agent-threat-rules 0.4.0 → 1.0.0

package/dist/verdict.js

@@ -1,127 +0,0 @@
-/**
- * Verdict computation from ATR rule matches.
- *
- * Pure functions that determine the outcome (allow/ask/deny)
- * based on severity, confidence, and auto-response thresholds.
- *
- * @module agent-threat-rules/verdict
- */
-/** Severity rank from most severe (0) to least severe (4) */
-export const SEVERITY_RANK = {
-    critical: 0,
-    high: 1,
-    medium: 2,
-    low: 3,
-    informational: 4,
-};
-/**
- * Check whether auto-response is enabled for a matched rule.
- * The auto_response_threshold field on ATRResponse indicates the
- * minimum confidence level at which the action should be taken
- * automatically (without human approval).
- */
-export function isAutoResponseEnabled(match) {
-    const threshold = match.rule.response.auto_response_threshold;
-    if (!threshold)
-        return false;
-    const thresholdMap = {
-        high: 0.9,
-        medium: 0.7,
-        low: 0.5,
-    };
-    const requiredConfidence = thresholdMap[threshold];
-    if (requiredConfidence === undefined)
-        return false;
-    return match.confidence >= requiredConfidence;
-}
-/**
- * Determine the verdict outcome based on severity and confidence.
- *
- * Decision matrix:
- *   - critical severity           -> deny
- *   - high severity, conf >= 0.8  -> deny
- *   - high severity, conf < 0.8   -> ask
- *   - medium severity, conf >= 0.6 -> ask
- *   - everything else             -> allow
- */
-function determineOutcome(severity, confidence) {
-    if (severity === 'critical') {
-        return 'deny';
-    }
-    if (severity === 'high') {
-        return confidence >= 0.8 ? 'deny' : 'ask';
-    }
-    if (severity === 'medium' && confidence >= 0.6) {
-        return 'ask';
-    }
-    return 'allow';
-}
-/**
- * Collect unique actions from all matched rules, preserving order
- * of first appearance.
- */
-function collectUniqueActions(matches) {
-    const seen = new Set();
-    const actions = [];
-    for (const match of matches) {
-        for (const action of match.rule.response.actions) {
-            if (!seen.has(action)) {
-                seen.add(action);
-                actions.push(action);
-            }
-        }
-    }
-    return Object.freeze(actions);
-}
-/**
- * Build a human-readable reason string from the highest severity match.
- */
-function buildReason(highestMatch, outcome, matchCount) {
-    if (!highestMatch) {
-        return 'No rules matched.';
-    }
-    const { rule, confidence } = highestMatch;
-    const pct = Math.round(confidence * 100);
-    return (`${outcome.toUpperCase()}: ${rule.title} ` +
-        `[${rule.severity}/${pct}% confidence] ` +
-        `(${matchCount} rule${matchCount === 1 ? '' : 's'} matched)`);
-}
-/**
- * Compute a verdict from an array of ATR matches.
- *
- * This is a pure function -- no side effects, no mutation.
- * Returns a frozen ATRVerdict object.
- */
-export function computeVerdict(matches) {
-    if (matches.length === 0) {
-        return Object.freeze({
-            outcome: 'allow',
-            reason: 'No rules matched.',
-            matchCount: 0,
-            highestSeverity: null,
-            highestConfidence: 0,
-            actions: Object.freeze([]),
-            matches: Object.freeze([]),
-            timestamp: new Date().toISOString(),
-        });
-    }
-    // Matches are already sorted by the engine (severity desc, confidence desc).
-    // The first match has the highest severity.
-    const highestMatch = matches[0];
-    const highestSeverity = highestMatch.rule.severity;
-    const highestConfidence = highestMatch.confidence;
-    const outcome = determineOutcome(highestSeverity, highestConfidence);
-    const actions = collectUniqueActions(matches);
-    const reason = buildReason(highestMatch, outcome, matches.length);
-    return Object.freeze({
-        outcome,
-        reason,
-        matchCount: matches.length,
-        highestSeverity,
-        highestConfidence,
-        actions,
-        matches: Object.freeze([...matches]),
-        timestamp: new Date().toISOString(),
-    });
-}
-//# sourceMappingURL=verdict.js.map

package/dist/verdict.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAA0C;IAClE,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,aAAa,EAAE,CAAC;CACjB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAe;IAEf,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAC9D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7B,MAAM,YAAY,GAA2B;QAC3C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,GAAG;KACT,CAAC;IAEF,MAAM,kBAAkB,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEnD,OAAO,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC;AAChD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,QAAqB,EACrB,UAAkB;IAElB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,OAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAClB,YAAkC,EAClC,OAAuB,EACvB,UAAkB;IAElB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAEzC,OAAO,CACL,GAAG,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,KAAK,GAAG;QAC1C,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,gBAAgB;QACxC,IAAI,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA4B;IAE5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,OAAgB;YACzB,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,CAAC;YACb,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IACjC,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;IACnD,MAAM,iBAAiB,GAAG,YAAY,CAAC,UAAU,CAAC;IAElD,MAAM,OAAO,GAAG,gBAAgB,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAElE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO;QACP,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,eAAe;QACf,iBAAiB;QACjB,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;QACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC"}