renma 0.8.0 → 0.9.0

package/dist/security-policy.js

@@ -0,0 +1,269 @@
+const BOOLEAN_POLICY_FIELDS = new Map([
+    ["network_allowed", "networkAllowed"],
+    ["networkAllowed", "networkAllowed"],
+    ["external_upload_allowed", "externalUploadAllowed"],
+    ["externalUploadAllowed", "externalUploadAllowed"],
+    ["secrets_allowed", "secretsAllowed"],
+    ["secretsAllowed", "secretsAllowed"],
+    ["human_approval_required", "humanApprovalRequired"],
+    ["humanApprovalRequired", "humanApprovalRequired"],
+    ["requires_human_approval", "humanApprovalRequired"],
+    ["requiresHumanApproval", "humanApprovalRequired"],
+]);
+const DESTINATION_POLICY_FIELDS = new Set([
+    "approved_network_destinations",
+    "approvedNetworkDestinations",
+    "allowed_network_destinations",
+    "allowedNetworkDestinations",
+]);
+const UPLOAD_DESTINATION_POLICY_FIELDS = new Set([
+    "approved_upload_destinations",
+    "approvedUploadDestinations",
+    "approved_upload_domains",
+    "approvedUploadDomains",
+]);
+const ALLOWED_DATA_POLICY_FIELDS = new Set(["allowed_data", "allowedData"]);
+const FORBIDDEN_INPUT_POLICY_FIELDS = new Set([
+    "forbidden_inputs",
+    "forbiddenInputs",
+]);
+const SECURITY_PROFILE_POLICY_FIELDS = new Set([
+    "security_profile",
+    "securityProfile",
+]);
+const FUTURE_BLOCK_LIST_POLICY_FIELDS = new Set([
+    "allowed_tools",
+    "allowedTools",
+    "allowed_clients",
+    "allowedClients",
+]);
+export function parseSecurityPolicy(content) {
+    const policy = {
+        allowedData: [],
+        forbiddenInputs: [],
+        approvedNetworkDestinations: [],
+        approvedUploadDestinations: [],
+        disallowedCommands: [],
+        declared: new Set(),
+        lineByField: new Map(),
+    };
+    const lines = content.split(/\r?\n/);
+    const frontmatterEnd = lines[0]?.trim() === "---"
+        ? lines.findIndex((line, index) => index > 0 && line.trim() === "---")
+        : -1;
+    const scanEnd = frontmatterEnd > 0 ? frontmatterEnd : Math.min(lines.length, 80);
+    for (let index = 0; index < scanEnd; index += 1) {
+        const line = lines[index] ?? "";
+        const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*):\s*(.*?)\s*$/);
+        if (!match) {
+            continue;
+        }
+        const rawKey = match[1] ?? "";
+        const rawValue = match[2] ?? "";
+        const key = rawKey.trim();
+        const value = rawValue.trim();
+        const blockList = value.length === 0
+            ? parseBlockList(lines, index, scanEnd)
+            : { values: [], nextIndex: index + 1 };
+        const booleanField = BOOLEAN_POLICY_FIELDS.get(key);
+        if (booleanField !== undefined) {
+            const parsed = parseBoolean(value);
+            if (parsed !== undefined) {
+                policy[booleanField] = parsed;
+                policy.declared.add(booleanField);
+                policy.lineByField.set(booleanField, index + 1);
+            }
+            continue;
+        }
+        if (DESTINATION_POLICY_FIELDS.has(key)) {
+            const destinations = policyListValues(value, blockList);
+            policy.approvedNetworkDestinations.push(...destinations);
+            policy.declared.add("approvedNetworkDestinations");
+            policy.lineByField.set("approvedNetworkDestinations", index + 1);
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (UPLOAD_DESTINATION_POLICY_FIELDS.has(key)) {
+            const destinations = policyListValues(value, blockList);
+            policy.approvedUploadDestinations.push(...destinations);
+            policy.declared.add("approvedUploadDestinations");
+            policy.lineByField.set("approvedUploadDestinations", index + 1);
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (ALLOWED_DATA_POLICY_FIELDS.has(key)) {
+            const values = policyListValues(value, blockList);
+            policy.allowedData.push(...values);
+            policy.declared.add("allowedData");
+            policy.lineByField.set("allowedData", index + 1);
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (FORBIDDEN_INPUT_POLICY_FIELDS.has(key)) {
+            policy.forbiddenInputs.push(...policyListValues(value, blockList));
+            policy.declared.add("forbiddenInputs");
+            policy.lineByField.set("forbiddenInputs", index + 1);
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (FUTURE_BLOCK_LIST_POLICY_FIELDS.has(key)) {
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (SECURITY_PROFILE_POLICY_FIELDS.has(key)) {
+            policy.securityProfile = value;
+            policy.declared.add("securityProfile");
+            policy.lineByField.set("securityProfile", index + 1);
+        }
+    }
+    return policy;
+}
+export function applySecurityConfig(policy, config) {
+    if (config === undefined)
+        return policy;
+    const declared = new Set(policy.declared);
+    const lineByField = new Map(policy.lineByField);
+    const resolved = {
+        ...policy,
+        allowedData: [...policy.allowedData],
+        forbiddenInputs: [...policy.forbiddenInputs],
+        approvedNetworkDestinations: [...policy.approvedNetworkDestinations],
+        approvedUploadDestinations: [...policy.approvedUploadDestinations],
+        disallowedCommands: [...policy.disallowedCommands],
+        declared,
+        lineByField,
+    };
+    const chain = securityProfileChain(policy.securityProfile, config);
+    for (const item of chain.profiles) {
+        const profile = item.profile;
+        if (!declared.has("networkAllowed") &&
+            profile.networkAllowed !== undefined) {
+            resolved.networkAllowed = profile.networkAllowed;
+        }
+        if (!declared.has("externalUploadAllowed") &&
+            profile.externalUploadAllowed !== undefined) {
+            resolved.externalUploadAllowed = profile.externalUploadAllowed;
+        }
+        if (!declared.has("secretsAllowed") &&
+            profile.secretsAllowed !== undefined) {
+            resolved.secretsAllowed = profile.secretsAllowed;
+        }
+        if (!declared.has("humanApprovalRequired") &&
+            profile.humanApprovalRequired !== undefined) {
+            resolved.humanApprovalRequired = profile.humanApprovalRequired;
+        }
+        if (!declared.has("allowedData") &&
+            profile.allowedDataClass !== undefined) {
+            resolved.allowedDataClass = profile.allowedDataClass;
+        }
+        if (!declared.has("allowedData")) {
+            resolved.allowedData.push(...profile.allowedData);
+        }
+        if (!declared.has("forbiddenInputs")) {
+            resolved.forbiddenInputs.push(...profile.forbiddenInputs);
+        }
+        resolved.approvedNetworkDestinations.push(...profile.approvedDomains);
+        resolved.approvedUploadDestinations.push(...profile.approvedUploadDomains);
+        resolved.disallowedCommands.push(...profile.disallowedCommands);
+    }
+    resolved.approvedNetworkDestinations.push(...config.approvedDomains);
+    resolved.approvedUploadDestinations.push(...config.approvedUploadDomains);
+    resolved.disallowedCommands.push(...config.disallowedCommands);
+    resolved.allowedData = uniqueStrings(resolved.allowedData);
+    resolved.forbiddenInputs = uniqueStrings(resolved.forbiddenInputs);
+    resolved.approvedNetworkDestinations = uniqueStrings(resolved.approvedNetworkDestinations);
+    resolved.approvedUploadDestinations = uniqueStrings(resolved.approvedUploadDestinations);
+    resolved.disallowedCommands = uniqueStrings(resolved.disallowedCommands);
+    return resolved;
+}
+export function securityProfileChain(name, config) {
+    if (name === undefined)
+        return { profiles: [] };
+    if (config === undefined)
+        return { profiles: [], missingProfile: name };
+    const profiles = [];
+    const seen = new Set();
+    const path = [];
+    let current = name;
+    while (current !== undefined) {
+        if (seen.has(current)) {
+            return {
+                profiles: [],
+                cycle: [...path.slice(path.indexOf(current)), current],
+            };
+        }
+        seen.add(current);
+        path.push(current);
+        const profile = config.profiles?.[current];
+        if (profile === undefined) {
+            return { profiles: [], missingProfile: current };
+        }
+        profiles.push({ name: current, profile });
+        current = profile.securityProfile;
+    }
+    return { profiles: profiles.reverse() };
+}
+export function effectiveAllowedDataClass(policy) {
+    return policy.allowedDataClass ?? policy.allowedData[0];
+}
+export function effectiveAllowedDataList(policy) {
+    return policy.allowedData;
+}
+export function isSecurityPolicyLine(line) {
+    const key = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*):/)?.[1];
+    return (key !== undefined &&
+        (BOOLEAN_POLICY_FIELDS.has(key) ||
+            DESTINATION_POLICY_FIELDS.has(key) ||
+            UPLOAD_DESTINATION_POLICY_FIELDS.has(key) ||
+            ALLOWED_DATA_POLICY_FIELDS.has(key) ||
+            FORBIDDEN_INPUT_POLICY_FIELDS.has(key) ||
+            SECURITY_PROFILE_POLICY_FIELDS.has(key) ||
+            FUTURE_BLOCK_LIST_POLICY_FIELDS.has(key)));
+}
+function parseBlockList(lines, startIndex, scanEnd) {
+    const values = [];
+    let index = startIndex + 1;
+    for (; index < scanEnd; index += 1) {
+        const line = lines[index] ?? "";
+        if (line.trim().length === 0)
+            break;
+        const match = line.match(/^\s*-\s*(.*?)\s*$/);
+        if (!match)
+            break;
+        values.push(...parseList(match[1] ?? ""));
+    }
+    return { values, nextIndex: index };
+}
+function policyListValues(value, blockList) {
+    return value.length > 0 ? parseList(value) : blockList.values;
+}
+function consumesBlockList(value, blockList) {
+    return value.length === 0 && blockList.values.length > 0;
+}
+function uniqueStrings(values) {
+    return [...new Set(values)];
+}
+function parseBoolean(value) {
+    const normalized = value.toLowerCase();
+    if (["true", "yes", "allowed", "allow", "1"].includes(normalized)) {
+        return true;
+    }
+    if (["false", "no", "denied", "deny", "0"].includes(normalized)) {
+        return false;
+    }
+    return undefined;
+}
+function parseList(value) {
+    return value
+        .replace(/^\[/, "")
+        .replace(/\]$/, "")
+        .split(",")
+        .map((item) => item.trim().replace(/^["']|["']$/g, ""))
+        .filter((item) => item.length > 0);
+}
+//# sourceMappingURL=security-policy.js.map

package/dist/security-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.js","sourceRoot":"","sources":["../src/security-policy.ts"],"names":[],"mappings":"AA6BA,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAA+B;IAClE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IACrC,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IACpC,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;IACpD,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAClD,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IACrC,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IACpC,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;IACpD,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAClD,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;IACpD,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,+BAA+B;IAC/B,6BAA6B;IAC7B,8BAA8B;IAC9B,4BAA4B;CAC7B,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAC/C,8BAA8B;IAC9B,4BAA4B;IAC5B,yBAAyB;IACzB,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC5E,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,kBAAkB;IAClB,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC7C,kBAAkB;IAClB,iBAAiB;CAClB,CAAC,CAAC;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,gBAAgB;CACjB,CAAC,CAAC;AAOH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAmB;QAC7B,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,EAAE;QACnB,2BAA2B,EAAE,EAAE;QAC/B,0BAA0B,EAAE,EAAE;QAC9B,kBAAkB,EAAE,EAAE;QACtB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,WAAW,EAAE,IAAI,GAAG,EAAE;KACvB,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,cAAc,GAClB,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK;QACxB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;QACtE,CAAC,CAAC,CAAC,CAAC,CAAC;IACT,MAAM,OAAO,GACX,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEnE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,CAAC;YAChB,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QAE3C,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,YAAY,CAAyB,GAAG,MAAM,CAAC;gBACvD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAClC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YACzD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACnD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,gCAAgC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAClD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAChE,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAClD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACvC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACrD,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,+BAA+B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACvC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAsB,EACtB,MAAuB;IAEvB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAmB;QAC/B,GAAG,MAAM;QACT,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QAC5C,2BAA2B,EAAE,CAAC,GAAG,MAAM,CAAC,2BAA2B,CAAC;QACpE,0BAA0B,EAAE,CAAC,GAAG,MAAM,CAAC,0BAA0B,CAAC;QAClE,kBAAkB,EAAE,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAClD,QAAQ;QACR,WAAW;KACZ,CAAC;IAEF,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC/B,OAAO,CAAC,cAAc,KAAK,SAAS,EACpC,CAAC;YACD,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACnD,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtC,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAC3C,CAAC;YACD,QAAQ,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QACjE,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC/B,OAAO,CAAC,cAAc,KAAK,SAAS,EACpC,CAAC;YACD,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACnD,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtC,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAC3C,CAAC;YACD,QAAQ,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QACjE,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;YAC5B,OAAO,CAAC,gBAAgB,KAAK,SAAS,EACtC,CAAC;YACD,QAAQ,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5D,CAAC;QACD,QAAQ,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QACtE,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC3E,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IACrE,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC/D,QAAQ,CAAC,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,QAAQ,CAAC,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnE,QAAQ,CAAC,2BAA2B,GAAG,aAAa,CAClD,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IACF,QAAQ,CAAC,0BAA0B,GAAG,aAAa,CACjD,QAAQ,CAAC,0BAA0B,CACpC,CAAC;IACF,QAAQ,CAAC,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAEzE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAwB,EACxB,MAAkC;IAElC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAExE,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAuB,IAAI,CAAC;IAEvC,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC;aACvD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnB,MAAM,OAAO,GACX,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAsB;IAEtB,OAAO,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7B,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;YAClC,gCAAgC,CAAC,GAAG,CAAC,GAAG,CAAC;YACzC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;YACnC,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC;YACtC,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC;YACvC,+BAA+B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,KAAe,EACf,UAAkB,EAClB,OAAe;IAEf,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;IAC3B,OAAO,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM;QAElB,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,SAA0B;IACjE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,SAA0B;IAClE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/security-posture.d.ts

@@ -0,0 +1,35 @@
+import type { RiskClass, Severity } from "./types.js";
+export interface SecurityPostureSummary {
+    totalSecurityFindings: number;
+    riskClasses: {
+        violation: number;
+        suspicious: number;
+        advisory: number;
+        unclassified: number;
+    };
+    severities: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+    };
+    highOrCritical: number;
+    topFindingIds: Array<{
+        id: string;
+        count: number;
+        riskClass?: RiskClass | undefined;
+        maxSeverity: Severity;
+    }>;
+}
+export interface SecurityPostureFindingLike {
+    id: string;
+    severity: string;
+    riskClass?: string | undefined;
+}
+export declare function summarizeSecurityPosture(findings: SecurityPostureFindingLike[]): SecurityPostureSummary;
+export declare function isSecurityFinding(finding: SecurityPostureFindingLike): boolean;
+export declare function normalizeRiskClass(value: string | undefined): RiskClass | undefined;
+export declare function normalizeSeverity(value: string | undefined): Severity | undefined;
+export declare function compareSeverity(left: Severity, right: Severity): number;
+export declare function zeroSecurityPostureSummary(): SecurityPostureSummary;
+//# sourceMappingURL=security-posture.d.ts.map

package/dist/security-posture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-posture.d.ts","sourceRoot":"","sources":["../src/security-posture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAetD,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,KAAK,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;QAClC,WAAW,EAAE,QAAQ,CAAC;KACvB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AASD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,0BAA0B,EAAE,GACrC,sBAAsB,CAgExB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAKT;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,SAAS,GAAG,SAAS,CAKvB;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,QAAQ,GAAG,SAAS,CAUtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,CAEvE;AAED,wBAAgB,0BAA0B,IAAI,sBAAsB,CAkBnE"}

package/dist/security-posture.js

@@ -0,0 +1,108 @@
+const RISK_CLASS_ORDER = {
+    advisory: 1,
+    suspicious: 2,
+    violation: 3,
+};
+const SEVERITY_ORDER = {
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+export function summarizeSecurityPosture(findings) {
+    const summary = zeroSecurityPostureSummary();
+    const topFindings = new Map();
+    for (const finding of findings) {
+        if (!isSecurityFinding(finding))
+            continue;
+        const riskClass = normalizeRiskClass(finding.riskClass);
+        const severity = normalizeSeverity(finding.severity);
+        summary.totalSecurityFindings += 1;
+        if (riskClass === undefined) {
+            summary.riskClasses.unclassified += 1;
+        }
+        else {
+            summary.riskClasses[riskClass] += 1;
+        }
+        if (severity !== undefined) {
+            summary.severities[severity] += 1;
+        }
+        const topFinding = topFindings.get(finding.id) ?? {
+            id: finding.id,
+            count: 0,
+        };
+        topFinding.count += 1;
+        if (riskClass !== undefined &&
+            (topFinding.riskClass === undefined ||
+                RISK_CLASS_ORDER[riskClass] > RISK_CLASS_ORDER[topFinding.riskClass])) {
+            topFinding.riskClass = riskClass;
+        }
+        if (severity !== undefined &&
+            (topFinding.maxSeverity === undefined ||
+                compareSeverity(severity, topFinding.maxSeverity) > 0)) {
+            topFinding.maxSeverity = severity;
+        }
+        topFindings.set(finding.id, topFinding);
+    }
+    summary.highOrCritical =
+        summary.severities.high + summary.severities.critical;
+    summary.topFindingIds = [...topFindings.values()]
+        .map((finding) => ({
+        id: finding.id,
+        count: finding.count,
+        ...(finding.riskClass ? { riskClass: finding.riskClass } : {}),
+        maxSeverity: finding.maxSeverity ?? "low",
+    }))
+        .sort((left, right) => {
+        if (left.count !== right.count)
+            return right.count - left.count;
+        const severityComparison = compareSeverity(right.maxSeverity, left.maxSeverity);
+        if (severityComparison !== 0)
+            return severityComparison;
+        return left.id.localeCompare(right.id);
+    })
+        .slice(0, 10);
+    return summary;
+}
+export function isSecurityFinding(finding) {
+    return (finding.id.startsWith("SEC-") ||
+        normalizeRiskClass(finding.riskClass) !== undefined);
+}
+export function normalizeRiskClass(value) {
+    if (value === "violation" || value === "suspicious" || value === "advisory") {
+        return value;
+    }
+    return undefined;
+}
+export function normalizeSeverity(value) {
+    if (value === "critical" ||
+        value === "high" ||
+        value === "medium" ||
+        value === "low") {
+        return value;
+    }
+    return undefined;
+}
+export function compareSeverity(left, right) {
+    return SEVERITY_ORDER[left] - SEVERITY_ORDER[right];
+}
+export function zeroSecurityPostureSummary() {
+    return {
+        totalSecurityFindings: 0,
+        riskClasses: {
+            violation: 0,
+            suspicious: 0,
+            advisory: 0,
+            unclassified: 0,
+        },
+        severities: {
+            critical: 0,
+            high: 0,
+            medium: 0,
+            low: 0,
+        },
+        highOrCritical: 0,
+        topFindingIds: [],
+    };
+}
+//# sourceMappingURL=security-posture.js.map

package/dist/security-posture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-posture.js","sourceRoot":"","sources":["../src/security-posture.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAA8B;IAClD,QAAQ,EAAE,CAAC;IACX,UAAU,EAAE,CAAC;IACb,SAAS,EAAE,CAAC;CACb,CAAC;AAEF,MAAM,cAAc,GAA6B;IAC/C,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAsCF,MAAM,UAAU,wBAAwB,CACtC,QAAsC;IAEtC,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE7D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,SAAS;QAE1C,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAErD,OAAO,CAAC,qBAAqB,IAAI,CAAC,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,WAAW,CAAC,YAAY,IAAI,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI;YAChD,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,CAAC;SACT,CAAC;QACF,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC;QACtB,IACE,SAAS,KAAK,SAAS;YACvB,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;gBACjC,gBAAgB,CAAC,SAAS,CAAC,GAAG,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EACvE,CAAC;YACD,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;QACnC,CAAC;QACD,IACE,QAAQ,KAAK,SAAS;YACtB,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS;gBACnC,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EACxD,CAAC;YACD,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC;QACpC,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,cAAc;QACpB,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;IACxD,OAAO,CAAC,aAAa,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC;SAC9C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACjB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;KAC1C,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAChE,MAAM,kBAAkB,GAAG,eAAe,CACxC,KAAK,CAAC,WAAW,EACjB,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,IAAI,kBAAkB,KAAK,CAAC;YAAE,OAAO,kBAAkB,CAAC;QACxD,OAAO,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAmC;IAEnC,OAAO,CACL,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,SAAS,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAyB;IAEzB,IACE,KAAK,KAAK,UAAU;QACpB,KAAK,KAAK,MAAM;QAChB,KAAK,KAAK,QAAQ;QAClB,KAAK,KAAK,KAAK,EACf,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,KAAe;IAC7D,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,qBAAqB,EAAE,CAAC;QACxB,WAAW,EAAE;YACX,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;YACX,YAAY,EAAE,CAAC;SAChB;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,GAAG,EAAE,CAAC;SACP;QACD,cAAc,EAAE,CAAC;QACjB,aAAa,EAAE,EAAE;KAClB,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -1,3 +1,4 @@
+import type { SecurityPolicyInventorySummary } from "./security-policy-inventory.js";
 /** Finding severity used for scan reports and failure thresholds. */
 export type Severity = "low" | "medium" | "high" | "critical";
 /** Security review taxonomy for static scan findings. */
@@ -143,6 +144,7 @@ export interface ScanResult {
     configPath?: string;
     scannedFileCount: number;
     format: "text" | "json";
+    securityPolicyInventory?: SecurityPolicyInventorySummary;
     findings: Finding[];
     diagnostics: Diagnostic[];
     exitThreshold: Severity;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE9D,yDAAyD;AACzD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,CAAC;AAEhE,iEAAiE;AACjE,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,OAAO,GACP,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,CAAC;IAC7D,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,+CAA+C;AAC/C,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,GAAG,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AAE9E,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sDAAsD;AACtD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sDAAsD;AACtD,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAE9C,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACtD,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,aAAa,EAAE,QAAQ,CAAC;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAErF,qEAAqE;AACrE,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE9D,yDAAyD;AACzD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,UAAU,CAAC;AAEhE,iEAAiE;AACjE,MAAM,MAAM,YAAY,GACpB,OAAO,GACP,OAAO,GACP,SAAS,GACT,SAAS,GACT,WAAW,GACX,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,6DAA6D;AAC7D,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,WAAW,GAAG,aAAa,CAAC;IAC7D,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACtC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,EAAE,QAAQ,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,+CAA+C;AAC/C,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,GAAG,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AAE9E,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,sDAAsD;AACtD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,YAAY,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sDAAsD;AACtD,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,EAAE,CAAC;AAE9C,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACtD,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;CAC5D;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,8BAA8B,CAAC;IACzD,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,aAAa,EAAE,QAAQ,CAAC;CACzB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "renma",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Manage human-curated context assets for LLMs and agents in Git.",
   "license": "MIT",
   "repository": {