driftdetect-core 0.7.1 → 0.8.0

package/dist/quality-gates/gates/security-boundary/security-boundary-gate.js

@@ -0,0 +1,307 @@
+/**
+ * Security Boundary Gate
+ *
+ * @license Apache-2.0
+ *
+ * Enforces security boundaries by checking that sensitive data access
+ * has proper authorization in the call chain.
+ *
+ * FUTURE_GATE: gate:security-boundary (Enterprise tier)
+ */
+import { BaseGate } from '../base-gate.js';
+/**
+ * Security Boundary Gate
+ *
+ * Checks that sensitive data access has proper authorization.
+ */
+export class SecurityBoundaryGate extends BaseGate {
+    id = 'security-boundary';
+    name = 'Security Boundary';
+    description = 'Enforces authorization for sensitive data access';
+    async executeGate(input) {
+        const config = input.config;
+        const callGraph = input.context.callGraph;
+        if (!callGraph || callGraph.nodes.size === 0) {
+            return this.createPassedResult('No call graph available for security analysis', {
+                newSensitiveAccess: [],
+                unauthorizedPaths: [],
+                tablesAccessed: [],
+                authCoverage: 100,
+                protectedTablesStatus: {},
+            }, ['No call graph found. Run `drift callgraph build` first.']);
+        }
+        // Analyze security boundaries
+        const analysis = this.analyzeSecurityBoundaries(input.files, callGraph, config);
+        // Build violations from unauthorized access
+        const violations = this.buildViolations(analysis, config);
+        // Determine pass/fail based on thresholds
+        const passed = this.evaluateThresholds(analysis, config);
+        const score = this.calculateScore(analysis);
+        const status = passed ? (violations.length > 0 ? 'warned' : 'passed') : 'failed';
+        const details = {
+            newSensitiveAccess: analysis.newSensitiveAccess,
+            unauthorizedPaths: analysis.unauthorizedPaths,
+            tablesAccessed: analysis.tablesAccessed,
+            authCoverage: analysis.authCoverage,
+            protectedTablesStatus: analysis.protectedTablesStatus,
+        };
+        const summary = this.buildSummary(analysis, passed);
+        const warnings = this.buildWarnings(analysis, config);
+        if (!passed) {
+            return this.createFailedResult(summary, violations, details, score, warnings);
+        }
+        if (violations.length > 0) {
+            return this.createWarnedResult(summary, violations, details, score, warnings);
+        }
+        return {
+            gateId: this.id,
+            gateName: this.name,
+            status,
+            passed,
+            score,
+            summary,
+            violations,
+            warnings,
+            executionTimeMs: 0,
+            details: details,
+        };
+    }
+    validateConfig(config) {
+        const errors = [];
+        const c = config;
+        if (c.maxDataFlowDepth < 1) {
+            errors.push('maxDataFlowDepth must be at least 1');
+        }
+        return { valid: errors.length === 0, errors };
+    }
+    getDefaultConfig() {
+        return {
+            enabled: true,
+            blocking: true,
+            allowNewSensitiveAccess: false,
+            protectedTables: ['users', 'credentials', 'tokens', 'sessions', 'payments'],
+            maxDataFlowDepth: 10,
+            requiredAuthPatterns: ['requireAuth', 'authenticate', 'authorize', 'checkPermission', 'verifyToken'],
+        };
+    }
+    /**
+     * Analyze security boundaries in changed files.
+     */
+    analyzeSecurityBoundaries(files, callGraph, config) {
+        const newSensitiveAccess = [];
+        const unauthorizedPaths = [];
+        const tablesAccessed = new Set();
+        const protectedTablesStatus = {};
+        // Find functions in changed files
+        const changedFunctions = new Set();
+        for (const [nodeId, node] of callGraph.nodes) {
+            if (files.some(f => node.file.endsWith(f) || f.endsWith(node.file))) {
+                changedFunctions.add(nodeId);
+            }
+        }
+        // Analyze each changed function for data access
+        for (const funcId of changedFunctions) {
+            const node = callGraph.nodes.get(funcId);
+            if (!node)
+                continue;
+            // Check if function accesses sensitive data
+            // In full implementation, this would use SemanticDataAccessScanner
+            const accessedData = this.detectDataAccess(node.name, node.file);
+            for (const data of accessedData) {
+                tablesAccessed.add(data.table);
+                // Check if this is a protected table
+                if (config.protectedTables.includes(data.table)) {
+                    // Check if auth is in call chain
+                    const hasAuth = this.hasAuthInCallChain(funcId, callGraph, config.requiredAuthPatterns, config.maxDataFlowDepth);
+                    newSensitiveAccess.push({
+                        file: node.file,
+                        line: data.line,
+                        dataAccessed: data.table,
+                        accessType: data.accessType,
+                        hasAuth,
+                    });
+                    if (!hasAuth) {
+                        // Find the unauthorized path
+                        const path = this.findUnauthorizedPath(funcId, callGraph, config.maxDataFlowDepth);
+                        unauthorizedPaths.push({
+                            entryPoint: path.entryPoint,
+                            sensitiveData: data.table,
+                            path: path.path,
+                            missingAuth: `No ${config.requiredAuthPatterns.join(' or ')} in call chain`,
+                        });
+                    }
+                }
+            }
+        }
+        // Calculate auth coverage
+        const totalAccess = newSensitiveAccess.length;
+        const authorizedAccess = newSensitiveAccess.filter(a => a.hasAuth).length;
+        const authCoverage = totalAccess > 0 ? (authorizedAccess / totalAccess) * 100 : 100;
+        // Determine protected tables status
+        for (const table of config.protectedTables) {
+            const accessPoints = newSensitiveAccess.filter(a => a.dataAccessed === table);
+            if (accessPoints.length === 0) {
+                // Not accessed in changed files
+                continue;
+            }
+            const allProtected = accessPoints.every(a => a.hasAuth);
+            const noneProtected = accessPoints.every(a => !a.hasAuth);
+            protectedTablesStatus[table] = allProtected ? 'protected' : noneProtected ? 'unprotected' : 'partial';
+        }
+        return {
+            newSensitiveAccess,
+            unauthorizedPaths,
+            tablesAccessed: Array.from(tablesAccessed),
+            authCoverage,
+            protectedTablesStatus,
+        };
+    }
+    /**
+     * Detect data access in a function (simplified).
+     */
+    detectDataAccess(_funcName, _file) {
+        // In full implementation, this would use SemanticDataAccessScanner
+        // to detect actual data access patterns
+        return [];
+    }
+    /**
+     * Check if auth is in the call chain.
+     */
+    hasAuthInCallChain(funcId, callGraph, authPatterns, maxDepth) {
+        const visited = new Set();
+        const queue = [{ nodeId: funcId, depth: 0 }];
+        while (queue.length > 0) {
+            const { nodeId, depth } = queue.shift();
+            if (visited.has(nodeId) || depth > maxDepth)
+                continue;
+            visited.add(nodeId);
+            const node = callGraph.nodes.get(nodeId);
+            if (!node)
+                continue;
+            // Check if this function is an auth function
+            if (authPatterns.some(pattern => node.name.toLowerCase().includes(pattern.toLowerCase()))) {
+                return true;
+            }
+            // Add callers to queue
+            for (const edge of callGraph.edges) {
+                if (edge.to === nodeId && !visited.has(edge.from)) {
+                    queue.push({ nodeId: edge.from, depth: depth + 1 });
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Find the unauthorized path from entry point to function.
+     */
+    findUnauthorizedPath(funcId, callGraph, maxDepth) {
+        const path = [];
+        let current = funcId;
+        let depth = 0;
+        while (depth < maxDepth) {
+            const node = callGraph.nodes.get(current);
+            if (!node)
+                break;
+            path.unshift(node.name);
+            // Find caller
+            const callerEdge = callGraph.edges.find(e => e.to === current);
+            if (!callerEdge) {
+                // This is an entry point
+                return { entryPoint: node.name, path };
+            }
+            current = callerEdge.from;
+            depth++;
+        }
+        return { entryPoint: path[0] || 'unknown', path };
+    }
+    /**
+     * Evaluate whether the gate passes based on thresholds.
+     */
+    evaluateThresholds(analysis, config) {
+        // Fail if new sensitive access is not allowed and we have any
+        if (!config.allowNewSensitiveAccess && analysis.newSensitiveAccess.length > 0) {
+            // Only fail if there are unauthorized paths
+            if (analysis.unauthorizedPaths.length > 0) {
+                return false;
+            }
+        }
+        // Fail if any unauthorized paths exist
+        if (analysis.unauthorizedPaths.length > 0) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Build violations from unauthorized access.
+     */
+    buildViolations(analysis, _config) {
+        const violations = [];
+        // Violation for each unauthorized path
+        for (const path of analysis.unauthorizedPaths) {
+            violations.push(this.createViolation({
+                severity: 'error',
+                file: 'project',
+                line: 1,
+                column: 1,
+                message: `Unauthorized access to ${path.sensitiveData}`,
+                explanation: `Path: ${path.path.join(' → ')}\n${path.missingAuth}`,
+                ruleId: 'security-unauthorized-access',
+                suggestedFix: 'Add authentication/authorization middleware to the call chain',
+            }));
+        }
+        // Warning for new sensitive access (even if authorized)
+        for (const access of analysis.newSensitiveAccess.filter(a => a.hasAuth)) {
+            violations.push(this.createViolation({
+                severity: 'info',
+                file: access.file,
+                line: access.line,
+                column: 1,
+                message: `New ${access.accessType} access to ${access.dataAccessed}`,
+                explanation: 'This access point has proper authorization',
+                ruleId: 'security-new-access',
+            }));
+        }
+        return violations;
+    }
+    /**
+     * Calculate score based on analysis.
+     */
+    calculateScore(analysis) {
+        // Base score from auth coverage
+        let score = analysis.authCoverage;
+        // Heavy penalty for unauthorized paths
+        score -= analysis.unauthorizedPaths.length * 20;
+        return Math.max(0, Math.min(100, Math.round(score)));
+    }
+    /**
+     * Build human-readable summary.
+     */
+    buildSummary(analysis, passed) {
+        if (analysis.newSensitiveAccess.length === 0) {
+            return 'No sensitive data access in changed files';
+        }
+        if (passed) {
+            return `Security boundaries intact: ${analysis.authCoverage.toFixed(0)}% auth coverage, ${analysis.tablesAccessed.length} table${analysis.tablesAccessed.length === 1 ? '' : 's'} accessed`;
+        }
+        return `Security boundary violations: ${analysis.unauthorizedPaths.length} unauthorized path${analysis.unauthorizedPaths.length === 1 ? '' : 's'} to sensitive data`;
+    }
+    /**
+     * Build warnings for the result.
+     */
+    buildWarnings(analysis, _config) {
+        const warnings = [];
+        // Warn about partial protection
+        const partialTables = Object.entries(analysis.protectedTablesStatus)
+            .filter(([, status]) => status === 'partial')
+            .map(([table]) => table);
+        if (partialTables.length > 0) {
+            warnings.push(`Partial auth coverage for: ${partialTables.join(', ')}`);
+        }
+        // Warn about low auth coverage
+        if (analysis.authCoverage < 100 && analysis.authCoverage > 0) {
+            warnings.push(`Auth coverage is ${analysis.authCoverage.toFixed(0)}% (some access points may be intentionally public)`);
+        }
+        return warnings;
+    }
+}
+//# sourceMappingURL=security-boundary-gate.js.map

package/dist/quality-gates/gates/security-boundary/security-boundary-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-boundary-gate.js","sourceRoot":"","sources":["../../../../src/quality-gates/gates/security-boundary/security-boundary-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAc3C;;;;GAIG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ;IACvC,EAAE,GAAW,mBAAmB,CAAC;IACjC,IAAI,GAAG,mBAAmB,CAAC;IAC3B,WAAW,GAAG,kDAAkD,CAAC;IAEhE,KAAK,CAAC,WAAW,CAAC,KAAgB;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAgC,CAAC;QACtD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAE1C,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,kBAAkB,CAC5B,+CAA+C,EAC/C;gBACE,kBAAkB,EAAE,EAAE;gBACtB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,EAAE;gBAClB,YAAY,EAAE,GAAG;gBACjB,qBAAqB,EAAE,EAAE;aACY,EACvC,CAAC,yDAAyD,CAAC,CAC5D,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAEhF,4CAA4C;QAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE1D,0CAA0C;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEjF,MAAM,OAAO,GAA4B;YACvC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;YAC/C,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;SACtD,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEtD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAA6C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtH,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAA6C,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACtH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,MAAM;YACN,MAAM;YACN,KAAK;YACL,OAAO;YACP,UAAU;YACV,QAAQ;YACR,eAAe,EAAE,CAAC;YAClB,OAAO,EAAE,OAA6C;SACvD,CAAC;IACJ,CAAC;IAED,cAAc,CAAC,MAAkB;QAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,MAAgC,CAAC;QAE3C,IAAI,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,gBAAgB;QACd,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,uBAAuB,EAAE,KAAK;YAC9B,eAAe,EAAE,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC;YAC3E,gBAAgB,EAAE,EAAE;YACpB,oBAAoB,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,aAAa,CAAC;SACrG,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,yBAAyB,CAC/B,KAAe,EACf,SAAoB,EACpB,MAA8B;QAQ9B,MAAM,kBAAkB,GAAsB,EAAE,CAAC;QACjD,MAAM,iBAAiB,GAAuB,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;QACzC,MAAM,qBAAqB,GAA4D,EAAE,CAAC;QAE1F,kCAAkC;QAClC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACpE,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,4CAA4C;YAC5C,mEAAmE;YACnE,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEjE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAE/B,qCAAqC;gBACrC,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChD,iCAAiC;oBACjC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CACrC,MAAM,EACN,SAAS,EACT,MAAM,CAAC,oBAAoB,EAC3B,MAAM,CAAC,gBAAgB,CACxB,CAAC;oBAEF,kBAAkB,CAAC,IAAI,CAAC;wBACtB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,YAAY,EAAE,IAAI,CAAC,KAAK;wBACxB,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,OAAO;qBACR,CAAC,CAAC;oBAEH,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,6BAA6B;wBAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;wBACnF,iBAAiB,CAAC,IAAI,CAAC;4BACrB,UAAU,EAAE,IAAI,CAAC,UAAU;4BAC3B,aAAa,EAAE,IAAI,CAAC,KAAK;4BACzB,IAAI,EAAE,IAAI,CAAC,IAAI;4BACf,WAAW,EAAE,MAAM,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB;yBAC5E,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC;QAC9C,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1E,MAAM,YAAY,GAAG,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,GAAG,WAAW,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAEpF,oCAAoC;QACpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC;YAC9E,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,gCAAgC;gBAChC,SAAS;YACX,CAAC;YAED,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAE1D,qBAAqB,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACxG,CAAC;QAED,OAAO;YACL,kBAAkB;YAClB,iBAAiB;YACjB,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC;YAC1C,YAAY;YACZ,qBAAqB;SACtB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,gBAAgB,CACtB,SAAiB,EACjB,KAAa;QAEb,mEAAmE;QACnE,wCAAwC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,MAAc,EACd,SAAoB,EACpB,YAAsB,EACtB,QAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,KAAK,GAA6C,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAEvF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YACzC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,QAAQ;gBAAE,SAAS;YACtD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEpB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,6CAA6C;YAC7C,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC9B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CACxD,EAAE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,uBAAuB;YACvB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,oBAAoB,CAC1B,MAAc,EACd,SAAoB,EACpB,QAAgB;QAEhB,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAG,MAAM,CAAC;QACrB,IAAI,KAAK,GAAG,CAAC,CAAC;QAEd,OAAO,KAAK,GAAG,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI;gBAAE,MAAM;YAEjB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAExB,cAAc;YACd,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;YAC/D,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,yBAAyB;gBACzB,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,CAAC;YAED,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,CAAC;QACV,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,QAIC,EACD,MAA8B;QAE9B,8DAA8D;QAC9D,IAAI,CAAC,MAAM,CAAC,uBAAuB,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,4CAA4C;YAC5C,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,QAGC,EACD,OAA+B;QAE/B,MAAM,UAAU,GAAoB,EAAE,CAAC;QAEvC,uCAAuC;QACvC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC9C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;gBACnC,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,CAAC;gBACP,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,0BAA0B,IAAI,CAAC,aAAa,EAAE;gBACvD,WAAW,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE;gBAClE,MAAM,EAAE,8BAA8B;gBACtC,YAAY,EAAE,+DAA+D;aAC9E,CAAC,CAAC,CAAC;QACN,CAAC;QAED,wDAAwD;QACxD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACxE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;gBACnC,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,MAAM,EAAE,CAAC;gBACT,OAAO,EAAE,OAAO,MAAM,CAAC,UAAU,cAAc,MAAM,CAAC,YAAY,EAAE;gBACpE,WAAW,EAAE,4CAA4C;gBACzD,MAAM,EAAE,qBAAqB;aAC9B,CAAC,CAAC,CAAC;QACN,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,QAItB;QACC,gCAAgC;QAChC,IAAI,KAAK,GAAG,QAAQ,CAAC,YAAY,CAAC;QAElC,uCAAuC;QACvC,KAAK,IAAI,QAAQ,CAAC,iBAAiB,CAAC,MAAM,GAAG,EAAE,CAAC;QAEhD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,QAKC,EACD,MAAe;QAEf,IAAI,QAAQ,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,2CAA2C,CAAC;QACrD,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,+BAA+B,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,QAAQ,CAAC,cAAc,CAAC,MAAM,SAAS,QAAQ,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC;QAC9L,CAAC;QAED,OAAO,iCAAiC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,qBAAqB,QAAQ,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC;IACvK,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,QAKC,EACD,OAA+B;QAE/B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,gCAAgC;QAChC,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;aACjE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAE3B,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,8BAA8B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,+BAA+B;QAC/B,IAAI,QAAQ,CAAC,YAAY,GAAG,GAAG,IAAI,QAAQ,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC7D,QAAQ,CAAC,IAAI,CAAC,oBAAoB,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC;QAC1H,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/quality-gates/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Quality Gates System
+ *
+ * @license Apache-2.0
+ *
+ * Enterprise-grade quality gates for code changes.
+ * Checks pattern compliance, constraint verification, regression detection,
+ * impact simulation, security boundaries, and custom rules.
+ *
+ * LICENSING NOTE: All features are available to all users initially.
+ * The licensing infrastructure is in place but NOT enforced.
+ * See FUTURE_GATE comments in types.ts for where license checks should be added.
+ */
+export * from './types.js';
+export { GateOrchestrator } from './orchestrator/index.js';
+export { GateRegistry, getGateRegistry } from './orchestrator/index.js';
+export { ParallelExecutor } from './orchestrator/index.js';
+export { ResultAggregator } from './orchestrator/index.js';
+export { BaseGate } from './gates/index.js';
+export { PatternComplianceGate } from './gates/index.js';
+export { ConstraintVerificationGate } from './gates/index.js';
+export { RegressionDetectionGate } from './gates/index.js';
+export { ImpactSimulationGate } from './gates/index.js';
+export { SecurityBoundaryGate } from './gates/index.js';
+export { CustomRulesGate } from './gates/index.js';
+export { PolicyLoader } from './policy/index.js';
+export { PolicyEvaluator } from './policy/index.js';
+export { DEFAULT_POLICIES } from './policy/index.js';
+export { BaseReporter, TextReporter, JsonReporter, GitHubReporter, GitLabReporter, SarifReporter, } from './reporters/index.js';
+export type { Reporter } from './reporters/index.js';
+export { GateRunStore } from './store/index.js';
+export { SnapshotStore } from './store/index.js';
+import { GateOrchestrator } from './orchestrator/index.js';
+export declare function createQualityGateOrchestrator(projectRoot: string): GateOrchestrator;
+//# sourceMappingURL=index.d.ts.map

package/dist/quality-gates/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/quality-gates/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,GAAG,gBAAgB,CAEnF"}

package/dist/quality-gates/index.js

@@ -0,0 +1,43 @@
+/**
+ * Quality Gates System
+ *
+ * @license Apache-2.0
+ *
+ * Enterprise-grade quality gates for code changes.
+ * Checks pattern compliance, constraint verification, regression detection,
+ * impact simulation, security boundaries, and custom rules.
+ *
+ * LICENSING NOTE: All features are available to all users initially.
+ * The licensing infrastructure is in place but NOT enforced.
+ * See FUTURE_GATE comments in types.ts for where license checks should be added.
+ */
+// Types
+export * from './types.js';
+// Orchestrator
+export { GateOrchestrator } from './orchestrator/index.js';
+export { GateRegistry, getGateRegistry } from './orchestrator/index.js';
+export { ParallelExecutor } from './orchestrator/index.js';
+export { ResultAggregator } from './orchestrator/index.js';
+// Gates
+export { BaseGate } from './gates/index.js';
+export { PatternComplianceGate } from './gates/index.js';
+export { ConstraintVerificationGate } from './gates/index.js';
+export { RegressionDetectionGate } from './gates/index.js';
+export { ImpactSimulationGate } from './gates/index.js';
+export { SecurityBoundaryGate } from './gates/index.js';
+export { CustomRulesGate } from './gates/index.js';
+// Policy
+export { PolicyLoader } from './policy/index.js';
+export { PolicyEvaluator } from './policy/index.js';
+export { DEFAULT_POLICIES } from './policy/index.js';
+// Reporters
+export { BaseReporter, TextReporter, JsonReporter, GitHubReporter, GitLabReporter, SarifReporter, } from './reporters/index.js';
+// Store
+export { GateRunStore } from './store/index.js';
+export { SnapshotStore } from './store/index.js';
+// Factory function for easy instantiation
+import { GateOrchestrator } from './orchestrator/index.js';
+export function createQualityGateOrchestrator(projectRoot) {
+    return new GateOrchestrator(projectRoot);
+}
+//# sourceMappingURL=index.js.map

package/dist/quality-gates/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/quality-gates/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,QAAQ;AACR,cAAc,YAAY,CAAC;AAE3B,eAAe;AACf,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,QAAQ;AACR,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,SAAS;AACT,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,YAAY;AACZ,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,sBAAsB,CAAC;AAG9B,QAAQ;AACR,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,0CAA0C;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,UAAU,6BAA6B,CAAC,WAAmB;IAC/D,OAAO,IAAI,gBAAgB,CAAC,WAAW,CAAC,CAAC;AAC3C,CAAC"}

package/dist/quality-gates/orchestrator/gate-orchestrator.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Gate Orchestrator
+ *
+ * @license Apache-2.0
+ *
+ * Main orchestrator for quality gates.
+ * Coordinates gate execution and aggregates results.
+ */
+import type { QualityGateOptions, QualityGateResult } from '../types.js';
+/**
+ * Main orchestrator for quality gates.
+ * Coordinates gate execution and aggregates results.
+ */
+export declare class GateOrchestrator {
+    private registry;
+    private executor;
+    private aggregator;
+    private policyLoader;
+    private policyEvaluator;
+    readonly projectRoot: string;
+    constructor(projectRoot: string);
+    /**
+     * Run quality gates with the given options.
+     */
+    run(options: QualityGateOptions): Promise<QualityGateResult>;
+    /**
+     * Resolve files to check.
+     */
+    private resolveFiles;
+    /**
+     * Load the appropriate policy.
+     */
+    private loadPolicy;
+    /**
+     * Determine which gates to run.
+     */
+    private determineGates;
+    /**
+     * Build shared context for gates.
+     */
+    private buildContext;
+    /**
+     * Check if any of the specified gates are enabled.
+     */
+    private gatesNeed;
+    /**
+     * Execute gates in parallel where possible.
+     */
+    private executeGates;
+    /**
+     * Create result for empty file list or no gates.
+     */
+    private createEmptyResult;
+    /**
+     * Load patterns from the pattern store.
+     */
+    private loadPatterns;
+    /**
+     * Load constraints from the constraint store.
+     */
+    private loadConstraints;
+    /**
+     * Load call graph from the call graph analyzer.
+     */
+    private loadCallGraph;
+    /**
+     * Load previous snapshot for regression detection.
+     */
+    private loadPreviousSnapshot;
+    /**
+     * Load custom rules from policy configuration.
+     */
+    private loadCustomRules;
+    /**
+     * Save result to history.
+     */
+    private saveToHistory;
+}
+//# sourceMappingURL=gate-orchestrator.d.ts.map

package/dist/quality-gates/orchestrator/gate-orchestrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-orchestrator.d.ts","sourceRoot":"","sources":["../../../src/quality-gates/orchestrator/gate-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EAWlB,MAAM,aAAa,CAAC;AAOrB;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,eAAe,CAAkB;IAEzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;gBAEjB,WAAW,EAAE,MAAM;IAS/B;;OAEG;IACG,GAAG,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA0DlE;;OAEG;YACW,YAAY;IAU1B;;OAEG;YACW,UAAU;IAgBxB;;OAEG;IACH,OAAO,CAAC,cAAc;IAoBtB;;OAEG;YACW,YAAY;IA6C1B;;OAEG;IACH,OAAO,CAAC,SAAS;IAUjB;;OAEG;YACW,YAAY;IAyC1B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAwCzB;;OAEG;YACW,YAAY;IAoC1B;;OAEG;YACW,eAAe;IAM7B;;OAEG;YACW,aAAa;IAM3B;;OAEG;YACW,oBAAoB;IAMlC;;OAEG;YACW,eAAe;IAkB7B;;OAEG;YACW,aAAa;CAI5B"}