vaspera 2.5.0

package/dist/sbom/types.d.ts

@@ -0,0 +1,384 @@
+/**
+ * SBOM, Provenance, and Signing Types
+ *
+ * Types for CycloneDX SBOM generation, SLSA provenance,
+ * and Sigstore signing.
+ *
+ * @module sbom/types
+ */
+/**
+ * CycloneDX SBOM format version
+ */
+export declare const CYCLONEDX_SPEC_VERSION = "1.5";
+/**
+ * CycloneDX component type
+ */
+export type ComponentType = "application" | "framework" | "library" | "container" | "platform" | "operating-system" | "device" | "device-driver" | "firmware" | "file" | "machine-learning-model" | "data";
+/**
+ * Component scope
+ */
+export type ComponentScope = "required" | "optional" | "excluded";
+/**
+ * External reference type
+ */
+export type ExternalReferenceType = "vcs" | "issue-tracker" | "website" | "advisories" | "bom" | "mailing-list" | "social" | "chat" | "documentation" | "support" | "source-distribution" | "distribution" | "distribution-intake" | "license" | "build-meta" | "build-system" | "release-notes" | "security-contact" | "model-card" | "log" | "configuration" | "evidence" | "formulation" | "attestation" | "threat-model" | "adversary-model" | "risk-assessment" | "vulnerability-assertion" | "exploitability-statement" | "pentest-report" | "static-analysis-report" | "dynamic-analysis-report" | "runtime-analysis-report" | "component-analysis-report" | "maturity-report" | "certification-report" | "codified-infrastructure" | "quality-metrics" | "poam" | "electronic-signature" | "digital-signature" | "rfc-9116" | "other";
+/**
+ * Hash algorithm
+ */
+export type HashAlgorithm = "MD5" | "SHA-1" | "SHA-256" | "SHA-384" | "SHA-512" | "SHA3-256" | "SHA3-384" | "SHA3-512" | "BLAKE2b-256" | "BLAKE2b-384" | "BLAKE2b-512" | "BLAKE3";
+/**
+ * Hash value
+ */
+export interface Hash {
+    alg: HashAlgorithm;
+    content: string;
+}
+/**
+ * External reference
+ */
+export interface ExternalReference {
+    type: ExternalReferenceType;
+    url: string;
+    comment?: string;
+    hashes?: Hash[];
+}
+/**
+ * License information
+ */
+export interface LicenseInfo {
+    license?: {
+        id?: string;
+        name?: string;
+        url?: string;
+    };
+    expression?: string;
+}
+/**
+ * Property (name-value pair)
+ */
+export interface Property {
+    name: string;
+    value: string;
+}
+/**
+ * CycloneDX Component
+ */
+export interface CycloneDXComponent {
+    type: ComponentType;
+    "bom-ref"?: string;
+    supplier?: {
+        name?: string;
+        url?: string[];
+    };
+    author?: string;
+    publisher?: string;
+    group?: string;
+    name: string;
+    version?: string;
+    description?: string;
+    scope?: ComponentScope;
+    hashes?: Hash[];
+    licenses?: LicenseInfo[];
+    copyright?: string;
+    purl?: string;
+    externalReferences?: ExternalReference[];
+    properties?: Property[];
+}
+/**
+ * CycloneDX Dependency
+ */
+export interface CycloneDXDependency {
+    ref: string;
+    dependsOn?: string[];
+}
+/**
+ * CycloneDX Tool
+ */
+export interface CycloneDXTool {
+    vendor?: string;
+    name: string;
+    version?: string;
+    hashes?: Hash[];
+    externalReferences?: ExternalReference[];
+}
+/**
+ * CycloneDX Metadata
+ */
+export interface CycloneDXMetadata {
+    timestamp?: string;
+    tools?: CycloneDXTool[];
+    authors?: Array<{
+        name?: string;
+        email?: string;
+    }>;
+    component?: CycloneDXComponent;
+    manufacture?: {
+        name?: string;
+        url?: string[];
+    };
+    supplier?: {
+        name?: string;
+        url?: string[];
+    };
+    licenses?: LicenseInfo[];
+    properties?: Property[];
+}
+/**
+ * Vulnerability source
+ */
+export interface VulnerabilitySource {
+    name: string;
+    url?: string;
+}
+/**
+ * Vulnerability rating
+ */
+export interface VulnerabilityRating {
+    source?: VulnerabilitySource;
+    score?: number;
+    severity?: "critical" | "high" | "medium" | "low" | "info" | "none" | "unknown";
+    method?: "CVSSv2" | "CVSSv3" | "CVSSv31" | "CVSSv4" | "OWASP" | "other";
+    vector?: string;
+    justification?: string;
+}
+/**
+ * CycloneDX Vulnerability
+ */
+export interface CycloneDXVulnerability {
+    "bom-ref"?: string;
+    id: string;
+    source?: VulnerabilitySource;
+    references?: Array<{
+        id: string;
+        source: VulnerabilitySource;
+    }>;
+    ratings?: VulnerabilityRating[];
+    cwes?: number[];
+    description?: string;
+    detail?: string;
+    recommendation?: string;
+    advisories?: Array<{
+        title?: string;
+        url: string;
+    }>;
+    created?: string;
+    published?: string;
+    updated?: string;
+    affects?: Array<{
+        ref: string;
+        versions?: Array<{
+            version?: string;
+            range?: string;
+            status: "affected" | "unaffected" | "unknown";
+        }>;
+    }>;
+}
+/**
+ * CycloneDX SBOM
+ */
+export interface CycloneDXSBOM {
+    bomFormat: "CycloneDX";
+    specVersion: string;
+    serialNumber?: string;
+    version: number;
+    metadata?: CycloneDXMetadata;
+    components?: CycloneDXComponent[];
+    dependencies?: CycloneDXDependency[];
+    vulnerabilities?: CycloneDXVulnerability[];
+    externalReferences?: ExternalReference[];
+    properties?: Property[];
+}
+/**
+ * SLSA Provenance predicate type
+ */
+export declare const SLSA_PREDICATE_TYPE = "https://slsa.dev/provenance/v1";
+/**
+ * SLSA Builder
+ */
+export interface SLSABuilder {
+    id: string;
+    version?: Record<string, string>;
+    builderDependencies?: Array<{
+        uri: string;
+        digest?: Record<string, string>;
+    }>;
+}
+/**
+ * SLSA Build metadata
+ */
+export interface SLSABuildMetadata {
+    invocationId?: string;
+    startedOn?: string;
+    finishedOn?: string;
+}
+/**
+ * SLSA Run details
+ */
+export interface SLSARunDetails {
+    builder: SLSABuilder;
+    metadata?: SLSABuildMetadata;
+    byproducts?: Array<{
+        uri?: string;
+        mediaType?: string;
+        digest?: Record<string, string>;
+        content?: string;
+    }>;
+}
+/**
+ * SLSA Build definition
+ */
+export interface SLSABuildDefinition {
+    buildType: string;
+    externalParameters?: Record<string, unknown>;
+    internalParameters?: Record<string, unknown>;
+    resolvedDependencies?: Array<{
+        uri: string;
+        digest?: Record<string, string>;
+        content?: string;
+        downloadLocation?: string;
+        mediaType?: string;
+        name?: string;
+        annotations?: Record<string, string>;
+    }>;
+}
+/**
+ * SLSA Provenance Predicate (v1.0)
+ */
+export interface SLSAProvenancePredicate {
+    buildDefinition: SLSABuildDefinition;
+    runDetails: SLSARunDetails;
+}
+/**
+ * In-toto Statement (envelope for SLSA)
+ */
+export interface InTotoStatement {
+    _type: "https://in-toto.io/Statement/v1";
+    subject: Array<{
+        name: string;
+        digest: Record<string, string>;
+    }>;
+    predicateType: string;
+    predicate: SLSAProvenancePredicate;
+}
+/**
+ * Sigstore Bundle (simplified)
+ */
+export interface SigstoreBundle {
+    mediaType: string;
+    verificationMaterial: {
+        certificate?: {
+            rawBytes: string;
+        };
+        publicKey?: {
+            hint: string;
+        };
+        tlogEntries?: Array<{
+            logIndex: string;
+            logId: {
+                keyId: string;
+            };
+            kindVersion: {
+                kind: string;
+                version: string;
+            };
+            integratedTime: string;
+            inclusionPromise?: {
+                signedEntryTimestamp: string;
+            };
+            inclusionProof?: {
+                logIndex: string;
+                rootHash: string;
+                treeSize: string;
+                hashes: string[];
+                checkpoint: {
+                    envelope: string;
+                };
+            };
+            canonicalizedBody: string;
+        }>;
+        timestampVerificationData?: {
+            rfc3161Timestamps: Array<{
+                signedTimestamp: string;
+            }>;
+        };
+    };
+    messageSignature?: {
+        messageDigest: {
+            algorithm: string;
+            digest: string;
+        };
+        signature: string;
+    };
+    dsseEnvelope?: {
+        payload: string;
+        payloadType: string;
+        signatures: Array<{
+            sig: string;
+            keyid?: string;
+        }>;
+    };
+}
+/**
+ * Signed artifact output
+ */
+export interface SignedArtifact {
+    /** The original content that was signed */
+    content: string;
+    /** SHA-256 digest of content */
+    digest: string;
+    /** Sigstore bundle containing signature and certificate */
+    bundle?: SigstoreBundle;
+    /** Timestamp of signing */
+    signedAt: string;
+    /** Whether signing was successful */
+    signed: boolean;
+    /** Error message if signing failed */
+    error?: string;
+}
+/**
+ * SBOM generation options
+ */
+export interface SBOMOptions {
+    /** Include dev dependencies */
+    includeDevDependencies?: boolean;
+    /** Include vulnerabilities from scanners */
+    includeVulnerabilities?: boolean;
+    /** Include license information */
+    includeLicenses?: boolean;
+    /** Project name override */
+    projectName?: string;
+    /** Project version override */
+    projectVersion?: string;
+    /** Author information */
+    author?: {
+        name?: string;
+        email?: string;
+    };
+}
+/**
+ * Provenance generation options
+ */
+export interface ProvenanceOptions {
+    /** Builder ID (e.g., "https://github.com/RCOLKITT/vaspera-hardening-mcp") */
+    builderId?: string;
+    /** Build type URL */
+    buildType?: string;
+    /** External parameters passed to the build */
+    externalParameters?: Record<string, unknown>;
+    /** Internal parameters (environment, etc.) */
+    internalParameters?: Record<string, unknown>;
+}
+/**
+ * Signing options
+ */
+export interface SigningOptions {
+    /** Skip signing (generate unsigned artifacts) */
+    skipSigning?: boolean;
+    /** Identity token for Sigstore (OIDC) */
+    identityToken?: string;
+    /** Fulcio URL for certificate authority */
+    fulcioUrl?: string;
+    /** Rekor URL for transparency log */
+    rekorUrl?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/sbom/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sbom/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAE5C;;GAEG;AACH,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,WAAW,GACX,SAAS,GACT,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,QAAQ,GACR,eAAe,GACf,UAAU,GACV,MAAM,GACN,wBAAwB,GACxB,MAAM,CAAC;AAEX;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAElE;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,KAAK,GACL,eAAe,GACf,SAAS,GACT,YAAY,GACZ,KAAK,GACL,cAAc,GACd,QAAQ,GACR,MAAM,GACN,eAAe,GACf,SAAS,GACT,qBAAqB,GACrB,cAAc,GACd,qBAAqB,GACrB,SAAS,GACT,YAAY,GACZ,cAAc,GACd,eAAe,GACf,kBAAkB,GAClB,YAAY,GACZ,KAAK,GACL,eAAe,GACf,UAAU,GACV,aAAa,GACb,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,GAC1B,gBAAgB,GAChB,wBAAwB,GACxB,yBAAyB,GACzB,yBAAyB,GACzB,2BAA2B,GAC3B,iBAAiB,GACjB,sBAAsB,GACtB,yBAAyB,GACzB,iBAAiB,GACjB,MAAM,GACN,sBAAsB,GACtB,mBAAmB,GACnB,UAAU,GACV,OAAO,CAAC;AAEZ;;GAEG;AACH,MAAM,MAAM,aAAa,GACrB,KAAK,GACL,OAAO,GACP,SAAS,GACT,SAAS,GACT,SAAS,GACT,UAAU,GACV,UAAU,GACV,UAAU,GACV,aAAa,GACb,aAAa,GACb,aAAa,GACb,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,IAAI;IACnB,GAAG,EAAE,aAAa,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE;QACR,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;KAChB,CAAC;IACF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAChB,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;KAChB,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;KAChB,CAAC;IACF,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAChF,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,mBAAmB,CAAC;KAC7B,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,CAAC,EAAE,KAAK,CAAC;YACf,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;SAC/C,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAClC,YAAY,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACrC,eAAe,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC3C,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,mCAAmC,CAAC;AAEpE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,mBAAmB,CAAC,EAAE,KAAK,CAAC;QAC1B,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAC3B,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,mBAAmB,CAAC;IACrC,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,iCAAiC,CAAC;IACzC,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE;QACpB,WAAW,CAAC,EAAE;YACZ,QAAQ,EAAE,MAAM,CAAC;SAClB,CAAC;QACF,SAAS,CAAC,EAAE;YACV,IAAI,EAAE,MAAM,CAAC;SACd,CAAC;QACF,WAAW,CAAC,EAAE,KAAK,CAAC;YAClB,QAAQ,EAAE,MAAM,CAAC;YACjB,KAAK,EAAE;gBACL,KAAK,EAAE,MAAM,CAAC;aACf,CAAC;YACF,WAAW,EAAE;gBACX,IAAI,EAAE,MAAM,CAAC;gBACb,OAAO,EAAE,MAAM,CAAC;aACjB,CAAC;YACF,cAAc,EAAE,MAAM,CAAC;YACvB,gBAAgB,CAAC,EAAE;gBACjB,oBAAoB,EAAE,MAAM,CAAC;aAC9B,CAAC;YACF,cAAc,CAAC,EAAE;gBACf,QAAQ,EAAE,MAAM,CAAC;gBACjB,QAAQ,EAAE,MAAM,CAAC;gBACjB,QAAQ,EAAE,MAAM,CAAC;gBACjB,MAAM,EAAE,MAAM,EAAE,CAAC;gBACjB,UAAU,EAAE;oBACV,QAAQ,EAAE,MAAM,CAAC;iBAClB,CAAC;aACH,CAAC;YACF,iBAAiB,EAAE,MAAM,CAAC;SAC3B,CAAC,CAAC;QACH,yBAAyB,CAAC,EAAE;YAC1B,iBAAiB,EAAE,KAAK,CAAC;gBACvB,eAAe,EAAE,MAAM,CAAC;aACzB,CAAC,CAAC;SACJ,CAAC;KACH,CAAC;IACF,gBAAgB,CAAC,EAAE;QACjB,aAAa,EAAE;YACb,SAAS,EAAE,MAAM,CAAC;YAClB,MAAM,EAAE,MAAM,CAAC;SAChB,CAAC;QACF,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,KAAK,CAAC;YAChB,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,CAAC,EAAE,MAAM,CAAC;SAChB,CAAC,CAAC;KACJ,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,MAAM,EAAE,OAAO,CAAC;IAChB,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,+BAA+B;IAC/B,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,4CAA4C;IAC5C,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kCAAkC;IAClC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,yBAAyB;IACzB,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,8CAA8C;IAC9C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/sbom/types.js

@@ -0,0 +1,17 @@
+/**
+ * SBOM, Provenance, and Signing Types
+ *
+ * Types for CycloneDX SBOM generation, SLSA provenance,
+ * and Sigstore signing.
+ *
+ * @module sbom/types
+ */
+/**
+ * CycloneDX SBOM format version
+ */
+export const CYCLONEDX_SPEC_VERSION = "1.5";
+/**
+ * SLSA Provenance predicate type
+ */
+export const SLSA_PREDICATE_TYPE = "https://slsa.dev/provenance/v1";
+//# sourceMappingURL=types.js.map

package/dist/sbom/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sbom/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAuQ5C;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gCAAgC,CAAC"}

package/dist/scanners/agent/credential-scope-audit.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Credential Scope Audit Scanner
+ *
+ * Inspects credentials and tokens for over-scoping and rotation needs.
+ * Detects common credential patterns and analyzes their permissions:
+ * - GitHub PATs with excessive scopes
+ * - AWS credentials with AdministratorAccess
+ * - Unrotated tokens older than 90 days
+ * - Hardcoded credentials in config
+ *
+ * @module scanners/agent/credential-scope-audit
+ */
+import type { AgentScannerResult, MCPManifest } from "./types.js";
+/**
+ * Run credential scope audit scanner
+ */
+export declare function runCredentialScopeAudit(manifest: MCPManifest, options?: {
+    /** Directory to scan for config files */
+    scanPath?: string;
+    /** Also scan environment variables */
+    scanEnvironment?: boolean;
+    /** Additional files to scan */
+    additionalFiles?: string[];
+}): Promise<AgentScannerResult>;
+/**
+ * Check if credential scope audit is available
+ */
+export declare function checkCredentialScopeAuditAvailable(): Promise<{
+    scanner: "credential-scope-audit";
+    available: boolean;
+    version: string;
+}>;
+/**
+ * Get credential audit summary
+ */
+export declare function getCredentialAuditSummary(result: AgentScannerResult): {
+    totalCredentials: number;
+    byType: Record<string, number>;
+} | null;
+//# sourceMappingURL=credential-scope-audit.d.ts.map

package/dist/scanners/agent/credential-scope-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-scope-audit.d.ts","sourceRoot":"","sources":["../../../src/scanners/agent/credential-scope-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EACV,kBAAkB,EAClB,WAAW,EAGZ,MAAM,YAAY,CAAC;AAgYpB;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE;IACR,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,+BAA+B;IAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,GACA,OAAO,CAAC,kBAAkB,CAAC,CAgD7B;AAED;;GAEG;AACH,wBAAsB,kCAAkC,IAAI,OAAO,CAAC;IAClE,OAAO,EAAE,wBAAwB,CAAC;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC,CAMD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,kBAAkB,GAAG;IACrE,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC,GAAG,IAAI,CAkBP"}