@absolutejs/agent-trust 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AbsoluteJS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,17 @@
+# @absolutejs/agent-trust
+
+Provider-neutral provenance and taint tracking for agents. Every value carries
+its purpose, authority, source, digest/proof, taints, parent digests, and
+evidence-bearing transformations.
+
+The central security rule is structural: external content is data, never an
+instruction merely because it contains imperative language. `compileAgentContext`
+returns separate instruction and data segments instead of interpolating tool,
+web, file, or memory content into a privileged prompt. Sink policies then fail
+closed before instructions or actions cross a trust boundary.
+
+Taints propagate through derived model output. A sanitizer may remove named
+taints only while recording evidence and a new digest; there is no implicit
+"trusted because the model said so" conversion. Proof verification is injected,
+so signed discovery descriptors, DSSE, JWTs, or provider KMS can share the same
+contract.

package/dist/context.d.ts

@@ -0,0 +1,18 @@
+import type { TrustedAgentValue } from "./types";
+export type AgentContextSegment = {
+    channel: "instructions" | "data";
+    content: string;
+    metadata: {
+        authority: string;
+        source: string;
+        digest?: string;
+        taints: string[];
+    };
+};
+/**
+ * Produces structured segments so providers can map trusted instructions and
+ * untrusted data to separate message/content channels. It never concatenates
+ * external data into an instruction string.
+ */
+export declare const compileAgentContext: (values: readonly TrustedAgentValue[]) => AgentContextSegment[];
+export declare const detectPromptInjection: <Value>(input: TrustedAgentValue<Value>, detector: (value: Value) => boolean | Promise<boolean>) => Promise<TrustedAgentValue<Value>>;

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./types";
+export * from "./trust";
+export * from "./context";

package/dist/index.js

@@ -0,0 +1,111 @@
+// @bun
+// src/trust.ts
+var unique = (values) => [...new Set(values)];
+var encoder = new TextEncoder;
+var stable = (value) => JSON.stringify(value, (_key, item) => item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a.localeCompare(b))) : item);
+var digestAgentValue = async (value) => `sha256:${Buffer.from(await crypto.subtle.digest("SHA-256", encoder.encode(stable(value)))).toString("hex")}`;
+var trustAgentValue = (value, labels) => ({
+  value,
+  purpose: labels.purpose,
+  authority: labels.authority,
+  provenance: structuredClone(labels.provenance),
+  taints: unique(labels.taints ?? []),
+  transformations: []
+});
+var deriveAgentValue = (value, parents, input) => ({
+  value,
+  purpose: input.purpose,
+  authority: input.authority ?? (parents.every((parent) => parent.authority === parents[0]?.authority) ? parents[0]?.authority ?? "model" : "model"),
+  taints: unique(parents.flatMap((parent) => parent.taints).concat("model-generated")),
+  provenance: {
+    ...input.provenance,
+    parentDigests: parents.flatMap((parent) => parent.provenance.digest ? [parent.provenance.digest] : [])
+  },
+  transformations: [
+    ...parents.flatMap((parent) => parent.transformations),
+    input.transformation
+  ]
+});
+var withAgentValueDigest = async (input) => ({
+  ...structuredClone(input),
+  provenance: {
+    ...input.provenance,
+    digest: await digestAgentValue(input.value)
+  }
+});
+var sanitizeAgentValue = async (input, sanitizer, at = new Date().toISOString()) => {
+  const result = await sanitizer.run(input.value);
+  if (result.evidence === undefined)
+    throw new Error("Sanitizer must return evidence");
+  return {
+    ...structuredClone(input),
+    value: result.value,
+    taints: input.taints.filter((taint) => !sanitizer.removes.includes(taint)),
+    transformations: [
+      ...input.transformations,
+      { id: sanitizer.id, at, evidence: result.evidence }
+    ],
+    provenance: {
+      ...input.provenance,
+      digest: await digestAgentValue(result.value),
+      parentDigests: unique([
+        ...input.provenance.parentDigests ?? [],
+        ...input.provenance.digest ? [input.provenance.digest] : []
+      ])
+    }
+  };
+};
+var enforceAgentTrustPolicy = async (input, policy, verifyProof) => {
+  if (!policy.allowedPurposes.includes(input.purpose))
+    throw new Error(`Purpose ${input.purpose} is denied at ${policy.sink}`);
+  if (policy.allowedAuthorities && !policy.allowedAuthorities.includes(input.authority))
+    throw new Error(`Authority ${input.authority} is denied at ${policy.sink}`);
+  const denied = input.taints.find((taint) => policy.deniedTaints?.includes(taint));
+  if (denied)
+    throw new Error(`Taint ${denied} is denied at ${policy.sink}`);
+  if (policy.requireDigest && !input.provenance.digest)
+    throw new Error(`A provenance digest is required at ${policy.sink}`);
+  if (policy.requireVerifiedProof && (!verifyProof || !await verifyProof(input.provenance)))
+    throw new Error(`Verified provenance is required at ${policy.sink}`);
+};
+var AGENT_INSTRUCTION_POLICY = {
+  sink: "agent.instructions",
+  allowedPurposes: ["instruction"],
+  allowedAuthorities: ["system", "developer", "user", "delegated"],
+  deniedTaints: ["external", "unverified", "prompt-injection-suspected"]
+};
+var AGENT_ACTION_POLICY = {
+  sink: "agent.actions",
+  allowedPurposes: ["data", "tool-output", "memory"],
+  deniedTaints: ["secret", "prompt-injection-suspected", "executable"],
+  requireDigest: true
+};
+// src/context.ts
+var compileAgentContext = (values) => values.map((item) => ({
+  channel: item.purpose === "instruction" ? "instructions" : "data",
+  content: typeof item.value === "string" ? item.value : JSON.stringify(item.value),
+  metadata: {
+    authority: item.authority,
+    source: item.provenance.source,
+    digest: item.provenance.digest,
+    taints: [...item.taints]
+  }
+}));
+var detectPromptInjection = async (input, detector) => await detector(input.value) ? {
+  ...structuredClone(input),
+  taints: [
+    ...new Set([...input.taints, "prompt-injection-suspected"])
+  ]
+} : structuredClone(input);
+export {
+  withAgentValueDigest,
+  trustAgentValue,
+  sanitizeAgentValue,
+  enforceAgentTrustPolicy,
+  digestAgentValue,
+  detectPromptInjection,
+  deriveAgentValue,
+  compileAgentContext,
+  AGENT_INSTRUCTION_POLICY,
+  AGENT_ACTION_POLICY
+};

package/dist/manifest.d.ts

@@ -0,0 +1 @@
+export declare const manifest: import("@absolutejs/manifest").PackageManifest<unknown, never>;

package/dist/manifest.js

@@ -0,0 +1,23 @@
+// @bun
+// src/manifest.ts
+import { defineManifest } from "@absolutejs/manifest";
+import { Type } from "@sinclair/typebox";
+var manifest = defineManifest()({
+  contract: 2,
+  identity: {
+    name: "@absolutejs/agent-trust",
+    category: "security",
+    tagline: "Keep agent instructions authoritative and external data untrusted.",
+    description: "Provider-neutral provenance envelopes, taint propagation, explicit instruction/data channels, evidence-bearing sanitizers, and fail-closed sink policies for AI agents.",
+    docsUrl: "https://github.com/absolutejs/agent-trust",
+    accent: "#f59e0b"
+  },
+  settings: Type.Object({}),
+  slots: {},
+  implements: [],
+  tools: {},
+  wiring: []
+});
+export {
+  manifest
+};

package/dist/manifest.json

@@ -0,0 +1,19 @@
+{
+	"contract": 2,
+	"identity": {
+		"name": "@absolutejs/agent-trust",
+		"category": "security",
+		"tagline": "Keep agent instructions authoritative and external data untrusted.",
+		"description": "Provider-neutral provenance envelopes, taint propagation, explicit instruction/data channels, evidence-bearing sanitizers, and fail-closed sink policies for AI agents.",
+		"docsUrl": "https://github.com/absolutejs/agent-trust",
+		"accent": "#f59e0b"
+	},
+	"settings": {
+		"type": "object",
+		"properties": {}
+	},
+	"slots": {},
+	"implements": [],
+	"wiring": [],
+	"tools": {}
+}

package/dist/trust.d.ts

@@ -0,0 +1,33 @@
+import type { AgentAuthority, AgentContentPurpose, AgentProofVerifier, AgentProvenance, AgentTaint, AgentTrustSinkPolicy, TrustedAgentValue } from "./types";
+export declare const digestAgentValue: (value: unknown) => Promise<string>;
+export declare const trustAgentValue: <Value>(value: Value, labels: {
+    purpose: AgentContentPurpose;
+    authority: AgentAuthority;
+    provenance: AgentProvenance;
+    taints?: AgentTaint[];
+}) => TrustedAgentValue<Value>;
+export declare const deriveAgentValue: <Value>(value: Value, parents: readonly TrustedAgentValue[], input: {
+    purpose: AgentContentPurpose;
+    authority?: AgentAuthority;
+    transformation: {
+        id: string;
+        at: string;
+        evidence?: unknown;
+    };
+    provenance: Omit<AgentProvenance, "parentDigests">;
+}) => TrustedAgentValue<Value>;
+export declare const withAgentValueDigest: <Value>(input: TrustedAgentValue<Value>) => Promise<TrustedAgentValue<Value>>;
+export declare const sanitizeAgentValue: <Value>(input: TrustedAgentValue<Value>, sanitizer: {
+    id: string;
+    removes: AgentTaint[];
+    run(value: Value): Promise<{
+        value: Value;
+        evidence: unknown;
+    }> | {
+        value: Value;
+        evidence: unknown;
+    };
+}, at?: string) => Promise<TrustedAgentValue<Value>>;
+export declare const enforceAgentTrustPolicy: (input: TrustedAgentValue, policy: AgentTrustSinkPolicy, verifyProof?: AgentProofVerifier) => Promise<void>;
+export declare const AGENT_INSTRUCTION_POLICY: AgentTrustSinkPolicy;
+export declare const AGENT_ACTION_POLICY: AgentTrustSinkPolicy;

package/dist/types.d.ts

@@ -0,0 +1,33 @@
+export type AgentAuthority = "system" | "developer" | "user" | "delegated" | "tool" | "external" | "model";
+export type AgentContentPurpose = "instruction" | "data" | "tool-output" | "memory" | "credential";
+export type AgentTaint = "external" | "user-controlled" | "model-generated" | "unverified" | "personal" | "secret" | "financial" | "executable" | "prompt-injection-suspected";
+export type AgentProvenance = {
+    source: string;
+    sourceType: "user" | "agent" | "tool" | "web" | "file" | "memory" | "system";
+    producer?: string;
+    retrievedAt: string;
+    digest?: string;
+    parentDigests?: string[];
+    proof?: unknown;
+};
+export type TrustedAgentValue<Value = unknown> = {
+    value: Value;
+    purpose: AgentContentPurpose;
+    authority: AgentAuthority;
+    taints: AgentTaint[];
+    provenance: AgentProvenance;
+    transformations: Array<{
+        id: string;
+        at: string;
+        evidence?: unknown;
+    }>;
+};
+export type AgentTrustSinkPolicy = {
+    sink: string;
+    allowedPurposes: AgentContentPurpose[];
+    allowedAuthorities?: AgentAuthority[];
+    deniedTaints?: AgentTaint[];
+    requireDigest?: boolean;
+    requireVerifiedProof?: boolean;
+};
+export type AgentProofVerifier = (provenance: AgentProvenance) => boolean | Promise<boolean>;

package/package.json

@@ -0,0 +1,51 @@
+{
+  "name": "@absolutejs/agent-trust",
+  "version": "0.1.0",
+  "description": "Provider-neutral provenance, taint propagation, instruction/data separation, and sink policy enforcement for AI agents.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/absolutejs/agent-trust.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "absolutejs": {
+    "manifestContract": 2
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./manifest": {
+      "types": "./dist/manifest.d.ts",
+      "import": "./dist/manifest.js"
+    },
+    "./manifest.json": "./dist/manifest.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "format": "prettier --write \"./**/*.{ts,json,md,yml}\"",
+    "typecheck": "tsc --noEmit",
+    "test": "bun test",
+    "build": "rm -rf dist && bun build src/index.ts src/manifest.ts --outdir dist --target=bun --external @absolutejs/manifest --external @sinclair/typebox && tsc -p tsconfig.build.json && absolute-manifest emit",
+    "check:package": "bun run typecheck && bun run test && bun run build"
+  },
+  "dependencies": {
+    "@absolutejs/manifest": "^0.2.0",
+    "@sinclair/typebox": "^0.34.0"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.14",
+    "prettier": "3.5.3",
+    "typescript": "5.8.3"
+  }
+}