renma 0.13.1 → 0.14.0

package/dist/commands/suggest-metadata.js

@@ -0,0 +1,248 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { parseDocument } from "../markdown.js";
+import { parseAssetMetadata } from "../metadata.js";
+export class SuggestMetadataTargetError extends Error {
+    constructor(target, cause) {
+        super(`Could not read metadata target ${target}: ${readErrorReason(cause)}`);
+        this.name = "SuggestMetadataTargetError";
+    }
+}
+export async function runSuggestMetadataCommand(target, options = {}) {
+    const suggestion = await buildMetadataSuggestion(target, options);
+    const format = options.format ?? "prompt";
+    process.stdout.write(format === "json"
+        ? `${JSON.stringify(suggestion, null, 2)}\n`
+        : renderMetadataPrompt(suggestion));
+    return 0;
+}
+export async function buildMetadataSuggestion(target, options = {}) {
+    const absolutePath = path.resolve(target);
+    let content;
+    try {
+        content = await readFile(absolutePath, "utf8");
+    }
+    catch (error) {
+        throw new SuggestMetadataTargetError(target, error);
+    }
+    const outputPath = toPosix(target);
+    const initialKind = classifyPath(outputPath);
+    const document = parseDocument({
+        path: outputPath,
+        absolutePath,
+        kind: initialKind,
+        sizeBytes: Buffer.byteLength(content),
+        content,
+    });
+    const { metadata } = parseAssetMetadata(document);
+    const kind = initialKind === "context" && metadata.type === "context_lens"
+        ? "context_lens"
+        : initialKind;
+    const existingId = optionalText(metadataValueText(document.metadata.id));
+    const existingTitle = optionalText(metadataValueText(document.metadata.title));
+    const existingOwner = optionalText(metadata.owner);
+    const explicitOwner = optionalText(options.owner);
+    const candidateMetadata = {};
+    const candidateId = inferCandidateId(kind, outputPath);
+    const candidateTitle = mainHeadingTitle(document.headings);
+    if (!existingId && candidateId) {
+        candidateMetadata.id = candidateId;
+    }
+    if (!existingTitle && candidateTitle) {
+        candidateMetadata.title = candidateTitle;
+    }
+    if (!existingOwner && explicitOwner) {
+        candidateMetadata.owner = explicitOwner;
+    }
+    const blockedMetadata = [];
+    if (!existingOwner && !explicitOwner) {
+        blockedMetadata.push({
+            field: "owner",
+            reason: "No owner was explicitly provided. Missing owner is allowed.",
+        });
+    }
+    if (existingOwner && explicitOwner && existingOwner !== explicitOwner) {
+        blockedMetadata.push({
+            field: "owner",
+            reason: `Existing owner "${existingOwner}" differs from explicitly provided owner "${explicitOwner}". Do not change ownership without human review.`,
+        });
+    }
+    return {
+        path: outputPath,
+        kind,
+        suggestedMode: "metadata-retrofit",
+        ownerProvided: Boolean(explicitOwner),
+        instructions: buildInstructions({ existingOwner, explicitOwner }),
+        candidateMetadata,
+        blockedMetadata,
+    };
+}
+export function renderMetadataPrompt(suggestion) {
+    return `${[
+        "# Codex Task: Safely Retrofit Renma Metadata",
+        "",
+        "Update this existing Renma asset metadata safely.",
+        "",
+        "Asset:",
+        `- Path: \`${suggestion.path}\``,
+        `- Kind: \`${suggestion.kind}\``,
+        `- Mode: \`${suggestion.suggestedMode}\``,
+        "",
+        "Rules:",
+        ...suggestion.instructions.map((instruction) => `- ${instruction}`),
+        "",
+        "Candidate Metadata:",
+        ...metadataLines(suggestion.candidateMetadata),
+        "",
+        "Blocked Metadata:",
+        ...blockedMetadataLines(suggestion.blockedMetadata),
+        "",
+        "Verification:",
+        "- Run `renma scan .`.",
+        "- Run `renma ownership .`.",
+        "",
+        "Return a small reviewed patch. Do not rewrite the asset body.",
+    ].join("\n")}\n`;
+}
+function buildInstructions(input) {
+    return [
+        "Inspect the existing asset before editing.",
+        "Preserve the existing markdown body content.",
+        "Preserve existing frontmatter fields and values unless they are clearly invalid.",
+        "Add missing metadata only when it is clearly supported by file content, established Renma path conventions, or user-provided options.",
+        "Do not infer or invent owner.",
+        "Do not infer owner from Git history, file path, prose, or author.",
+        "Missing owner is allowed.",
+        "Avoid placeholder metadata.",
+        "Keep metadata compact.",
+        ownerInstruction(input),
+        "Run renma scan . and renma ownership . after editing.",
+    ];
+}
+function ownerInstruction(input) {
+    if (input.existingOwner) {
+        if (input.explicitOwner && input.existingOwner !== input.explicitOwner) {
+            return `Existing owner is ${input.existingOwner}. The explicitly provided owner ${input.explicitOwner} differs, so do not change ownership without human review.`;
+        }
+        return `Preserve existing owner: ${input.existingOwner}.`;
+    }
+    if (input.explicitOwner) {
+        return `Use owner: ${input.explicitOwner} because the user explicitly provided it.`;
+    }
+    return "Do not add owner unless the existing asset already declares one or a maintainer provides one.";
+}
+function metadataLines(candidateMetadata) {
+    const entries = Object.entries(candidateMetadata);
+    if (entries.length === 0) {
+        return ["- (none)"];
+    }
+    return entries.map(([field, value]) => `- ${field}: \`${value}\``);
+}
+function blockedMetadataLines(blockedMetadata) {
+    if (blockedMetadata.length === 0) {
+        return ["- (none)"];
+    }
+    return blockedMetadata.map((item) => `- ${item.field}: ${item.reason}`);
+}
+function classifyPath(filePath) {
+    const parts = pathParts(filePath);
+    const basename = parts.at(-1) ?? "";
+    if (basename === "SKILL.md")
+        return "skill";
+    if (parts.includes("lenses"))
+        return "context_lens";
+    if (parts.includes("contexts") || parts.includes("context"))
+        return "context";
+    if (parts.includes("profiles"))
+        return "profile";
+    if (parts.includes("references"))
+        return "reference";
+    if (parts.includes("examples"))
+        return "example";
+    if (basename === "AGENTS.md" || parts.includes(".agents"))
+        return "agent";
+    if (basename === "renma.config.json" || basename === ".renma.json") {
+        return "config";
+    }
+    return "unknown";
+}
+function inferCandidateId(kind, filePath) {
+    if (kind === "skill") {
+        return inferRootedId("skill", filePath, "skills", (parts) => parts.filter((part) => part !== "SKILL"));
+    }
+    if (kind === "context") {
+        return inferRootedId("context", filePath, "contexts");
+    }
+    if (kind === "context_lens") {
+        return inferRootedId("lens", filePath, "lenses");
+    }
+    return undefined;
+}
+function inferRootedId(prefix, filePath, rootSegment, transform = (parts) => parts) {
+    const parts = pathParts(stripExtension(filePath));
+    let rootIndex = lastIndexOf(parts, rootSegment);
+    if (rootIndex < 0 && rootSegment === "contexts") {
+        rootIndex = lastIndexOf(parts, "context");
+    }
+    if (rootIndex < 0)
+        return undefined;
+    const idParts = transform(parts.slice(rootIndex + 1))
+        .map(slugify)
+        .filter(Boolean);
+    if (idParts.length === 0)
+        return undefined;
+    if (idParts[0] === prefix)
+        return idParts.join(".");
+    return [prefix, ...idParts].join(".");
+}
+function mainHeadingTitle(headings) {
+    return headings.find((heading) => heading.depth === 1)?.text.trim();
+}
+function metadataValueText(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function optionalText(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function stripExtension(value) {
+    return value.replace(/\.[^/.]+$/, "");
+}
+function pathParts(value) {
+    return toPosix(value).split("/").filter(Boolean);
+}
+function toPosix(value) {
+    return value.replace(/\\/g, "/");
+}
+function lastIndexOf(values, target) {
+    for (let index = values.length - 1; index >= 0; index -= 1) {
+        if (values[index] === target)
+            return index;
+    }
+    return -1;
+}
+function slugify(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+}
+function readErrorReason(error) {
+    const code = errorCode(error);
+    if (code === "ENOENT")
+        return "file does not exist";
+    if (code === "EISDIR")
+        return "target is a directory";
+    if (code === "EACCES" || code === "EPERM")
+        return "permission denied";
+    return error instanceof Error ? error.message : String(error);
+}
+function errorCode(error) {
+    if (typeof error !== "object" || error === null || !("code" in error)) {
+        return undefined;
+    }
+    const code = error.code;
+    return typeof code === "string" ? code : undefined;
+}
+//# sourceMappingURL=suggest-metadata.js.map

package/dist/commands/suggest-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggest-metadata.js","sourceRoot":"","sources":["../../src/commands/suggest-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAyBpD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,MAAc,EAAE,KAAc;QACxC,KAAK,CACH,kCAAkC,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CACtE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAc,EACd,UAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,MAAM,KAAK,MAAM;QACf,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QAC5C,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,CACrC,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,UAAkC,EAAE;IAEpC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,0BAA0B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC;QAC7B,IAAI,EAAE,UAAU;QAChB,YAAY;QACZ,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,OAAO;KACW,CAAC,CAAC;IACtB,MAAM,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,IAAI,GACR,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc;QAC3D,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,WAAW,CAAC;IAClB,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,aAAa,GAAG,YAAY,CAChC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3C,CAAC;IACF,MAAM,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAA2B,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE3D,IAAI,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC;QAC/B,iBAAiB,CAAC,EAAE,GAAG,WAAW,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,cAAc,EAAE,CAAC;QACrC,iBAAiB,CAAC,KAAK,GAAG,cAAc,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,aAAa,EAAE,CAAC;QACpC,iBAAiB,CAAC,KAAK,GAAG,aAAa,CAAC;IAC1C,CAAC;IAED,MAAM,eAAe,GAAsB,EAAE,CAAC;IAC9C,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,6DAA6D;SACtE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,aAAa,IAAI,aAAa,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QACtE,eAAe,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,mBAAmB,aAAa,6CAA6C,aAAa,kDAAkD;SACrJ,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,IAAI;QACJ,aAAa,EAAE,mBAAmB;QAClC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC;QACrC,YAAY,EAAE,iBAAiB,CAAC,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;QACjE,iBAAiB;QACjB,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAA8B;IACjE,OAAO,GAAG;QACR,8CAA8C;QAC9C,EAAE;QACF,mDAAmD;QACnD,EAAE;QACF,QAAQ;QACR,aAAa,UAAU,CAAC,IAAI,IAAI;QAChC,aAAa,UAAU,CAAC,IAAI,IAAI;QAChC,aAAa,UAAU,CAAC,aAAa,IAAI;QACzC,EAAE;QACF,QAAQ;QACR,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC;QACnE,EAAE;QACF,qBAAqB;QACrB,GAAG,aAAa,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAC9C,EAAE;QACF,mBAAmB;QACnB,GAAG,oBAAoB,CAAC,UAAU,CAAC,eAAe,CAAC;QACnD,EAAE;QACF,eAAe;QACf,uBAAuB;QACvB,4BAA4B;QAC5B,EAAE;QACF,+DAA+D;KAChE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAG1B;IACC,OAAO;QACL,4CAA4C;QAC5C,8CAA8C;QAC9C,kFAAkF;QAClF,uIAAuI;QACvI,+BAA+B;QAC/B,mEAAmE;QACnE,2BAA2B;QAC3B,6BAA6B;QAC7B,wBAAwB;QACxB,gBAAgB,CAAC,KAAK,CAAC;QACvB,uDAAuD;KACxD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAGzB;IACC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YACvE,OAAO,qBAAqB,KAAK,CAAC,aAAa,mCAAmC,KAAK,CAAC,aAAa,4DAA4D,CAAC;QACpK,CAAC;QACD,OAAO,4BAA4B,KAAK,CAAC,aAAa,GAAG,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACxB,OAAO,cAAc,KAAK,CAAC,aAAa,2CAA2C,CAAC;IACtF,CAAC;IACD,OAAO,+FAA+F,CAAC;AACzG,CAAC;AAED,SAAS,aAAa,CAAC,iBAAyC;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,KAAK,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,oBAAoB,CAAC,eAAkC;IAC9D,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpC,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAC5C,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,cAAc,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9E,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,WAAW,CAAC;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,QAAQ,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1E,IAAI,QAAQ,KAAK,mBAAmB,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAkB,EAClB,QAAgB;IAEhB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAC1D,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,QAAgB,EAChB,WAAmB,EACnB,YAA2C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK;IAE3D,MAAM,KAAK,GAAG,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,IAAI,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,SAAS,GAAG,CAAC,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAChD,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;SAClD,GAAG,CAAC,OAAO,CAAC;SACZ,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgD;IACxE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAgC;IAEhC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,MAAgB,EAAE,MAAc;IACnD,KAAK,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;IAC7C,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK;SACT,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,qBAAqB,CAAC;IACpD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,uBAAuB,CAAC;IACtD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,mBAAmB,CAAC;IACtE,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;IAChD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC"}

package/dist/commands/trust-graph.d.ts

@@ -0,0 +1,11 @@
+import type { ConfigOverrides } from "../config.js";
+import type { TrustGraph } from "../trust-graph.js";
+export type TrustGraphFormat = "json" | "markdown";
+export declare function runTrustGraphCommand(targetPath: string, options: {
+    format: TrustGraphFormat;
+    overrides?: ConfigOverrides;
+}): Promise<number>;
+export declare function trustGraph(targetPath: string, overrides?: ConfigOverrides): Promise<TrustGraph>;
+export declare function formatTrustGraphJson(graph: TrustGraph): string;
+export declare function formatTrustGraphMarkdown(graph: TrustGraph): string;
+//# sourceMappingURL=trust-graph.d.ts.map

package/dist/commands/trust-graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-graph.d.ts","sourceRoot":"","sources":["../../src/commands/trust-graph.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,KAAK,EACV,UAAU,EAKX,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,UAAU,CAAC;AAgCnD,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,SAAS,CAAC,EAAE,eAAe,CAAA;CAAE,GACjE,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,eAAoB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAE9D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CA4ElE"}

package/dist/commands/trust-graph.js

@@ -0,0 +1,136 @@
+import { scan } from "../scanner.js";
+const NODE_TYPES = [
+    "asset",
+    "owner",
+    "lifecycle_status",
+    "security_profile",
+    "effective_policy",
+    "diagnostic",
+];
+const EDGE_TYPES = [
+    "owned_by",
+    "has_lifecycle_status",
+    "declares_dependency",
+    "references",
+    "selects_security_profile",
+    "inherits_policy",
+    "has_effective_policy",
+    "has_diagnostic",
+];
+const REVIEW_SEVERITY_ORDER = [
+    "error",
+    "critical",
+    "high",
+    "medium",
+    "warning",
+    "low",
+    "info",
+];
+export async function runTrustGraphCommand(targetPath, options) {
+    const graph = await trustGraph(targetPath, options.overrides ?? {});
+    process.stdout.write(formatTrustGraph(graph, options.format));
+    return 0;
+}
+export async function trustGraph(targetPath, overrides = {}) {
+    const result = await scan(targetPath, overrides);
+    if (!result.trustGraph) {
+        throw new Error("scan did not produce Trust Graph evidence.");
+    }
+    return result.trustGraph;
+}
+export function formatTrustGraphJson(graph) {
+    return `${JSON.stringify(graph, null, 2)}\n`;
+}
+export function formatTrustGraphMarkdown(graph) {
+    const lines = [
+        "# Renma Trust Graph",
+        "",
+        `- Schema: ${graph.schemaVersion}`,
+        `- Assets: ${graph.summary.assetCount}`,
+        `- Nodes: ${graph.summary.nodeCount}`,
+        `- Edges: ${graph.summary.edgeCount}`,
+        `- Findings: ${graph.summary.findingCount}`,
+        "",
+        "## Node Counts",
+        "",
+        "| Type | Count |",
+        "| --- | ---: |",
+        ...NODE_TYPES.map((type) => `| ${type} | ${graph.summary.nodeTypeCounts[type]} |`),
+        "",
+        "## Edge Counts",
+        "",
+        "| Type | Count |",
+        "| --- | ---: |",
+        ...EDGE_TYPES.map((type) => `| ${type} | ${graph.summary.edgeTypeCounts[type]} |`),
+        "",
+        "## Trust Evidence Highlights",
+        "",
+        `- Owned assets: ${graph.summary.edgeTypeCounts.owned_by}/${graph.summary.assetCount}`,
+        `- Assets with lifecycle status: ${graph.summary.edgeTypeCounts.has_lifecycle_status}/${graph.summary.assetCount}`,
+        `- Selected security profiles: ${graph.summary.edgeTypeCounts.selects_security_profile}`,
+        `- Effective policy fingerprints: ${graph.summary.nodeTypeCounts.effective_policy}`,
+        `- Diagnostics linked to assets: ${graph.summary.edgeTypeCounts.has_diagnostic}`,
+        "",
+        "## Finding Severity Counts",
+        "",
+        "| Severity | Count |",
+        "| --- | ---: |",
+        `| error | ${graph.summary.findingSeverityCounts.error} |`,
+        `| warning | ${graph.summary.findingSeverityCounts.warning} |`,
+        `| info | ${graph.summary.findingSeverityCounts.info} |`,
+        `| critical | ${graph.summary.findingSeverityCounts.critical} |`,
+        `| high | ${graph.summary.findingSeverityCounts.high} |`,
+        `| medium | ${graph.summary.findingSeverityCounts.medium} |`,
+        `| low | ${graph.summary.findingSeverityCounts.low} |`,
+        "",
+        "## Finding Risk Class Counts",
+        "",
+        "| Risk Class | Count |",
+        "| --- | ---: |",
+        `| violation | ${graph.summary.riskClassCounts.violation} |`,
+        `| suspicious | ${graph.summary.riskClassCounts.suspicious} |`,
+        `| advisory | ${graph.summary.riskClassCounts.advisory} |`,
+        `| unclassified | ${graph.summary.riskClassCounts.unclassified} |`,
+        "",
+        "## Top Findings",
+        "",
+    ];
+    const topFindings = [...graph.findings]
+        .sort(compareFindingsForReview)
+        .slice(0, 20);
+    if (topFindings.length === 0) {
+        lines.push("- (none)");
+    }
+    else {
+        for (const finding of topFindings) {
+            const identifier = finding.id ?? finding.code ?? finding.source;
+            const risk = finding.riskClass ? ` [${finding.riskClass}]` : "";
+            const path = finding.path ? ` ${finding.path}` : "";
+            lines.push(`- ${finding.severity}${risk} ${identifier}${path}: ${singleLine(finding.message)}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+function formatTrustGraph(graph, format) {
+    if (format === "json")
+        return formatTrustGraphJson(graph);
+    return formatTrustGraphMarkdown(graph);
+}
+function compareFindingsForReview(left, right) {
+    const bySeverity = REVIEW_SEVERITY_ORDER.indexOf(left.severity) -
+        REVIEW_SEVERITY_ORDER.indexOf(right.severity);
+    if (bySeverity !== 0)
+        return bySeverity;
+    const byPath = (left.path ?? "").localeCompare(right.path ?? "");
+    if (byPath !== 0)
+        return byPath;
+    const byLine = (left.evidence?.startLine ?? 0) - (right.evidence?.startLine ?? 0);
+    if (byLine !== 0)
+        return byLine;
+    return ((left.id ?? left.code ?? "").localeCompare(right.id ?? right.code ?? "") ||
+        left.message.localeCompare(right.message));
+}
+function singleLine(value) {
+    return value.replace(/\r?\n/g, " ");
+}
+//# sourceMappingURL=trust-graph.js.map

package/dist/commands/trust-graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-graph.js","sourceRoot":"","sources":["../../src/commands/trust-graph.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAWrC,MAAM,UAAU,GAAyB;IACvC,OAAO;IACP,OAAO;IACP,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,YAAY;CACb,CAAC;AAEF,MAAM,UAAU,GAAyB;IACvC,UAAU;IACV,sBAAsB;IACtB,qBAAqB;IACrB,YAAY;IACZ,0BAA0B;IAC1B,iBAAiB;IACjB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC;AAEF,MAAM,qBAAqB,GAAgC;IACzD,OAAO;IACP,UAAU;IACV,MAAM;IACN,QAAQ;IACR,SAAS;IACT,KAAK;IACL,MAAM;CACP,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,OAAkE;IAElE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAkB,EAClB,YAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAiB;IACxD,MAAM,KAAK,GAAG;QACZ,qBAAqB;QACrB,EAAE;QACF,aAAa,KAAK,CAAC,aAAa,EAAE;QAClC,aAAa,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;QACvC,YAAY,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE;QACrC,YAAY,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE;QACrC,eAAe,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE;QAC3C,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,kBAAkB;QAClB,gBAAgB;QAChB,GAAG,UAAU,CAAC,GAAG,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAChE;QACD,EAAE;QACF,gBAAgB;QAChB,EAAE;QACF,kBAAkB;QAClB,gBAAgB;QAChB,GAAG,UAAU,CAAC,GAAG,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,MAAM,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAChE;QACD,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,mBAAmB,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;QACtF,mCAAmC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;QAClH,iCAAiC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,wBAAwB,EAAE;QACxF,oCAAoC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,EAAE;QACnF,mCAAmC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,EAAE;QAChF,EAAE;QACF,4BAA4B;QAC5B,EAAE;QACF,sBAAsB;QACtB,gBAAgB;QAChB,aAAa,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,IAAI;QAC1D,eAAe,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,IAAI;QAC9D,YAAY,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,IAAI;QACxD,gBAAgB,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,QAAQ,IAAI;QAChE,YAAY,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,IAAI;QACxD,cAAc,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,MAAM,IAAI;QAC5D,WAAW,KAAK,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,IAAI;QACtD,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,wBAAwB;QACxB,gBAAgB;QAChB,iBAAiB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,IAAI;QAC5D,kBAAkB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,UAAU,IAAI;QAC9D,gBAAgB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,IAAI;QAC1D,oBAAoB,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,YAAY,IAAI;QAClE,EAAE;QACF,iBAAiB;QACjB,EAAE;KACH,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;SACpC,IAAI,CAAC,wBAAwB,CAAC;SAC9B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;YAChE,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,KAAK,CAAC,IAAI,CACR,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,UAAU,GAAG,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB,EAAE,MAAwB;IACnE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC1D,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAuB,EACvB,KAAwB;IAExB,MAAM,UAAU,GACd,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC5C,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAChC,MAAM,MAAM,GACV,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,CACL,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QACxE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC"}

package/dist/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAW/D,OAAO,KAAK,EAAuB,UAAU,EAAE,MAAM,YAAY,CAAC;AAElE,sEAAsE;AACtE,wBAAsB,IAAI,CACxB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,eAAoB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAgDrB"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAe/D,OAAO,KAAK,EAAuB,UAAU,EAAE,MAAM,YAAY,CAAC;AAElE,sEAAsE;AACtE,wBAAsB,IAAI,CACxB,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,eAAoB,GAC9B,OAAO,CAAC,UAAU,CAAC,CA2DrB"}

package/dist/scanner.js

@@ -9,14 +9,16 @@ import { parseDocument } from "./markdown.js";
 import { detectRepeatedContextPatterns } from "./repeated-context.js";
 import { runRules } from "./rules.js";
 import { securityDiagnosticFindings } from "./security-diagnostics.js";
-import { summarizeSecurityPolicyInventory } from "./security-policy-inventory.js";
+import { collectSecurityPolicyAssetEvidence, summarizeSecurityPolicyInventory, } from "./security-policy-inventory.js";
 import { applySuppressions } from "./suppressions.js";
+import { buildTrustGraph } from "./trust-graph.js";
 /** Run the complete deterministic scan pipeline for a target path. */
 export async function scan(targetPath, overrides = {}) {
     const root = path.resolve(targetPath);
     const { config, configPath } = await loadConfig(root, overrides);
     const { artifacts, diagnostics } = await discoverArtifacts(root, config);
     const securityPolicyInventory = summarizeSecurityPolicyInventory(artifacts, config.security);
+    const securityPolicies = collectSecurityPolicyAssetEvidence(artifacts, config.security);
     const documents = artifacts.map(parseDocument);
     const catalogResult = buildCatalog(documents);
     const contextLens = summarizeContextLensGovernance(documents, catalogResult.catalog);
@@ -41,6 +43,12 @@ export async function scan(targetPath, overrides = {}) {
         findings: suppressed.findings,
         diagnostics: scanDiagnostics,
     });
+    const trustGraph = buildTrustGraph({
+        catalog: catalogResult.catalog,
+        findings: suppressed.findings,
+        diagnostics: scanDiagnostics,
+        securityPolicies,
+    });
     return {
         root,
         ...(configPath ? { configPath } : {}),
@@ -48,6 +56,7 @@ export async function scan(targetPath, overrides = {}) {
         format: config.format,
         contextLens: contextLens.summary,
         securityPolicyInventory,
+        trustGraph,
         findings: suppressed.findings,
         diagnostics: scanDiagnostics,
         diagnosticsV2,

package/dist/scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,gCAAgC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,UAAkB,EAClB,YAA6B,EAAE;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,uBAAuB,GAAG,gCAAgC,CAC9D,SAAS,EACT,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,8BAA8B,CAChD,SAAS,EACT,aAAa,CAAC,OAAO,CACtB,CAAC;IACF,MAAM,WAAW,GAAG;QAClB,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;QACrD,GAAG,6BAA6B,CAAC,SAAS,CAAC;QAC3C,GAAG,yBAAyB,CAAC,aAAa,CAAC,WAAW,CAAC;QACvD,GAAG,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC;KACjD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG;QACtB,GAAG,WAAW;QACd,GAAG,WAAW,CAAC,WAAW;QAC1B,GAAG,UAAU,CAAC,WAAW;KAC1B,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CAAC;QACxC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,eAAe;KAC7B,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,gBAAgB,EAAE,SAAS,CAAC,MAAM;QAClC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,WAAW,CAAC,OAAO;QAChC,uBAAuB;QACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,eAAe;QAC5B,aAAa;QACb,aAAa,EAAE,mBAAmB,CAAC,aAAa,CAAC;QACjD,aAAa,EAAE,MAAM,CAAC,MAAM;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,WAAyB;IAC1D,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAC9D,CAAC;IACF,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,WAAW,CAAC;QAC5C,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC3E,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,cAAc,CAAC,mBAAmB;gBACtC,KAAK,EAAE,iDAAiD;gBACxD,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;oBAC/B,IAAI;oBACJ,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;gBACD,YAAY,EACV,4OAA4O;gBAC9O,WAAW,EACT,4LAA4L;gBAC9L,WAAW,EAAE;oBACX,8CAA8C;oBAC9C,gCAAgC;oBAChC,+CAA+C;oBAC/C,2FAA2F;iBAC5F;gBACD,iBAAiB,EAAE;oBACjB,iBAAiB;oBACjB,oBAAoB;oBACpB,2EAA2E;iBAC5E;gBACD,OAAO,EACL,uNAAuN;gBACzN,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,2BAA2B,CAAC,IAAI,CAC5D,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,qBAAqB,IAAI,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;YACpE,OAAO;gBACL,EAAE,EAAE,qBAAqB;oBACvB,CAAC,CAAC,cAAc,CAAC,6BAA6B;oBAC9C,CAAC,CAAC,gBAAgB;wBAChB,CAAC,CAAC,cAAc,CAAC,uBAAuB;wBACxC,CAAC,CAAC,cAAc,CAAC,yBAAyB;gBAC9C,KAAK,EAAE,qBAAqB;oBAC1B,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,gBAAgB;wBAChB,CAAC,CAAC,oDAAoD;wBACtD,CAAC,CAAC,qDAAqD;gBAC3D,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;oBAC/B,IAAI;oBACJ,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;gBACD,YAAY,EACV,2IAA2I;gBAC7I,WAAW,EACT,6IAA6I;gBAC/I,WAAW,EAAE;oBACX,qDAAqD;oBACrD,8CAA8C;oBAC9C,gCAAgC;oBAChC,+CAA+C;iBAChD;gBACD,iBAAiB,EAAE;oBACjB,iBAAiB;oBACjB,oBAAoB;oBACpB,mDAAmD;iBACpD;gBACD,OAAO,EACL,wHAAwH;gBAC1H,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,oCAAoC,CAAC,IAAI,CACnE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,uBAAuB,GAAG,iCAAiC,CAAC,IAAI,CACpE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,IAAI,mBAAmB,IAAI,uBAAuB,EAAE,CAAC;YACnD,OAAO;gBACL,EAAE,EAAE,mBAAmB;oBACrB,CAAC,CAAC,cAAc,CAAC,0BAA0B;oBAC3C,CAAC,CAAC,cAAc,CAAC,uBAAuB;gBAC1C,KAAK,EAAE,mBAAmB;oBACxB,CAAC,CAAC,mCAAmC;oBACrC,CAAC,CAAC,gCAAgC;gBACpC,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;oBAC/B,IAAI;oBACJ,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;gBACD,YAAY,EACV,iOAAiO;gBACnO,WAAW,EACT,+LAA+L;gBACjM,WAAW,EAAE;oBACX,oDAAoD;oBACpD,+DAA+D;oBAC/D,6EAA6E;oBAC7E,8GAA8G;iBAC/G;gBACD,iBAAiB,EAAE;oBACjB,iBAAiB;oBACjB,oBAAoB;oBACpB,8FAA8F;iBAC/F;gBACD,OAAO,EACL,iMAAiM;gBACnM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,uBAAuB,GAAG,+BAA+B,CAAC,IAAI,CAClE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,0BAA0B,GAAG,mCAAmC,CAAC,IAAI,CACzE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,wBAAwB,GAC5B,sDAAsD,CAAC,IAAI,CACzD,UAAU,CAAC,OAAO,CACnB,CAAC;QACJ,IACE,uBAAuB;YACvB,0BAA0B;YAC1B,wBAAwB,EACxB,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,uBAAuB;oBACzB,CAAC,CAAC,cAAc,CAAC,gCAAgC;oBACjD,CAAC,CAAC,0BAA0B;wBAC1B,CAAC,CAAC,cAAc,CAAC,oCAAoC;wBACrD,CAAC,CAAC,cAAc,CAAC,uCAAuC;gBAC5D,KAAK,EAAE,uBAAuB;oBAC5B,CAAC,CAAC,sDAAsD;oBACxD,CAAC,CAAC,0BAA0B;wBAC1B,CAAC,CAAC,0DAA0D;wBAC5D,CAAC,CAAC,8DAA8D;gBACpE,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;oBAC/B,IAAI;oBACJ,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;gBACD,YAAY,EACV,sOAAsO;gBACxO,WAAW,EACT,2LAA2L;gBAC7L,WAAW,EAAE;oBACX,wDAAwD;oBACxD,2FAA2F;oBAC3F,8CAA8C;oBAC9C,gCAAgC;oBAChC,2EAA2E;iBAC5E;gBACD,iBAAiB,EAAE;oBACjB,iBAAiB;oBACjB,oBAAoB;oBACpB,uFAAuF;iBACxF;gBACD,OAAO,EACL,yJAAyJ;gBAC3J,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,iCAAiC,CAAC,IAAI,CAC9D,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,IAAI,CACtE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,OAAO;YACL,EAAE,EAAE,SAAS;gBACX,CAAC,CAAC,cAAc,CAAC,eAAe;gBAChC,CAAC,CAAC,iBAAiB;oBACjB,CAAC,CAAC,cAAc,CAAC,uBAAuB;oBACxC,CAAC,CAAC,kBAAkB;wBAClB,CAAC,CAAC,cAAc,CAAC,wBAAwB;wBACzC,CAAC,CAAC,cAAc,CAAC,uBAAuB;YAC9C,KAAK,EAAE,SAAS;gBACd,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,iBAAiB;oBACjB,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,kBAAkB;wBAClB,CAAC,CAAC,+CAA+C;wBACjD,CAAC,CAAC,6BAA6B;YACrC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;gBAC/B,IAAI;gBACJ,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B;YACD,YAAY,EACV,kLAAkL;YACpL,WAAW,EACT,+GAA+G;YACjH,WAAW,EAAE;gBACX,8CAA8C;gBAC9C,gCAAgC;gBAChC,+CAA+C;aAChD;YACD,iBAAiB,EAAE;gBACjB,iBAAiB;gBACjB,oBAAoB;gBACpB,2EAA2E;aAC5E;YACD,OAAO,EACL,0HAA0H;YAC5H,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAwB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EACL,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGnD,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,IAAI,CACxB,UAAkB,EAClB,YAA6B,EAAE;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,uBAAuB,GAAG,gCAAgC,CAC9D,SAAS,EACT,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,MAAM,gBAAgB,GAAG,kCAAkC,CACzD,SAAS,EACT,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,8BAA8B,CAChD,SAAS,EACT,aAAa,CAAC,OAAO,CACtB,CAAC;IACF,MAAM,WAAW,GAAG;QAClB,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC;QACrD,GAAG,6BAA6B,CAAC,SAAS,CAAC;QAC3C,GAAG,yBAAyB,CAAC,aAAa,CAAC,WAAW,CAAC;QACvD,GAAG,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC;KACjD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACd,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;IACrD,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG;QACtB,GAAG,WAAW;QACd,GAAG,WAAW,CAAC,WAAW;QAC1B,GAAG,UAAU,CAAC,WAAW;KAC1B,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CAAC;QACxC,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,eAAe;KAC7B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,eAAe,CAAC;QACjC,OAAO,EAAE,aAAa,CAAC,OAAO;QAC9B,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,eAAe;QAC5B,gBAAgB;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,gBAAgB,EAAE,SAAS,CAAC,MAAM;QAClC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,WAAW,CAAC,OAAO;QAChC,uBAAuB;QACvB,UAAU;QACV,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,WAAW,EAAE,eAAe;QAC5B,aAAa;QACb,aAAa,EAAE,mBAAmB,CAAC,aAAa,CAAC;QACjD,aAAa,EAAE,MAAM,CAAC,MAAM;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,WAAyB;IAC1D,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,CAC3C,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAC9D,CAAC;IACF,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,IAAI,WAAW,CAAC;QAC5C,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC3E,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO;gBACL,EAAE,EAAE,cAAc,CAAC,mBAAmB;gBACtC,KAAK,EAAE,iDAAiD;gBACxD,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;oBAC/B,IAAI;oBACJ,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;gBACD,YAAY,EACV,4OAA4O;gBAC9O,WAAW,EACT,4LAA4L;gBAC9L,WAAW,EAAE;oBACX,8CAA8C;oBAC9C,gCAAgC;oBAChC,+CAA+C;oBAC/C,2FAA2F;iBAC5F;gBACD,iBAAiB,EAAE;oBACjB,iBAAiB;oBACjB,oBAAoB;oBACpB,2EAA2E;iBAC5E;gBACD,OAAO,EACL,uNAAuN;gBACzN,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,qBAAqB,GAAG,2BAA2B,CAAC,IAAI,CAC5D,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACxE,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5E,IAAI,qBAAqB,IAAI,gBAAgB,IAAI,kBAAkB,EAAE,CAAC;YACpE,OAAO;gBACL,EAAE,EAAE,qBAAqB;oBACvB,CAAC,CAAC,cAAc,CAAC,6BAA6B;oBAC9C,CAAC,CAAC,gBAAgB;wBAChB,CAAC,CAAC,cAAc,CAAC,uBAAuB;wBACxC,CAAC,CAAC,cAAc,CAAC,yBAAyB;gBAC9C,KAAK,EAAE,qBAAqB;oBAC1B,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,gBAAgB;wBAChB,CAAC,CAAC,oDAAoD;wBACtD,CAAC,CAAC,qDAAqD;gBAC3D,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;oBAC/B,IAAI;oBACJ,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;gBACD,YAAY,EACV,2IAA2I;gBAC7I,WAAW,EACT,6IAA6I;gBAC/I,WAAW,EAAE;oBACX,qDAAqD;oBACrD,8CAA8C;oBAC9C,gCAAgC;oBAChC,+CAA+C;iBAChD;gBACD,iBAAiB,EAAE;oBACjB,iBAAiB;oBACjB,oBAAoB;oBACpB,mDAAmD;iBACpD;gBACD,OAAO,EACL,wHAAwH;gBAC1H,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAG,oCAAoC,CAAC,IAAI,CACnE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,uBAAuB,GAAG,iCAAiC,CAAC,IAAI,CACpE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,IAAI,mBAAmB,IAAI,uBAAuB,EAAE,CAAC;YACnD,OAAO;gBACL,EAAE,EAAE,mBAAmB;oBACrB,CAAC,CAAC,cAAc,CAAC,0BAA0B;oBAC3C,CAAC,CAAC,cAAc,CAAC,uBAAuB;gBAC1C,KAAK,EAAE,mBAAmB;oBACxB,CAAC,CAAC,mCAAmC;oBACrC,CAAC,CAAC,gCAAgC;gBACpC,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;oBAC/B,IAAI;oBACJ,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;gBACD,YAAY,EACV,iOAAiO;gBACnO,WAAW,EACT,+LAA+L;gBACjM,WAAW,EAAE;oBACX,oDAAoD;oBACpD,+DAA+D;oBAC/D,6EAA6E;oBAC7E,8GAA8G;iBAC/G;gBACD,iBAAiB,EAAE;oBACjB,iBAAiB;oBACjB,oBAAoB;oBACpB,8FAA8F;iBAC/F;gBACD,OAAO,EACL,iMAAiM;gBACnM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,uBAAuB,GAAG,+BAA+B,CAAC,IAAI,CAClE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,0BAA0B,GAAG,mCAAmC,CAAC,IAAI,CACzE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,wBAAwB,GAC5B,sDAAsD,CAAC,IAAI,CACzD,UAAU,CAAC,OAAO,CACnB,CAAC;QACJ,IACE,uBAAuB;YACvB,0BAA0B;YAC1B,wBAAwB,EACxB,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,uBAAuB;oBACzB,CAAC,CAAC,cAAc,CAAC,gCAAgC;oBACjD,CAAC,CAAC,0BAA0B;wBAC1B,CAAC,CAAC,cAAc,CAAC,oCAAoC;wBACrD,CAAC,CAAC,cAAc,CAAC,uCAAuC;gBAC5D,KAAK,EAAE,uBAAuB;oBAC5B,CAAC,CAAC,sDAAsD;oBACxD,CAAC,CAAC,0BAA0B;wBAC1B,CAAC,CAAC,0DAA0D;wBAC5D,CAAC,CAAC,8DAA8D;gBACpE,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;oBAC/B,IAAI;oBACJ,SAAS,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,UAAU,CAAC,OAAO;iBAC5B;gBACD,YAAY,EACV,sOAAsO;gBACxO,WAAW,EACT,2LAA2L;gBAC7L,WAAW,EAAE;oBACX,wDAAwD;oBACxD,2FAA2F;oBAC3F,8CAA8C;oBAC9C,gCAAgC;oBAChC,2EAA2E;iBAC5E;gBACD,iBAAiB,EAAE;oBACjB,iBAAiB;oBACjB,oBAAoB;oBACpB,uFAAuF;iBACxF;gBACD,OAAO,EACL,yJAAyJ;gBAC3J,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,iBAAiB,GAAG,iCAAiC,CAAC,IAAI,CAC9D,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,MAAM,kBAAkB,GAAG,wCAAwC,CAAC,IAAI,CACtE,UAAU,CAAC,OAAO,CACnB,CAAC;QACF,OAAO;YACL,EAAE,EAAE,SAAS;gBACX,CAAC,CAAC,cAAc,CAAC,eAAe;gBAChC,CAAC,CAAC,iBAAiB;oBACjB,CAAC,CAAC,cAAc,CAAC,uBAAuB;oBACxC,CAAC,CAAC,kBAAkB;wBAClB,CAAC,CAAC,cAAc,CAAC,wBAAwB;wBACzC,CAAC,CAAC,cAAc,CAAC,uBAAuB;YAC9C,KAAK,EAAE,SAAS;gBACd,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,iBAAiB;oBACjB,CAAC,CAAC,uCAAuC;oBACzC,CAAC,CAAC,kBAAkB;wBAClB,CAAC,CAAC,+CAA+C;wBACjD,CAAC,CAAC,6BAA6B;YACrC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ,IAAI;gBAC/B,IAAI;gBACJ,SAAS,EAAE,CAAC;gBACZ,OAAO,EAAE,CAAC;gBACV,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B;YACD,YAAY,EACV,kLAAkL;YACpL,WAAW,EACT,+GAA+G;YACjH,WAAW,EAAE;gBACX,8CAA8C;gBAC9C,gCAAgC;gBAChC,+CAA+C;aAChD;YACD,iBAAiB,EAAE;gBACjB,iBAAiB;gBACjB,oBAAoB;gBACpB,2EAA2E;aAC5E;YACD,OAAO,EACL,0HAA0H;YAC5H,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/security-policy-inventory.d.ts

@@ -1,5 +1,5 @@
 import { type SecurityPolicy } from "./security-policy.js";
-import type { Artifact, ArtifactKind, SecurityConfig } from "./types.js";
+import type { Artifact, ArtifactKind, Evidence, SecurityConfig } from "./types.js";
 type InventoryArtifactKind = ArtifactKind;
 export interface PolicyBooleanCounts {
     true: number;
@@ -47,7 +47,34 @@ export interface SecurityPolicyInventorySummary {
         kind: ArtifactKind;
     }>;
 }
+export interface EffectiveSecurityPolicyEvidence {
+    fingerprint: string;
+    allowedData: string[];
+    forbiddenInputs: string[];
+    networkAllowed: boolean | null;
+    externalUploadAllowed: boolean | null;
+    secretsAllowed: boolean | null;
+    humanApprovalRequired: boolean | null;
+    approvedNetworkDestinations: string[];
+    approvedUploadDestinations: string[];
+    disallowedCommands: string[];
+}
+export type SecurityProfileResolution = "none" | "resolved" | "missing" | "cyclic";
+export interface SecurityPolicyAssetEvidence {
+    path: string;
+    kind: ArtifactKind;
+    hasLocalPolicyMetadata: boolean;
+    selectedSecurityProfile?: string;
+    profileResolution: SecurityProfileResolution;
+    profileChain: string[];
+    effectivePolicy: EffectiveSecurityPolicyEvidence;
+    evidence: {
+        selectedSecurityProfile?: Evidence;
+        policyFields: Evidence[];
+    };
+}
 export declare function summarizeSecurityPolicyInventory(artifacts: Artifact[], config?: SecurityConfig): SecurityPolicyInventorySummary;
+export declare function collectSecurityPolicyAssetEvidence(artifacts: Artifact[], config?: SecurityConfig): SecurityPolicyAssetEvidence[];
 export declare function zeroSecurityPolicyInventorySummary(): SecurityPolicyInventorySummary;
 export declare function isPolicyInventoryArtifact(artifact: Artifact, hasLocalMetadata?: boolean): boolean;
 export declare function hasLocalSecurityPolicyMetadata(policy: SecurityPolicy): boolean;

package/dist/security-policy-inventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-policy-inventory.d.ts","sourceRoot":"","sources":["../src/security-policy-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzE,KAAK,qBAAqB,GAAG,YAAY,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,MAAM,CAAC;IACjC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAClD,cAAc,EAAE,mBAAmB,CAAC;IACpC,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C,cAAc,EAAE,mBAAmB,CAAC;IACpC,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C,+BAA+B,EAAE,MAAM,CAAC;IACxC,8BAA8B,EAAE,MAAM,CAAC;IACvC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC/C,CAAC;IACF,8BAA8B,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,6BAA6B,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,kBAAkB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,mBAAmB,EAAE,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,YAAY,CAAC;KACpB,CAAC,CAAC;CACJ;AAmCD,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,CAAC,EAAE,cAAc,GACtB,8BAA8B,CAwEhC;AAED,wBAAgB,kCAAkC,IAAI,8BAA8B,CA2BnF;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,EAClB,gBAAgB,UAEf,GACA,OAAO,CAET;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,cAAc,GACrB,OAAO,CAIT"}
+{"version":3,"file":"security-policy-inventory.d.ts","sourceRoot":"","sources":["../src/security-policy-inventory.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,cAAc,EACf,MAAM,YAAY,CAAC;AAEpB,KAAK,qBAAqB,GAAG,YAAY,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,MAAM,CAAC;IACjC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAClD,cAAc,EAAE,mBAAmB,CAAC;IACpC,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C,cAAc,EAAE,mBAAmB,CAAC;IACpC,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C,+BAA+B,EAAE,MAAM,CAAC;IACxC,8BAA8B,EAAE,MAAM,CAAC;IACvC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC/C,CAAC;IACF,8BAA8B,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,6BAA6B,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,kBAAkB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,mBAAmB,EAAE,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,YAAY,CAAC;KACpB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,qBAAqB,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,qBAAqB,EAAE,OAAO,GAAG,IAAI,CAAC;IACtC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,MAAM,yBAAyB,GACjC,MAAM,GACN,UAAU,GACV,SAAS,GACT,QAAQ,CAAC;AAEb,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,YAAY,CAAC;IACnB,sBAAsB,EAAE,OAAO,CAAC;IAChC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,iBAAiB,EAAE,yBAAyB,CAAC;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,+BAA+B,CAAC;IACjD,QAAQ,EAAE;QACR,uBAAuB,CAAC,EAAE,QAAQ,CAAC;QACnC,YAAY,EAAE,QAAQ,EAAE,CAAC;KAC1B,CAAC;CACH;AAqCD,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,CAAC,EAAE,cAAc,GACtB,8BAA8B,CAwEhC;AAED,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,CAAC,EAAE,cAAc,GACtB,2BAA2B,EAAE,CAsC/B;AAED,wBAAgB,kCAAkC,IAAI,8BAA8B,CA2BnF;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,EAClB,gBAAgB,UAEf,GACA,OAAO,CAET;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,cAAc,GACrB,OAAO,CAIT"}