aura-security 0.4.0

package/dist/schemas/index.d.ts

@@ -0,0 +1,2 @@
+export { auditorInputSchema } from './input.schema.js';
+export { auditorOutputSchema } from './output.schema.js';

package/dist/schemas/index.js

@@ -0,0 +1,2 @@
+export { auditorInputSchema } from './input.schema.js';
+export { auditorOutputSchema } from './output.schema.js';

package/dist/schemas/input.schema.d.ts

@@ -0,0 +1,87 @@
+export declare const auditorInputSchema: {
+    readonly $schema: "http://json-schema.org/draft-07/schema#";
+    readonly type: "object";
+    readonly required: readonly ["change_event", "evidence_bundle", "policy_context"];
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly change_event: {
+            readonly type: "object";
+            readonly required: readonly ["id", "type", "environment", "repo", "commit", "files_changed", "diff"];
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly id: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly type: {
+                    readonly type: "string";
+                    readonly enum: readonly ["pull_request", "deploy", "infra_change"];
+                };
+                readonly environment: {
+                    readonly type: "string";
+                    readonly enum: readonly ["dev", "staging", "prod"];
+                };
+                readonly repo: {
+                    readonly type: "string";
+                    readonly minLength: 1;
+                };
+                readonly commit: {
+                    readonly type: "string";
+                    readonly pattern: "^[a-f0-9]{40}$";
+                };
+                readonly files_changed: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly minItems: 1;
+                };
+                readonly diff: {
+                    readonly type: "string";
+                };
+            };
+        };
+        readonly evidence_bundle: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly sbom: {
+                    readonly type: "string";
+                };
+                readonly vuln_scan: {
+                    readonly type: "string";
+                };
+                readonly sast_results: {
+                    readonly type: "string";
+                };
+                readonly iac_scan: {
+                    readonly type: "string";
+                };
+                readonly provenance: {
+                    readonly type: "string";
+                };
+                readonly runtime_delta: {
+                    readonly type: "string";
+                };
+            };
+        };
+        readonly policy_context: {
+            readonly type: "object";
+            readonly required: readonly ["critical_assets", "risk_tolerance"];
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly critical_assets: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly minItems: 1;
+                };
+                readonly risk_tolerance: {
+                    readonly type: "string";
+                    readonly enum: readonly ["low", "medium", "high"];
+                };
+            };
+        };
+    };
+};

package/dist/schemas/input.schema.js

@@ -0,0 +1,44 @@
+// Strict JSON Schema for Auditor Input validation
+export const auditorInputSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    type: 'object',
+    required: ['change_event', 'evidence_bundle', 'policy_context'],
+    additionalProperties: false,
+    properties: {
+        change_event: {
+            type: 'object',
+            required: ['id', 'type', 'environment', 'repo', 'commit', 'files_changed', 'diff'],
+            additionalProperties: false,
+            properties: {
+                id: { type: 'string', minLength: 1 },
+                type: { type: 'string', enum: ['pull_request', 'deploy', 'infra_change'] },
+                environment: { type: 'string', enum: ['dev', 'staging', 'prod'] },
+                repo: { type: 'string', minLength: 1 },
+                commit: { type: 'string', pattern: '^[a-f0-9]{40}$' },
+                files_changed: { type: 'array', items: { type: 'string' }, minItems: 1 },
+                diff: { type: 'string' }
+            }
+        },
+        evidence_bundle: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+                sbom: { type: 'string' },
+                vuln_scan: { type: 'string' },
+                sast_results: { type: 'string' },
+                iac_scan: { type: 'string' },
+                provenance: { type: 'string' },
+                runtime_delta: { type: 'string' }
+            }
+        },
+        policy_context: {
+            type: 'object',
+            required: ['critical_assets', 'risk_tolerance'],
+            additionalProperties: false,
+            properties: {
+                critical_assets: { type: 'array', items: { type: 'string' }, minItems: 1 },
+                risk_tolerance: { type: 'string', enum: ['low', 'medium', 'high'] }
+            }
+        }
+    }
+};

package/dist/schemas/output.schema.d.ts

@@ -0,0 +1,115 @@
+export declare const auditorOutputSchema: {
+    readonly $schema: "http://json-schema.org/draft-07/schema#";
+    readonly type: "object";
+    readonly required: readonly ["agent_id", "agent_state", "events", "meta"];
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly agent_id: {
+            readonly type: "string";
+            readonly const: "exploit-reviewer";
+        };
+        readonly agent_state: {
+            readonly type: "string";
+            readonly enum: readonly ["idle", "analyzing", "conflict", "escalated", "blocked"];
+        };
+        readonly events: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly required: readonly ["event_type", "target", "payload", "timestamp"];
+                readonly additionalProperties: false;
+                readonly properties: {
+                    readonly event_type: {
+                        readonly type: "string";
+                        readonly enum: readonly ["analysis_started", "finding_raised", "conflict_detected", "escalation_triggered"];
+                    };
+                    readonly target: {
+                        readonly type: "string";
+                        readonly minLength: 1;
+                    };
+                    readonly payload: {
+                        readonly type: "object";
+                        readonly required: readonly ["severity", "claim", "attack_path", "affected_assets", "evidence_refs", "assurance_break", "confidence"];
+                        readonly additionalProperties: false;
+                        readonly properties: {
+                            readonly severity: {
+                                readonly type: "string";
+                                readonly enum: readonly ["low", "medium", "high", "critical"];
+                            };
+                            readonly claim: {
+                                readonly type: "string";
+                                readonly minLength: 1;
+                            };
+                            readonly attack_path: {
+                                readonly type: "array";
+                                readonly items: {
+                                    readonly type: "string";
+                                };
+                                readonly minItems: 1;
+                            };
+                            readonly affected_assets: {
+                                readonly type: "array";
+                                readonly items: {
+                                    readonly type: "string";
+                                };
+                            };
+                            readonly evidence_refs: {
+                                readonly type: "array";
+                                readonly items: {
+                                    readonly type: "object";
+                                    readonly required: readonly ["type", "pointer"];
+                                    readonly additionalProperties: false;
+                                    readonly properties: {
+                                        readonly type: {
+                                            readonly type: "string";
+                                            readonly enum: readonly ["diff", "sbom", "scan", "provenance", "runtime"];
+                                        };
+                                        readonly pointer: {
+                                            readonly type: "string";
+                                            readonly minLength: 1;
+                                        };
+                                    };
+                                };
+                            };
+                            readonly assurance_break: {
+                                readonly type: "array";
+                                readonly items: {
+                                    readonly type: "string";
+                                    readonly enum: readonly ["integrity", "access_control", "isolation", "auditability"];
+                                };
+                            };
+                            readonly confidence: {
+                                readonly type: "number";
+                                readonly minimum: 0;
+                                readonly maximum: 1;
+                            };
+                        };
+                    };
+                    readonly timestamp: {
+                        readonly type: "string";
+                        readonly format: "date-time";
+                    };
+                };
+            };
+        };
+        readonly meta: {
+            readonly type: "object";
+            readonly required: readonly ["assumptions", "uncertainties"];
+            readonly additionalProperties: false;
+            readonly properties: {
+                readonly assumptions: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+                readonly uncertainties: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                };
+            };
+        };
+    };
+};

package/dist/schemas/output.schema.js

@@ -0,0 +1,64 @@
+// Strict JSON Schema for Auditor Output validation
+export const auditorOutputSchema = {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    type: 'object',
+    required: ['agent_id', 'agent_state', 'events', 'meta'],
+    additionalProperties: false,
+    properties: {
+        agent_id: { type: 'string', const: 'exploit-reviewer' },
+        agent_state: { type: 'string', enum: ['idle', 'analyzing', 'conflict', 'escalated', 'blocked'] },
+        events: {
+            type: 'array',
+            items: {
+                type: 'object',
+                required: ['event_type', 'target', 'payload', 'timestamp'],
+                additionalProperties: false,
+                properties: {
+                    event_type: {
+                        type: 'string',
+                        enum: ['analysis_started', 'finding_raised', 'conflict_detected', 'escalation_triggered']
+                    },
+                    target: { type: 'string', minLength: 1 },
+                    payload: {
+                        type: 'object',
+                        required: ['severity', 'claim', 'attack_path', 'affected_assets', 'evidence_refs', 'assurance_break', 'confidence'],
+                        additionalProperties: false,
+                        properties: {
+                            severity: { type: 'string', enum: ['low', 'medium', 'high', 'critical'] },
+                            claim: { type: 'string', minLength: 1 },
+                            attack_path: { type: 'array', items: { type: 'string' }, minItems: 1 },
+                            affected_assets: { type: 'array', items: { type: 'string' } },
+                            evidence_refs: {
+                                type: 'array',
+                                items: {
+                                    type: 'object',
+                                    required: ['type', 'pointer'],
+                                    additionalProperties: false,
+                                    properties: {
+                                        type: { type: 'string', enum: ['diff', 'sbom', 'scan', 'provenance', 'runtime'] },
+                                        pointer: { type: 'string', minLength: 1 }
+                                    }
+                                }
+                            },
+                            assurance_break: {
+                                type: 'array',
+                                items: { type: 'string', enum: ['integrity', 'access_control', 'isolation', 'auditability'] }
+                            },
+                            confidence: { type: 'number', minimum: 0, maximum: 1 }
+                        }
+                    },
+                    timestamp: { type: 'string', format: 'date-time' }
+                }
+            }
+        },
+        meta: {
+            type: 'object',
+            required: ['assumptions', 'uncertainties'],
+            additionalProperties: false,
+            properties: {
+                assumptions: { type: 'array', items: { type: 'string' } },
+                uncertainties: { type: 'array', items: { type: 'string' } }
+            }
+        }
+    }
+};

package/dist/serve-visualizer.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/serve-visualizer.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+// Serve the 3D Visualizer
+import { createServer } from 'http';
+import { readFileSync, existsSync } from 'fs';
+import { join, extname } from 'path';
+import { fileURLToPath } from 'url';
+import { dirname } from 'path';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const VISUALIZER_DIR = join(__dirname, '..', 'visualizer');
+const PORT = parseInt(process.env.VISUALIZER_PORT ?? '8080', 10);
+const MIME_TYPES = {
+    '.html': 'text/html',
+    '.js': 'application/javascript',
+    '.css': 'text/css',
+    '.json': 'application/json',
+    '.png': 'image/png',
+    '.svg': 'image/svg+xml'
+};
+const server = createServer((req, res) => {
+    // CORS headers for Aura API access
+    res.setHeader('Access-Control-Allow-Origin', '*');
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+    if (req.method === 'OPTIONS') {
+        res.writeHead(204);
+        res.end();
+        return;
+    }
+    const url = req.url?.split('?')[0] ?? '/';
+    let filePath;
+    // Route: / -> landing page
+    // Route: /app -> dashboard (3D visualizer)
+    // Route: /app/classic -> classic dashboard
+    if (url === '/') {
+        filePath = join(VISUALIZER_DIR, 'landing.html');
+    }
+    else if (url === '/app' || url === '/app/') {
+        filePath = join(VISUALIZER_DIR, 'index-minimal.html');
+    }
+    else if (url === '/app/classic') {
+        filePath = join(VISUALIZER_DIR, 'index.html');
+    }
+    else {
+        filePath = join(VISUALIZER_DIR, url);
+    }
+    if (!existsSync(filePath)) {
+        res.writeHead(404);
+        res.end('Not found');
+        return;
+    }
+    const ext = extname(filePath);
+    const contentType = MIME_TYPES[ext] || 'application/octet-stream';
+    try {
+        const content = readFileSync(filePath);
+        res.writeHead(200, { 'Content-Type': contentType });
+        res.end(content);
+    }
+    catch (err) {
+        res.writeHead(500);
+        res.end('Server error');
+    }
+});
+server.listen(PORT, () => {
+    console.log(`
+╔═══════════════════════════════════════════════════════════╗
+║              AURASECURITY - WEB SERVER                    ║
+╠═══════════════════════════════════════════════════════════╣
+║  Landing:    http://127.0.0.1:${PORT}                        ║
+║  Dashboard:  http://127.0.0.1:${PORT}/app                    ║
+║  Aura API:   http://127.0.0.1:3000                        ║
+╚═══════════════════════════════════════════════════════════╝
+
+Routes:
+  /          Landing page
+  /app       3D Dashboard (visualizer)
+  /app/classic   Classic dashboard UI
+`);
+});

package/dist/slop/client.d.ts

@@ -0,0 +1,29 @@
+export interface SlopClientConfig {
+    baseUrl: string;
+    apiKey?: string;
+    timeout?: number;
+}
+export interface SlopToolCall {
+    tool: string;
+    arguments: Record<string, unknown>;
+}
+export interface SlopMemoryEntry {
+    key: string;
+    value: unknown;
+    metadata?: Record<string, unknown>;
+}
+export declare class SlopConnectionError extends Error {
+    constructor(message: string);
+}
+export declare class SlopClient {
+    private config;
+    private _connected;
+    constructor(config: SlopClientConfig);
+    get connected(): boolean;
+    private headers;
+    connect(): Promise<void>;
+    disconnect(): Promise<void>;
+    publishToMemory(entry: SlopMemoryEntry): Promise<void>;
+    callTool(call: SlopToolCall): Promise<unknown>;
+    healthCheck(): Promise<boolean>;
+}

package/dist/slop/client.js

@@ -0,0 +1,125 @@
+// SLOP Client - Publish-only client for auditor pipeline
+// Implements: /tools, /memory endpoints per SLOP spec
+export class SlopConnectionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SlopConnectionError';
+    }
+}
+export class SlopClient {
+    config;
+    _connected = false;
+    constructor(config) {
+        this.config = {
+            baseUrl: config.baseUrl.replace(/\/$/, ''),
+            apiKey: config.apiKey ?? '',
+            timeout: config.timeout ?? 30000
+        };
+    }
+    get connected() {
+        return this._connected;
+    }
+    headers() {
+        const h = {
+            'Content-Type': 'application/json'
+        };
+        if (this.config.apiKey) {
+            h['Authorization'] = `Bearer ${this.config.apiKey}`;
+        }
+        return h;
+    }
+    async connect() {
+        // Verify SLOP server is available via /info
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+        try {
+            const res = await fetch(`${this.config.baseUrl}/info`, {
+                method: 'GET',
+                headers: this.headers(),
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            if (!res.ok) {
+                throw new SlopConnectionError(`SLOP server returned ${res.status}`);
+            }
+            this._connected = true;
+        }
+        catch (err) {
+            clearTimeout(timeoutId);
+            if (err instanceof SlopConnectionError)
+                throw err;
+            throw new SlopConnectionError(`Failed to connect to SLOP server: ${err}`);
+        }
+    }
+    async disconnect() {
+        this._connected = false;
+    }
+    // Fail-closed: throws on any error
+    async publishToMemory(entry) {
+        if (!this._connected) {
+            throw new SlopConnectionError('Not connected to SLOP server');
+        }
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+        try {
+            const res = await fetch(`${this.config.baseUrl}/memory`, {
+                method: 'POST',
+                headers: this.headers(),
+                body: JSON.stringify(entry),
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            if (!res.ok) {
+                throw new SlopConnectionError(`Memory publish failed: ${res.status}`);
+            }
+        }
+        catch (err) {
+            clearTimeout(timeoutId);
+            if (err instanceof SlopConnectionError)
+                throw err;
+            throw new SlopConnectionError(`Memory publish error: ${err}`);
+        }
+    }
+    async callTool(call) {
+        if (!this._connected) {
+            throw new SlopConnectionError('Not connected to SLOP server');
+        }
+        const controller = new AbortController();
+        const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+        try {
+            const res = await fetch(`${this.config.baseUrl}/tools`, {
+                method: 'POST',
+                headers: this.headers(),
+                body: JSON.stringify(call),
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            if (!res.ok) {
+                throw new SlopConnectionError(`Tool call failed: ${res.status}`);
+            }
+            return await res.json();
+        }
+        catch (err) {
+            clearTimeout(timeoutId);
+            if (err instanceof SlopConnectionError)
+                throw err;
+            throw new SlopConnectionError(`Tool call error: ${err}`);
+        }
+    }
+    async healthCheck() {
+        try {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(`${this.config.baseUrl}/info`, {
+                method: 'GET',
+                headers: this.headers(),
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            return res.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+}

package/dist/slop/index.d.ts

@@ -0,0 +1,4 @@
+export { SlopServer } from './server.js';
+export type { SlopTool, SlopServerConfig } from './server.js';
+export { SlopClient, SlopConnectionError } from './client.js';
+export type { SlopClientConfig, SlopToolCall, SlopMemoryEntry } from './client.js';

package/dist/slop/index.js

@@ -0,0 +1,2 @@
+export { SlopServer } from './server.js';
+export { SlopClient, SlopConnectionError } from './client.js';

package/dist/slop/server.d.ts

@@ -0,0 +1,45 @@
+import { type AuditorDatabase } from '../database/index.js';
+import { NotificationService } from '../integrations/notifications.js';
+export interface SlopTool {
+    name: string;
+    description: string;
+    parameters: Record<string, unknown>;
+    handler: (args: Record<string, unknown>) => Promise<unknown>;
+}
+export interface SlopServerConfig {
+    port: number;
+    host?: string;
+    dbPath?: string;
+}
+export declare class SlopServer {
+    private server;
+    private tools;
+    private memory;
+    private config;
+    private db;
+    private notificationService;
+    constructor(config: SlopServerConfig);
+    getNotificationService(): NotificationService;
+    reloadNotifications(): void;
+    registerTool(tool: SlopTool): void;
+    getDatabase(): AuditorDatabase;
+    private handleRequest;
+    private handleInfo;
+    private handleListTools;
+    private handleCallTool;
+    private handleMemoryWrite;
+    private handleMemoryRead;
+    private handleGetSettings;
+    private handleSaveSettings;
+    private handleGetAudits;
+    private handleGetAudit;
+    private handleDeleteAudit;
+    private handleGetStats;
+    private handleGetNotifications;
+    private handleTestNotification;
+    private handleSendNotification;
+    private readBody;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    getMemorySnapshot(): Map<string, unknown>;
+}