fullshield 0.4.0 → 1.0.1

package/dist/compliance.js

@@ -1,164 +1,2 @@
-// src/compliance/index.ts
-var COMPLIANCE_DISCLAIMER = "This is not a certification or audit. FullShield produces an evidence-style mapping only; it does not certify PCI DSS, SOC 2, ISO, or any other standard.";
-var ROW = (ruleId, owasp, cwe, asvs, pci) => ({
-  ruleId,
-  owasp,
-  cwe,
-  asvs,
-  pci
-});
-var RULE_MAP = [
-  ROW("SAST-SQLI-001", "A03:2021 Injection", "CWE-89", "V5.3.4", "PCI DSS 6.2.4"),
-  ROW("SAST-NOSQLI-001", "A03:2021 Injection", "CWE-943", "V5.3.4", "PCI DSS 6.2.4"),
-  ROW("SAST-CMDI-001", "A03:2021 Injection", "CWE-78", "V5.3.3", "PCI DSS 6.2.4"),
-  ROW("SAST-PATH-001", "A01:2021 Broken Access Control", "CWE-22", "V12.3.1", "PCI DSS 6.2.4"),
-  ROW("SAST-EVAL-001", "A03:2021 Injection", "CWE-95", "V5.3.3", "PCI DSS 6.2.4"),
-  ROW("SAST-SSRF-001", "A10:2021 SSRF", "CWE-918", "V12.6.1", "PCI DSS 6.2.4"),
-  ROW("SAST-REDIRECT-001", "A01:2021 Broken Access Control", "CWE-601", "V5.1.1", "PCI DSS 6.4.2"),
-  ROW("SAST-PROTO-001", "A03:2021 Injection", "CWE-1321", "V5.3.3", "PCI DSS 6.2.4"),
-  ROW("SAST-XSS-001", "A03:2021 Injection", "CWE-79", "V5.3.3", "PCI DSS 6.2.4"),
-  ROW("SAST-JWT-001", "A07:2021 Identification Failures", "CWE-347", "V3.5.3", "PCI DSS 6.5.10"),
-  ROW("SAST-CRYPTO-001", "A02:2021 Cryptographic Failures", "CWE-338", "V6.2.1", "PCI DSS 3.6 / 4.2"),
-  ROW("SAST-AUTH-001", "A07:2021 Identification Failures", "CWE-306", "V4.1.1", "PCI DSS 8.2"),
-  ROW("SECRET-AWS-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
-  ROW("SECRET-STRIPE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2"),
-  ROW("SECRET-GITHUB-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
-  ROW("SECRET-SLACK-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
-  ROW("SECRET-GOOGLE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
-  ROW("SECRET-AIKEY-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
-  ROW("SECRET-PRIVKEY-001", "A02:2021 Cryptographic Failures", "CWE-321", "V6.4.1", "PCI DSS 3.5 / 4.2"),
-  ROW("SECRET-DBURL-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
-  ROW("SECRET-JWT-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.5"),
-  ROW("SECRET-SESSION-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.5 / 6.2.4"),
-  ROW("CONFIG-DIRLIST-001", "A05:2021 Security Misconfiguration", "CWE-548", "V12.1.1", "PCI DSS 2.2 / 6.4.3"),
-  ROW("SECRET-ENVFILE-001", "A02:2021 Cryptographic Failures", "CWE-312", "V8.3.4", "PCI DSS 3.2"),
-  ROW("SECRET-ENTROPY-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 8.3"),
-  ROW("DEPS-VULN-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("DEPS-MALICIOUS-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
-  ROW("DEPS-TYPOSQUAT-001", "A06:2021 Vulnerable Components", "CWE-494", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("DEPS-NOLOCK-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("DEPS-DEPRECATED-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("CONFIG-HELMET-001", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 6.4.3"),
-  ROW("CONFIG-BODYLIMIT-001", "A05:2021 Security Misconfiguration", "CWE-400", "V13.1.1", "PCI DSS 6.2.4"),
-  ROW("CONFIG-CORS-001", "A05:2021 Security Misconfiguration", "CWE-942", "V14.4.5", "PCI DSS 6.4.3"),
-  ROW("CONFIG-RATELIMIT-001", "A07:2021 Identification Failures", "CWE-307", "V2.2.1", "PCI DSS 8.3.4"),
-  ROW("CONFIG-ERRSTACK-001", "A04:2021 Insecure Design", "CWE-209", "V7.4.1", "PCI DSS 6.2.4"),
-  ROW("CONFIG-INSTALLSCRIPT-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("CONFIG-DOCKER-LATEST-001", "A05:2021 Security Misconfiguration", "CWE-1188", "V14.1.3", "PCI DSS 2.2"),
-  ROW("CONFIG-DOCKER-ROOT-001", "A05:2021 Security Misconfiguration", "CWE-250", "V14.1.3", "PCI DSS 2.2"),
-  ROW("CONFIG-DOCKER-ENV-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2"),
-  ROW("EDGE-CDN-001", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 1.2 / 6.4"),
-  ROW("EDGE-CSP-001", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 6.4.3"),
-  ROW("EDGE-EXPOSE-001", "A05:2021 Security Misconfiguration", "CWE-538", "V14.4.3", "PCI DSS 2.2 / 6.4"),
-  ROW("EDGE-HSTS-001", "A05:2021 Security Misconfiguration", "CWE-319", "V9.1.1", "PCI DSS 4.2"),
-  ROW("EDGE-REFERRER-001", "A05:2021 Security Misconfiguration", "CWE-201", "V14.4.3", "PCI DSS 6.4.3"),
-  ROW("EDGE-TLS-001", "A02:2021 Cryptographic Failures", "CWE-319", "V9.1.1", "PCI DSS 4.2"),
-  ROW("EDGE-XCTO-001", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 6.4.3"),
-  ROW("EDGE-XFO-001", "A05:2021 Security Misconfiguration", "CWE-1021", "V14.4.3", "PCI DSS 6.4.3"),
-  ROW("RASP-SQL-001", "A03:2021 Injection", "CWE-89", "V5.3.4", "PCI DSS 6.4.2"),
-  ROW("RASP-SHELL-001", "A03:2021 Injection", "CWE-78", "V5.3.3", "PCI DSS 6.4.2"),
-  ROW("RASP-PATH-001", "A01:2021 Broken Access Control", "CWE-22", "V12.3.1", "PCI DSS 6.4.2"),
-  ROW("RASP-NOSQL-001", "A03:2021 Injection", "CWE-943", "V5.3.4", "PCI DSS 6.4.2"),
-  ROW("RASP-SSRF-001", "A10:2021 SSRF", "CWE-918", "V12.6.1", "PCI DSS 1.3"),
-  ROW("RASP-PROTO-001", "A03:2021 Injection", "CWE-1321", "V5.3.3", "PCI DSS 6.4.2"),
-  ROW("AI-INJECT-001", "A03:2021 Injection", "CWE-1427", "V5.3.3", "PCI DSS 6.2.4"),
-  ROW("LLM-001", "A03:2021 Injection", "CWE-1426", "V5.3.3", "PCI DSS 6.2.4"),
-  ROW("LLM-002", "A03:2021 Injection", "CWE-94", "V5.3.3", "PCI DSS 6.2.4"),
-  ROW("LLM-003", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
-  ROW("LLM-004", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2"),
-  ROW("LLM-005", "A04:2021 Insecure Design", "CWE-770", "V13.1.1", "PCI DSS 6.2.4"),
-  ROW("SUPPLY-INSTALLSCRIPT-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-NPMRC-NET-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 12.10"),
-  ROW("SUPPLY-OBFUSCATE-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-BEHAVIOR-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-COOLDOWN-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-LOCKURL-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-LOCKINTEGRITY-001", "A08:2021 Integrity Failures", "CWE-353", "V14.2.3", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-CONFUSION-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-PROVENANCE-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-WORM-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3 / 12.10"),
-  ROW("SUPPLY-WORKFLOW-001", "A08:2021 Integrity Failures", "CWE-829", "V14.2.3", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-CHAINC2-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-STEALER-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 12.10"),
-  ROW("SUPPLY-PLATFORMGATE-001", "A06:2021 Vulnerable Components", "CWE-829", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("SUPPLY-SECHOLDER-001", "A06:2021 Vulnerable Components", "CWE-506", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("IAC-GHA-UNPINNED-001", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
-  ROW("IAC-GHA-PRTARGET-001", "A01:2021 Broken Access Control", "CWE-269", "V4.1.1", "PCI DSS 7.2"),
-  ROW("IAC-GHA-PERMS-001", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
-  ROW("IAC-GHA-SECRETLOG-001", "A09:2021 Security Logging Failures", "CWE-532", "V7.1.1", "PCI DSS 3.2 / 10.2"),
-  ROW("IAC-GHA-INJECT-001", "A03:2021 Injection", "CWE-94", "V5.2.4", "PCI DSS 6.2.4"),
-  ROW("IAC-GHA-PRCHECKOUT-001", "A01:2021 Broken Access Control", "CWE-829", "V4.1.1", "PCI DSS 6.2.4"),
-  ROW("DEPS-LICENSE-001", "A06:2021 Vulnerable Components", "CWE-1104", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("IAC-TF-S3PUBLIC-001", "A01:2021 Broken Access Control", "CWE-284", "V12.1.1", "PCI DSS 1.3 / 3.2"),
-  ROW("IAC-TF-SGOPEN-001", "A05:2021 Security Misconfiguration", "CWE-284", "V1.4.1", "PCI DSS 1.2 / 1.3"),
-  ROW("IAC-TF-UNENCRYPTED-001", "A02:2021 Cryptographic Failures", "CWE-311", "V6.2.1", "PCI DSS 3.4 / 4.2"),
-  ROW("IAC-K8S-PRIV-001", "A05:2021 Security Misconfiguration", "CWE-250", "V14.1.3", "PCI DSS 2.2"),
-  ROW("IAC-COMPOSE-PRIV-001", "A05:2021 Security Misconfiguration", "CWE-250", "V14.1.3", "PCI DSS 2.2"),
-  ROW("RASP-EGRESS-001", "A10:2021 SSRF", "CWE-918", "V12.6.1", "PCI DSS 1.3"),
-  ROW("RASP-HONEY-001", "A09:2021 Security Logging Failures", "CWE-778", "V7.1.1", "PCI DSS 10.2 / 11.5"),
-  ROW("RASP-FAIL-OPEN-001", "A05:2021 Security Misconfiguration", "CWE-755", "V14.4.3", "PCI DSS 6.4.3"),
-  ROW("RUNTIME-SQLI-001", "A03:2021 Injection", "CWE-89", "V5.3.4", "PCI DSS 6.4.2"),
-  ROW("RUNTIME-XSS-001", "A03:2021 Injection", "CWE-79", "V5.3.3", "PCI DSS 6.4.2"),
-  ROW("RUNTIME-PATH-001", "A01:2021 Broken Access Control", "CWE-22", "V12.3.1", "PCI DSS 6.4.2"),
-  ROW("RUNTIME-RATELIMIT-001", "A07:2021 Identification Failures", "CWE-307", "V2.2.1", "PCI DSS 8.3.4"),
-  ROW("RUNTIME-BODY-001", "A05:2021 Security Misconfiguration", "CWE-400", "V13.1.1", "PCI DSS 6.2.4"),
-  ROW("RUNTIME-ANOMALY-001", "A04:2021 Insecure Design", "CWE-754", "V14.4.3", "PCI DSS 10.2"),
-  ROW("AI-IDOR-001", "A01:2021 Broken Access Control", "CWE-639", "V4.1.1", "PCI DSS 7.2"),
-  ROW("AI-MASSASSIGN-001", "A01:2021 Broken Access Control", "CWE-915", "V5.1.1", "PCI DSS 6.2.4"),
-  ROW("SAST-REDOS-001", "A05:2021 Security Misconfiguration", "CWE-1333", "V5.1.5", "PCI DSS 6.2.4"),
-  ROW("SAST-DESER-001", "A08:2021 Integrity Failures", "CWE-502", "V5.5.3", "PCI DSS 6.2.4"),
-  ROW("SAST-XXE-001", "A05:2021 Security Misconfiguration", "CWE-611", "V5.5.2", "PCI DSS 6.2.4"),
-  ROW("SAST-UPLOAD-001", "A04:2021 Insecure Design", "CWE-434", "V12.5.1", "PCI DSS 6.2.4"),
-  ROW("SAST-COOKIE-001", "A05:2021 Security Misconfiguration", "CWE-614/1004", "V3.4.2", "PCI DSS 6.2.4"),
-  ROW("SAST-CSRF-001", "A01:2021 Broken Access Control", "CWE-352", "V4.2.2", "PCI DSS 6.4.3"),
-  ROW("SAST-MASSASSIGN-001", "A01:2021 Broken Access Control", "CWE-915", "V5.1.1", "PCI DSS 6.2.4"),
-  ROW("SAST-TIMING-001", "A07:2021 Identification Failures", "CWE-208", "V2.10.3", "PCI DSS 8.3"),
-  ROW("SAST-HASH-001", "A02:2021 Cryptographic Failures", "CWE-916", "V6.2.2", "PCI DSS 8.3.1"),
-  ROW("SAST-GQL-001", "A04:2021 Insecure Design", "CWE-770/200", "V13.1.1", "PCI DSS 6.2.4"),
-  ROW("SAST-SKIP-001", "A05:2021 Security Misconfiguration", "CWE-693", "V1.1.1", "PCI DSS 6.2.4"),
-  ROW("CONFIG-TRUSTPROXY-001", "A07:2021 Identification Failures", "CWE-290", "V2.2.1", "PCI DSS 8.3.4"),
-  ROW("SECRET-BUNDLE-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
-  ROW("DLP-SECRET-001", "A02:2021 Cryptographic Failures", "CWE-200", "V8.3.4", "PCI DSS 3.2 / 8.3"),
-  ROW("DLP-STACK-001", "A04:2021 Insecure Design", "CWE-209", "V7.4.1", "PCI DSS 6.2.4"),
-  ROW("DLP-INTERNAL-001", "A01:2021 Broken Access Control", "CWE-200", "V8.3.4", "PCI DSS 1.3 / 2.2"),
-  ROW("DLP-CARD-001", "A02:2021 Cryptographic Failures", "CWE-359", "V8.3.4", "PCI DSS 3.3 / 3.4"),
-  ROW("DLP-PII-001", "A01:2021 Broken Access Control", "CWE-359", "V8.3.4", "PCI DSS 3.2 / 6.4.2"),
-  ROW("MCP-001", "A02:2021 Cryptographic Failures", "CWE-798", "V6.4.1", "PCI DSS 3.2 / 8.3"),
-  ROW("MCP-002", "A08:2021 Integrity Failures", "CWE-494", "V14.2.3", "PCI DSS 6.3.3"),
-  ROW("MCP-003", "A01:2021 Broken Access Control", "CWE-250", "V4.1.1", "PCI DSS 7.2"),
-  ROW("MCP-004", "A03:2021 Injection", "CWE-74", "V5.3.3", "PCI DSS 6.2.4"),
-  ROW("MCP-005", "A02:2021 Cryptographic Failures", "CWE-319", "V9.1.1", "PCI DSS 4.2"),
-  ROW("HOST-SSH-001", "A06:2021 Vulnerable Components", "CWE-364", "V14.2.1", "PCI DSS 6.3.3"),
-  ROW("HOST-SSH-002", "A05:2021 Security Misconfiguration", "CWE-693", "V14.4.3", "PCI DSS 2.2"),
-  ROW("HOST-SSH-003", "A07:2021 Identification Failures", "CWE-307", "V7.1.1", "PCI DSS 10.2 / 11.5")
-];
-var byId = new Map(RULE_MAP.map((r) => [r.ruleId, r]));
-function mappingFor(ruleId) {
-  return byId.get(ruleId);
-}
-function renderCompliance(findings, standard = "pci") {
-  const rows = findings.map((f) => {
-    const m = mappingFor(f.ruleId);
-    return `${f.ruleId}	${f.severity ?? ""}	${f.file ?? ""}	${m?.pci ?? "unmapped"}	${m?.owasp ?? ""}	${m?.cwe ?? ""}`;
-  });
-  return [
-    `FullShield compliance mapping (${standard})`,
-    COMPLIANCE_DISCLAIMER,
-    "",
-    "ruleId	severity	file	pci	owasp	cwe",
-    ...rows,
-    "",
-    COMPLIANCE_DISCLAIMER
-  ].join("\n");
-}
-function collectRuleIdsFromSources(texts) {
-  const ids = /* @__PURE__ */ new Set();
-  const re = /\b((?:SAST|SECRET|DEPS|CONFIG|EDGE|AI|LLM|SUPPLY|IAC|RASP|RUNTIME|DLP|MCP|HOST)(?:-[A-Z0-9]+)*-\d{3})\b/g;
-  for (const text of texts) {
-    let m;
-    while ((m = re.exec(text)) !== null) ids.add(m[1] ?? "");
-  }
-  return [...ids].sort();
-}
-
-export { COMPLIANCE_DISCLAIMER, RULE_MAP, collectRuleIdsFromSources, mappingFor, renderCompliance };
+var I="This is not a certification or audit. FullShield produces an evidence-style mapping only; it does not certify PCI DSS, SOC 2, ISO, or any other standard.",S=(C,i,r,e,n)=>({ruleId:C,owasp:i,cwe:r,asvs:e,pci:n}),E=[S("SAST-SQLI-001","A03:2021 Injection","CWE-89","V5.3.4","PCI DSS 6.2.4"),S("SAST-NOSQLI-001","A03:2021 Injection","CWE-943","V5.3.4","PCI DSS 6.2.4"),S("SAST-CMDI-001","A03:2021 Injection","CWE-78","V5.3.3","PCI DSS 6.2.4"),S("SAST-PATH-001","A01:2021 Broken Access Control","CWE-22","V12.3.1","PCI DSS 6.2.4"),S("SAST-EVAL-001","A03:2021 Injection","CWE-95","V5.3.3","PCI DSS 6.2.4"),S("SAST-SSRF-001","A10:2021 SSRF","CWE-918","V12.6.1","PCI DSS 6.2.4"),S("SAST-REDIRECT-001","A01:2021 Broken Access Control","CWE-601","V5.1.1","PCI DSS 6.4.2"),S("SAST-PROTO-001","A03:2021 Injection","CWE-1321","V5.3.3","PCI DSS 6.2.4"),S("SAST-XSS-001","A03:2021 Injection","CWE-79","V5.3.3","PCI DSS 6.2.4"),S("SAST-JWT-001","A07:2021 Identification Failures","CWE-347","V3.5.3","PCI DSS 6.5.10"),S("SAST-CRYPTO-001","A02:2021 Cryptographic Failures","CWE-338","V6.2.1","PCI DSS 3.6 / 4.2"),S("SAST-AUTH-001","A07:2021 Identification Failures","CWE-306","V4.1.1","PCI DSS 8.2"),S("SECRET-AWS-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.2 / 8.3"),S("SECRET-STRIPE-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.2"),S("SECRET-GITHUB-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 8.3"),S("SECRET-SLACK-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 8.3"),S("SECRET-GOOGLE-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 8.3"),S("SECRET-AIKEY-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 8.3"),S("SECRET-PRIVKEY-001","A02:2021 Cryptographic Failures","CWE-321","V6.4.1","PCI DSS 3.5 / 4.2"),S("SECRET-DBURL-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.2 / 8.3"),S("SECRET-JWT-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.5"),S("SECRET-SESSION-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.5 / 6.2.4"),S("CONFIG-DIRLIST-001","A05:2021 Security Misconfiguration","CWE-548","V12.1.1","PCI DSS 2.2 / 6.4.3"),S("SECRET-ENVFILE-001","A02:2021 Cryptographic Failures","CWE-312","V8.3.4","PCI DSS 3.2"),S("SECRET-ENTROPY-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 8.3"),S("DEPS-VULN-001","A06:2021 Vulnerable Components","CWE-1104","V14.2.1","PCI DSS 6.3.3"),S("DEPS-MALICIOUS-001","A06:2021 Vulnerable Components","CWE-506","V14.2.1","PCI DSS 6.3.3 / 12.10"),S("DEPS-TYPOSQUAT-001","A06:2021 Vulnerable Components","CWE-494","V14.2.1","PCI DSS 6.3.3"),S("DEPS-NOLOCK-001","A06:2021 Vulnerable Components","CWE-1104","V14.2.1","PCI DSS 6.3.3"),S("DEPS-DEPRECATED-001","A06:2021 Vulnerable Components","CWE-1104","V14.2.1","PCI DSS 6.3.3"),S("CONFIG-HELMET-001","A05:2021 Security Misconfiguration","CWE-693","V14.4.3","PCI DSS 6.4.3"),S("CONFIG-BODYLIMIT-001","A05:2021 Security Misconfiguration","CWE-400","V13.1.1","PCI DSS 6.2.4"),S("CONFIG-CORS-001","A05:2021 Security Misconfiguration","CWE-942","V14.4.5","PCI DSS 6.4.3"),S("CONFIG-RATELIMIT-001","A07:2021 Identification Failures","CWE-307","V2.2.1","PCI DSS 8.3.4"),S("CONFIG-ERRSTACK-001","A04:2021 Insecure Design","CWE-209","V7.4.1","PCI DSS 6.2.4"),S("CONFIG-INSTALLSCRIPT-001","A06:2021 Vulnerable Components","CWE-829","V14.2.1","PCI DSS 6.3.3"),S("CONFIG-DOCKER-LATEST-001","A05:2021 Security Misconfiguration","CWE-1188","V14.1.3","PCI DSS 2.2"),S("CONFIG-DOCKER-ROOT-001","A05:2021 Security Misconfiguration","CWE-250","V14.1.3","PCI DSS 2.2"),S("CONFIG-DOCKER-ENV-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.2"),S("EDGE-CDN-001","A05:2021 Security Misconfiguration","CWE-693","V14.4.3","PCI DSS 1.2 / 6.4"),S("EDGE-CSP-001","A05:2021 Security Misconfiguration","CWE-693","V14.4.3","PCI DSS 6.4.3"),S("EDGE-EXPOSE-001","A05:2021 Security Misconfiguration","CWE-538","V14.4.3","PCI DSS 2.2 / 6.4"),S("EDGE-HSTS-001","A05:2021 Security Misconfiguration","CWE-319","V9.1.1","PCI DSS 4.2"),S("EDGE-REFERRER-001","A05:2021 Security Misconfiguration","CWE-201","V14.4.3","PCI DSS 6.4.3"),S("EDGE-TLS-001","A02:2021 Cryptographic Failures","CWE-319","V9.1.1","PCI DSS 4.2"),S("EDGE-XCTO-001","A05:2021 Security Misconfiguration","CWE-693","V14.4.3","PCI DSS 6.4.3"),S("EDGE-XFO-001","A05:2021 Security Misconfiguration","CWE-1021","V14.4.3","PCI DSS 6.4.3"),S("RASP-SQL-001","A03:2021 Injection","CWE-89","V5.3.4","PCI DSS 6.4.2"),S("RASP-SHELL-001","A03:2021 Injection","CWE-78","V5.3.3","PCI DSS 6.4.2"),S("RASP-PATH-001","A01:2021 Broken Access Control","CWE-22","V12.3.1","PCI DSS 6.4.2"),S("RASP-NOSQL-001","A03:2021 Injection","CWE-943","V5.3.4","PCI DSS 6.4.2"),S("RASP-SSRF-001","A10:2021 SSRF","CWE-918","V12.6.1","PCI DSS 1.3"),S("RASP-PROTO-001","A03:2021 Injection","CWE-1321","V5.3.3","PCI DSS 6.4.2"),S("AI-INJECT-001","A03:2021 Injection","CWE-1427","V5.3.3","PCI DSS 6.2.4"),S("LLM-001","A03:2021 Injection","CWE-1426","V5.3.3","PCI DSS 6.2.4"),S("LLM-002","A03:2021 Injection","CWE-94","V5.3.3","PCI DSS 6.2.4"),S("LLM-003","A01:2021 Broken Access Control","CWE-250","V4.1.1","PCI DSS 7.2"),S("LLM-004","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.2"),S("LLM-005","A04:2021 Insecure Design","CWE-770","V13.1.1","PCI DSS 6.2.4"),S("SUPPLY-INSTALLSCRIPT-001","A06:2021 Vulnerable Components","CWE-829","V14.2.1","PCI DSS 6.3.3"),S("SUPPLY-NPMRC-NET-001","A06:2021 Vulnerable Components","CWE-506","V14.2.1","PCI DSS 12.10"),S("SUPPLY-OBFUSCATE-001","A06:2021 Vulnerable Components","CWE-506","V14.2.1","PCI DSS 6.3.3"),S("SUPPLY-BEHAVIOR-001","A06:2021 Vulnerable Components","CWE-829","V14.2.1","PCI DSS 6.3.3"),S("SUPPLY-COOLDOWN-001","A06:2021 Vulnerable Components","CWE-1104","V14.2.1","PCI DSS 6.3.3"),S("SUPPLY-LOCKURL-001","A08:2021 Integrity Failures","CWE-494","V14.2.3","PCI DSS 6.3.3"),S("SUPPLY-LOCKINTEGRITY-001","A08:2021 Integrity Failures","CWE-353","V14.2.3","PCI DSS 6.3.3"),S("SUPPLY-CONFUSION-001","A08:2021 Integrity Failures","CWE-494","V14.2.3","PCI DSS 6.3.3"),S("SUPPLY-PROVENANCE-001","A08:2021 Integrity Failures","CWE-494","V14.2.3","PCI DSS 6.3.3"),S("SUPPLY-PROV-001","A08:2021 Integrity Failures","CWE-494","V14.2.3","PCI DSS 6.3.3"),S("SUPPLY-WORM-001","A06:2021 Vulnerable Components","CWE-506","V14.2.1","PCI DSS 6.3.3 / 12.10"),S("SUPPLY-WORKFLOW-001","A08:2021 Integrity Failures","CWE-829","V14.2.3","PCI DSS 6.3.3"),S("SUPPLY-CHAINC2-001","A06:2021 Vulnerable Components","CWE-506","V14.2.1","PCI DSS 6.3.3"),S("SUPPLY-STEALER-001","A06:2021 Vulnerable Components","CWE-506","V14.2.1","PCI DSS 12.10"),S("SUPPLY-PLATFORMGATE-001","A06:2021 Vulnerable Components","CWE-829","V14.2.1","PCI DSS 6.3.3"),S("SUPPLY-SECHOLDER-001","A06:2021 Vulnerable Components","CWE-506","V14.2.1","PCI DSS 6.3.3"),S("SUPPLY-CAP-001","A06:2021 Vulnerable Components","CWE-829","V14.2.1","PCI DSS 6.3.3"),S("IAC-GHA-UNPINNED-001","A08:2021 Integrity Failures","CWE-494","V14.2.3","PCI DSS 6.3.3"),S("IAC-GHA-PRTARGET-001","A01:2021 Broken Access Control","CWE-269","V4.1.1","PCI DSS 7.2"),S("IAC-GHA-PERMS-001","A01:2021 Broken Access Control","CWE-250","V4.1.1","PCI DSS 7.2"),S("IAC-GHA-SECRETLOG-001","A09:2021 Security Logging Failures","CWE-532","V7.1.1","PCI DSS 3.2 / 10.2"),S("IAC-GHA-INJECT-001","A03:2021 Injection","CWE-94","V5.2.4","PCI DSS 6.2.4"),S("IAC-GHA-PRCHECKOUT-001","A01:2021 Broken Access Control","CWE-829","V4.1.1","PCI DSS 6.2.4"),S("DEPS-LICENSE-001","A06:2021 Vulnerable Components","CWE-1104","V14.2.1","PCI DSS 6.3.3"),S("IAC-TF-S3PUBLIC-001","A01:2021 Broken Access Control","CWE-284","V12.1.1","PCI DSS 1.3 / 3.2"),S("IAC-TF-SGOPEN-001","A05:2021 Security Misconfiguration","CWE-284","V1.4.1","PCI DSS 1.2 / 1.3"),S("IAC-TF-UNENCRYPTED-001","A02:2021 Cryptographic Failures","CWE-311","V6.2.1","PCI DSS 3.4 / 4.2"),S("IAC-K8S-PRIV-001","A05:2021 Security Misconfiguration","CWE-250","V14.1.3","PCI DSS 2.2"),S("IAC-COMPOSE-PRIV-001","A05:2021 Security Misconfiguration","CWE-250","V14.1.3","PCI DSS 2.2"),S("RASP-EGRESS-001","A10:2021 SSRF","CWE-918","V12.6.1","PCI DSS 1.3"),S("RASP-HONEY-001","A09:2021 Security Logging Failures","CWE-778","V7.1.1","PCI DSS 10.2 / 11.5"),S("RASP-FAIL-OPEN-001","A05:2021 Security Misconfiguration","CWE-755","V14.4.3","PCI DSS 6.4.3"),S("RUNTIME-SQLI-001","A03:2021 Injection","CWE-89","V5.3.4","PCI DSS 6.4.2"),S("RUNTIME-XSS-001","A03:2021 Injection","CWE-79","V5.3.3","PCI DSS 6.4.2"),S("RUNTIME-PATH-001","A01:2021 Broken Access Control","CWE-22","V12.3.1","PCI DSS 6.4.2"),S("RUNTIME-RATELIMIT-001","A07:2021 Identification Failures","CWE-307","V2.2.1","PCI DSS 8.3.4"),S("RUNTIME-BODY-001","A05:2021 Security Misconfiguration","CWE-400","V13.1.1","PCI DSS 6.2.4"),S("RUNTIME-ANOMALY-001","A04:2021 Insecure Design","CWE-754","V14.4.3","PCI DSS 10.2"),S("AI-IDOR-001","A01:2021 Broken Access Control","CWE-639","V4.1.1","PCI DSS 7.2"),S("AI-MASSASSIGN-001","A01:2021 Broken Access Control","CWE-915","V5.1.1","PCI DSS 6.2.4"),S("SAST-REDOS-001","A05:2021 Security Misconfiguration","CWE-1333","V5.1.5","PCI DSS 6.2.4"),S("SAST-DESER-001","A08:2021 Integrity Failures","CWE-502","V5.5.3","PCI DSS 6.2.4"),S("SAST-XXE-001","A05:2021 Security Misconfiguration","CWE-611","V5.5.2","PCI DSS 6.2.4"),S("SAST-UPLOAD-001","A04:2021 Insecure Design","CWE-434","V12.5.1","PCI DSS 6.2.4"),S("SAST-COOKIE-001","A05:2021 Security Misconfiguration","CWE-614/1004","V3.4.2","PCI DSS 6.2.4"),S("SAST-CSRF-001","A01:2021 Broken Access Control","CWE-352","V4.2.2","PCI DSS 6.4.3"),S("SAST-MASSASSIGN-001","A01:2021 Broken Access Control","CWE-915","V5.1.1","PCI DSS 6.2.4"),S("SAST-TIMING-001","A07:2021 Identification Failures","CWE-208","V2.10.3","PCI DSS 8.3"),S("SAST-HASH-001","A02:2021 Cryptographic Failures","CWE-916","V6.2.2","PCI DSS 8.3.1"),S("SAST-GQL-001","A04:2021 Insecure Design","CWE-770/200","V13.1.1","PCI DSS 6.2.4"),S("SAST-SKIP-001","A05:2021 Security Misconfiguration","CWE-693","V1.1.1","PCI DSS 6.2.4"),S("CONFIG-TRUSTPROXY-001","A07:2021 Identification Failures","CWE-290","V2.2.1","PCI DSS 8.3.4"),S("SECRET-BUNDLE-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.2 / 8.3"),S("DLP-SECRET-001","A02:2021 Cryptographic Failures","CWE-200","V8.3.4","PCI DSS 3.2 / 8.3"),S("DLP-STACK-001","A04:2021 Insecure Design","CWE-209","V7.4.1","PCI DSS 6.2.4"),S("DLP-INTERNAL-001","A01:2021 Broken Access Control","CWE-200","V8.3.4","PCI DSS 1.3 / 2.2"),S("DLP-CARD-001","A02:2021 Cryptographic Failures","CWE-359","V8.3.4","PCI DSS 3.3 / 3.4"),S("DLP-PII-001","A01:2021 Broken Access Control","CWE-359","V8.3.4","PCI DSS 3.2 / 6.4.2"),S("MCP-001","A02:2021 Cryptographic Failures","CWE-798","V6.4.1","PCI DSS 3.2 / 8.3"),S("MCP-002","A08:2021 Integrity Failures","CWE-494","V14.2.3","PCI DSS 6.3.3"),S("MCP-003","A01:2021 Broken Access Control","CWE-250","V4.1.1","PCI DSS 7.2"),S("MCP-004","A03:2021 Injection","CWE-74","V5.3.3","PCI DSS 6.2.4"),S("MCP-005","A02:2021 Cryptographic Failures","CWE-319","V9.1.1","PCI DSS 4.2"),S("HOST-SSH-001","A06:2021 Vulnerable Components","CWE-364","V14.2.1","PCI DSS 6.3.3"),S("HOST-SSH-002","A05:2021 Security Misconfiguration","CWE-693","V14.4.3","PCI DSS 2.2"),S("HOST-SSH-003","A07:2021 Identification Failures","CWE-307","V7.1.1","PCI DSS 10.2 / 11.5"),S("DEPS-PHANTOM-001","A06:2021 Vulnerable Components","CWE-829","V14.2.1","PCI DSS 6.3.3"),S("DEPS-LOCKMISMATCH-001","A06:2021 Vulnerable Components","CWE-1104","V14.2.1","PCI DSS 6.3.3")],A=new Map(E.map(C=>[C.ruleId,C]));function P(C){return A.get(C)}function o(C,i="pci"){let r=C.map(e=>{let n=P(e.ruleId);return `${e.ruleId}	${e.severity??""}	${e.file??""}	${n?.pci??"unmapped"}	${n?.owasp??""}	${n?.cwe??""}`});return [`FullShield compliance mapping (${i})`,I,"","ruleId	severity	file	pci	owasp	cwe",...r,"",I].join(`
+`)}function t(C){let i=new Set,r=/\b((?:SAST|SECRET|DEPS|CONFIG|EDGE|AI|LLM|SUPPLY|IAC|RASP|RUNTIME|DLP|MCP|HOST)(?:-[A-Z0-9]+)*-\d{3})\b/g;for(let e of C){let n;for(;(n=r.exec(e))!==null;)i.add(n[1]??"");}return [...i].sort()}export{I as COMPLIANCE_DISCLAIMER,E as RULE_MAP,t as collectRuleIdsFromSources,P as mappingFor,o as renderCompliance};

package/dist/confirm.js

@@ -1,146 +1,2 @@
-// src/confirm/index.ts
-var DESTRUCTIVE = /\b(drop|delete|update|insert|truncate|alter)\b|\brm\s|unlink|mkfs|\bdd\s|format\s|>\s*\/dev/i;
-var containers = /* @__PURE__ */ new Map();
-function registerConfirmContainer(entry) {
-  containers.set(entry.id, entry);
-}
-function resetConfirmContainers() {
-  containers.clear();
-}
-function hostnameOf(raw) {
-  const href = raw.includes("://") ? raw : `http://${raw}`;
-  const url = new URL(href);
-  const m = href.match(/^https?:\/\/([^/?#]+)/i);
-  let authority = m?.[1] ?? url.hostname;
-  if (authority.includes("@")) authority = authority.slice(authority.lastIndexOf("@") + 1);
-  let rawHost;
-  if (authority.startsWith("[")) {
-    const end = authority.indexOf("]");
-    rawHost = end >= 0 ? authority.slice(0, end + 1) : authority;
-  } else {
-    rawHost = authority.split(":")[0] ?? url.hostname;
-  }
-  return { host: url.hostname, href: url.href, rawHost };
-}
-function isLiteralLocal(host) {
-  return host === "localhost" || host === "127.0.0.1";
-}
-function isRegisteredContainer(host) {
-  for (const c of containers.values()) {
-    if (c.host === host || c.ip === host) return true;
-  }
-  return false;
-}
-function assertLocalTarget(raw, opts = {}) {
-  let host;
-  let rawHost;
-  try {
-    const parsed = hostnameOf(raw);
-    host = parsed.host;
-    rawHost = parsed.rawHost;
-  } catch {
-    throw new Error(`confirm: refused target ${raw}`);
-  }
-  if (isLiteralLocal(rawHost) && isLiteralLocal(host)) return;
-  if (isRegisteredContainer(host) || isRegisteredContainer(rawHost)) return;
-  if (opts.lookup) {
-    const ips = opts.lookup(host);
-    throw new Error(`confirm: refused target ${raw} (resolved ${ips.join(",")})`);
-  }
-  throw new Error(`confirm: refused target ${raw} (host ${host} is not localhost/127.0.0.1/FullShield container)`);
-}
-function buildCanary(kind, token) {
-  if (DESTRUCTIVE.test(token)) {
-    throw new Error("confirm: canary must be harmless (no DROP/DELETE/rm/dd)");
-  }
-  if (kind === "sql") return `1 UNION SELECT 0,'${token}'`;
-  if (kind === "shell") return `; echo ${token}`;
-  if (kind === "path") return "../canary.txt";
-  return token;
-}
-function curlProof(method, url, extra = "") {
-  return `curl -sS -X ${method} ${extra}${url}`.trim();
-}
-async function probe(fetchImpl, url, method, body, headers) {
-  try {
-    const res = await fetchImpl(url, {
-      method,
-      headers: {
-        ...body !== void 0 ? { "content-type": "application/json" } : {},
-        ...headers
-      },
-      body: body !== void 0 ? JSON.stringify(body) : void 0
-    });
-    const text = await res.text();
-    return { ok: res.ok, text };
-  } catch (err) {
-    return { ok: false, text: err instanceof Error ? err.message : String(err) };
-  }
-}
-async function confirmTarget(baseUrl, opts) {
-  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_CONFIRM !== "1") {
-    return { confirmations: [], skipped: true };
-  }
-  try {
-    assertLocalTarget(baseUrl);
-  } catch (err) {
-    return {
-      confirmations: [
-        {
-          kind: "sql",
-          status: "unconfirmed",
-          detail: err instanceof Error ? err.message : String(err)
-        }
-      ]
-    };
-  }
-  const token = opts.canaryToken ?? `FULLSHIELD_CANARY_${Date.now().toString(16)}`;
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const origin = baseUrl.replace(/\/$/, "");
-  const confirmations = [];
-  for (const route of opts.routes) {
-    try {
-      if (route.kind === "idor") {
-        const url2 = `${origin}${route.path}`;
-        const hit2 = await probe(fetchImpl, url2, route.method, void 0, {
-          "x-user": route.asUser ?? opts.users?.b ?? "bob"
-        });
-        const owner = route.expectOwner ?? opts.users?.a ?? "alice";
-        const confirmed2 = hit2.ok && hit2.text.includes(owner);
-        confirmations.push({
-          kind: "idor",
-          status: confirmed2 ? "confirmed" : "unconfirmed",
-          proof: curlProof(route.method, url2, `-H 'x-user: ${route.asUser ?? "bob"}' `),
-          detail: hit2.text.slice(0, 200)
-        });
-        continue;
-      }
-      const payload = buildCanary(route.kind, token);
-      const param = route.param ?? "q";
-      let url = `${origin}${route.path}`;
-      let body;
-      if (route.method === "GET") {
-        url += `?${encodeURIComponent(param)}=${encodeURIComponent(payload)}`;
-      } else {
-        body = { [param]: payload };
-      }
-      const hit = await probe(fetchImpl, url, route.method, body);
-      const confirmed = hit.text.includes(token) || route.kind === "path" && hit.text.includes("FULLSHIELD_CANARY");
-      confirmations.push({
-        kind: route.kind,
-        status: confirmed ? "confirmed" : "unconfirmed",
-        proof: curlProof(route.method, url),
-        detail: hit.text.slice(0, 200)
-      });
-    } catch (err) {
-      confirmations.push({
-        kind: route.kind,
-        status: "unconfirmed",
-        detail: err instanceof Error ? err.message : String(err)
-      });
-    }
-  }
-  return { confirmations };
-}
-
-export { assertLocalTarget, buildCanary, confirmTarget, registerConfirmContainer, resetConfirmContainers };
+var w=/\b(drop|delete|update|insert|truncate|alter)\b|\brm\s|unlink|mkfs|\bdd\s|format\s|>\s*\/dev/i,d=new Map;function O(t){d.set(t.id,t);}function S(){d.clear();}function L(t){let r=t.includes("://")?t:`http://${t}`,o=new URL(r),e=r.match(/^https?:\/\/([^/?#]+)/i)?.[1]??o.hostname;e.includes("@")&&(e=e.slice(e.lastIndexOf("@")+1));let i;if(e.startsWith("[")){let n=e.indexOf("]");i=n>=0?e.slice(0,n+1):e;}else i=e.split(":")[0]??o.hostname;return {host:o.hostname,href:o.href,rawHost:i}}function h(t){return t==="localhost"||t==="127.0.0.1"}function g(t){for(let r of d.values())if(r.host===t||r.ip===t)return  true;return  false}function b(t,r={}){let o,s;try{let e=L(t);o=e.host,s=e.rawHost;}catch{throw new Error(`confirm: refused target ${t}`)}if(!(h(s)&&h(o))&&!(g(o)||g(s))){if(r.lookup){let e=r.lookup(o);throw new Error(`confirm: refused target ${t} (resolved ${e.join(",")})`)}throw new Error(`confirm: refused target ${t} (host ${o} is not localhost/127.0.0.1/FullShield container)`)}}function y(t,r){if(w.test(r))throw new Error("confirm: canary must be harmless (no DROP/DELETE/rm/dd)");return t==="sql"?`1 UNION SELECT 0,'${r}'`:t==="shell"?`; echo ${r}`:t==="path"?"../canary.txt":r}function x(t,r,o=""){return `curl -sS -X ${t} ${o}${r}`.trim()}async function C(t,r,o,s,e){try{let i=await t(r,{method:o,headers:{...s!==void 0?{"content-type":"application/json"}:{},...e},body:s!==void 0?JSON.stringify(s):void 0}),n=await i.text();return {ok:i.ok,text:n}}catch(i){return {ok:false,text:i instanceof Error?i.message:String(i)}}}async function T(t,r){if(!r.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_CONFIRM!=="1")return {confirmations:[],skipped:true};try{b(t);}catch(n){return {confirmations:[{kind:"sql",status:"unconfirmed",detail:n instanceof Error?n.message:String(n)}]}}let o=r.canaryToken??`FULLSHIELD_CANARY_${Date.now().toString(16)}`,s=r.fetchImpl??fetch,e=t.replace(/\/$/,""),i=[];for(let n of r.routes)try{if(n.kind==="idor"){let p=`${e}${n.path}`,u=await C(s,p,n.method,void 0,{"x-user":n.asUser??r.users?.b??"bob"}),E=n.expectOwner??r.users?.a??"alice",$=u.ok&&u.text.includes(E);i.push({kind:"idor",status:$?"confirmed":"unconfirmed",proof:x(n.method,p,`-H 'x-user: ${n.asUser??"bob"}' `),detail:u.text.slice(0,200)});continue}let a=y(n.kind,o),l=n.param??"q",c=`${e}${n.path}`,m;n.method==="GET"?c+=`?${encodeURIComponent(l)}=${encodeURIComponent(a)}`:m={[l]:a};let f=await C(s,c,n.method,m),k=f.text.includes(o)||n.kind==="path"&&f.text.includes("FULLSHIELD_CANARY");i.push({kind:n.kind,status:k?"confirmed":"unconfirmed",proof:x(n.method,c),detail:f.text.slice(0,200)});}catch(a){i.push({kind:n.kind,status:"unconfirmed",detail:a instanceof Error?a.message:String(a)});}return {confirmations:i}}
+export{b as assertLocalTarget,y as buildCanary,T as confirmTarget,O as registerConfirmContainer,S as resetConfirmContainers};

package/dist/dashboard.js

@@ -1,179 +1,2 @@
-import { mkdirSync, existsSync } from 'fs';
-import { createRequire } from 'module';
-import { createServer } from 'http';
-import { join } from 'path';
-
-// src/dashboard/index.ts
-var require2 = createRequire(import.meta.url);
-function nodeSqliteAvailable() {
-  try {
-    require2("node:sqlite");
-    return true;
-  } catch {
-    return false;
-  }
-}
-function nodeSqliteUnavailableMessage(feature) {
-  return `${feature} requires Node 22.13+ (node:sqlite is not available on Node ${process.versions.node})`;
-}
-
-// src/dashboard/index.ts
-var require3 = createRequire(import.meta.url);
-function sqliteDb(file) {
-  const { DatabaseSync } = require3("node:sqlite");
-  let db;
-  try {
-    db = new DatabaseSync(file);
-    db.exec(
-      "CREATE TABLE IF NOT EXISTS scans (scannedAt TEXT NOT NULL, total INTEGER NOT NULL, highCrit INTEGER NOT NULL)"
-    );
-    db.exec(
-      "CREATE TABLE IF NOT EXISTS provenance (scannedAt TEXT NOT NULL, percent REAL NOT NULL, withProvenance INTEGER NOT NULL, total INTEGER NOT NULL)"
-    );
-  } catch (error) {
-    try {
-      db?.close();
-    } catch {
-    }
-    throw error;
-  }
-  let closed = false;
-  const handle = db;
-  return {
-    list() {
-      return handle.prepare("SELECT scannedAt, total, highCrit FROM scans ORDER BY scannedAt").all();
-    },
-    insert(row) {
-      handle.prepare("INSERT INTO scans (scannedAt, total, highCrit) VALUES (?, ?, ?)").run(
-        row.scannedAt,
-        row.total,
-        row.highCrit
-      );
-    },
-    listProvenance() {
-      return handle.prepare(
-        "SELECT scannedAt, percent, withProvenance, total FROM provenance ORDER BY scannedAt"
-      ).all();
-    },
-    insertProvenance(row) {
-      handle.prepare(
-        "INSERT INTO provenance (scannedAt, percent, withProvenance, total) VALUES (?, ?, ?, ?)"
-      ).run(row.scannedAt, row.percent, row.withProvenance, row.total);
-    },
-    close() {
-      if (closed) return;
-      closed = true;
-      try {
-        handle.close();
-      } catch {
-      }
-    }
-  };
-}
-function openHistory(dir) {
-  if (!nodeSqliteAvailable()) {
-    throw new Error(nodeSqliteUnavailableMessage("history"));
-  }
-  const root = join(dir, ".fullshield");
-  mkdirSync(root, { recursive: true });
-  return sqliteDb(join(root, "history.db"));
-}
-function recordHistory(db, row) {
-  db.insert(row);
-}
-function recordProvenance(db, row) {
-  db.insertProvenance(row);
-}
-function listProvenance(db) {
-  return db.listProvenance();
-}
-function assertDashboardHost(host) {
-  if (host === void 0 || host.length === 0) return false;
-  const h = host.split(":")[0]?.toLowerCase() ?? "";
-  return h === "localhost" || h === "127.0.0.1";
-}
-function createDashboardHandler(opts) {
-  if (!opts.experimental && process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM !== "1") {
-    throw new Error("dashboard requires FULLSHIELD_EXPERIMENTAL_PLATFORM=1");
-  }
-  const db = opts.db ?? openHistory(opts.dbPath);
-  return (req, res) => {
-    if (!assertDashboardHost(typeof req.headers.host === "string" ? req.headers.host : void 0)) {
-      res.writeHead(400, { "content-type": "text/plain" });
-      res.end("invalid host");
-      return;
-    }
-    const url = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (url.pathname === "/api/ingest" && req.method !== "POST") {
-      res.writeHead(405, { allow: "POST" });
-      res.end("method not allowed");
-      return;
-    }
-    if (req.method === "POST" && url.pathname === "/api/ingest") {
-      const chunks = [];
-      req.on("data", (c) => chunks.push(c));
-      req.on("end", () => {
-        try {
-          const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
-          db.insert(body);
-          res.writeHead(204);
-          res.end();
-        } catch {
-          res.writeHead(400);
-          res.end("bad json");
-        }
-      });
-      return;
-    }
-    if (req.method === "GET" && url.pathname === "/api/history") {
-      res.writeHead(200, { "content-type": "application/json" });
-      res.end(JSON.stringify({ scans: db.list() }));
-      return;
-    }
-    if (req.method === "GET" && (url.pathname === "/" || url.pathname === "/index.html")) {
-      const scans = db.list();
-      const rows = scans.map((s) => `<tr><td>${s.scannedAt}</td><td>${s.total}</td><td>${s.highCrit}</td></tr>`).join("");
-      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-      res.end(
-        `<!DOCTYPE html><html><body><h1>FullShield history</h1><table><tr><th>at</th><th>total</th><th>high+crit</th></tr>${rows}</table></body></html>`
-      );
-      return;
-    }
-    res.writeHead(404);
-    res.end("not found");
-  };
-}
-function startDashboard(opts) {
-  if (!existsSync(opts.dir)) mkdirSync(opts.dir, { recursive: true });
-  const db = openHistory(opts.dir);
-  const handler = createDashboardHandler({ dbPath: opts.dir, experimental: opts.experimental, db });
-  const server = createServer(handler);
-  return new Promise((resolve, reject) => {
-    server.listen(opts.port ?? 0, "127.0.0.1", () => {
-      const addr = server.address();
-      const port = typeof addr === "object" && addr !== null ? addr.port : 0;
-      resolve({
-        port,
-        close: () => new Promise((res, rej) => {
-          server.close((err) => {
-            try {
-              db.close();
-            } catch {
-            }
-            if (err) rej(err);
-            else res();
-          });
-        })
-      });
-    });
-    server.on("error", (err) => {
-      try {
-        db.close();
-      } catch {
-      }
-      reject(err);
-    });
-  });
-}
-
-export { assertDashboardHost, createDashboardHandler, listProvenance, openHistory, recordHistory, recordProvenance, startDashboard };
+import {mkdirSync,existsSync}from'fs';import {createRequire}from'module';import {createServer}from'http';import {join}from'path';var y=createRequire(import.meta.url);function d(){try{return y("node:sqlite"),!0}catch{return  false}}function l(e){return `${e} requires Node 22.13+ (node:sqlite is not available on Node ${process.versions.node})`}var E=new Set;function h(e){E.add(e);}var P=createRequire(import.meta.url);function L(e){let{DatabaseSync:r}=P("node:sqlite"),o;try{o=new r(e),o.exec("CREATE TABLE IF NOT EXISTS scans (scannedAt TEXT NOT NULL, total INTEGER NOT NULL, highCrit INTEGER NOT NULL)"),o.exec("CREATE TABLE IF NOT EXISTS provenance (scannedAt TEXT NOT NULL, percent REAL NOT NULL, withProvenance INTEGER NOT NULL, total INTEGER NOT NULL)");}catch(n){try{o?.close();}catch{}throw n}let t=false,a=o,i={list(){return a.prepare("SELECT scannedAt, total, highCrit FROM scans ORDER BY scannedAt").all()},insert(n){a.prepare("INSERT INTO scans (scannedAt, total, highCrit) VALUES (?, ?, ?)").run(n.scannedAt,n.total,n.highCrit);},listProvenance(){return a.prepare("SELECT scannedAt, percent, withProvenance, total FROM provenance ORDER BY scannedAt").all()},insertProvenance(n){a.prepare("INSERT INTO provenance (scannedAt, percent, withProvenance, total) VALUES (?, ?, ?, ?)").run(n.scannedAt,n.percent,n.withProvenance,n.total);},close(){if(!t){t=true;try{a.close();}catch{}}}};return h(i),i}function f(e){if(!d())throw new Error(l("history"));let r=join(e,".fullshield");return mkdirSync(r,{recursive:true}),L(join(r,"history.db"))}function U(e,r){e.insert(r);}function C(e,r){e.insertProvenance(r);}function M(e){return e.listProvenance()}function H(e){if(e===void 0||e.length===0)return  false;let r=e.split(":")[0]?.toLowerCase()??"";return r==="localhost"||r==="127.0.0.1"}function S(e){if(!e.experimental&&process.env.FULLSHIELD_EXPERIMENTAL_PLATFORM!=="1")throw new Error("dashboard requires FULLSHIELD_EXPERIMENTAL_PLATFORM=1");let r=e.db??f(e.dbPath);return (o,t)=>{if(!H(typeof o.headers.host=="string"?o.headers.host:void 0)){t.writeHead(400,{"content-type":"text/plain"}),t.end("invalid host");return}let a=new URL(o.url??"/","http://127.0.0.1");if(a.pathname==="/api/ingest"&&o.method!=="POST"){t.writeHead(405,{allow:"POST"}),t.end("method not allowed");return}if(o.method==="POST"&&a.pathname==="/api/ingest"){let i=[];o.on("data",n=>i.push(n)),o.on("end",()=>{try{let n=JSON.parse(Buffer.concat(i).toString("utf8"));r.insert(n),t.writeHead(204),t.end();}catch{t.writeHead(400),t.end("bad json");}});return}if(o.method==="GET"&&a.pathname==="/api/history"){t.writeHead(200,{"content-type":"application/json"}),t.end(JSON.stringify({scans:r.list()}));return}if(o.method==="GET"&&(a.pathname==="/"||a.pathname==="/index.html")){let n=r.list().map(s=>`<tr><td>${s.scannedAt}</td><td>${s.total}</td><td>${s.highCrit}</td></tr>`).join("");t.writeHead(200,{"content-type":"text/html; charset=utf-8"}),t.end(`<!DOCTYPE html><html><body><h1>FullShield history</h1><table><tr><th>at</th><th>total</th><th>high+crit</th></tr>${n}</table></body></html>`);return}t.writeHead(404),t.end("not found");}}function F(e){existsSync(e.dir)||mkdirSync(e.dir,{recursive:true});let r=f(e.dir),o=S({dbPath:e.dir,experimental:e.experimental,db:r}),t=createServer(o);return new Promise((a,i)=>{t.listen(e.port??0,"127.0.0.1",()=>{let n=t.address(),s=typeof n=="object"&&n!==null?n.port:0;a({port:s,close:()=>new Promise((m,b)=>{t.close(c=>{try{r.close();}catch{}c?b(c):m();});})});}),t.on("error",n=>{try{r.close();}catch{}i(n);});})}
+export{H as assertDashboardHost,S as createDashboardHandler,M as listProvenance,f as openHistory,U as recordHistory,C as recordProvenance,F as startDashboard};