hackmyagent 0.11.14 → 0.12.0

package/dist/nanomind-core/analyzers/credential-analyzer.js

@@ -0,0 +1,317 @@
+"use strict";
+/**
+ * Credential Analyzer -- AST-based AST-CRED-* checks
+ *
+ * Queries the SecurityAST for credential exposure patterns instead of
+ * regex-matching raw text. Understands data flow through AST.declaredDataAccess
+ * and distinguishes real credentials from test fixtures and documentation.
+ *
+ * Checks:
+ *   AST-CRED-001: Credentials in non-environment contexts
+ *   AST-CRED-002: Credential forwarding to external destinations
+ *   AST-CRED-003: Hardcoded secrets in artifact content
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeCredentials = analyzeCredentials;
+const defense_in_depth_js_1 = require("../security/defense-in-depth.js");
+// ============================================================================
+// Public API
+// ============================================================================
+/**
+ * Analyze a SecurityAST for credential-related security issues.
+ * Verifies AST integrity before processing.
+ */
+function analyzeCredentials(ast, verifier) {
+    (0, defense_in_depth_js_1.assertASTIntegrity)(ast, verifier);
+    const findings = [];
+    findings.push(...checkCredentialsInNonEnvContext(ast));
+    findings.push(...checkCredentialForwarding(ast));
+    findings.push(...checkHardcodedSecrets(ast));
+    return findings;
+}
+// ============================================================================
+// AST-CRED-001: Credentials in non-environment contexts
+// ============================================================================
+/**
+ * Detects credential data access patterns that occur outside of proper
+ * environment variable / secret manager contexts. Skills and configs
+ * should reference credentials via env vars, not inline.
+ *
+ * Uses AST.declaredDataAccess to find credential-type data patterns
+ * and checks whether the artifact type is an appropriate context.
+ */
+function checkCredentialsInNonEnvContext(ast) {
+    const findings = [];
+    // Env files and credential files are expected to contain credentials
+    const safeContextTypes = new Set(['env_file', 'credential_file']);
+    if (safeContextTypes.has(ast.artifactType)) {
+        return findings;
+    }
+    const credentialAccess = ast.declaredDataAccess.filter(d => d.dataType === 'credentials');
+    if (credentialAccess.length === 0) {
+        return findings;
+    }
+    // Check if evidence spans suggest these are documentation examples or test fixtures
+    const isDocOrTest = isDocumentationOrTestContext(ast);
+    for (const access of credentialAccess) {
+        // Credential reads in skills/configs/source code are suspicious
+        // unless the artifact is clearly documentation or test fixture
+        if (isDocOrTest) {
+            continue;
+        }
+        const severity = deriveSeverity(access, ast);
+        findings.push({
+            checkId: 'AST-CRED-001',
+            name: 'Credentials in Non-Environment Context',
+            description: `Credential data (${access.accessMode}) detected in a ${ast.artifactType} artifact. ` +
+                'Credentials should only be referenced via environment variables or secret managers, ' +
+                'never embedded in skills, configs, or source code.',
+            category: 'Credential Security',
+            severity,
+            passed: false,
+            message: `Credential ${access.accessMode} in ${ast.artifactType} context`,
+            fixable: true,
+            file: ast.artifactPath,
+            fix: 'Replace inline credentials with environment variable references (e.g., $API_KEY or process.env.API_KEY). ' +
+                'Use a secret manager for production deployments.',
+            guidance: 'Credentials embedded in non-env artifacts can be leaked through version control, ' +
+                'logs, or prompt injection attacks that extract artifact content.',
+            attackClass: 'CRED-EXPOSURE',
+            confidence: isDocOrTest ? 0.3 : 0.8,
+        });
+    }
+    return findings;
+}
+// ============================================================================
+// AST-CRED-002: Credential forwarding patterns
+// ============================================================================
+/**
+ * Detects credentials being transmitted to external destinations.
+ * Cross-references AST.declaredDataAccess (transmit mode) with
+ * credential data types to find forwarding patterns.
+ */
+function checkCredentialForwarding(ast) {
+    const findings = [];
+    // Find credential data that is transmitted externally
+    // Direct: credentials type with transmit mode
+    const directCredTransmit = ast.declaredDataAccess.filter(d => d.dataType === 'credentials' && d.accessMode === 'transmit');
+    // Indirect: credentials type (read) combined with any transmit pattern
+    const hasCredentialAccess = ast.declaredDataAccess.some(d => d.dataType === 'credentials');
+    const hasExternalTransmit = ast.declaredDataAccess.some(d => d.accessMode === 'transmit');
+    const hasExfilRisk = ast.inferredRiskSurface.some(r => r.attackClass === 'SKILL-EXFIL' || r.attackClass === 'DATA-EXFIL');
+    // Combine direct transmissions with indirect patterns
+    const credentialTransmissions = [];
+    for (const d of directCredTransmit) {
+        credentialTransmissions.push({ destination: d.destination ?? 'unknown endpoint' });
+    }
+    // If credentials are accessed AND there's external transmission, flag it
+    if (directCredTransmit.length === 0 && hasCredentialAccess && hasExternalTransmit) {
+        credentialTransmissions.push({ destination: 'external endpoint' });
+    }
+    // If credentials are accessed AND there's an exfiltration risk surface
+    if (directCredTransmit.length === 0 && credentialTransmissions.length === 0 && hasCredentialAccess && hasExfilRisk) {
+        credentialTransmissions.push({ destination: 'external (inferred from exfiltration risk)' });
+    }
+    for (const transmission of credentialTransmissions) {
+        const destination = transmission.destination;
+        // Cross-check with risk surfaces for corroboration
+        const corroboratingRisk = ast.inferredRiskSurface.find(r => r.attackClass === 'CRED-HARVEST' || r.attackClass === 'SKILL-EXFIL');
+        const confidence = corroboratingRisk
+            ? Math.max(corroboratingRisk.confidence, 0.8)
+            : 0.7;
+        findings.push({
+            checkId: 'AST-CRED-002',
+            name: 'Credential Forwarding Detected',
+            description: `Credentials are being transmitted to ${destination}. ` +
+                'Credential forwarding is a primary exfiltration vector. ' +
+                'Even legitimate logging must never include credential values.',
+            category: 'Credential Security',
+            severity: 'critical',
+            passed: false,
+            message: `Credential forwarding to ${destination}`,
+            fixable: true,
+            file: ast.artifactPath,
+            fix: `Remove credential transmission to ${destination}. ` +
+                'If external auth is needed, use OAuth token exchange or a credential broker. ' +
+                'Never forward raw credentials.',
+            guidance: 'Credential forwarding enables account takeover. Even forwarding to "trusted" ' +
+                'endpoints is risky because the destination can be compromised or spoofed.',
+            attackClass: 'CRED-EXFIL',
+            confidence,
+            evidence: corroboratingRisk?.evidence,
+        });
+    }
+    // Also check: capabilities that imply credential forwarding
+    const forwardingCaps = ast.inferredCapabilities.filter(c => c.name.includes('send') || c.name.includes('transmit') || c.name.includes('forward'));
+    for (const cap of forwardingCaps) {
+        const mentionsCredentials = cap.evidence?.toLowerCase().includes('credential') ||
+            cap.evidence?.toLowerCase().includes('token') ||
+            cap.evidence?.toLowerCase().includes('secret') ||
+            cap.evidence?.toLowerCase().includes('password');
+        if (mentionsCredentials) {
+            // Avoid duplicates -- only add if we didn't already find a direct transmission
+            if (credentialTransmissions.length === 0) {
+                findings.push({
+                    checkId: 'AST-CRED-002',
+                    name: 'Credential Forwarding Detected',
+                    description: `Inferred capability "${cap.name}" involves credential data. ` +
+                        'This pattern suggests credentials may be forwarded externally.',
+                    category: 'Credential Security',
+                    severity: 'high',
+                    passed: false,
+                    message: `Inferred credential forwarding via ${cap.name}`,
+                    fixable: true,
+                    file: ast.artifactPath,
+                    fix: 'Remove or restrict the capability that forwards credential data. ' +
+                        'Use environment variable references instead of passing credential values.',
+                    attackClass: 'CRED-EXFIL',
+                    confidence: 0.6,
+                    evidence: cap.evidence,
+                });
+            }
+        }
+    }
+    return findings;
+}
+// ============================================================================
+// AST-CRED-003: Hardcoded secrets in artifact content
+// ============================================================================
+/**
+ * Detects evidence of hardcoded secrets in the artifact by examining
+ * evidence spans and risk surfaces for credential patterns.
+ * Distinguishes real secrets from test fixtures (containing "FAKE",
+ * "EXAMPLE", "test", "placeholder") and documentation examples.
+ */
+function checkHardcodedSecrets(ast) {
+    const findings = [];
+    // Look for evidence spans that support credential exposure
+    const credentialEvidence = ast.evidenceSpans.filter(e => e.supports === 'CRED-HARVEST' ||
+        e.supports === 'CRED-EXFIL' ||
+        e.supports === 'credential_exposure');
+    // Check risk surfaces for credential patterns
+    const credentialRisks = ast.inferredRiskSurface.filter(r => r.attackClass === 'CRED-HARVEST');
+    // Combine signals
+    const hasCredentialSignals = credentialEvidence.length > 0 || credentialRisks.length > 0;
+    if (!hasCredentialSignals) {
+        return findings;
+    }
+    // Filter out defensive constraint contexts: if the artifact has constraints
+    // about credential management (e.g., "must never store credentials"), the
+    // CRED-HARVEST signal is from the constraint text, not actual harvesting.
+    const hasDefensiveCredConstraint = ast.declaredConstraints.some(c => c.domain === 'credential_management' && c.enforceability >= 0.6);
+    if (hasDefensiveCredConstraint && credentialEvidence.length === 0) {
+        // The credential signal is likely from the constraint text, not from
+        // actual credential harvesting patterns. Only risk surfaces exist,
+        // and they were triggered by the constraint's mention of credentials.
+        return findings;
+    }
+    // Filter out test fixtures and documentation
+    const isTestOrDoc = isDocumentationOrTestContext(ast);
+    const evidenceTexts = credentialEvidence.map(e => e.text);
+    const allTestFixtures = evidenceTexts.every(t => isTestFixtureCredential(t));
+    if (isTestOrDoc && allTestFixtures) {
+        return findings;
+    }
+    // Determine severity based on artifact type and evidence strength
+    const maxConfidence = Math.max(...credentialEvidence.map(e => e.confidence), ...credentialRisks.map(r => r.confidence), 0);
+    const severity = maxConfidence >= 0.8 ? 'critical' : maxConfidence >= 0.5 ? 'high' : 'medium';
+    const evidenceSummary = credentialEvidence.length > 0
+        ? credentialEvidence[0].text.slice(0, 120)
+        : credentialRisks[0]?.evidence ?? 'Credential pattern detected';
+    findings.push({
+        checkId: 'AST-CRED-003',
+        name: 'Hardcoded Secret Detected',
+        description: 'The artifact contains patterns consistent with hardcoded secrets. ' +
+            'Hardcoded credentials are exposed in version control, build artifacts, ' +
+            'and prompt injection attacks that extract artifact content.',
+        category: 'Credential Security',
+        severity,
+        passed: false,
+        message: `Hardcoded secret: ${evidenceSummary.slice(0, 80)}`,
+        fixable: true,
+        file: ast.artifactPath,
+        fix: 'Move all secrets to environment variables or a secret manager. ' +
+            'Replace hardcoded values with references: $SECRET_NAME or process.env.SECRET_NAME. ' +
+            'Rotate any credentials that were committed to version control.',
+        guidance: 'After removing hardcoded credentials, rotate them immediately. ' +
+            'The old values may already be in git history or build caches.',
+        attackClass: 'CRED-HARDCODED',
+        confidence: allTestFixtures ? 0.3 : maxConfidence,
+        evidence: evidenceSummary,
+    });
+    return findings;
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+/**
+ * Determine if the artifact is a documentation example or test fixture.
+ * Test fixtures contain "FAKE", "EXAMPLE", "placeholder", etc.
+ * Documentation contexts reference credentials for illustration only.
+ */
+function isDocumentationOrTestContext(ast) {
+    const path = (ast.artifactPath ?? '').toLowerCase();
+    // Test fixtures
+    if (path.includes('test/') ||
+        path.includes('__tests__/') ||
+        path.includes('fixture') ||
+        path.includes('example') ||
+        path.includes('.example')) {
+        return true;
+    }
+    // Documentation (but not .skill.md, .soul.md, or CLAUDE.md which are functional)
+    if ((path.endsWith('.md') &&
+        !path.endsWith('.skill.md') &&
+        !path.endsWith('.soul.md') &&
+        !path.endsWith('claude.md')) ||
+        path.includes('doc/') ||
+        path.includes('docs/') ||
+        path.includes('readme')) {
+        return true;
+    }
+    // Check declared purpose for test/doc language
+    const purpose = ast.declaredPurpose.toLowerCase();
+    if (purpose.includes('test') ||
+        purpose.includes('example') ||
+        purpose.includes('documentation') ||
+        purpose.includes('fixture') ||
+        purpose.includes('demo')) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Check if a credential-like string is a test fixture (contains markers
+ * like FAKE, EXAMPLE, placeholder, etc.)
+ */
+function isTestFixtureCredential(text) {
+    const upper = text.toUpperCase();
+    return (upper.includes('FAKE') ||
+        upper.includes('EXAMPLE') ||
+        upper.includes('PLACEHOLDER') ||
+        upper.includes('TEST') ||
+        upper.includes('DUMMY') ||
+        upper.includes('SAMPLE') ||
+        upper.includes('XXX') ||
+        upper.includes('YOUR_') ||
+        upper.includes('<YOUR'));
+}
+/**
+ * Derive severity from data access pattern and artifact context.
+ */
+function deriveSeverity(access, ast) {
+    // Transmitting credentials is always critical
+    if (access.accessMode === 'transmit')
+        return 'critical';
+    // Writing credentials outside env context is high
+    if (access.accessMode === 'write')
+        return 'high';
+    // Reading credentials in a skill is medium (might be legitimate env var ref)
+    if (ast.artifactType === 'skill' || ast.artifactType === 'system_prompt')
+        return 'medium';
+    // Source code with credential access is high
+    if (ast.artifactType === 'source_code')
+        return 'high';
+    return 'medium';
+}
+//# sourceMappingURL=credential-analyzer.js.map

package/dist/nanomind-core/analyzers/credential-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-analyzer.js","sourceRoot":"","sources":["../../../src/nanomind-core/analyzers/credential-analyzer.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAcH,gDAaC;AAvBD,yEAAqE;AAErE,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;GAGG;AACH,SAAgB,kBAAkB,CAChC,GAAgB,EAChB,QAAuC;IAEvC,IAAA,wCAAkB,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAElC,QAAQ,CAAC,IAAI,CAAC,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;IAE7C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,wDAAwD;AACxD,+EAA+E;AAE/E;;;;;;;GAOG;AACH,SAAS,+BAA+B,CAAC,GAAgB;IACvD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAElC,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAClE,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,aAAa,CAClC,CAAC;IAEF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,oFAAoF;IACpF,MAAM,WAAW,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAEtD,KAAK,MAAM,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACtC,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAE7C,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,wCAAwC;YAC9C,WAAW,EACT,oBAAoB,MAAM,CAAC,UAAU,mBAAmB,GAAG,CAAC,YAAY,aAAa;gBACrF,sFAAsF;gBACtF,oDAAoD;YACtD,QAAQ,EAAE,qBAAqB;YAC/B,QAAQ;YACR,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,cAAc,MAAM,CAAC,UAAU,OAAO,GAAG,CAAC,YAAY,UAAU;YACzE,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,GAAG,CAAC,YAAY;YACtB,GAAG,EACD,2GAA2G;gBAC3G,kDAAkD;YACpD,QAAQ,EACN,mFAAmF;gBACnF,kEAAkE;YACpE,WAAW,EAAE,eAAe;YAC5B,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SACpC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,+CAA+C;AAC/C,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,GAAgB;IACjD,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAElC,sDAAsD;IACtD,8CAA8C;IAC9C,MAAM,kBAAkB,GAAG,GAAG,CAAC,kBAAkB,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,aAAa,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CACjE,CAAC;IACF,uEAAuE;IACvE,MAAM,mBAAmB,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,aAAa,CAClC,CAAC;IACF,MAAM,mBAAmB,GAAG,GAAG,CAAC,kBAAkB,CAAC,IAAI,CACrD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CACjC,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAC/C,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,aAAa,IAAI,CAAC,CAAC,WAAW,KAAK,YAAY,CACvE,CAAC;IAEF,sDAAsD;IACtD,MAAM,uBAAuB,GAAmC,EAAE,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACnC,uBAAuB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,kBAAkB,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,yEAAyE;IACzE,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,IAAI,mBAAmB,EAAE,CAAC;QAClF,uBAAuB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,uEAAuE;IACvE,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,IAAI,mBAAmB,IAAI,YAAY,EAAE,CAAC;QACnH,uBAAuB,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,MAAM,YAAY,IAAI,uBAAuB,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAE7C,mDAAmD;QACnD,MAAM,iBAAiB,GAAG,GAAG,CAAC,mBAAmB,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,IAAI,CAAC,CAAC,WAAW,KAAK,aAAa,CACzE,CAAC;QAEF,MAAM,UAAU,GAAG,iBAAiB;YAClC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,UAAU,EAAE,GAAG,CAAC;YAC7C,CAAC,CAAC,GAAG,CAAC;QAER,QAAQ,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,gCAAgC;YACtC,WAAW,EACT,wCAAwC,WAAW,IAAI;gBACvD,0DAA0D;gBAC1D,+DAA+D;YACjE,QAAQ,EAAE,qBAAqB;YAC/B,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,4BAA4B,WAAW,EAAE;YAClD,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,GAAG,CAAC,YAAY;YACtB,GAAG,EACD,qCAAqC,WAAW,IAAI;gBACpD,+EAA+E;gBAC/E,gCAAgC;YAClC,QAAQ,EACN,+EAA+E;gBAC/E,2EAA2E;YAC7E,WAAW,EAAE,YAAY;YACzB,UAAU;YACV,QAAQ,EAAE,iBAAiB,EAAE,QAAQ;SACtC,CAAC,CAAC;IACL,CAAC;IAED,4DAA4D;IAC5D,MAAM,cAAc,GAAG,GAAG,CAAC,oBAAoB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CACvF,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,mBAAmB,GACvB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;YAClD,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC7C,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC9C,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAEnD,IAAI,mBAAmB,EAAE,CAAC;YACxB,+EAA+E;YAC/E,IAAI,uBAAuB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,cAAc;oBACvB,IAAI,EAAE,gCAAgC;oBACtC,WAAW,EACT,wBAAwB,GAAG,CAAC,IAAI,8BAA8B;wBAC9D,gEAAgE;oBAClE,QAAQ,EAAE,qBAAqB;oBAC/B,QAAQ,EAAE,MAAM;oBAChB,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,sCAAsC,GAAG,CAAC,IAAI,EAAE;oBACzD,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,GAAG,CAAC,YAAY;oBACtB,GAAG,EACD,mEAAmE;wBACnE,2EAA2E;oBAC7E,WAAW,EAAE,YAAY;oBACzB,UAAU,EAAE,GAAG;oBACf,QAAQ,EAAE,GAAG,CAAC,QAAQ;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,sDAAsD;AACtD,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,GAAgB;IAC7C,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAElC,2DAA2D;IAC3D,MAAM,kBAAkB,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,CACjD,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,QAAQ,KAAK,cAAc;QAC7B,CAAC,CAAC,QAAQ,KAAK,YAAY;QAC3B,CAAC,CAAC,QAAQ,KAAK,qBAAqB,CACvC,CAAC;IAEF,8CAA8C;IAC9C,MAAM,eAAe,GAAG,GAAG,CAAC,mBAAmB,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CACtC,CAAC;IAEF,kBAAkB;IAClB,MAAM,oBAAoB,GACxB,kBAAkB,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAE9D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,0BAA0B,GAAG,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAC7D,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,uBAAuB,IAAI,CAAC,CAAC,cAAc,IAAI,GAAG,CACrE,CAAC;IACF,IAAI,0BAA0B,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,sEAAsE;QACtE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,6CAA6C;IAC7C,MAAM,WAAW,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7E,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;QACnC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,kEAAkE;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAC5C,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EACzC,CAAC,CACF,CAAC;IAEF,MAAM,QAAQ,GACZ,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE/E,MAAM,eAAe,GACnB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC1C,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,6BAA6B,CAAC;IAEpE,QAAQ,CAAC,IAAI,CAAC;QACZ,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,oEAAoE;YACpE,yEAAyE;YACzE,6DAA6D;QAC/D,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ;QACR,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,qBAAqB,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAC5D,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,GAAG,CAAC,YAAY;QACtB,GAAG,EACD,iEAAiE;YACjE,qFAAqF;YACrF,gEAAgE;QAClE,QAAQ,EACN,iEAAiE;YACjE,+DAA+D;QACjE,WAAW,EAAE,gBAAgB;QAC7B,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa;QACjD,QAAQ,EAAE,eAAe;KAC1B,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,GAAgB;IACpD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAEpD,gBAAgB;IAChB,IACE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1B,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACvB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+CAA+C;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC;IAClD,IACE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7B,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,MAAyB,EACzB,GAAgB;IAEhB,8CAA8C;IAC9C,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACxD,kDAAkD;IAClD,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACjD,6EAA6E;IAC7E,IAAI,GAAG,CAAC,YAAY,KAAK,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,eAAe;QAAE,OAAO,QAAQ,CAAC;IAC1F,6CAA6C;IAC7C,IAAI,GAAG,CAAC,YAAY,KAAK,aAAa;QAAE,OAAO,MAAM,CAAC;IACtD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/nanomind-core/analyzers/governance-analyzer.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Governance Analyzer -- AST-based AST-GOV-* checks
+ *
+ * Queries the SecurityAST for governance and SOUL gaps. Evaluates
+ * constraint coverage, enforceability, and override resistance using
+ * the structured AST.declaredConstraints instead of raw text matching.
+ *
+ * Checks:
+ *   AST-GOV-001: Constraint domain coverage gaps (9 domains)
+ *   AST-GOV-002: Weak constraint enforceability
+ *   AST-GOV-003: Missing governance for capabilities
+ *   AST-GOV-004: Override resistance gaps
+ *   AST-GOV-005: Governance-capability ratio imbalance
+ */
+import type { SecurityAST } from '../types.js';
+import type { ASTFinding } from './capability-analyzer.js';
+/**
+ * Analyze a SecurityAST for governance and SOUL-related issues.
+ * Verifies AST integrity before processing.
+ */
+export declare function analyzeGovernance(ast: SecurityAST, verifier: (ast: SecurityAST) => boolean): ASTFinding[];
+//# sourceMappingURL=governance-analyzer.d.ts.map

package/dist/nanomind-core/analyzers/governance-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance-analyzer.d.ts","sourceRoot":"","sources":["../../../src/nanomind-core/analyzers/governance-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,WAAW,EAA4C,MAAM,aAAa,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAqD3D;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,OAAO,GACtC,UAAU,EAAE,CAYd"}