verification-layer 0.27.13 → 0.28.0

package/dist/delivery/diff.js

@@ -0,0 +1,41 @@
+import { generateFindingHash, normalizeFindingFile, } from '../baseline.js';
+const VIRTUAL_FILES = new Set(['project-level', 'ASSET-INVENTORY', 'PHI-FLOW-MAP']);
+function isActive(finding) {
+    return !finding.suppressed && !finding.acknowledged;
+}
+function isChangedFile(finding, projectRoot, changed) {
+    const file = normalizeFindingFile(finding, projectRoot);
+    if (VIRTUAL_FILES.has(file))
+        return true;
+    return changed.has(file);
+}
+/**
+ * Build the change-oriented view used by CI policy evaluation. Findings already
+ * marked by `scan(..., baselineFile)` are treated as existing debt; active
+ * findings outside the baseline are new risk.
+ */
+export function buildFindingDelta(findings, projectRoot, changedFiles, baseline) {
+    const changed = new Set(changedFiles.map(file => file.replace(/\\/g, '/')));
+    const active = findings.filter(isActive);
+    const baselineFindings = active.filter(finding => finding.isBaseline === true);
+    const newFindings = active.filter(finding => finding.isBaseline !== true);
+    const newFindingsInChangedFiles = changed.size === 0
+        ? newFindings
+        : newFindings.filter(finding => isChangedFile(finding, projectRoot, changed));
+    let resolvedFindings = baseline?.findings.filter(() => false) ?? [];
+    if (baseline?.version.startsWith('2')) {
+        const currentFingerprints = new Set(findings.map(finding => generateFindingHash(finding, projectRoot)));
+        resolvedFindings = baseline.findings.filter(entry => {
+            const fingerprint = entry.fingerprint ?? entry.hash;
+            return !currentFingerprints.has(fingerprint);
+        });
+    }
+    return {
+        newFindings,
+        newFindingsInChangedFiles,
+        baselineFindings,
+        resolvedFindings,
+        changedFiles: [...changed],
+    };
+}
+//# sourceMappingURL=diff.js.map

package/dist/delivery/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/delivery/diff.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpF,SAAS,QAAQ,CAAC,OAAgB;IAChC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB,EAAE,WAAmB,EAAE,OAAoB;IAChF,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAmB,EACnB,WAAmB,EACnB,YAAsB,EACtB,QAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAC1E,MAAM,yBAAyB,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC;QAClD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAEhF,IAAI,gBAAgB,GAAG,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CACnE,CAAC;QACF,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAClD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC;YACpD,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,gBAAgB;QAChB,gBAAgB;QAChB,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/delivery/evidence.d.ts

@@ -0,0 +1,11 @@
+import type { EvidencePackage, GuardResult } from './types.js';
+export declare function hashEvidencePayload(value: unknown): string;
+/**
+ * Create a machine-readable evidence package without embedding source context
+ * lines. This intentionally minimizes the risk of copying PHI or secrets into
+ * compliance artifacts while preserving rule, file, decision, and provenance.
+ */
+export declare function buildEvidencePackage(projectPath: string, guard: GuardResult): EvidencePackage;
+export declare function saveEvidencePackage(path: string, evidence: EvidencePackage): Promise<void>;
+export declare function verifyEvidencePackage(evidence: EvidencePackage): boolean;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/delivery/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/delivery/evidence.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAmB,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAehF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,WAAW,GACjB,eAAe,CAuDjB;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhG;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAGxE"}

package/dist/delivery/evidence.js

@@ -0,0 +1,87 @@
+import { createHash } from 'crypto';
+import { writeFile } from 'fs/promises';
+import { basename, resolve } from 'path';
+import { canonicalRuleId, generateFindingHash, normalizeFindingFile, } from '../baseline.js';
+import { buildComplianceGraph, controlForFinding } from './graph.js';
+function canonicalize(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalize);
+    if (value && typeof value === 'object') {
+        const record = value;
+        return Object.fromEntries(Object.keys(record)
+            .sort()
+            .map(key => [key, canonicalize(record[key])]));
+    }
+    return value;
+}
+export function hashEvidencePayload(value) {
+    const serialized = JSON.stringify(canonicalize(value));
+    return createHash('sha256').update(serialized).digest('hex');
+}
+/**
+ * Create a machine-readable evidence package without embedding source context
+ * lines. This intentionally minimizes the risk of copying PHI or secrets into
+ * compliance artifacts while preserving rule, file, decision, and provenance.
+ */
+export function buildEvidencePackage(projectPath, guard) {
+    const root = resolve(projectPath);
+    const evidenceFindings = guard.findings.map(finding => ({
+        fingerprint: generateFindingHash(finding, root),
+        ruleId: canonicalRuleId(finding.id),
+        id: finding.id,
+        severity: finding.severity,
+        category: finding.category,
+        title: finding.title,
+        file: normalizeFindingFile(finding, root),
+        line: finding.line,
+        hipaaReference: finding.hipaaReference,
+        recommendation: finding.recommendation,
+        acknowledged: finding.acknowledged === true,
+        acknowledgment: finding.acknowledgment,
+        baseline: finding.isBaseline === true,
+        suppressed: finding.suppressed === true,
+    }));
+    const controls = [...new Set(guard.findings.map(controlForFinding))].sort();
+    const graph = buildComplianceGraph(guard.findings, root, guard.decision, guard.git);
+    const body = {
+        schemaVersion: '1.0',
+        generatedAt: new Date().toISOString(),
+        project: {
+            name: basename(root),
+        },
+        source: {
+            repository: guard.git.repository,
+            branch: guard.git.branch,
+            headSha: guard.git.headSha,
+            baseSha: guard.git.baseSha,
+            author: guard.git.author,
+            commitUrl: guard.git.commitUrl,
+            changedFiles: guard.git.changedFiles,
+        },
+        decision: guard.decision,
+        summary: {
+            scannedFiles: guard.scannedFiles,
+            totalFindings: guard.findings.length,
+            newFindings: guard.delta.newFindings.length,
+            resolvedFindings: guard.delta.resolvedFindings.length,
+            acknowledged: guard.findings.filter(finding => finding.acknowledged === true).length,
+            suppressed: guard.findings.filter(finding => finding.suppressed === true).length,
+            complianceScore: guard.complianceScore,
+        },
+        controls,
+        findings: evidenceFindings,
+        graph,
+    };
+    return {
+        ...body,
+        packageHash: hashEvidencePayload(body),
+    };
+}
+export async function saveEvidencePackage(path, evidence) {
+    await writeFile(path, JSON.stringify(evidence, null, 2), 'utf-8');
+}
+export function verifyEvidencePackage(evidence) {
+    const { packageHash, ...body } = evidence;
+    return hashEvidencePayload(body) === packageHash;
+}
+//# sourceMappingURL=evidence.js.map

package/dist/delivery/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/delivery/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGrE,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAChB,IAAI,EAAE;aACN,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,KAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,gBAAgB,GAAsB,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzE,WAAW,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC;QAC/C,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC;QACzC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;QAC3C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI;QACrC,UAAU,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI;KACxC,CAAC,CAAC,CAAC;IAEJ,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG;QACX,aAAa,EAAE,KAAc;QAC7B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,OAAO,EAAE;YACP,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;SACrB;QACD,MAAM,EAAE;YACN,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU;YAChC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;YACxB,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO;YAC1B,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO;YAC1B,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;YACxB,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS;YAC9B,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,YAAY;SACrC;QACD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE;YACP,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YACpC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM;YAC3C,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM;YACrD,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,MAAM;YACpF,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,MAAM;YAChF,eAAe,EAAE,KAAK,CAAC,eAAe;SACvC;QACD,QAAQ;QACR,QAAQ,EAAE,gBAAgB;QAC1B,KAAK;KACN,CAAC;IAEF,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE,mBAAmB,CAAC,IAAI,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAyB;IAC/E,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC1C,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC;AACnD,CAAC"}

package/dist/delivery/git.d.ts

@@ -0,0 +1,8 @@
+import type { GitContext } from './types.js';
+/**
+ * Resolve the source-control context used by a deployment decision. Git is a
+ * best-effort enhancement: callers can still evaluate all findings when the
+ * target directory is not a repository.
+ */
+export declare function getGitContext(projectPath: string, baseRef?: string, headRef?: string): Promise<GitContext>;
+//# sourceMappingURL=git.d.ts.map

package/dist/delivery/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/delivery/git.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA8C7C;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,SAAS,GACf,OAAO,CAAC,UAAU,CAAC,CAsDrB"}

package/dist/delivery/git.js

@@ -0,0 +1,98 @@
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import { resolve } from 'path';
+const execFileAsync = promisify(execFile);
+async function runGit(cwd, args) {
+    const result = await execFileAsync('git', args, {
+        cwd,
+        encoding: 'utf8',
+        maxBuffer: 5 * 1024 * 1024,
+    });
+    return String(result.stdout).trim();
+}
+async function tryGit(cwd, args) {
+    try {
+        const value = await runGit(cwd, args);
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function validGithubSha(value) {
+    if (!value || /^0+$/.test(value))
+        return undefined;
+    return value;
+}
+async function resolveBaseSha(root, headSha, baseRef) {
+    const githubBaseSha = validGithubSha(process.env.GITHUB_BASE_SHA);
+    if (!baseRef && githubBaseSha)
+        return githubBaseSha;
+    const requested = baseRef || process.env.GITHUB_BASE_REF;
+    if (requested) {
+        const candidates = requested.startsWith('refs/') || requested.startsWith('origin/')
+            ? [requested]
+            : [`origin/${requested}`, requested];
+        for (const candidate of candidates) {
+            const mergeBase = await tryGit(root, ['merge-base', candidate, headSha]);
+            if (mergeBase)
+                return mergeBase;
+        }
+    }
+    return tryGit(root, ['rev-parse', `${headSha}^`]);
+}
+/**
+ * Resolve the source-control context used by a deployment decision. Git is a
+ * best-effort enhancement: callers can still evaluate all findings when the
+ * target directory is not a repository.
+ */
+export async function getGitContext(projectPath, baseRef, headRef = 'HEAD') {
+    const cwd = resolve(projectPath);
+    const root = await tryGit(cwd, ['rev-parse', '--show-toplevel']);
+    if (!root) {
+        return {
+            available: false,
+            root: cwd,
+            changedFiles: [],
+        };
+    }
+    const headSha = await tryGit(root, ['rev-parse', headRef]);
+    if (!headSha) {
+        return {
+            available: false,
+            root,
+            changedFiles: [],
+        };
+    }
+    const baseSha = await resolveBaseSha(root, headSha, baseRef);
+    let changedFiles = [];
+    if (baseSha && baseSha !== headSha) {
+        const diff = await tryGit(root, [
+            'diff',
+            '--name-only',
+            '--diff-filter=ACMR',
+            `${baseSha}...${headSha}`,
+        ]);
+        changedFiles = diff
+            ? diff.split('\n').map(file => file.trim()).filter(Boolean).map(file => file.replace(/\\/g, '/'))
+            : [];
+    }
+    const branch = process.env.GITHUB_HEAD_REF
+        || await tryGit(root, ['rev-parse', '--abbrev-ref', headSha]);
+    const author = await tryGit(root, ['show', '-s', '--format=%an <%ae>', headSha]);
+    const repository = process.env.GITHUB_REPOSITORY;
+    const serverUrl = process.env.GITHUB_SERVER_URL || 'https://github.com';
+    const commitUrl = repository ? `${serverUrl}/${repository}/commit/${headSha}` : undefined;
+    return {
+        available: true,
+        root,
+        branch,
+        headSha,
+        baseSha,
+        author,
+        changedFiles,
+        repository,
+        commitUrl,
+    };
+}
+//# sourceMappingURL=git.js.map

package/dist/delivery/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/delivery/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAG/B,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAAc;IAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAC9C,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;KAC3B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAAc;IAC/C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,IAAI,SAAS,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,OAAe,EAAE,OAAgB;IAC3E,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAEpD,MAAM,SAAS,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;YACjF,CAAC,CAAC,CAAC,SAAS,CAAC;YACb,CAAC,CAAC,CAAC,UAAU,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;QAEvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YACzE,IAAI,SAAS;gBAAE,OAAO,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,OAAgB,EAChB,OAAO,GAAG,MAAM;IAEhB,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAEjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,GAAG;YACT,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,IAAI;YACJ,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,YAAY,GAAa,EAAE,CAAC;IAEhC,IAAI,OAAO,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE;YAC9B,MAAM;YACN,aAAa;YACb,oBAAoB;YACpB,GAAG,OAAO,MAAM,OAAO,EAAE;SAC1B,CAAC,CAAC;QACH,YAAY,GAAG,IAAI;YACjB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjG,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe;WACrC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;IACxE,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,UAAU,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1F,OAAO;QACL,SAAS,EAAE,IAAI;QACf,IAAI;QACJ,MAAM;QACN,OAAO;QACP,OAAO;QACP,MAAM;QACN,YAAY;QACZ,UAAU;QACV,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/delivery/governance.d.ts

@@ -0,0 +1,23 @@
+import type { AcknowledgedFinding } from '../types.js';
+import type { DeliveryPolicy } from './types.js';
+export declare function parseDeliveryPolicy(value: unknown): DeliveryPolicy;
+export interface LoadedDeliveryPolicy {
+    policy: DeliveryPolicy;
+    source?: string;
+}
+/**
+ * Load delivery policy from an explicit file, conventional policy file, or the
+ * `deliveryPolicy` block inside the scanner config, in that precedence order.
+ */
+export declare function loadDeliveryPolicy(projectPath: string, policyFile?: string, configFile?: string): Promise<LoadedDeliveryPolicy>;
+export interface AcknowledgmentLifecycle {
+    total: number;
+    active: AcknowledgedFinding[];
+    expired: AcknowledgedFinding[];
+    expiringSoon: AcknowledgedFinding[];
+}
+/**
+ * Summarize exception governance directly from the scanner configuration.
+ */
+export declare function getAcknowledgmentLifecycle(projectPath: string, configFile?: string, now?: Date): Promise<AcknowledgmentLifecycle>;
+//# sourceMappingURL=governance.d.ts.map

package/dist/delivery/governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../../src/delivery/governance.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAY,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,YAAY,CAAC;AAmCjE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAiBlE;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,cAAc,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,CAAC,CA8B/B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,YAAY,EAAE,mBAAmB,EAAE,CAAC;CACrC;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,GAAG,OAAa,GACf,OAAO,CAAC,uBAAuB,CAAC,CAgClC"}

package/dist/delivery/governance.js

@@ -0,0 +1,118 @@
+import { readFile } from 'fs/promises';
+import { isAbsolute, join, resolve } from 'path';
+import { loadConfig } from '../config.js';
+const VALID_SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'info']);
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+async function readJson(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf-8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseSeverityArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const values = value.filter((item) => typeof item === 'string' && VALID_SEVERITIES.has(item));
+    return values.length > 0 ? values : [];
+}
+function parseSeverityBudget(value) {
+    if (!isRecord(value))
+        return undefined;
+    const budget = {};
+    for (const severity of VALID_SEVERITIES) {
+        const candidate = value[severity];
+        if (typeof candidate === 'number' && Number.isInteger(candidate) && candidate >= 0) {
+            budget[severity] = candidate;
+        }
+    }
+    return budget;
+}
+export function parseDeliveryPolicy(value) {
+    if (!isRecord(value))
+        return {};
+    const policy = {};
+    const blockOn = parseSeverityArray(value.blockOn);
+    const maxNew = parseSeverityBudget(value.maxNew);
+    if (blockOn !== undefined)
+        policy.blockOn = blockOn;
+    if (maxNew !== undefined)
+        policy.maxNew = maxNew;
+    if (typeof value.changedFilesOnly === 'boolean')
+        policy.changedFilesOnly = value.changedFilesOnly;
+    if (typeof value.minimumScore === 'number' && value.minimumScore >= 0 && value.minimumScore <= 100) {
+        policy.minimumScore = value.minimumScore;
+    }
+    if (typeof value.requireBaseline === 'boolean')
+        policy.requireBaseline = value.requireBaseline;
+    if (typeof value.failOnExpiredAcknowledgments === 'boolean') {
+        policy.failOnExpiredAcknowledgments = value.failOnExpiredAcknowledgments;
+    }
+    return policy;
+}
+/**
+ * Load delivery policy from an explicit file, conventional policy file, or the
+ * `deliveryPolicy` block inside the scanner config, in that precedence order.
+ */
+export async function loadDeliveryPolicy(projectPath, policyFile, configFile) {
+    const root = resolve(projectPath);
+    const explicit = policyFile
+        ? (isAbsolute(policyFile) ? policyFile : resolve(root, policyFile))
+        : undefined;
+    const candidates = [
+        explicit,
+        join(root, 'vlayer.policy.json'),
+        join(root, '.vlayer', 'policy.json'),
+    ].filter((value) => Boolean(value));
+    for (const candidate of candidates) {
+        const raw = await readJson(candidate);
+        if (raw !== undefined) {
+            return { policy: parseDeliveryPolicy(raw), source: candidate };
+        }
+    }
+    const configPath = configFile
+        ? (isAbsolute(configFile) ? configFile : resolve(root, configFile))
+        : join(root, '.vlayerrc.json');
+    const rawConfig = await readJson(configPath);
+    if (isRecord(rawConfig) && rawConfig.deliveryPolicy !== undefined) {
+        return {
+            policy: parseDeliveryPolicy(rawConfig.deliveryPolicy),
+            source: `${configPath}#deliveryPolicy`,
+        };
+    }
+    return { policy: {} };
+}
+/**
+ * Summarize exception governance directly from the scanner configuration.
+ */
+export async function getAcknowledgmentLifecycle(projectPath, configFile, now = new Date()) {
+    const config = await loadConfig(resolve(projectPath), configFile);
+    const acknowledgments = config.acknowledgedFindings ?? [];
+    const thirtyDays = 30 * 24 * 60 * 60 * 1000;
+    const expired = [];
+    const active = [];
+    const expiringSoon = [];
+    for (const acknowledgment of acknowledgments) {
+        const expiresAt = acknowledgment.expiresAt ? new Date(acknowledgment.expiresAt) : undefined;
+        if (expiresAt && !Number.isNaN(expiresAt.getTime()) && expiresAt.getTime() < now.getTime()) {
+            expired.push(acknowledgment);
+            continue;
+        }
+        active.push(acknowledgment);
+        if (expiresAt
+            && !Number.isNaN(expiresAt.getTime())
+            && expiresAt.getTime() - now.getTime() <= thirtyDays) {
+            expiringSoon.push(acknowledgment);
+        }
+    }
+    return {
+        total: acknowledgments.length,
+        active,
+        expired,
+        expiringSoon,
+    };
+}
+//# sourceMappingURL=governance.js.map

package/dist/delivery/governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/delivery/governance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1F,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAoB,EAAE,CACrD,OAAO,IAAI,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAgB,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnF,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACjD,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,SAAS;QAAE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAClG,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,IAAI,KAAK,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC;QACnG,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC/F,IAAI,OAAO,KAAK,CAAC,4BAA4B,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,CAAC,4BAA4B,GAAG,KAAK,CAAC,4BAA4B,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,UAAmB,EACnB,UAAmB;IAEnB,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU;QACzB,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,UAAU,GAAG;QACjB,QAAQ;QACR,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;KACrC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,EAAE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACnE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAClE,OAAO;YACL,MAAM,EAAE,mBAAmB,CAAC,SAAS,CAAC,cAAc,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,iBAAiB;SACvC,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACxB,CAAC;AASD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,UAAmB,EACnB,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;IAClE,MAAM,eAAe,GAAG,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;IAC1D,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE5C,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,MAAM,YAAY,GAA0B,EAAE,CAAC;IAE/C,KAAK,MAAM,cAAc,IAAI,eAAe,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC3F,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC7B,SAAS;QACX,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC5B,IACE,SAAS;eACN,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;eAClC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,UAAU,EACpD,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,MAAM;QAC7B,MAAM;QACN,OAAO;QACP,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/delivery/graph.d.ts

@@ -0,0 +1,11 @@
+import type { Finding } from '../types.js';
+import type { ComplianceGraph, GitContext, PolicyDecision } from './types.js';
+export declare function controlForFinding(finding: Finding): string;
+/**
+ * Materialize the core vlayer knowledge graph:
+ * code -> finding -> control -> policy, with optional ownership and evidence.
+ */
+export declare function buildComplianceGraph(findings: Finding[], projectRoot: string, decision: PolicyDecision, git?: GitContext): ComplianceGraph;
+/** Render a portable Mermaid view for reports and documentation. */
+export declare function graphToMermaid(graph: ComplianceGraph): string;
+//# sourceMappingURL=graph.d.ts.map

package/dist/delivery/graph.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../../src/delivery/graph.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAM3C,OAAO,KAAK,EACV,eAAe,EAGf,UAAU,EACV,cAAc,EACf,MAAM,YAAY,CAAC;AA4BpB,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAE1D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,cAAc,EACxB,GAAG,CAAC,EAAE,UAAU,GACf,eAAe,CAqFjB;AAMD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAa7D"}

package/dist/delivery/graph.js

@@ -0,0 +1,130 @@
+import { createHash } from 'crypto';
+import { canonicalRuleId, generateFindingHash, normalizeFindingFile, } from '../baseline.js';
+const CATEGORY_CONTROLS = {
+    'phi-exposure': 'HIPAA Privacy + §164.312(a)(1)',
+    encryption: '§164.312(a)(2)(iv) / §164.312(e)(2)(ii)',
+    'audit-logging': '§164.312(b)',
+    'access-control': '§164.312(a)(1) / §164.312(d)',
+    'data-retention': '§164.316(b)(2)(i)',
+};
+function shortHash(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, 12);
+}
+function addNode(nodes, node) {
+    if (!nodes.has(node.id))
+        nodes.set(node.id, node);
+}
+function addEdge(edges, edge) {
+    if (!edges.some(existing => existing.from === edge.from
+        && existing.to === edge.to
+        && existing.relation === edge.relation)) {
+        edges.push(edge);
+    }
+}
+export function controlForFinding(finding) {
+    return finding.hipaaReference?.trim() || CATEGORY_CONTROLS[finding.category] || 'HIPAA Security Rule';
+}
+/**
+ * Materialize the core vlayer knowledge graph:
+ * code -> finding -> control -> policy, with optional ownership and evidence.
+ */
+export function buildComplianceGraph(findings, projectRoot, decision, git) {
+    const nodes = new Map();
+    const edges = [];
+    const policyId = 'policy:delivery';
+    const evidenceId = `evidence:${shortHash(`${decision.evaluatedAt}|${git?.headSha ?? 'local'}`)}`;
+    addNode(nodes, {
+        id: policyId,
+        type: 'policy',
+        label: decision.deployAllowed ? 'Deployment policy: PASS' : 'Deployment policy: FAIL',
+        metadata: {
+            deployAllowed: decision.deployAllowed,
+            scope: decision.consideredScope,
+            reasons: decision.reasons.length,
+        },
+    });
+    addNode(nodes, {
+        id: evidenceId,
+        type: 'evidence',
+        label: git?.headSha ? `Evidence for ${git.headSha.slice(0, 8)}` : 'Local scan evidence',
+        metadata: {
+            headSha: git?.headSha ?? null,
+            baseSha: git?.baseSha ?? null,
+        },
+    });
+    addEdge(edges, { from: evidenceId, to: policyId, relation: 'supports' });
+    let ownerId;
+    if (git?.author) {
+        ownerId = `owner:${shortHash(git.author)}`;
+        addNode(nodes, {
+            id: ownerId,
+            type: 'owner',
+            label: git.author,
+        });
+    }
+    for (const finding of findings) {
+        const file = normalizeFindingFile(finding, projectRoot);
+        const fingerprint = generateFindingHash(finding, projectRoot);
+        const codeId = `code:${shortHash(file)}`;
+        const findingId = `finding:${fingerprint}`;
+        const control = controlForFinding(finding);
+        const controlId = `control:${shortHash(control)}`;
+        addNode(nodes, {
+            id: codeId,
+            type: 'code',
+            label: file,
+            metadata: { file },
+        });
+        addNode(nodes, {
+            id: findingId,
+            type: 'finding',
+            label: finding.title,
+            metadata: {
+                fingerprint,
+                ruleId: canonicalRuleId(finding.id),
+                severity: finding.severity,
+                category: finding.category,
+                line: finding.line ?? null,
+                acknowledged: finding.acknowledged === true,
+                baseline: finding.isBaseline === true,
+            },
+        });
+        addNode(nodes, {
+            id: controlId,
+            type: 'control',
+            label: control,
+        });
+        addEdge(edges, { from: codeId, to: findingId, relation: 'contains' });
+        addEdge(edges, { from: findingId, to: controlId, relation: 'violates' });
+        addEdge(edges, { from: findingId, to: policyId, relation: 'governed-by' });
+        addEdge(edges, { from: evidenceId, to: findingId, relation: 'supports' });
+        if (ownerId)
+            addEdge(edges, { from: findingId, to: ownerId, relation: 'owned-by' });
+    }
+    return {
+        schemaVersion: '1.0',
+        generatedAt: new Date().toISOString(),
+        nodes: [...nodes.values()],
+        edges,
+    };
+}
+function mermaidLabel(value) {
+    return value.replace(/"/g, "'").replace(/\n/g, ' ');
+}
+/** Render a portable Mermaid view for reports and documentation. */
+export function graphToMermaid(graph) {
+    const lines = ['flowchart LR'];
+    for (const node of graph.nodes) {
+        const id = `n${shortHash(node.id)}`;
+        lines.push(`  ${id}["${mermaidLabel(node.label)}"]`);
+    }
+    const ids = new Map(graph.nodes.map(node => [node.id, `n${shortHash(node.id)}`]));
+    for (const edge of graph.edges) {
+        const from = ids.get(edge.from);
+        const to = ids.get(edge.to);
+        if (from && to)
+            lines.push(`  ${from} -->|${edge.relation}| ${to}`);
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=graph.js.map

package/dist/delivery/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/delivery/graph.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AASxB,MAAM,iBAAiB,GAA2B;IAChD,cAAc,EAAE,gCAAgC;IAChD,UAAU,EAAE,yCAAyC;IACrD,eAAe,EAAE,aAAa;IAC9B,gBAAgB,EAAE,8BAA8B;IAChD,gBAAgB,EAAE,mBAAmB;CACtC,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,OAAO,CAAC,KAAuC,EAAE,IAAyB;IACjF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,KAA4B,EAAE,IAAyB;IACtE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CACzB,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;WACxB,QAAQ,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;WACvB,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CACvC,EAAE,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,OAAO,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,qBAAqB,CAAC;AACxG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,WAAmB,EACnB,QAAwB,EACxB,GAAgB;IAEhB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA+B,CAAC;IACrD,MAAM,KAAK,GAA0B,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;IACnC,MAAM,UAAU,GAAG,YAAY,SAAS,CAAC,GAAG,QAAQ,CAAC,WAAW,IAAI,GAAG,EAAE,OAAO,IAAI,OAAO,EAAE,CAAC,EAAE,CAAC;IAEjG,OAAO,CAAC,KAAK,EAAE;QACb,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,yBAAyB;QACrF,QAAQ,EAAE;YACR,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,KAAK,EAAE,QAAQ,CAAC,eAAe;YAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM;SACjC;KACF,CAAC,CAAC;IAEH,OAAO,CAAC,KAAK,EAAE;QACb,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;QACvF,QAAQ,EAAE;YACR,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;YAC7B,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;SAC9B;KACF,CAAC,CAAC;IACH,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzE,IAAI,OAA2B,CAAC;IAChC,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,GAAG,SAAS,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO,CAAC,KAAK,EAAE;YACb,EAAE,EAAE,OAAO;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,GAAG,CAAC,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,QAAQ,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,WAAW,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAElD,OAAO,CAAC,KAAK,EAAE;YACb,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,EAAE,IAAI,EAAE;SACnB,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE;YACb,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE;gBACR,WAAW;gBACX,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBACnC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;gBAC3C,QAAQ,EAAE,OAAO,CAAC,UAAU,KAAK,IAAI;aACtC;SACF,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,EAAE;YACb,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1E,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACtD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,KAAsB;IACnD,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,IAAI,IAAI,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,IAAI,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/delivery/index.d.ts

@@ -0,0 +1,14 @@
+export { getGitContext } from './git.js';
+export { buildFindingDelta } from './diff.js';
+export { DEFAULT_DELIVERY_POLICY, evaluateDeliveryPolicy, resolveDeliveryPolicy, } from './policy.js';
+export { getAcknowledgmentLifecycle, loadDeliveryPolicy, parseDeliveryPolicy, } from './governance.js';
+export { buildComplianceGraph, controlForFinding, graphToMermaid, } from './graph.js';
+export { buildEvidencePackage, hashEvidencePayload, saveEvidencePackage, verifyEvidencePackage, } from './evidence.js';
+export { uploadEvidenceFile, uploadEvidencePackage, } from './upload.js';
+export { buildRemediationPlan, remediationToMarkdown, } from './remediation.js';
+export { runComplianceGuard } from './runner.js';
+export type { ComplianceGraph, ComplianceGraphEdge, ComplianceGraphNode, ComplianceGraphNodeType, DeliveryPolicy, EvidenceFinding, EvidencePackage, FindingDelta, GitContext, GuardResult, PolicyDecision, PolicyReason, RemediationItem, RemediationPlan, SeverityBudget, } from './types.js';
+export type { GuardExecution, RunGuardOptions } from './runner.js';
+export type { AcknowledgmentLifecycle, LoadedDeliveryPolicy } from './governance.js';
+export type { UploadEvidenceOptions, UploadEvidenceResult } from './upload.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/delivery/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/delivery/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,eAAe,EACf,eAAe,EACf,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnE,YAAY,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACrF,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/dist/delivery/index.js

@@ -0,0 +1,10 @@
+export { getGitContext } from './git.js';
+export { buildFindingDelta } from './diff.js';
+export { DEFAULT_DELIVERY_POLICY, evaluateDeliveryPolicy, resolveDeliveryPolicy, } from './policy.js';
+export { getAcknowledgmentLifecycle, loadDeliveryPolicy, parseDeliveryPolicy, } from './governance.js';
+export { buildComplianceGraph, controlForFinding, graphToMermaid, } from './graph.js';
+export { buildEvidencePackage, hashEvidencePayload, saveEvidencePackage, verifyEvidencePackage, } from './evidence.js';
+export { uploadEvidenceFile, uploadEvidencePackage, } from './upload.js';
+export { buildRemediationPlan, remediationToMarkdown, } from './remediation.js';
+export { runComplianceGuard } from './runner.js';
+//# sourceMappingURL=index.js.map

package/dist/delivery/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/delivery/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}