/security.plugin.js

@@ -0,0 +1,78 @@
+import securityDocsDescriptor from "./tools/security.docs.descriptor.js";
+import { createRuntimePlugin, loader } from '@vibesdotdev/kernel/factory';
+import { securityScannerKind, securityRedactorKind, securityPolicyKind, securityAuditorKind, securityDepScannerKind, securityIOCFeedKind, securityFreshnessPolicyKind, } from "./kinds/index.js";
+import { scanInputDescriptor, redactOutputDescriptor, checkPolicyDescriptor, reportEventDescriptor, } from "./tools/index.js";
+import shieldGroupDescriptor from "./cli/shield.cli-group.descriptor.js";
+import shieldDepsGroupDescriptor from "./cli/shield.deps.cli-group.descriptor.js";
+import shieldDepsScanDescriptor from "./cli/shield.deps.scan.descriptor.js";
+import shieldDepsGateDescriptor from "./cli/shield.deps.gate.descriptor.js";
+/**
+ * Built-in dep-scanner descriptor.
+ *
+ * Registered by securityPlugin so that `runtime.query('security/dep-scanner').resolve()`
+ * succeeds and the CLI commands in `./cli` can operate. The kind's `defaultImplementation`
+ * (DefaultDepScannerService) handles resolution; it returns `verdict: 'unknown'` when no
+ * real scanner is wired — an honest response that the gate command treats as non-clean.
+ *
+ * Migration debt: replace with a real impl (e.g. wrapping `bun audit`) once available.
+ */
+const builtinDepScannerDescriptor = {
+    kind: 'security/dep-scanner',
+    id: 'security.dep-scanner.builtin',
+    name: 'Built-in Dependency Scanner (stub)',
+    description: 'Default dep-scanner — returns verdict:unknown until a real impl is registered.',
+    enabled: true,
+    tags: ['builtin', 'stub'],
+};
+/**
+ * The universal security plugin: kinds, tool and Shield descriptors, the
+ * semantic SecurityClient and the lazy built-in scanner/redactor loaders.
+ *
+ * Scope purity: this plugin is composed into cloud workers and browsers, so it
+ * carries no `*.impl.consumer.*` or CLI implementation loader inline — a
+ * runtime `scope` tag does not stop static bundler traversal. The four
+ * consumer tool implementations live in `./consumer.plugin.ts`
+ * (`securityConsumerPlugin`), and the Shield command implementations live in
+ * `./cli/plugin` (`securityCliPlugin`). Hosts compose those slices for the
+ * surfaces their scope supports. The universal plugin does not load Svelte or
+ * TUI either; those are separate surface plugins.
+ */
+export const securityPlugin = createRuntimePlugin({
+    id: 'security',
+    name: 'Security',
+    description: 'Security domain runtime — kinds: security/scanner, security/redactor, security/policy, security/auditor, security/dep-scanner, security/ioc-feed, security/freshness-policy. Registers the semantic SecurityClient; ships AI tool descriptors; built-in scanner and redactor are lazy implementations; policies and auditors are composed by consumers. Consumer tool and Shield CLI implementations live in the ./consumer.plugin and ./cli/plugin slices.',
+    dependencies: [],
+    kinds: [securityScannerKind, securityRedactorKind, securityPolicyKind, securityAuditorKind, securityDepScannerKind, securityIOCFeedKind, securityFreshnessPolicyKind],
+    descriptors: [
+        securityDocsDescriptor,
+        scanInputDescriptor,
+        redactOutputDescriptor,
+        checkPolicyDescriptor,
+        reportEventDescriptor,
+        builtinDepScannerDescriptor,
+        { kind: 'security/scanner', id: 'security.scanner.builtin', name: 'Built-in Scanner', enabled: true },
+        { kind: 'security/redactor', id: 'security.redactor.builtin', name: 'Built-in Redactor', enabled: true, tags: ['builtin'] },
+        shieldGroupDescriptor,
+        shieldDepsGroupDescriptor,
+        shieldDepsScanDescriptor,
+        shieldDepsGateDescriptor,
+        // The runtime-owned semantic security client, resolved through the
+        // kernel client APIs as id `security`.
+        { kind: 'runtime/client', id: 'security', name: 'Security Client', description: 'Semantic security client: audit emission and querying through the selected security/auditor' }
+    ],
+    loaders: [
+        loader('security.scanner.builtin', { kind: 'security/scanner' }, () => import("./implementations/scanner.impl.js")),
+        // One built-in redactor, two hardware implementations chosen by the
+        // kernel's scope resolution: the in-process redactor serves every
+        // runtime (cloud Workers, browsers, undeclared hardware); on consumer
+        // hardware the more specific subprocess redactor wins, adding a
+        // preemptive deadline for caller-supplied patterns.
+        loader('security.redactor.builtin', { kind: 'security/redactor' }, () => import("./implementations/redactor.inprocess.impl.js")),
+        loader('security.redactor.builtin', { kind: 'security/redactor', scope: 'consumer' }, () => import("./implementations/redactor.subprocess.impl.js")),
+        loader('security', { kind: 'runtime/client' }, async () => ({
+            impl: (await import("./security-client/security-client.js")).SecurityClient
+        }))
+    ],
+});
+export default securityPlugin;
+//# sourceMappingURL=security.plugin.js.map

package/dist/security.plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.plugin.js","sourceRoot":"","sources":["../src/security.plugin.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,6BAA6B,CAAC;AAE1E,OAAO,EACN,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,mBAAmB,EACnB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,qBAAqB,MAAM,sCAAsC,CAAC;AACzE,OAAO,yBAAyB,MAAM,2CAA2C,CAAC;AAClF,OAAO,wBAAwB,MAAM,sCAAsC,CAAC;AAC5E,OAAO,wBAAwB,MAAM,sCAAsC,CAAC;AAE5E;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAG;IACnC,IAAI,EAAE,sBAA+B;IACrC,EAAE,EAAE,8BAA8B;IAClC,IAAI,EAAE,oCAAoC;IAC1C,WAAW,EAAE,gFAAgF;IAC7F,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,mBAAmB,CAAC;IACjD,EAAE,EAAE,UAAU;IACd,IAAI,EAAE,UAAU;IAChB,WAAW,EACV,6bAA6b;IAC9b,YAAY,EAAE,EAAE;IAChB,KAAK,EAAE,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,2BAA2B,CAAC;IACrK,WAAW,EAAE;QACZ,sBAAsB;QACtB,mBAAmB;QACnB,sBAAsB;QACtB,qBAAqB;QACrB,qBAAqB;QACrB,2BAA2B;QAC3B,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,0BAA0B,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE;QACrG,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,2BAA2B,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE;QAC3H,qBAAqB;QACrB,yBAAyB;QACzB,wBAAwB;QACxB,wBAAwB;QACxB,mEAAmE;QACnE,uCAAuC;QACvC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,WAAW,EAAE,6FAA6F,EAAE;KAC/K;IACD,OAAO,EAAE;QACR,MAAM,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;QACnH,oEAAoE;QACpE,kEAAkE;QAClE,sEAAsE;QACtE,gEAAgE;QAChE,oDAAoD;QACpD,MAAM,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,8CAA8C,CAAC,CAAC;QAChI,MAAM,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAAC;QACpJ,MAAM,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC3D,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,sCAAsC,CAAC,CAAC,CAAC,cAAc;SAC3E,CAAC,CAAC;KACH;CACD,CAAC,CAAC;AAEH,eAAe,cAAc,CAAC"}

package/dist/svelte/index.d.ts

@@ -0,0 +1,3 @@
+export { default as SecurityToolCard } from './tool-widgets/SecurityToolCard.svelte';
+export { default as securitySveltePlugin } from './security-svelte.plugin.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/svelte/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/svelte/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/svelte/index.js

@@ -0,0 +1,2 @@
+export { default as SecurityToolCard } from './tool-widgets/SecurityToolCard.svelte';
+export { default as securitySveltePlugin } from "./security-svelte.plugin.js";

package/dist/svelte/security-svelte.plugin.d.ts

@@ -0,0 +1,5 @@
+/** Settles after every widget registration this module queued so far (none when Kit is absent). */
+export declare function toolWidgetsRegistered(): Promise<void>;
+export declare const securitySveltePlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default securitySveltePlugin;
+//# sourceMappingURL=security-svelte.plugin.d.ts.map

package/dist/svelte/security-svelte.plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-svelte.plugin.d.ts","sourceRoot":"","sources":["../../src/svelte/security-svelte.plugin.ts"],"names":[],"mappings":"AA0BA,mGAAmG;AACnG,wBAAgB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAErD;AAQD,eAAO,MAAM,oBAAoB,6CAiB/B,CAAC;AAEH,eAAe,oBAAoB,CAAC"}

package/dist/svelte/security-svelte.plugin.js

@@ -0,0 +1,49 @@
+import { createRuntimeImplementation, createRuntimePlugin, loader, settle } from '@vibesdotdev/kernel';
+import { SECURITY_TOOL_IDS } from "../tools/index.js";
+const loadSecurityToolCard = () => import('./tool-widgets/SecurityToolCard.svelte');
+const widgets = SECURITY_TOOL_IDS.map((toolId) => ({
+    id: `${toolId}.svelte-widget`,
+    kind: 'tools/ui',
+    name: `${toolId} Svelte Widget`,
+    description: `Designed Kit card for ${toolId} (policy name, allow/deny, event type).`,
+    surfaces: ['web'],
+    role: 'widget',
+    targetToolId: toolId,
+    tags: ['security', 'widget'],
+    enabled: true
+}));
+// Kit's widget registry loads lazily: a top-level await here would suspend every importer and,
+// inside a module cycle, let WebKit run a dependent before this module's bindings exist.
+const kitToolWidgets = settle(() => import('@vibesdotdev/kit/components/tool-widgets'));
+function registerKitToolWidget(...args) {
+    void kitToolWidgets.then((kit) => {
+        if (kit.ok)
+            kit.value.registerToolWidget(...args);
+    });
+}
+/** Settles after every widget registration this module queued so far (none when Kit is absent). */
+export function toolWidgetsRegistered() {
+    return kitToolWidgets.then(() => undefined);
+}
+if (registerKitToolWidget) {
+    for (const toolId of SECURITY_TOOL_IDS) {
+        registerKitToolWidget(toolId, loadSecurityToolCard);
+    }
+}
+export const securitySveltePlugin = createRuntimePlugin({
+    id: '@vibesdotdev/security/svelte',
+    name: 'Security Svelte',
+    description: 'Security-owned Svelte tool-result cards registered as tools/ui.',
+    dependencies: [],
+    descriptors: widgets,
+    loaders: widgets.map((descriptor) => loader(descriptor.id, { kind: 'tools/ui', scope: 'browser' }, async () => {
+        registerKitToolWidget?.(descriptor.targetToolId, loadSecurityToolCard);
+        const module = await loadSecurityToolCard();
+        return createRuntimeImplementation({
+            kind: 'tools/ui',
+            id: descriptor.id,
+            implementation: { web: { component: module.default } }
+        });
+    }))
+});
+export default securitySveltePlugin;

package/dist/svelte/styles.css

@@ -0,0 +1,8 @@
+/*
+ * Tailwind v4 source declaration for consumers — mirrors @vibesdotdev/kit's
+ * styles.css pattern. Apps that @import this file get this package's
+ * components scanned by their Tailwind build, so utility classes used only
+ * inside these components are emitted in the app's CSS bundle (Tailwind
+ * never scans node_modules). Paths resolve relative to this file.
+ */
+@source "./";

package/dist/svelte/tool-widgets/SecurityToolCard.svelte

@@ -0,0 +1,140 @@
+<script lang="ts">
+	/**
+	 * Family card for security.check-policy, security.scan-input,
+	 * security.redact-output, and security.report-event. Surfaces policy name,
+	 * allow/deny, and event type from the live tool schemas.
+	 */
+	import { Badge } from '@vibesdotdev/kit/components/ui/badge';
+	import { Icon } from '@vibesdotdev/kit/components/icon';
+	import {
+		ToolCard,
+		ToolCardBody,
+		type ToolWidgetProps
+	} from '@vibesdotdev/kit/components/tool-widgets';
+	import {
+		decisionTone,
+		securityToolCardModel,
+		securityToolCardRows,
+		type SecurityToolCardTone
+	} from '@vibesdotdev/security/tools';
+
+	let { tool, compact = false }: ToolWidgetProps = $props();
+
+	const model = $derived(
+		securityToolCardModel({
+			name: tool.name,
+			input: tool.input,
+			output: tool.output,
+			error: tool.error
+		})
+	);
+	const rows = $derived(securityToolCardRows(model));
+
+	const BADGE_VARIANT = {
+		default: 'secondary',
+		success: 'success',
+		danger: 'destructive',
+		warning: 'warning',
+		muted: 'outline'
+	} satisfies Record<
+		SecurityToolCardTone,
+		'secondary' | 'destructive' | 'success' | 'warning' | 'outline'
+	>;
+
+	function severityVariant(severity: string): 'outline' | 'warning' | 'destructive' {
+		switch (severity) {
+			case 'critical':
+			case 'high':
+				return 'destructive';
+			case 'medium':
+				return 'warning';
+			default:
+				return 'outline';
+		}
+	}
+</script>
+
+<ToolCard {tool} {compact} title={model.title} icon={model.icon} defaultOpen={model.defaultOpen}>
+	{#snippet children()}
+		<ToolCardBody {compact}>
+			<div class="flex flex-wrap items-center gap-1.5">
+				{#if model.decisionLabel}
+					<Badge variant={BADGE_VARIANT[decisionTone(model.decision)]} class="text-caption">
+						{model.decisionLabel}
+					</Badge>
+				{/if}
+				{#if model.policyName}
+					<span class="truncate font-mono text-caption text-muted-foreground"
+						>{model.policyName}</span
+					>
+				{/if}
+				{#if model.eventType}
+					<Badge variant="secondary" class="text-caption">{model.eventType}</Badge>
+				{/if}
+				{#if model.recorded !== null}
+					<Badge variant={model.recorded ? 'success' : 'destructive'} class="text-caption">
+						{model.recorded ? 'Recorded' : 'Not recorded'}
+					</Badge>
+				{/if}
+				{#if model.matchCount !== null}
+					<Badge variant="outline" class="text-caption">
+						{model.matchCount === 1 ? '1 match' : `${model.matchCount} matches`}
+					</Badge>
+				{/if}
+			</div>
+
+			{#if rows.length}
+				<dl class="space-y-0.5">
+					{#each rows as row (row.label)}
+						<div class="flex min-w-0 items-baseline gap-2">
+							<dt class="shrink-0 text-caption text-muted-foreground">{row.label}</dt>
+							<dd
+								class={[
+									'min-w-0 truncate',
+									row.tone === 'danger' && 'text-destructive',
+									row.tone === 'muted' && 'text-muted-foreground'
+								]}
+							>
+								{row.value}
+							</dd>
+						</div>
+					{/each}
+				</dl>
+			{/if}
+
+			{#if model.threats.length}
+				<ul class="space-y-1">
+					{#each model.threats.slice(0, 5) as threat, index (`${threat.kind}-${index}`)}
+						<li class="flex min-w-0 items-start gap-1.5">
+							<Badge
+								variant={severityVariant(threat.severity)}
+								class="mt-0.5 shrink-0 text-caption"
+							>
+								{threat.severity}
+							</Badge>
+							<div class="min-w-0">
+								<span class="font-medium">{threat.kind.replaceAll('_', ' ')}</span>
+								{#if threat.description}
+									<span class="block text-caption text-muted-foreground">{threat.description}</span>
+								{/if}
+							</div>
+						</li>
+					{/each}
+				</ul>
+			{/if}
+
+			{#if model.redactedPreview}
+				<p class="line-clamp-4 whitespace-pre-wrap text-muted-foreground">
+					{model.redactedPreview}
+				</p>
+			{/if}
+
+			{#if !rows.length && !model.threats.length && !model.redactedPreview && !tool.error}
+				<p class="flex items-center gap-1.5 text-muted-foreground italic">
+					<Icon icon="lucide:loader-circle" class="size-3" />
+					Waiting for result…
+				</p>
+			{/if}
+		</ToolCardBody>
+	{/snippet}
+</ToolCard>

package/dist/svelte/tool-widgets/SecurityToolCard.svelte.d.ts

@@ -0,0 +1,5 @@
+import { type ToolWidgetProps } from '@vibesdotdev/kit/components/tool-widgets';
+declare const SecurityToolCard: import("svelte").Component<ToolWidgetProps, {}, "">;
+type SecurityToolCard = ReturnType<typeof SecurityToolCard>;
+export default SecurityToolCard;
+//# sourceMappingURL=SecurityToolCard.svelte.d.ts.map

package/dist/svelte/tool-widgets/SecurityToolCard.svelte.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityToolCard.svelte.d.ts","sourceRoot":"","sources":["../../../src/svelte/tool-widgets/SecurityToolCard.svelte.ts"],"names":[],"mappings":"AAUA,OAAO,EAGL,KAAK,eAAe,EACpB,MAAM,0CAA0C,CAAC;AAmInD,QAAA,MAAM,gBAAgB,qDAAwC,CAAC;AAC/D,KAAK,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC5D,eAAe,gBAAgB,CAAC"}

package/dist/svelte/tool-widgets/index.d.ts

@@ -0,0 +1,2 @@
+export { default as SecurityToolCard } from './SecurityToolCard.svelte';
+//# sourceMappingURL=index.d.ts.map

package/dist/svelte/tool-widgets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/svelte/tool-widgets/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/svelte/tool-widgets/index.js

@@ -0,0 +1,6 @@
+import { registerToolWidget } from '@vibesdotdev/kit/components/tool-widgets';
+import { SECURITY_TOOL_IDS } from '@vibesdotdev/security/tools';
+for (const toolId of SECURITY_TOOL_IDS) {
+    registerToolWidget(toolId, () => import('./SecurityToolCard.svelte'));
+}
+export { default as SecurityToolCard } from './SecurityToolCard.svelte';

package/dist/tools/check-policy/check-policy.descriptor.d.ts

@@ -0,0 +1,37 @@
+declare const _default: {
+    kind: "tools/tool";
+    id: string;
+    name: string;
+    description: string;
+    mcpDescription: string;
+    category: string;
+    subcategory: string;
+    hardware: string[];
+    purpose: string[];
+    tags: string[];
+    safety: string;
+    requiresApproval: boolean;
+    schemas: {
+        input: import("zod/v4").ZodObject<{
+            policyId: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            context: import("zod/v4").ZodOptional<import("zod/v4").ZodObject<{
+                actor: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+                action: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+                resource: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+                metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodUnknown>>;
+            }, import("zod/v4/core").$strip>>;
+        }, import("zod/v4/core").$strip>;
+        output: import("zod/v4").ZodObject<{
+            outcome: import("zod/v4").ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+                review: "review";
+            }>;
+            policyId: import("zod/v4").ZodString;
+            reason: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            engineAvailable: import("zod/v4").ZodBoolean;
+        }, import("zod/v4/core").$strip>;
+    };
+};
+export default _default;
+//# sourceMappingURL=check-policy.descriptor.d.ts.map

package/dist/tools/check-policy/check-policy.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-policy.descriptor.d.ts","sourceRoot":"","sources":["../../../src/tools/check-policy/check-policy.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,wBAkBG"}

package/dist/tools/check-policy/check-policy.descriptor.js

@@ -0,0 +1,21 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+import { CheckPolicyInputSchema, CheckPolicyOutputSchema } from "./schemas.js";
+export default createRuntimeAsset({
+    kind: 'tools/tool',
+    id: 'security.check-policy',
+    name: 'Check Security Policy',
+    description: 'Evaluate a context against registered security policies to determine if an action is allowed, denied, or requires review.',
+    mcpDescription: 'Check security policy. Ex: {policyId,context}; returns allow, deny, or review.',
+    category: 'security',
+    subcategory: 'policy',
+    hardware: ['consumer', 'cloud'],
+    purpose: ['direct', 'worker', 'agent'],
+    tags: ['security', 'policy', 'evaluation', 'access-control'],
+    safety: 'read',
+    requiresApproval: false,
+    schemas: {
+        input: CheckPolicyInputSchema,
+        output: CheckPolicyOutputSchema,
+    },
+});
+//# sourceMappingURL=check-policy.descriptor.js.map

package/dist/tools/check-policy/check-policy.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-policy.descriptor.js","sourceRoot":"","sources":["../../../src/tools/check-policy/check-policy.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAE/E,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,2HAA2H;IACxI,cAAc,EACb,gFAAgF;IACjF,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,QAAQ;IACrB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;IACtC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,CAAC;IAC5D,MAAM,EAAE,MAAM;IACd,gBAAgB,EAAE,KAAK;IACvB,OAAO,EAAE;QACR,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EAAE,uBAAuB;KAC/B;CACD,CAAC,CAAC"}

package/dist/tools/check-policy/check-policy.impl.consumer.d.ts

@@ -0,0 +1,7 @@
+import type { ToolCallContext, VibesRuntime } from '@vibesdotdev/kernel';
+import { type CheckPolicyInput, type CheckPolicyOutput } from './schemas.ts';
+declare const _default: {
+    execute(input: CheckPolicyInput, runtime: VibesRuntime, _ctx: ToolCallContext): Promise<CheckPolicyOutput>;
+};
+export default _default;
+//# sourceMappingURL=check-policy.impl.consumer.d.ts.map

package/dist/tools/check-policy/check-policy.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-policy.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/tools/check-policy/check-policy.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAA0B,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;;mBAG/E,gBAAgB,WAAW,YAAY,QAAQ,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC;;AADjH,wBAeE"}

package/dist/tools/check-policy/check-policy.impl.consumer.js

@@ -0,0 +1,21 @@
+import { PolicyOutcomeSchema } from "../../schemas/contracts/policy.js";
+import { CheckPolicyInputSchema } from "./schemas.js";
+export default {
+    async execute(input, runtime, _ctx) {
+        const parsed = CheckPolicyInputSchema.parse(input);
+        const absent = {
+            outcome: 'deny', policyId: parsed.policyId ?? 'default',
+            reason: 'No policy implementation registered — fail-closed behavior', engineAvailable: false
+        };
+        if (!runtime.hasKind('security/policy'))
+            return absent;
+        let query = runtime.query('security/policy').enabled();
+        if (parsed.policyId !== undefined)
+            query = query.withId(parsed.policyId);
+        if (query.descriptors().length === 0)
+            return absent;
+        const policy = await query.resolve();
+        return { outcome: PolicyOutcomeSchema.parse(await policy.evaluate(parsed.context ?? {})), policyId: policy.descriptor.id, engineAvailable: true };
+    }
+};
+//# sourceMappingURL=check-policy.impl.consumer.js.map

package/dist/tools/check-policy/check-policy.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-policy.impl.consumer.js","sourceRoot":"","sources":["../../../src/tools/check-policy/check-policy.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAGxE,OAAO,EAAE,sBAAsB,EAAiD,MAAM,cAAc,CAAC;AAErG,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAuB,EAAE,OAAqB,EAAE,IAAqB;QAClF,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,MAAM,GAAsB;YACjC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;YACvD,MAAM,EAAE,4DAA4D,EAAE,eAAe,EAAE,KAAK;SAC5F,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAAE,OAAO,MAAM,CAAC;QACvD,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAkD,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC;QACxG,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,OAAO,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACnJ,CAAC;CACD,CAAC"}

package/dist/tools/check-policy/index.d.ts

@@ -0,0 +1,3 @@
+export { default } from './check-policy.descriptor.ts';
+export type { CheckPolicyInput, CheckPolicyOutput } from './schemas.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/check-policy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/check-policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/tools/check-policy/index.js

@@ -0,0 +1,2 @@
+export { default } from "./check-policy.descriptor.js";
+//# sourceMappingURL=index.js.map

package/dist/tools/check-policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/check-policy/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/tools/check-policy/schemas.d.ts

@@ -0,0 +1,23 @@
+import * as z from 'zod/v4';
+export declare const CheckPolicyInputSchema: z.ZodObject<{
+    policyId: z.ZodOptional<z.ZodString>;
+    context: z.ZodOptional<z.ZodObject<{
+        actor: z.ZodOptional<z.ZodString>;
+        action: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type CheckPolicyInput = z.infer<typeof CheckPolicyInputSchema>;
+export declare const CheckPolicyOutputSchema: z.ZodObject<{
+    outcome: z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+        review: "review";
+    }>;
+    policyId: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    engineAvailable: z.ZodBoolean;
+}, z.core.$strip>;
+export type CheckPolicyOutput = z.infer<typeof CheckPolicyOutputSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/tools/check-policy/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/tools/check-policy/schemas.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,sBAAsB;;;;;;;;iBAGjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,uBAAuB;;;;;;;;;iBAKlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/tools/check-policy/schemas.js

@@ -0,0 +1,13 @@
+import { PolicyEvaluationContextSchema, PolicyOutcomeSchema } from "../../schemas/policy.js";
+import * as z from 'zod/v4';
+export const CheckPolicyInputSchema = z.object({
+    policyId: z.string().optional().describe('Policy ID to check against (optional — uses default if not provided)'),
+    context: PolicyEvaluationContextSchema.optional(),
+});
+export const CheckPolicyOutputSchema = z.object({
+    outcome: PolicyOutcomeSchema.describe('Policy evaluation outcome'),
+    policyId: z.string().describe('ID of the policy that produced this outcome'),
+    reason: z.string().optional().describe('Human-readable reason for the outcome'),
+    engineAvailable: z.boolean().describe('Whether a policy engine is actually registered (if false, this is fail-closed behavior)'),
+});
+//# sourceMappingURL=schemas.js.map