renma 0.13.2 → 0.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +9 -1
- package/README.md +52 -10
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +31 -1
- package/dist/cli.js.map +1 -1
- package/dist/commands/trust-graph.d.ts +11 -0
- package/dist/commands/trust-graph.d.ts.map +1 -0
- package/dist/commands/trust-graph.js +136 -0
- package/dist/commands/trust-graph.js.map +1 -0
- package/dist/scanner.d.ts.map +1 -1
- package/dist/scanner.js +10 -1
- package/dist/scanner.js.map +1 -1
- package/dist/security-policy-inventory.d.ts +28 -1
- package/dist/security-policy-inventory.d.ts.map +1 -1
- package/dist/security-policy-inventory.js +109 -1
- package/dist/security-policy-inventory.js.map +1 -1
- package/dist/trust-graph.d.ts +59 -0
- package/dist/trust-graph.d.ts.map +1 -0
- package/dist/trust-graph.js +460 -0
- package/dist/trust-graph.js.map +1 -0
- package/dist/types.d.ts +2 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -1,7 +1,9 @@
|
|
|
1
|
+
import { createHash } from "node:crypto";
|
|
1
2
|
import { applySecurityConfig, effectiveAllowedDataClass, effectiveAllowedDataList, parseSecurityPolicy, securityProfileChain, } from "./security-policy.js";
|
|
2
3
|
const POLICY_INVENTORY_KINDS = new Set([
|
|
3
4
|
"skill",
|
|
4
5
|
"context",
|
|
6
|
+
"context_lens",
|
|
5
7
|
"agent",
|
|
6
8
|
"profile",
|
|
7
9
|
"reference",
|
|
@@ -11,6 +13,7 @@ const POLICY_INVENTORY_KINDS = new Set([
|
|
|
11
13
|
const ASSET_KINDS = [
|
|
12
14
|
"skill",
|
|
13
15
|
"context",
|
|
16
|
+
"context_lens",
|
|
14
17
|
"agent",
|
|
15
18
|
"profile",
|
|
16
19
|
"reference",
|
|
@@ -70,6 +73,42 @@ export function summarizeSecurityPolicyInventory(artifacts, config) {
|
|
|
70
73
|
summary.missingPolicyAssets.sort((left, right) => left.path.localeCompare(right.path));
|
|
71
74
|
return summary;
|
|
72
75
|
}
|
|
76
|
+
export function collectSecurityPolicyAssetEvidence(artifacts, config) {
|
|
77
|
+
return artifacts
|
|
78
|
+
.map((artifact) => {
|
|
79
|
+
const parsedPolicy = parseSecurityPolicy(artifact.content);
|
|
80
|
+
const hasMetadata = hasLocalSecurityPolicyMetadata(parsedPolicy);
|
|
81
|
+
if (!isPolicyInventoryArtifact(artifact, hasMetadata))
|
|
82
|
+
return undefined;
|
|
83
|
+
const policy = applySecurityConfig(parsedPolicy, config);
|
|
84
|
+
const chain = securityProfileChain(parsedPolicy.securityProfile, config);
|
|
85
|
+
const selectedSecurityProfile = parsedPolicy.securityProfile;
|
|
86
|
+
const selectedSecurityProfileEvidence = policyFieldEvidence(artifact, parsedPolicy, "securityProfile");
|
|
87
|
+
const row = {
|
|
88
|
+
path: artifact.path,
|
|
89
|
+
kind: artifact.kind,
|
|
90
|
+
hasLocalPolicyMetadata: hasMetadata,
|
|
91
|
+
...(selectedSecurityProfile ? { selectedSecurityProfile } : {}),
|
|
92
|
+
profileResolution: profileResolution(selectedSecurityProfile, chain),
|
|
93
|
+
profileChain: chain.profiles.map((item) => item.name),
|
|
94
|
+
effectivePolicy: normalizeEffectivePolicy(policy),
|
|
95
|
+
evidence: {
|
|
96
|
+
...(selectedSecurityProfileEvidence
|
|
97
|
+
? { selectedSecurityProfile: selectedSecurityProfileEvidence }
|
|
98
|
+
: {}),
|
|
99
|
+
policyFields: policyFieldEvidenceList(artifact, parsedPolicy),
|
|
100
|
+
},
|
|
101
|
+
};
|
|
102
|
+
return row;
|
|
103
|
+
})
|
|
104
|
+
.filter((row) => row !== undefined)
|
|
105
|
+
.sort((left, right) => {
|
|
106
|
+
const byPath = left.path.localeCompare(right.path);
|
|
107
|
+
if (byPath !== 0)
|
|
108
|
+
return byPath;
|
|
109
|
+
return left.kind.localeCompare(right.kind);
|
|
110
|
+
});
|
|
111
|
+
}
|
|
73
112
|
export function zeroSecurityPolicyInventorySummary() {
|
|
74
113
|
return {
|
|
75
114
|
totalPolicyAssets: 0,
|
|
@@ -105,7 +144,9 @@ export function hasLocalSecurityPolicyMetadata(policy) {
|
|
|
105
144
|
return [...LOCAL_POLICY_METADATA_FIELDS].some((field) => policy.declared.has(field));
|
|
106
145
|
}
|
|
107
146
|
function isMissingPolicyMetadataAsset(artifact, parsedPolicy, effectivePolicy) {
|
|
108
|
-
return ((artifact.kind === "skill" ||
|
|
147
|
+
return ((artifact.kind === "skill" ||
|
|
148
|
+
artifact.kind === "context" ||
|
|
149
|
+
artifact.kind === "context_lens") &&
|
|
109
150
|
effectiveAllowedDataClass(effectivePolicy) === undefined &&
|
|
110
151
|
effectiveAllowedDataList(effectivePolicy).length === 0 &&
|
|
111
152
|
!hasLocalSecurityPolicyMetadata(parsedPolicy));
|
|
@@ -156,6 +197,73 @@ function countSecurityProfile(summary, profileNames, policy, config) {
|
|
|
156
197
|
summary.securityProfiles.resolved += 1;
|
|
157
198
|
}
|
|
158
199
|
}
|
|
200
|
+
function normalizeEffectivePolicy(policy) {
|
|
201
|
+
const summary = {
|
|
202
|
+
allowedData: normalizeStringList([
|
|
203
|
+
...(policy.allowedDataClass ? [policy.allowedDataClass] : []),
|
|
204
|
+
...policy.allowedData,
|
|
205
|
+
]),
|
|
206
|
+
forbiddenInputs: normalizeStringList(policy.forbiddenInputs),
|
|
207
|
+
networkAllowed: policy.networkAllowed ?? null,
|
|
208
|
+
externalUploadAllowed: policy.externalUploadAllowed ?? null,
|
|
209
|
+
secretsAllowed: policy.secretsAllowed ?? null,
|
|
210
|
+
humanApprovalRequired: policy.humanApprovalRequired ?? null,
|
|
211
|
+
approvedNetworkDestinations: normalizeStringList(policy.approvedNetworkDestinations),
|
|
212
|
+
approvedUploadDestinations: normalizeStringList(policy.approvedUploadDestinations),
|
|
213
|
+
disallowedCommands: normalizeStringList(policy.disallowedCommands),
|
|
214
|
+
};
|
|
215
|
+
return {
|
|
216
|
+
fingerprint: `sha256:${createHash("sha256")
|
|
217
|
+
.update(JSON.stringify(summary))
|
|
218
|
+
.digest("hex")}`,
|
|
219
|
+
...summary,
|
|
220
|
+
};
|
|
221
|
+
}
|
|
222
|
+
function normalizeStringList(values) {
|
|
223
|
+
return [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort((left, right) => left.localeCompare(right));
|
|
224
|
+
}
|
|
225
|
+
function profileResolution(selectedSecurityProfile, chain) {
|
|
226
|
+
if (selectedSecurityProfile === undefined)
|
|
227
|
+
return "none";
|
|
228
|
+
if (chain.missingProfile !== undefined)
|
|
229
|
+
return "missing";
|
|
230
|
+
if (chain.cycle !== undefined)
|
|
231
|
+
return "cyclic";
|
|
232
|
+
return "resolved";
|
|
233
|
+
}
|
|
234
|
+
function policyFieldEvidenceList(artifact, policy) {
|
|
235
|
+
return [
|
|
236
|
+
"allowedData",
|
|
237
|
+
"forbiddenInputs",
|
|
238
|
+
"networkAllowed",
|
|
239
|
+
"externalUploadAllowed",
|
|
240
|
+
"secretsAllowed",
|
|
241
|
+
"humanApprovalRequired",
|
|
242
|
+
"securityProfile",
|
|
243
|
+
"approvedNetworkDestinations",
|
|
244
|
+
"approvedUploadDestinations",
|
|
245
|
+
]
|
|
246
|
+
.map((field) => policyFieldEvidence(artifact, policy, field))
|
|
247
|
+
.filter((evidence) => evidence !== undefined)
|
|
248
|
+
.sort((left, right) => {
|
|
249
|
+
const byStart = left.startLine - right.startLine;
|
|
250
|
+
if (byStart !== 0)
|
|
251
|
+
return byStart;
|
|
252
|
+
return left.snippet.localeCompare(right.snippet);
|
|
253
|
+
});
|
|
254
|
+
}
|
|
255
|
+
function policyFieldEvidence(artifact, policy, field) {
|
|
256
|
+
const startLine = policy.lineByField.get(field);
|
|
257
|
+
if (startLine === undefined)
|
|
258
|
+
return undefined;
|
|
259
|
+
const line = artifact.content.split(/\r?\n/)[startLine - 1] ?? "";
|
|
260
|
+
return {
|
|
261
|
+
path: artifact.path,
|
|
262
|
+
startLine,
|
|
263
|
+
endLine: startLine,
|
|
264
|
+
snippet: line.trim(),
|
|
265
|
+
};
|
|
266
|
+
}
|
|
159
267
|
function topCounts(counts, key) {
|
|
160
268
|
return [...counts.entries()]
|
|
161
269
|
.map(([name, count]) => ({ [key]: name, count }))
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"security-policy-inventory.js","sourceRoot":"","sources":["../src/security-policy-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;
|
|
1
|
+
{"version":3,"file":"security-policy-inventory.js","sourceRoot":"","sources":["../src/security-policy-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AA+E9B,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAe;IACnD,OAAO;IACP,SAAS;IACT,cAAc;IACd,OAAO;IACP,SAAS;IACT,WAAW;IACX,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,WAAW,GAA4B;IAC3C,OAAO;IACP,SAAS;IACT,cAAc;IACd,OAAO;IACP,SAAS;IACT,WAAW;IACX,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,aAAa;IACb,gBAAgB;IAChB,uBAAuB;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,iBAAiB;IACjB,iBAAiB;IACjB,6BAA6B;IAC7B,4BAA4B;CAC7B,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC,CAC9C,SAAqB,EACrB,MAAuB;IAEvB,MAAM,OAAO,GAAG,kCAAkC,EAAE,CAAC;IACrD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC;YAAE,SAAS;QAEhE,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvC,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,wBAAwB,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,4BAA4B,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,2BAA2B,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;QAED,kBAAkB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAClE,kBAAkB,CAChB,OAAO,CAAC,qBAAqB,EAC7B,MAAM,CAAC,qBAAqB,CAC7B,CAAC;QACF,kBAAkB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAClE,kBAAkB,CAChB,OAAO,CAAC,qBAAqB,EAC7B,MAAM,CAAC,qBAAqB,CAC7B,CAAC;QAEF,OAAO,CAAC,+BAA+B,IAAI,eAAe,CACxD,mBAAmB,EACnB,MAAM,CAAC,2BAA2B,CACnC,CAAC;QACF,OAAO,CAAC,8BAA8B,IAAI,eAAe,CACvD,kBAAkB,EAClB,MAAM,CAAC,0BAA0B,CAClC,CAAC;QACF,OAAO,CAAC,mBAAmB,IAAI,eAAe,CAC5C,eAAe,EACf,MAAM,CAAC,eAAe,CACvB,CAAC;QACF,OAAO,CAAC,sBAAsB,IAAI,aAAa,CAC7C,MAAM,CAAC,kBAAkB,CAC1B,CAAC,MAAM,CAAC;QAET,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjE,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAChD,mBAAmB,EACnB,aAAa,CACd,CAAC;IACF,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAC/C,kBAAkB,EAClB,aAAa,CACd,CAAC;IACF,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACpC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,SAAqB,EACrB,MAAuB;IAEvB,OAAO,SAAS;SACb,GAAG,CAAC,CAAC,QAAQ,EAA2C,EAAE;QACzD,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC;YAAE,OAAO,SAAS,CAAC;QAExE,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,oBAAoB,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,uBAAuB,GAAG,YAAY,CAAC,eAAe,CAAC;QAC7D,MAAM,+BAA+B,GAAG,mBAAmB,CACzD,QAAQ,EACR,YAAY,EACZ,iBAAiB,CAClB,CAAC;QACF,MAAM,GAAG,GAAgC;YACvC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,sBAAsB,EAAE,WAAW;YACnC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,iBAAiB,EAAE,iBAAiB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACpE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YACrD,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC;YACjD,QAAQ,EAAE;gBACR,GAAG,CAAC,+BAA+B;oBACjC,CAAC,CAAC,EAAE,uBAAuB,EAAE,+BAA+B,EAAE;oBAC9D,CAAC,CAAC,EAAE,CAAC;gBACP,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE,YAAY,CAAC;aAC9D;SACF,CAAC;QACF,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAsC,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC;SACtE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO;QACL,iBAAiB,EAAE,CAAC;QACpB,wBAAwB,EAAE,CAAC;QAC3B,2BAA2B,EAAE,CAAC;QAC9B,UAAU,EAAE,cAAc,EAAE;QAC5B,cAAc,EAAE,uBAAuB,EAAE;QACzC,qBAAqB,EAAE,uBAAuB,EAAE;QAChD,cAAc,EAAE,uBAAuB,EAAE;QACzC,qBAAqB,EAAE,uBAAuB,EAAE;QAChD,+BAA+B,EAAE,CAAC;QAClC,8BAA8B,EAAE,CAAC;QACjC,mBAAmB,EAAE,CAAC;QACtB,sBAAsB,EAAE,CAAC;QACzB,gBAAgB,EAAE;YAChB,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,EAAE;SACV;QACD,8BAA8B,EAAE,EAAE;QAClC,6BAA6B,EAAE,EAAE;QACjC,kBAAkB,EAAE,EAAE;QACtB,mBAAmB,EAAE,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAkB,EAClB,gBAAgB,GAAG,8BAA8B,CAC/C,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CACtC;IAED,OAAO,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAsB;IAEtB,OAAO,CAAC,GAAG,4BAA4B,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACtD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,QAAkB,EAClB,YAA4B,EAC5B,eAA+B;IAE/B,OAAO,CACL,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QACxB,QAAQ,CAAC,IAAI,KAAK,SAAS;QAC3B,QAAQ,CAAC,IAAI,KAAK,cAAc,CAAC;QACnC,yBAAyB,CAAC,eAAe,CAAC,KAAK,SAAS;QACxD,wBAAwB,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;QACtD,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAG7D,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,CAAC;QACR,WAAW,EAAE,CAAC;KACf,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA2B,EAC3B,KAA0B;IAE1B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IACnB,CAAC;SAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAA2B,EAC3B,MAAgB;IAEhB,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAuC,EACvC,YAAiC,EACjC,MAAsB,EACtB,MAAkC;IAElC,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,GAAG,CACd,MAAM,CAAC,eAAe,EACtB,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CACpD,CAAC;IAEF,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,gBAAgB,CAAC,QAAQ,IAAI,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAsB;IAEtB,MAAM,OAAO,GAAG;QACd,WAAW,EAAE,mBAAmB,CAAC;YAC/B,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,MAAM,CAAC,WAAW;SACtB,CAAC;QACF,eAAe,EAAE,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC;QAC5D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC7C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,IAAI,IAAI;QAC3D,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,IAAI;QAC7C,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,IAAI,IAAI;QAC3D,2BAA2B,EAAE,mBAAmB,CAC9C,MAAM,CAAC,2BAA2B,CACnC;QACD,0BAA0B,EAAE,mBAAmB,CAC7C,MAAM,CAAC,0BAA0B,CAClC;QACD,kBAAkB,EAAE,mBAAmB,CAAC,MAAM,CAAC,kBAAkB,CAAC;KACnE,CAAC;IACF,OAAO;QACL,WAAW,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC;aACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;aAC/B,MAAM,CAAC,KAAK,CAAC,EAAE;QAClB,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IAC3C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAC3E,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,uBAA2C,EAC3C,KAA8C;IAE9C,IAAI,uBAAuB,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAC9B,QAAkB,EAClB,MAAsB;IAEtB,OAAO;QACL,aAAa;QACb,iBAAiB;QACjB,gBAAgB;QAChB,uBAAuB;QACvB,gBAAgB;QAChB,uBAAuB;QACvB,iBAAiB;QACjB,6BAA6B;QAC7B,4BAA4B;KAC7B;SACE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;SAC5D,MAAM,CAAC,CAAC,QAAQ,EAAwB,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC;SAClE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACjD,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAkB,EAClB,MAAsB,EACtB,KAAa;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,SAAS;QACT,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,MAA2B,EAC3B,GAAQ;IAER,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzB,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAEtB,CACJ;SACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAChE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC"}
|
|
@@ -0,0 +1,59 @@
|
|
|
1
|
+
import type { Catalog } from "./model.js";
|
|
2
|
+
import type { SecurityPolicyAssetEvidence } from "./security-policy-inventory.js";
|
|
3
|
+
import type { Diagnostic, Evidence, Finding, RiskClass } from "./types.js";
|
|
4
|
+
export type TrustGraphSchemaVersion = "renma.trustGraph.v1";
|
|
5
|
+
export type TrustGraphNodeType = "asset" | "owner" | "lifecycle_status" | "security_profile" | "effective_policy" | "diagnostic";
|
|
6
|
+
export type TrustGraphEdgeType = "owned_by" | "has_lifecycle_status" | "declares_dependency" | "references" | "selects_security_profile" | "inherits_policy" | "has_effective_policy" | "has_diagnostic";
|
|
7
|
+
export type TrustGraphFindingSource = "finding" | "diagnostic";
|
|
8
|
+
export type TrustGraphFindingSeverity = Finding["severity"] | Diagnostic["severity"];
|
|
9
|
+
export interface TrustGraphSummary {
|
|
10
|
+
assetCount: number;
|
|
11
|
+
nodeCount: number;
|
|
12
|
+
edgeCount: number;
|
|
13
|
+
findingCount: number;
|
|
14
|
+
nodeTypeCounts: Record<TrustGraphNodeType, number>;
|
|
15
|
+
edgeTypeCounts: Record<TrustGraphEdgeType, number>;
|
|
16
|
+
findingSeverityCounts: Record<TrustGraphFindingSeverity, number>;
|
|
17
|
+
riskClassCounts: Record<RiskClass | "unclassified", number>;
|
|
18
|
+
}
|
|
19
|
+
export interface TrustGraphNode {
|
|
20
|
+
id: string;
|
|
21
|
+
type: TrustGraphNodeType;
|
|
22
|
+
label: string;
|
|
23
|
+
properties?: Record<string, unknown>;
|
|
24
|
+
evidence?: Evidence[];
|
|
25
|
+
}
|
|
26
|
+
export interface TrustGraphEdge {
|
|
27
|
+
id: string;
|
|
28
|
+
from: string;
|
|
29
|
+
to: string;
|
|
30
|
+
type: TrustGraphEdgeType;
|
|
31
|
+
properties?: Record<string, unknown>;
|
|
32
|
+
evidence?: Evidence[];
|
|
33
|
+
}
|
|
34
|
+
export interface TrustGraphFinding {
|
|
35
|
+
source: TrustGraphFindingSource;
|
|
36
|
+
severity: TrustGraphFindingSeverity;
|
|
37
|
+
message: string;
|
|
38
|
+
path?: string;
|
|
39
|
+
code?: string;
|
|
40
|
+
id?: string;
|
|
41
|
+
title?: string;
|
|
42
|
+
riskClass?: RiskClass;
|
|
43
|
+
evidence?: Evidence;
|
|
44
|
+
}
|
|
45
|
+
export interface TrustGraph {
|
|
46
|
+
schemaVersion: TrustGraphSchemaVersion;
|
|
47
|
+
summary: TrustGraphSummary;
|
|
48
|
+
nodes: TrustGraphNode[];
|
|
49
|
+
edges: TrustGraphEdge[];
|
|
50
|
+
findings: TrustGraphFinding[];
|
|
51
|
+
}
|
|
52
|
+
export interface TrustGraphInput {
|
|
53
|
+
catalog: Catalog;
|
|
54
|
+
findings?: Finding[];
|
|
55
|
+
diagnostics?: Diagnostic[];
|
|
56
|
+
securityPolicies?: SecurityPolicyAssetEvidence[];
|
|
57
|
+
}
|
|
58
|
+
export declare function buildTrustGraph(input: TrustGraphInput): TrustGraph;
|
|
59
|
+
//# sourceMappingURL=trust-graph.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"trust-graph.d.ts","sourceRoot":"","sources":["../src/trust-graph.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAS,OAAO,EAAc,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EAEV,2BAA2B,EAC5B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAE5D,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP,OAAO,GACP,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,YAAY,CAAC;AAEjB,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,sBAAsB,GACtB,qBAAqB,GACrB,YAAY,GACZ,0BAA0B,GAC1B,iBAAiB,GACjB,sBAAsB,GACtB,gBAAgB,CAAC;AAErB,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,YAAY,CAAC;AAC/D,MAAM,MAAM,yBAAyB,GACjC,OAAO,CAAC,UAAU,CAAC,GACnB,UAAU,CAAC,UAAU,CAAC,CAAC;AAE3B,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACnD,cAAc,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACnD,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;IACjE,eAAe,EAAE,MAAM,CAAC,SAAS,GAAG,cAAc,EAAE,MAAM,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,yBAAyB,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,uBAAuB,CAAC;IACvC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,2BAA2B,EAAE,CAAC;CAClD;AAuCD,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CA0FlE"}
|