renma 0.8.1 → 0.10.0

package/dist/security-policy-inventory.d.ts

@@ -0,0 +1,55 @@
+import { type SecurityPolicy } from "./security-policy.js";
+import type { Artifact, ArtifactKind, SecurityConfig } from "./types.js";
+type InventoryArtifactKind = ArtifactKind;
+export interface PolicyBooleanCounts {
+    true: number;
+    false: number;
+    unspecified: number;
+}
+export interface SecurityPolicyInventorySummary {
+    totalPolicyAssets: number;
+    assetsWithPolicyMetadata: number;
+    assetsMissingPolicyMetadata: number;
+    assetKinds: Record<InventoryArtifactKind, number>;
+    networkAllowed: PolicyBooleanCounts;
+    externalUploadAllowed: PolicyBooleanCounts;
+    secretsAllowed: PolicyBooleanCounts;
+    humanApprovalRequired: PolicyBooleanCounts;
+    approvedNetworkDestinationCount: number;
+    approvedUploadDestinationCount: number;
+    forbiddenInputCount: number;
+    disallowedCommandCount: number;
+    securityProfiles: {
+        referenced: number;
+        resolved: number;
+        missing: number;
+        cyclic: number;
+        none: number;
+        names: Array<{
+            name: string;
+            count: number;
+        }>;
+    };
+    topApprovedNetworkDestinations: Array<{
+        destination: string;
+        count: number;
+    }>;
+    topApprovedUploadDestinations: Array<{
+        destination: string;
+        count: number;
+    }>;
+    topForbiddenInputs: Array<{
+        input: string;
+        count: number;
+    }>;
+    missingPolicyAssets: Array<{
+        path: string;
+        kind: ArtifactKind;
+    }>;
+}
+export declare function summarizeSecurityPolicyInventory(artifacts: Artifact[], config?: SecurityConfig): SecurityPolicyInventorySummary;
+export declare function zeroSecurityPolicyInventorySummary(): SecurityPolicyInventorySummary;
+export declare function isPolicyInventoryArtifact(artifact: Artifact, hasLocalMetadata?: boolean): boolean;
+export declare function hasLocalSecurityPolicyMetadata(policy: SecurityPolicy): boolean;
+export {};
+//# sourceMappingURL=security-policy-inventory.d.ts.map

package/dist/security-policy-inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-inventory.d.ts","sourceRoot":"","sources":["../src/security-policy-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzE,KAAK,qBAAqB,GAAG,YAAY,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,wBAAwB,EAAE,MAAM,CAAC;IACjC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAClD,cAAc,EAAE,mBAAmB,CAAC;IACpC,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C,cAAc,EAAE,mBAAmB,CAAC;IACpC,qBAAqB,EAAE,mBAAmB,CAAC;IAC3C,+BAA+B,EAAE,MAAM,CAAC;IACxC,8BAA8B,EAAE,MAAM,CAAC;IACvC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC/C,CAAC;IACF,8BAA8B,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,6BAA6B,EAAE,KAAK,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,kBAAkB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5D,mBAAmB,EAAE,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,YAAY,CAAC;KACpB,CAAC,CAAC;CACJ;AAmCD,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,QAAQ,EAAE,EACrB,MAAM,CAAC,EAAE,cAAc,GACtB,8BAA8B,CAwEhC;AAED,wBAAgB,kCAAkC,IAAI,8BAA8B,CA2BnF;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,QAAQ,EAClB,gBAAgB,UAEf,GACA,OAAO,CAET;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,cAAc,GACrB,OAAO,CAIT"}

package/dist/security-policy-inventory.js

@@ -0,0 +1,172 @@
+import { applySecurityConfig, effectiveAllowedDataClass, effectiveAllowedDataList, parseSecurityPolicy, securityProfileChain, } from "./security-policy.js";
+const POLICY_INVENTORY_KINDS = new Set([
+    "skill",
+    "context",
+    "agent",
+    "profile",
+    "reference",
+    "example",
+    "config",
+]);
+const ASSET_KINDS = [
+    "skill",
+    "context",
+    "agent",
+    "profile",
+    "reference",
+    "example",
+    "config",
+    "unknown",
+];
+const LOCAL_POLICY_METADATA_FIELDS = new Set([
+    "allowedData",
+    "networkAllowed",
+    "externalUploadAllowed",
+    "secretsAllowed",
+    "humanApprovalRequired",
+    "securityProfile",
+    "forbiddenInputs",
+    "approvedNetworkDestinations",
+    "approvedUploadDestinations",
+]);
+export function summarizeSecurityPolicyInventory(artifacts, config) {
+    const summary = zeroSecurityPolicyInventorySummary();
+    const networkDestinations = new Map();
+    const uploadDestinations = new Map();
+    const forbiddenInputs = new Map();
+    const profileNames = new Map();
+    for (const artifact of artifacts) {
+        const parsedPolicy = parseSecurityPolicy(artifact.content);
+        const hasMetadata = hasLocalSecurityPolicyMetadata(parsedPolicy);
+        if (!isPolicyInventoryArtifact(artifact, hasMetadata))
+            continue;
+        const policy = applySecurityConfig(parsedPolicy, config);
+        summary.totalPolicyAssets += 1;
+        summary.assetKinds[artifact.kind] += 1;
+        if (hasMetadata) {
+            summary.assetsWithPolicyMetadata += 1;
+        }
+        if (isMissingPolicyMetadataAsset(artifact, parsedPolicy, policy)) {
+            summary.assetsMissingPolicyMetadata += 1;
+            summary.missingPolicyAssets.push({
+                path: artifact.path,
+                kind: artifact.kind,
+            });
+        }
+        countPolicyBoolean(summary.networkAllowed, policy.networkAllowed);
+        countPolicyBoolean(summary.externalUploadAllowed, policy.externalUploadAllowed);
+        countPolicyBoolean(summary.secretsAllowed, policy.secretsAllowed);
+        countPolicyBoolean(summary.humanApprovalRequired, policy.humanApprovalRequired);
+        summary.approvedNetworkDestinationCount += addUniqueCounts(networkDestinations, policy.approvedNetworkDestinations);
+        summary.approvedUploadDestinationCount += addUniqueCounts(uploadDestinations, policy.approvedUploadDestinations);
+        summary.forbiddenInputCount += addUniqueCounts(forbiddenInputs, policy.forbiddenInputs);
+        summary.disallowedCommandCount += uniqueStrings(policy.disallowedCommands).length;
+        countSecurityProfile(summary, profileNames, parsedPolicy, config);
+    }
+    summary.securityProfiles.names = topCounts(profileNames, "name");
+    summary.topApprovedNetworkDestinations = topCounts(networkDestinations, "destination");
+    summary.topApprovedUploadDestinations = topCounts(uploadDestinations, "destination");
+    summary.topForbiddenInputs = topCounts(forbiddenInputs, "input");
+    summary.missingPolicyAssets.sort((left, right) => left.path.localeCompare(right.path));
+    return summary;
+}
+export function zeroSecurityPolicyInventorySummary() {
+    return {
+        totalPolicyAssets: 0,
+        assetsWithPolicyMetadata: 0,
+        assetsMissingPolicyMetadata: 0,
+        assetKinds: zeroAssetKinds(),
+        networkAllowed: zeroPolicyBooleanCounts(),
+        externalUploadAllowed: zeroPolicyBooleanCounts(),
+        secretsAllowed: zeroPolicyBooleanCounts(),
+        humanApprovalRequired: zeroPolicyBooleanCounts(),
+        approvedNetworkDestinationCount: 0,
+        approvedUploadDestinationCount: 0,
+        forbiddenInputCount: 0,
+        disallowedCommandCount: 0,
+        securityProfiles: {
+            referenced: 0,
+            resolved: 0,
+            missing: 0,
+            cyclic: 0,
+            none: 0,
+            names: [],
+        },
+        topApprovedNetworkDestinations: [],
+        topApprovedUploadDestinations: [],
+        topForbiddenInputs: [],
+        missingPolicyAssets: [],
+    };
+}
+export function isPolicyInventoryArtifact(artifact, hasLocalMetadata = hasLocalSecurityPolicyMetadata(parseSecurityPolicy(artifact.content))) {
+    return POLICY_INVENTORY_KINDS.has(artifact.kind) || hasLocalMetadata;
+}
+export function hasLocalSecurityPolicyMetadata(policy) {
+    return [...LOCAL_POLICY_METADATA_FIELDS].some((field) => policy.declared.has(field));
+}
+function isMissingPolicyMetadataAsset(artifact, parsedPolicy, effectivePolicy) {
+    return ((artifact.kind === "skill" || artifact.kind === "context") &&
+        effectiveAllowedDataClass(effectivePolicy) === undefined &&
+        effectiveAllowedDataList(effectivePolicy).length === 0 &&
+        !hasLocalSecurityPolicyMetadata(parsedPolicy));
+}
+function zeroAssetKinds() {
+    return Object.fromEntries(ASSET_KINDS.map((kind) => [kind, 0]));
+}
+function zeroPolicyBooleanCounts() {
+    return {
+        true: 0,
+        false: 0,
+        unspecified: 0,
+    };
+}
+function countPolicyBoolean(counts, value) {
+    if (value === true) {
+        counts.true += 1;
+    }
+    else if (value === false) {
+        counts.false += 1;
+    }
+    else {
+        counts.unspecified += 1;
+    }
+}
+function addUniqueCounts(counts, values) {
+    const uniqueValues = uniqueStrings(values);
+    for (const value of uniqueValues) {
+        counts.set(value, (counts.get(value) ?? 0) + 1);
+    }
+    return uniqueValues.length;
+}
+function countSecurityProfile(summary, profileNames, policy, config) {
+    if (policy.securityProfile === undefined) {
+        summary.securityProfiles.none += 1;
+        return;
+    }
+    summary.securityProfiles.referenced += 1;
+    profileNames.set(policy.securityProfile, (profileNames.get(policy.securityProfile) ?? 0) + 1);
+    const chain = securityProfileChain(policy.securityProfile, config);
+    if (chain.missingProfile !== undefined) {
+        summary.securityProfiles.missing += 1;
+    }
+    else if (chain.cycle !== undefined) {
+        summary.securityProfiles.cyclic += 1;
+    }
+    else {
+        summary.securityProfiles.resolved += 1;
+    }
+}
+function topCounts(counts, key) {
+    return [...counts.entries()]
+        .map(([name, count]) => ({ [key]: name, count }))
+        .sort((left, right) => {
+        if (left.count !== right.count)
+            return right.count - left.count;
+        return left[key].localeCompare(right[key]);
+    })
+        .slice(0, 10);
+}
+function uniqueStrings(values) {
+    return [...new Set(values)];
+}
+//# sourceMappingURL=security-policy-inventory.js.map

package/dist/security-policy-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy-inventory.js","sourceRoot":"","sources":["../src/security-policy-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAyC9B,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAe;IACnD,OAAO;IACP,SAAS;IACT,OAAO;IACP,SAAS;IACT,WAAW;IACX,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,WAAW,GAA4B;IAC3C,OAAO;IACP,SAAS;IACT,OAAO;IACP,SAAS;IACT,WAAW;IACX,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC;AAEF,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,aAAa;IACb,gBAAgB;IAChB,uBAAuB;IACvB,gBAAgB;IAChB,uBAAuB;IACvB,iBAAiB;IACjB,iBAAiB;IACjB,6BAA6B;IAC7B,4BAA4B;CAC7B,CAAC,CAAC;AAEH,MAAM,UAAU,gCAAgC,CAC9C,SAAqB,EACrB,MAAuB;IAEvB,MAAM,OAAO,GAAG,kCAAkC,EAAE,CAAC;IACrD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,8BAA8B,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC;YAAE,SAAS;QAEhE,MAAM,MAAM,GAAG,mBAAmB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvC,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,wBAAwB,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,4BAA4B,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,2BAA2B,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;QAED,kBAAkB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAClE,kBAAkB,CAChB,OAAO,CAAC,qBAAqB,EAC7B,MAAM,CAAC,qBAAqB,CAC7B,CAAC;QACF,kBAAkB,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAClE,kBAAkB,CAChB,OAAO,CAAC,qBAAqB,EAC7B,MAAM,CAAC,qBAAqB,CAC7B,CAAC;QAEF,OAAO,CAAC,+BAA+B,IAAI,eAAe,CACxD,mBAAmB,EACnB,MAAM,CAAC,2BAA2B,CACnC,CAAC;QACF,OAAO,CAAC,8BAA8B,IAAI,eAAe,CACvD,kBAAkB,EAClB,MAAM,CAAC,0BAA0B,CAClC,CAAC;QACF,OAAO,CAAC,mBAAmB,IAAI,eAAe,CAC5C,eAAe,EACf,MAAM,CAAC,eAAe,CACvB,CAAC;QACF,OAAO,CAAC,sBAAsB,IAAI,aAAa,CAC7C,MAAM,CAAC,kBAAkB,CAC1B,CAAC,MAAM,CAAC;QAET,oBAAoB,CAAC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACjE,OAAO,CAAC,8BAA8B,GAAG,SAAS,CAChD,mBAAmB,EACnB,aAAa,CACd,CAAC;IACF,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAC/C,kBAAkB,EAClB,aAAa,CACd,CAAC;IACF,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC/C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACpC,CAAC;IAEF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO;QACL,iBAAiB,EAAE,CAAC;QACpB,wBAAwB,EAAE,CAAC;QAC3B,2BAA2B,EAAE,CAAC;QAC9B,UAAU,EAAE,cAAc,EAAE;QAC5B,cAAc,EAAE,uBAAuB,EAAE;QACzC,qBAAqB,EAAE,uBAAuB,EAAE;QAChD,cAAc,EAAE,uBAAuB,EAAE;QACzC,qBAAqB,EAAE,uBAAuB,EAAE;QAChD,+BAA+B,EAAE,CAAC;QAClC,8BAA8B,EAAE,CAAC;QACjC,mBAAmB,EAAE,CAAC;QACtB,sBAAsB,EAAE,CAAC;QACzB,gBAAgB,EAAE;YAChB,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,EAAE;SACV;QACD,8BAA8B,EAAE,EAAE;QAClC,6BAA6B,EAAE,EAAE;QACjC,kBAAkB,EAAE,EAAE;QACtB,mBAAmB,EAAE,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAkB,EAClB,gBAAgB,GAAG,8BAA8B,CAC/C,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CACtC;IAED,OAAO,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAsB;IAEtB,OAAO,CAAC,GAAG,4BAA4B,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACtD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CACnC,QAAkB,EAClB,YAA4B,EAC5B,eAA+B;IAE/B,OAAO,CACL,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC;QAC1D,yBAAyB,CAAC,eAAe,CAAC,KAAK,SAAS;QACxD,wBAAwB,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;QACtD,CAAC,8BAA8B,CAAC,YAAY,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAG7D,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL,IAAI,EAAE,CAAC;QACP,KAAK,EAAE,CAAC;QACR,WAAW,EAAE,CAAC;KACf,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAA2B,EAC3B,KAA0B;IAE1B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IACnB,CAAC;SAAM,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAA2B,EAC3B,MAAgB;IAEhB,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC;AAC7B,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAuC,EACvC,YAAiC,EACjC,MAAsB,EACtB,MAAkC;IAElC,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,CAAC;IACzC,YAAY,CAAC,GAAG,CACd,MAAM,CAAC,eAAe,EACtB,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CACpD,CAAC;IAEF,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,CAAC,gBAAgB,CAAC,OAAO,IAAI,CAAC,CAAC;IACxC,CAAC;SAAM,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,gBAAgB,CAAC,MAAM,IAAI,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,gBAAgB,CAAC,QAAQ,IAAI,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,MAA2B,EAC3B,GAAQ;IAER,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzB,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAEtB,CACJ;SACA,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAChE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/dist/security-policy.d.ts

@@ -0,0 +1,32 @@
+import type { SecurityConfig } from "./types.js";
+export interface SecurityPolicy {
+    networkAllowed?: boolean;
+    externalUploadAllowed?: boolean;
+    secretsAllowed?: boolean;
+    humanApprovalRequired?: boolean;
+    securityProfile?: string;
+    allowedDataClass?: string;
+    allowedData: string[];
+    forbiddenInputs: string[];
+    approvedNetworkDestinations: string[];
+    approvedUploadDestinations: string[];
+    disallowedCommands: string[];
+    declared: Set<string>;
+    lineByField: Map<string, number>;
+}
+export interface SecurityProfileChainItem {
+    name: string;
+    profile: NonNullable<SecurityConfig["profiles"]>[string];
+}
+export interface SecurityProfileChain {
+    profiles: SecurityProfileChainItem[];
+    missingProfile?: string;
+    cycle?: string[];
+}
+export declare function parseSecurityPolicy(content: string): SecurityPolicy;
+export declare function applySecurityConfig(policy: SecurityPolicy, config?: SecurityConfig): SecurityPolicy;
+export declare function securityProfileChain(name: string | undefined, config: SecurityConfig | undefined): SecurityProfileChain;
+export declare function effectiveAllowedDataClass(policy: SecurityPolicy): string | undefined;
+export declare function effectiveAllowedDataList(policy: SecurityPolicy): string[];
+export declare function isSecurityPolicyLine(line: string): boolean;
+//# sourceMappingURL=security-policy.d.ts.map

package/dist/security-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.d.ts","sourceRoot":"","sources":["../src/security-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,wBAAwB,EAAE,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAuBD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAyFnE;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,cAAc,EACtB,MAAM,CAAC,EAAE,cAAc,GACtB,cAAc,CA0EhB;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,cAAc,GAAG,SAAS,GACjC,oBAAoB,CA6BtB;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GACrB,MAAM,GAAG,SAAS,CAEpB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,EAAE,CAEzE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW1D"}

package/dist/security-policy.js

@@ -0,0 +1,237 @@
+const BOOLEAN_POLICY_FIELDS = new Map([
+    ["network_allowed", "networkAllowed"],
+    ["external_upload_allowed", "externalUploadAllowed"],
+    ["secrets_allowed", "secretsAllowed"],
+    ["requires_human_approval", "humanApprovalRequired"],
+]);
+const DESTINATION_POLICY_FIELDS = new Set(["approved_network_destinations"]);
+const UPLOAD_DESTINATION_POLICY_FIELDS = new Set([
+    "approved_upload_destinations",
+]);
+const ALLOWED_DATA_POLICY_FIELDS = new Set(["allowed_data"]);
+const FORBIDDEN_INPUT_POLICY_FIELDS = new Set(["forbidden_inputs"]);
+const SECURITY_PROFILE_POLICY_FIELDS = new Set(["security_profile"]);
+export function parseSecurityPolicy(content) {
+    const policy = {
+        allowedData: [],
+        forbiddenInputs: [],
+        approvedNetworkDestinations: [],
+        approvedUploadDestinations: [],
+        disallowedCommands: [],
+        declared: new Set(),
+        lineByField: new Map(),
+    };
+    const lines = content.split(/\r?\n/);
+    const frontmatterEnd = lines[0]?.trim() === "---"
+        ? lines.findIndex((line, index) => index > 0 && line.trim() === "---")
+        : -1;
+    const scanEnd = frontmatterEnd > 0 ? frontmatterEnd : Math.min(lines.length, 80);
+    for (let index = 0; index < scanEnd; index += 1) {
+        const line = lines[index] ?? "";
+        const match = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*):\s*(.*?)\s*$/);
+        if (!match) {
+            continue;
+        }
+        const rawKey = match[1] ?? "";
+        const rawValue = match[2] ?? "";
+        const key = rawKey.trim();
+        const value = rawValue.trim();
+        const blockList = value.length === 0
+            ? parseBlockList(lines, index, scanEnd)
+            : { values: [], nextIndex: index + 1 };
+        const booleanField = BOOLEAN_POLICY_FIELDS.get(key);
+        if (booleanField !== undefined) {
+            const parsed = parseBoolean(value);
+            if (parsed !== undefined) {
+                policy[booleanField] = parsed;
+                policy.declared.add(booleanField);
+                policy.lineByField.set(booleanField, index + 1);
+            }
+            continue;
+        }
+        if (DESTINATION_POLICY_FIELDS.has(key)) {
+            const destinations = policyListValues(value, blockList);
+            policy.approvedNetworkDestinations.push(...destinations);
+            policy.declared.add("approvedNetworkDestinations");
+            policy.lineByField.set("approvedNetworkDestinations", index + 1);
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (UPLOAD_DESTINATION_POLICY_FIELDS.has(key)) {
+            const destinations = policyListValues(value, blockList);
+            policy.approvedUploadDestinations.push(...destinations);
+            policy.declared.add("approvedUploadDestinations");
+            policy.lineByField.set("approvedUploadDestinations", index + 1);
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (ALLOWED_DATA_POLICY_FIELDS.has(key)) {
+            const values = policyListValues(value, blockList);
+            policy.allowedData.push(...values);
+            policy.declared.add("allowedData");
+            policy.lineByField.set("allowedData", index + 1);
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (FORBIDDEN_INPUT_POLICY_FIELDS.has(key)) {
+            policy.forbiddenInputs.push(...policyListValues(value, blockList));
+            policy.declared.add("forbiddenInputs");
+            policy.lineByField.set("forbiddenInputs", index + 1);
+            if (consumesBlockList(value, blockList))
+                index = blockList.nextIndex - 1;
+            continue;
+        }
+        if (SECURITY_PROFILE_POLICY_FIELDS.has(key)) {
+            policy.securityProfile = value;
+            policy.declared.add("securityProfile");
+            policy.lineByField.set("securityProfile", index + 1);
+        }
+    }
+    return policy;
+}
+export function applySecurityConfig(policy, config) {
+    if (config === undefined)
+        return policy;
+    const declared = new Set(policy.declared);
+    const lineByField = new Map(policy.lineByField);
+    const resolved = {
+        ...policy,
+        allowedData: [...policy.allowedData],
+        forbiddenInputs: [...policy.forbiddenInputs],
+        approvedNetworkDestinations: [...policy.approvedNetworkDestinations],
+        approvedUploadDestinations: [...policy.approvedUploadDestinations],
+        disallowedCommands: [...policy.disallowedCommands],
+        declared,
+        lineByField,
+    };
+    const chain = securityProfileChain(policy.securityProfile, config);
+    for (const item of chain.profiles) {
+        const profile = item.profile;
+        if (!declared.has("networkAllowed") &&
+            profile.networkAllowed !== undefined) {
+            resolved.networkAllowed = profile.networkAllowed;
+        }
+        if (!declared.has("externalUploadAllowed") &&
+            profile.externalUploadAllowed !== undefined) {
+            resolved.externalUploadAllowed = profile.externalUploadAllowed;
+        }
+        if (!declared.has("secretsAllowed") &&
+            profile.secretsAllowed !== undefined) {
+            resolved.secretsAllowed = profile.secretsAllowed;
+        }
+        if (!declared.has("humanApprovalRequired") &&
+            profile.humanApprovalRequired !== undefined) {
+            resolved.humanApprovalRequired = profile.humanApprovalRequired;
+        }
+        if (!declared.has("allowedData") &&
+            profile.allowedDataClass !== undefined) {
+            resolved.allowedDataClass = profile.allowedDataClass;
+        }
+        if (!declared.has("allowedData")) {
+            resolved.allowedData.push(...profile.allowedData);
+        }
+        if (!declared.has("forbiddenInputs")) {
+            resolved.forbiddenInputs.push(...profile.forbiddenInputs);
+        }
+        resolved.approvedNetworkDestinations.push(...profile.approvedDomains);
+        resolved.approvedUploadDestinations.push(...profile.approvedUploadDomains);
+        resolved.disallowedCommands.push(...profile.disallowedCommands);
+    }
+    resolved.approvedNetworkDestinations.push(...config.approvedDomains);
+    resolved.approvedUploadDestinations.push(...config.approvedUploadDomains);
+    resolved.disallowedCommands.push(...config.disallowedCommands);
+    resolved.allowedData = uniqueStrings(resolved.allowedData);
+    resolved.forbiddenInputs = uniqueStrings(resolved.forbiddenInputs);
+    resolved.approvedNetworkDestinations = uniqueStrings(resolved.approvedNetworkDestinations);
+    resolved.approvedUploadDestinations = uniqueStrings(resolved.approvedUploadDestinations);
+    resolved.disallowedCommands = uniqueStrings(resolved.disallowedCommands);
+    return resolved;
+}
+export function securityProfileChain(name, config) {
+    if (name === undefined)
+        return { profiles: [] };
+    if (config === undefined)
+        return { profiles: [], missingProfile: name };
+    const profiles = [];
+    const seen = new Set();
+    const path = [];
+    let current = name;
+    while (current !== undefined) {
+        if (seen.has(current)) {
+            return {
+                profiles: [],
+                cycle: [...path.slice(path.indexOf(current)), current],
+            };
+        }
+        seen.add(current);
+        path.push(current);
+        const profile = config.profiles?.[current];
+        if (profile === undefined) {
+            return { profiles: [], missingProfile: current };
+        }
+        profiles.push({ name: current, profile });
+        current = profile.securityProfile;
+    }
+    return { profiles: profiles.reverse() };
+}
+export function effectiveAllowedDataClass(policy) {
+    return policy.allowedDataClass ?? policy.allowedData[0];
+}
+export function effectiveAllowedDataList(policy) {
+    return policy.allowedData;
+}
+export function isSecurityPolicyLine(line) {
+    const key = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*):/)?.[1];
+    return (key !== undefined &&
+        (BOOLEAN_POLICY_FIELDS.has(key) ||
+            DESTINATION_POLICY_FIELDS.has(key) ||
+            UPLOAD_DESTINATION_POLICY_FIELDS.has(key) ||
+            ALLOWED_DATA_POLICY_FIELDS.has(key) ||
+            FORBIDDEN_INPUT_POLICY_FIELDS.has(key) ||
+            SECURITY_PROFILE_POLICY_FIELDS.has(key)));
+}
+function parseBlockList(lines, startIndex, scanEnd) {
+    const values = [];
+    let index = startIndex + 1;
+    for (; index < scanEnd; index += 1) {
+        const line = lines[index] ?? "";
+        if (line.trim().length === 0)
+            break;
+        const match = line.match(/^\s*-\s*(.*?)\s*$/);
+        if (!match)
+            break;
+        values.push(...parseList(match[1] ?? ""));
+    }
+    return { values, nextIndex: index };
+}
+function policyListValues(value, blockList) {
+    return value.length > 0 ? parseList(value) : blockList.values;
+}
+function consumesBlockList(value, blockList) {
+    return value.length === 0 && blockList.values.length > 0;
+}
+function uniqueStrings(values) {
+    return [...new Set(values)];
+}
+function parseBoolean(value) {
+    const normalized = value.toLowerCase();
+    if (["true", "yes", "allowed", "allow", "1"].includes(normalized)) {
+        return true;
+    }
+    if (["false", "no", "denied", "deny", "0"].includes(normalized)) {
+        return false;
+    }
+    return undefined;
+}
+function parseList(value) {
+    return value
+        .replace(/^\[/, "")
+        .replace(/\]$/, "")
+        .split(",")
+        .map((item) => item.trim().replace(/^["']|["']$/g, ""))
+        .filter((item) => item.length > 0);
+}
+//# sourceMappingURL=security-policy.js.map

package/dist/security-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.js","sourceRoot":"","sources":["../src/security-policy.ts"],"names":[],"mappings":"AA6BA,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAA+B;IAClE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IACrC,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;IACpD,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IACrC,CAAC,yBAAyB,EAAE,uBAAuB,CAAC;CACrD,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC;AAC7E,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAC/C,8BAA8B;CAC/B,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAC7D,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACpE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAOrE,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAAmB;QAC7B,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,EAAE;QACnB,2BAA2B,EAAE,EAAE;QAC/B,0BAA0B,EAAE,EAAE;QAC9B,kBAAkB,EAAE,EAAE;QACtB,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnB,WAAW,EAAE,IAAI,GAAG,EAAE;KACvB,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,cAAc,GAClB,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK;QACxB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC;QACtE,CAAC,CAAC,CAAC,CAAC,CAAC;IACT,MAAM,OAAO,GACX,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEnE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,CAAC;YAChB,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC;YACvC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QAE3C,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,YAAY,CAAyB,GAAG,MAAM,CAAC;gBACvD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAClC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YACzD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YACnD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,gCAAgC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAClD,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAChE,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAClD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YACnC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACjD,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACvC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACrD,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,IAAI,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC;YAC/B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACvC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,MAAsB,EACtB,MAAuB;IAEvB,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAmB;QAC/B,GAAG,MAAM;QACT,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;QACpC,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC;QAC5C,2BAA2B,EAAE,CAAC,GAAG,MAAM,CAAC,2BAA2B,CAAC;QACpE,0BAA0B,EAAE,CAAC,GAAG,MAAM,CAAC,0BAA0B,CAAC;QAClE,kBAAkB,EAAE,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAClD,QAAQ;QACR,WAAW;KACZ,CAAC;IAEF,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC/B,OAAO,CAAC,cAAc,KAAK,SAAS,EACpC,CAAC;YACD,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACnD,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtC,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAC3C,CAAC;YACD,QAAQ,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QACjE,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAC/B,OAAO,CAAC,cAAc,KAAK,SAAS,EACpC,CAAC;YACD,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACnD,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACtC,OAAO,CAAC,qBAAqB,KAAK,SAAS,EAC3C,CAAC;YACD,QAAQ,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QACjE,CAAC;QACD,IACE,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;YAC5B,OAAO,CAAC,gBAAgB,KAAK,SAAS,EACtC,CAAC;YACD,QAAQ,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACrC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QAC5D,CAAC;QACD,QAAQ,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;QACtE,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC3E,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IACrE,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC1E,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC/D,QAAQ,CAAC,WAAW,GAAG,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,QAAQ,CAAC,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnE,QAAQ,CAAC,2BAA2B,GAAG,aAAa,CAClD,QAAQ,CAAC,2BAA2B,CACrC,CAAC;IACF,QAAQ,CAAC,0BAA0B,GAAG,aAAa,CACjD,QAAQ,CAAC,0BAA0B,CACpC,CAAC;IACF,QAAQ,CAAC,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAEzE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAwB,EACxB,MAAkC;IAElC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAExE,MAAM,QAAQ,GAA+B,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAuB,IAAI,CAAC;IAEvC,OAAO,OAAO,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC;aACvD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEnB,MAAM,OAAO,GACX,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAsB;IAEtB,OAAO,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,CACL,GAAG,KAAK,SAAS;QACjB,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7B,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;YAClC,gCAAgC,CAAC,GAAG,CAAC,GAAG,CAAC;YACzC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC;YACnC,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC;YACtC,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,KAAe,EACf,UAAkB,EAClB,OAAe;IAEf,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC;IAC3B,OAAO,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK;YAAE,MAAM;QAElB,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,SAA0B;IACjE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,SAA0B;IAClE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;SACtD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/security-posture.d.ts

@@ -0,0 +1,35 @@
+import type { RiskClass, Severity } from "./types.js";
+export interface SecurityPostureSummary {
+    totalSecurityFindings: number;
+    riskClasses: {
+        violation: number;
+        suspicious: number;
+        advisory: number;
+        unclassified: number;
+    };
+    severities: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+    };
+    highOrCritical: number;
+    topFindingIds: Array<{
+        id: string;
+        count: number;
+        riskClass?: RiskClass | undefined;
+        maxSeverity: Severity;
+    }>;
+}
+export interface SecurityPostureFindingLike {
+    id: string;
+    severity: string;
+    riskClass?: string | undefined;
+}
+export declare function summarizeSecurityPosture(findings: SecurityPostureFindingLike[]): SecurityPostureSummary;
+export declare function isSecurityFinding(finding: SecurityPostureFindingLike): boolean;
+export declare function normalizeRiskClass(value: string | undefined): RiskClass | undefined;
+export declare function normalizeSeverity(value: string | undefined): Severity | undefined;
+export declare function compareSeverity(left: Severity, right: Severity): number;
+export declare function zeroSecurityPostureSummary(): SecurityPostureSummary;
+//# sourceMappingURL=security-posture.d.ts.map

package/dist/security-posture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-posture.d.ts","sourceRoot":"","sources":["../src/security-posture.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAetD,MAAM,WAAW,sBAAsB;IACrC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE;QACX,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,KAAK,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;QAClC,WAAW,EAAE,QAAQ,CAAC;KACvB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AASD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,0BAA0B,EAAE,GACrC,sBAAsB,CAgExB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAKT;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,SAAS,GAAG,SAAS,CAKvB;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,QAAQ,GAAG,SAAS,CAUtB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,GAAG,MAAM,CAEvE;AAED,wBAAgB,0BAA0B,IAAI,sBAAsB,CAkBnE"}