@aion0/bastion 0.1.11 → 0.1.13

package/dist/plugins/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/plugins/loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAG3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQrD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,wBAAsB,mBAAmB,CACvC,eAAe,EAAE,oBAAoB,EAAE,EACvC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,cAAc,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAA;CAAE,CAAC,CAwGxJ"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/plugins/loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAG3C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAQrD,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,wBAAsB,mBAAmB,CACvC,eAAe,EAAE,oBAAoB,EAAE,EACvC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EACrB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,cAAc,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,SAAS,CAAA;CAAE,CAAC,CAwHxJ"}

package/dist/plugins/loader.js

@@ -18,10 +18,25 @@ async function loadExternalPlugins(externalConfigs, db, eventBus) {
             log.info('External plugin disabled, skipping', { package: cfg.package });
             continue;
         }
-        // Dynamic import
+        // Dynamic import — resolve directory to package.json main entry for ESM compatibility
+        let importPath = cfg.package;
+        try {
+            const { join } = await import('node:path');
+            const { readFileSync, statSync } = await import('node:fs');
+            const s = statSync(importPath);
+            if (s.isDirectory()) {
+                const pkgPath = join(importPath, 'package.json');
+                const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+                const entry = pkg.main ?? 'index.js';
+                importPath = join(importPath, entry);
+            }
+        }
+        catch {
+            // If stat/read fails, keep original path and let import() handle the error
+        }
         let mod;
         try {
-            mod = await import(cfg.package);
+            mod = await import(importPath);
         }
         catch (err) {
             log.warn('Failed to import external plugin package', {
@@ -74,9 +89,11 @@ async function loadExternalPlugins(externalConfigs, db, eventBus) {
                 });
                 continue;
             }
-            // Adapt to internal Plugin interface
-            const adapted = (0, adapter_js_1.adaptPlugin)(externalPlugin, priorityCounter, repo, cfg.package);
-            priorityCounter += 1;
+            // Adapt to internal Plugin interface — use declared priority if available
+            const declaredPriority = externalPlugin.priority ?? priorityCounter;
+            const adapted = (0, adapter_js_1.adaptPlugin)(externalPlugin, declaredPriority, repo, cfg.package);
+            if (!externalPlugin.priority)
+                priorityCounter += 1;
             plugins.push(adapted);
             // Collect destroy callbacks
             if (externalPlugin.onDestroy) {

package/dist/plugins/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/plugins/loader.ts"],"names":[],"mappings":";;AAkBA,kDA4GC;AA5HD,qDAA4D;AAG5D,+EAAkF;AAClF,6CAA+E;AAC/E,6CAA2C;AAC3C,kDAAkD;AAElD,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,eAAe,CAAC,CAAC;AAQnC,KAAK,UAAU,mBAAmB,CACvC,eAAuC,EACvC,EAAqB,EACrB,QAAwB;IAExB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAA+B,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,yCAAsB,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,eAAe,GAAG,EAAE,CAAC;IAEzB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,iBAAiB;QACjB,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBACnD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAG,GAAa,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,8CAA8C;QAC9C,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAK,GAAG,CAAC,OAAmC,EAAE,QAAQ,CAEzE,CAAC;QAEd,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAuD,CAAC;QAC5D,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC3C,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAG,GAAa,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,wCAAwC;QACxC,KAAK,MAAM,cAAc,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC9C,sBAAsB;YACtB,IAAI,cAAc,CAAC,UAAU,KAAK,6BAAkB,EAAE,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBACxD,MAAM,EAAE,cAAc,CAAC,IAAI;oBAC3B,QAAQ,EAAE,6BAAkB;oBAC5B,GAAG,EAAE,cAAc,CAAC,UAAU;iBAC/B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAA,gCAAmB,EACjC,cAAc,CAAC,IAAI,EACnB,GAAG,CAAC,MAAM,IAAI,EAAE,EAChB,IAAI,EACJ,QAAQ,CACT,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAE7C,IAAI,CAAC;gBACH,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;oBAC1B,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBAClD,MAAM,EAAE,cAAc,CAAC,IAAI;oBAC3B,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,OAAO,GAAG,IAAA,wBAAW,EAAC,cAAc,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAChF,eAAe,IAAI,CAAC,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtB,4BAA4B;YAC5B,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;gBAC7B,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;YACvE,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACjC,MAAM,EAAE,cAAc,CAAC,IAAI;gBAC3B,OAAO,EAAE,cAAc,CAAC,OAAO;gBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,UAAkB,EAAE,GAAW;QACrD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;AACvD,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/plugins/loader.ts"],"names":[],"mappings":";;AAkBA,kDA4HC;AA5ID,qDAA4D;AAG5D,+EAAkF;AAClF,6CAA+E;AAC/E,6CAA2C;AAC3C,kDAAkD;AAElD,MAAM,GAAG,GAAG,IAAA,wBAAY,EAAC,eAAe,CAAC,CAAC;AAQnC,KAAK,UAAU,mBAAmB,CACvC,eAAuC,EACvC,EAAqB,EACrB,QAAwB;IAExB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,gBAAgB,GAA+B,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,yCAAsB,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,eAAe,GAAG,EAAE,CAAC;IAEzB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,SAAS;QACX,CAAC;QAED,sFAAsF;QACtF,IAAI,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3C,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3D,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;gBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBACvD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC;gBACrC,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;QAED,IAAI,GAA4B,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE;gBACnD,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAG,GAAa,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,8CAA8C;QAC9C,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAK,GAAG,CAAC,OAAmC,EAAE,QAAQ,CAEzE,CAAC;QAEd,IAAI,OAAO,UAAU,KAAK,UAAU,EAAE,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC,kDAAkD,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QAED,kBAAkB;QAClB,IAAI,QAAuD,CAAC;QAC5D,IAAI,CAAC;YACH,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE;gBAC3C,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK,EAAG,GAAa,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,wCAAwC;QACxC,KAAK,MAAM,cAAc,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC9C,sBAAsB;YACtB,IAAI,cAAc,CAAC,UAAU,KAAK,6BAAkB,EAAE,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBACxD,MAAM,EAAE,cAAc,CAAC,IAAI;oBAC3B,QAAQ,EAAE,6BAAkB;oBAC5B,GAAG,EAAE,cAAc,CAAC,UAAU;iBAC/B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAA,gCAAmB,EACjC,cAAc,CAAC,IAAI,EACnB,GAAG,CAAC,MAAM,IAAI,EAAE,EAChB,IAAI,EACJ,QAAQ,CACT,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAE7C,IAAI,CAAC;gBACH,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;oBAC1B,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE;oBAClD,MAAM,EAAE,cAAc,CAAC,IAAI;oBAC3B,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,0EAA0E;YAC1E,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,IAAI,eAAe,CAAC;YACpE,MAAM,OAAO,GAAG,IAAA,wBAAW,EAAC,cAAc,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACjF,IAAI,CAAC,cAAc,CAAC,QAAQ;gBAAE,eAAe,IAAI,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEtB,4BAA4B;YAC5B,IAAI,cAAc,CAAC,SAAS,EAAE,CAAC;gBAC7B,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;YACvE,CAAC;YAED,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACjC,MAAM,EAAE,cAAc,CAAC,IAAI;gBAC3B,OAAO,EAAE,cAAc,CAAC,OAAO;gBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,UAAkB,EAAE,GAAW;QACrD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9C,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;AACvD,CAAC"}

package/dist/plugins/types.d.ts

@@ -26,6 +26,9 @@ export interface RequestContext {
     _toolGuardStreamBlock?: string;
     /** Internal: DB-loaded rules for streaming guard (set by tool-guard onRequest) */
     _toolGuardRules?: import('../tool-guard/rules.js').ToolGuardRule[];
+    /** Internal: set by threat-scorer for tool-guard to read */
+    _threatLevel?: 'normal' | 'elevated' | 'high' | 'critical';
+    _threatScore?: number;
 }
 export interface ResponseCompleteContext {
     request: RequestContext;

package/dist/plugins/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/plugins/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;mDAC+C;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,eAAe,CAAC,EAAE,OAAO,wBAAwB,EAAE,aAAa,EAAE,CAAC;CACpE;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,KAAK,EAAE;QACL,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzE,UAAU,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrF,kBAAkB,CAAC,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/plugins/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+FAA+F;IAC/F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;mDAC+C;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kFAAkF;IAClF,eAAe,CAAC,EAAE,OAAO,wBAAwB,EAAE,aAAa,EAAE,CAAC;IACnE,4DAA4D;IAC5D,YAAY,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,KAAK,EAAE;QACL,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,WAAW,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IACzE,UAAU,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACrF,kBAAkB,CAAC,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE"}

package/dist/storage/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/storage/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAkP3C,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAqCzD"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../src/storage/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AA8R3C,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAqCzD"}

package/dist/storage/migrations.js

@@ -223,6 +223,49 @@ const MIGRATIONS = [
     // Migration 16: DLP patterns — context_verify column for anti-pattern / entropy / code-block checks
     `
   ALTER TABLE dlp_patterns ADD COLUMN context_verify TEXT;
+  `,
+    // Migration 17: Threat Intelligence — session threat scoring, tool chain detection, taint tracking
+    `
+  CREATE TABLE IF NOT EXISTS threat_scores (
+    session_id TEXT PRIMARY KEY,
+    score REAL DEFAULT 0,
+    level TEXT DEFAULT 'normal',
+    event_count INTEGER DEFAULT 0,
+    last_event_at TEXT,
+    updated_at TEXT DEFAULT (datetime('now'))
+  );
+
+  CREATE TABLE IF NOT EXISTS threat_score_events (
+    id TEXT PRIMARY KEY,
+    session_id TEXT NOT NULL,
+    event_type TEXT NOT NULL,
+    source_event TEXT,
+    points REAL NOT NULL,
+    score_after REAL NOT NULL,
+    level_after TEXT NOT NULL,
+    created_at TEXT DEFAULT (datetime('now'))
+  );
+  CREATE INDEX IF NOT EXISTS idx_tse_session ON threat_score_events(session_id);
+
+  CREATE TABLE IF NOT EXISTS tool_chain_detections (
+    id TEXT PRIMARY KEY,
+    session_id TEXT NOT NULL,
+    rule_id TEXT NOT NULL,
+    matched_sequence TEXT NOT NULL,
+    action TEXT NOT NULL,
+    created_at TEXT DEFAULT (datetime('now'))
+  );
+
+  CREATE TABLE IF NOT EXISTS taint_marks (
+    id TEXT PRIMARY KEY,
+    session_id TEXT NOT NULL,
+    request_id TEXT NOT NULL,
+    pattern_name TEXT NOT NULL,
+    direction TEXT NOT NULL,
+    fingerprint TEXT,
+    created_at TEXT DEFAULT (datetime('now'))
+  );
+  CREATE INDEX IF NOT EXISTS idx_taint_session ON taint_marks(session_id);
   `,
 ];
 function runMigrations(db) {

package/dist/storage/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/storage/migrations.ts"],"names":[],"mappings":";;AAkPA,sCAqCC;AArRD,MAAM,UAAU,GAAa;IAC3B,8BAA8B;IAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDC;IAED,2EAA2E;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCC;IAED,6EAA6E;IAC7E;;;;;;;;;;;GAWC;IAED,0EAA0E;IAC1E;;;;;;;;;;;;;;GAcC;IAED,mEAAmE;IACnE;;GAEC;IAED,yDAAyD;IACzD;;;;GAIC;IAED,yCAAyC;IACzC;;;;;;GAMC;IAED,uDAAuD;IACvD;;;;;;;;;;;;;;;;;;;GAmBC;IAED,+DAA+D;IAC/D;;GAEC;IAED,4EAA4E;IAC5E;;;;;;;;;;;;;;;GAeC;IAED,gFAAgF;IAChF,iGAAiG;IACjG;;;;GAIC;IAED,sGAAsG;IACtG;;GAEC;IAED,gEAAgE;IAChE;;;GAGC;IAED,iEAAiE;IACjE;;;GAGC;IAED,sEAAsE;IACtE;;;;;;;;;;;;;;;;GAgBC;IAED,oGAAoG;IACpG;;GAEC;CACF,CAAC;AAEF,SAAgB,aAAa,CAAC,EAAqB;IACjD,qCAAqC;IACrC,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,EAE9E,CAAC;IACd,MAAM,OAAO,GAAG,cAAc,EAAE,OAAO,IAAI,CAAC,CAAC;IAE7C,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACrE,oEAAoE;gBACpE,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/E,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;oBAAC,OAAO,OAAO,EAAE,CAAC;wBACjB,IAAI,CAAC,CAAC,OAAO,YAAY,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;4BACjF,MAAM,OAAO,CAAC;wBAChB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/storage/migrations.ts"],"names":[],"mappings":";;AA8RA,sCAqCC;AAjUD,MAAM,UAAU,GAAa;IAC3B,8BAA8B;IAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDC;IAED,2EAA2E;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCC;IAED,6EAA6E;IAC7E;;;;;;;;;;;GAWC;IAED,0EAA0E;IAC1E;;;;;;;;;;;;;;GAcC;IAED,mEAAmE;IACnE;;GAEC;IAED,yDAAyD;IACzD;;;;GAIC;IAED,yCAAyC;IACzC;;;;;;GAMC;IAED,uDAAuD;IACvD;;;;;;;;;;;;;;;;;;;GAmBC;IAED,+DAA+D;IAC/D;;GAEC;IAED,4EAA4E;IAC5E;;;;;;;;;;;;;;;GAeC;IAED,gFAAgF;IAChF,iGAAiG;IACjG;;;;GAIC;IAED,sGAAsG;IACtG;;GAEC;IAED,gEAAgE;IAChE;;;GAGC;IAED,iEAAiE;IACjE;;;GAGC;IAED,sEAAsE;IACtE;;;;;;;;;;;;;;;;GAgBC;IAED,oGAAoG;IACpG;;GAEC;IAED,mGAAmG;IACnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCC;CACF,CAAC;AAEF,SAAgB,aAAa,CAAC,EAAqB;IACjD,qCAAqC;IACrC,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,EAAE,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,GAAG,EAE9E,CAAC;IACd,MAAM,OAAO,GAAG,cAAc,EAAE,OAAO,IAAI,CAAC,CAAC;IAE7C,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACrE,oEAAoE;gBACpE,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/E,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,IAAI,CAAC;wBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;oBAAC,OAAO,OAAO,EAAE,CAAC;wBACjB,IAAI,CAAC,CAAC,OAAO,YAAY,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;4BACjF,MAAM,OAAO,CAAC;wBAChB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QACD,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC"}

package/dist/storage/repositories/taint-marks.d.ts

@@ -0,0 +1,26 @@
+import type Database from 'better-sqlite3';
+export interface TaintMarkRecord {
+    id: string;
+    session_id: string;
+    request_id: string;
+    pattern_name: string;
+    direction: string;
+    fingerprint: string | null;
+    created_at: string;
+}
+export declare class TaintMarksRepository {
+    private db;
+    constructor(db: Database.Database);
+    insert(record: {
+        id: string;
+        session_id: string;
+        request_id: string;
+        pattern_name: string;
+        direction: string;
+        fingerprint: string | null;
+    }): void;
+    getBySession(sessionId: string): TaintMarkRecord[];
+    getActiveBySession(sessionId: string, withinMinutes?: number): TaintMarkRecord[];
+    purgeOlderThan(hours: number): number;
+}
+//# sourceMappingURL=taint-marks.d.ts.map

package/dist/storage/repositories/taint-marks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-marks.d.ts","sourceRoot":"","sources":["../../../src/storage/repositories/taint-marks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,EAAE,CAAoB;gBAElB,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAIjC,MAAM,CAAC,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,IAAI;IAOR,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE;IAMlD,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,GAAE,MAAW,GAAG,eAAe,EAAE;IAMpF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAMtC"}

package/dist/storage/repositories/taint-marks.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TaintMarksRepository = void 0;
+class TaintMarksRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(record) {
+        this.db.prepare(`
+      INSERT INTO taint_marks (id, session_id, request_id, pattern_name, direction, fingerprint)
+      VALUES (@id, @session_id, @request_id, @pattern_name, @direction, @fingerprint)
+    `).run(record);
+    }
+    getBySession(sessionId) {
+        return this.db.prepare('SELECT * FROM taint_marks WHERE session_id = ? ORDER BY created_at DESC').all(sessionId);
+    }
+    getActiveBySession(sessionId, withinMinutes = 60) {
+        return this.db.prepare(`SELECT * FROM taint_marks WHERE session_id = ? AND created_at > datetime('now', '-' || ? || ' minutes') ORDER BY created_at DESC`).all(sessionId, withinMinutes);
+    }
+    purgeOlderThan(hours) {
+        const result = this.db.prepare(`DELETE FROM taint_marks WHERE created_at < datetime('now', '-' || ? || ' hours')`).run(hours);
+        return result.changes;
+    }
+}
+exports.TaintMarksRepository = TaintMarksRepository;
+//# sourceMappingURL=taint-marks.js.map

package/dist/storage/repositories/taint-marks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-marks.js","sourceRoot":"","sources":["../../../src/storage/repositories/taint-marks.ts"],"names":[],"mappings":";;;AAYA,MAAa,oBAAoB;IACvB,EAAE,CAAoB;IAE9B,YAAY,EAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAON;QACC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGf,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CACpB,yEAAyE,CAC1E,CAAC,GAAG,CAAC,SAAS,CAAsB,CAAC;IACxC,CAAC;IAED,kBAAkB,CAAC,SAAiB,EAAE,gBAAwB,EAAE;QAC9D,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CACpB,kIAAkI,CACnI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAsB,CAAC;IACvD,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,kFAAkF,CACnF,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF;AAvCD,oDAuCC"}

package/dist/storage/repositories/threat-score-events.d.ts

@@ -0,0 +1,27 @@
+import type Database from 'better-sqlite3';
+export interface ThreatScoreEventRecord {
+    id: string;
+    session_id: string;
+    event_type: string;
+    source_event: string | null;
+    points: number;
+    score_after: number;
+    level_after: string;
+    created_at: string;
+}
+export declare class ThreatScoreEventsRepository {
+    private db;
+    constructor(db: Database.Database);
+    insert(record: {
+        id: string;
+        session_id: string;
+        event_type: string;
+        source_event: string | null;
+        points: number;
+        score_after: number;
+        level_after: string;
+    }): void;
+    getBySession(sessionId: string, limit?: number): ThreatScoreEventRecord[];
+    purgeOlderThan(hours: number): number;
+}
+//# sourceMappingURL=threat-score-events.d.ts.map

package/dist/storage/repositories/threat-score-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-score-events.d.ts","sourceRoot":"","sources":["../../../src/storage/repositories/threat-score-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,2BAA2B;IACtC,OAAO,CAAC,EAAE,CAAoB;gBAElB,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAIjC,MAAM,CAAC,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI;IAOR,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,sBAAsB,EAAE;IAM7E,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAMtC"}

package/dist/storage/repositories/threat-score-events.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ThreatScoreEventsRepository = void 0;
+class ThreatScoreEventsRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(record) {
+        this.db.prepare(`
+      INSERT INTO threat_score_events (id, session_id, event_type, source_event, points, score_after, level_after)
+      VALUES (@id, @session_id, @event_type, @source_event, @points, @score_after, @level_after)
+    `).run(record);
+    }
+    getBySession(sessionId, limit = 50) {
+        return this.db.prepare('SELECT * FROM threat_score_events WHERE session_id = ? ORDER BY created_at DESC LIMIT ?').all(sessionId, limit);
+    }
+    purgeOlderThan(hours) {
+        const result = this.db.prepare(`DELETE FROM threat_score_events WHERE created_at < datetime('now', '-' || ? || ' hours')`).run(hours);
+        return result.changes;
+    }
+}
+exports.ThreatScoreEventsRepository = ThreatScoreEventsRepository;
+//# sourceMappingURL=threat-score-events.js.map

package/dist/storage/repositories/threat-score-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-score-events.js","sourceRoot":"","sources":["../../../src/storage/repositories/threat-score-events.ts"],"names":[],"mappings":";;;AAaA,MAAa,2BAA2B;IAC9B,EAAE,CAAoB;IAE9B,YAAY,EAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAQN;QACC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGf,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAChD,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CACpB,yFAAyF,CAC1F,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAA6B,CAAC;IACtD,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,0FAA0F,CAC3F,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF;AAlCD,kEAkCC"}

package/dist/storage/repositories/threat-scores.d.ts

@@ -0,0 +1,26 @@
+import type Database from 'better-sqlite3';
+export interface ThreatScoreRecord {
+    session_id: string;
+    score: number;
+    level: string;
+    event_count: number;
+    last_event_at: string | null;
+    updated_at: string;
+}
+export declare class ThreatScoresRepository {
+    private db;
+    constructor(db: Database.Database);
+    upsert(record: {
+        session_id: string;
+        score: number;
+        level: string;
+        event_count: number;
+        last_event_at: string | null;
+    }): void;
+    get(sessionId: string): ThreatScoreRecord | null;
+    getAll(): ThreatScoreRecord[];
+    getElevated(): ThreatScoreRecord[];
+    reset(sessionId: string): void;
+    purgeOlderThan(hours: number): number;
+}
+//# sourceMappingURL=threat-scores.d.ts.map

package/dist/storage/repositories/threat-scores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-scores.d.ts","sourceRoot":"","sources":["../../../src/storage/repositories/threat-scores.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,EAAE,CAAoB;gBAElB,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAIjC,MAAM,CAAC,MAAM,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,GAAG,IAAI;IAaR,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI;IAMhD,MAAM,IAAI,iBAAiB,EAAE;IAM7B,WAAW,IAAI,iBAAiB,EAAE;IAMlC,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAO9B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAMtC"}

package/dist/storage/repositories/threat-scores.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ThreatScoresRepository = void 0;
+class ThreatScoresRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    upsert(record) {
+        this.db.prepare(`
+      INSERT INTO threat_scores (session_id, score, level, event_count, last_event_at, updated_at)
+      VALUES (@session_id, @score, @level, @event_count, @last_event_at, datetime('now'))
+      ON CONFLICT(session_id) DO UPDATE SET
+        score = @score,
+        level = @level,
+        event_count = @event_count,
+        last_event_at = @last_event_at,
+        updated_at = datetime('now')
+    `).run(record);
+    }
+    get(sessionId) {
+        return this.db.prepare('SELECT * FROM threat_scores WHERE session_id = ?').get(sessionId) ?? null;
+    }
+    getAll() {
+        return this.db.prepare('SELECT * FROM threat_scores ORDER BY updated_at DESC').all();
+    }
+    getElevated() {
+        return this.db.prepare("SELECT * FROM threat_scores WHERE level != 'normal' ORDER BY score DESC").all();
+    }
+    reset(sessionId) {
+        this.db.prepare(`
+      UPDATE threat_scores SET score = 0, level = 'normal', event_count = 0, updated_at = datetime('now')
+      WHERE session_id = ?
+    `).run(sessionId);
+    }
+    purgeOlderThan(hours) {
+        const result = this.db.prepare(`DELETE FROM threat_scores WHERE updated_at < datetime('now', '-' || ? || ' hours')`).run(hours);
+        return result.changes;
+    }
+}
+exports.ThreatScoresRepository = ThreatScoresRepository;
+//# sourceMappingURL=threat-scores.js.map

package/dist/storage/repositories/threat-scores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-scores.js","sourceRoot":"","sources":["../../../src/storage/repositories/threat-scores.ts"],"names":[],"mappings":";;;AAWA,MAAa,sBAAsB;IACzB,EAAE,CAAoB;IAE9B,YAAY,EAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAMN;QACC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;KASf,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAQ,IAAI,CAAC,EAAE,CAAC,OAAO,CACrB,kDAAkD,CACnD,CAAC,GAAG,CAAC,SAAS,CAAmC,IAAI,IAAI,CAAC;IAC7D,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CACpB,sDAAsD,CACvD,CAAC,GAAG,EAAyB,CAAC;IACjC,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CACpB,yEAAyE,CAC1E,CAAC,GAAG,EAAyB,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,SAAiB;QACrB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGf,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpB,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,oFAAoF,CACrF,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF;AAzDD,wDAyDC"}

package/dist/storage/repositories/tool-chain-detections.d.ts

@@ -0,0 +1,24 @@
+import type Database from 'better-sqlite3';
+export interface ToolChainDetectionRecord {
+    id: string;
+    session_id: string;
+    rule_id: string;
+    matched_sequence: string;
+    action: string;
+    created_at: string;
+}
+export declare class ToolChainDetectionsRepository {
+    private db;
+    constructor(db: Database.Database);
+    insert(record: {
+        id: string;
+        session_id: string;
+        rule_id: string;
+        matched_sequence: string;
+        action: string;
+    }): void;
+    getRecent(limit?: number): ToolChainDetectionRecord[];
+    getBySession(sessionId: string): ToolChainDetectionRecord[];
+    purgeOlderThan(hours: number): number;
+}
+//# sourceMappingURL=tool-chain-detections.d.ts.map

package/dist/storage/repositories/tool-chain-detections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-chain-detections.d.ts","sourceRoot":"","sources":["../../../src/storage/repositories/tool-chain-detections.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,6BAA6B;IACxC,OAAO,CAAC,EAAE,CAAoB;gBAElB,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAIjC,MAAM,CAAC,MAAM,EAAE;QACb,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,IAAI;IAOR,SAAS,CAAC,KAAK,GAAE,MAAW,GAAG,wBAAwB,EAAE;IAMzD,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,wBAAwB,EAAE;IAM3D,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAMtC"}

package/dist/storage/repositories/tool-chain-detections.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolChainDetectionsRepository = void 0;
+class ToolChainDetectionsRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    insert(record) {
+        this.db.prepare(`
+      INSERT INTO tool_chain_detections (id, session_id, rule_id, matched_sequence, action)
+      VALUES (@id, @session_id, @rule_id, @matched_sequence, @action)
+    `).run(record);
+    }
+    getRecent(limit = 50) {
+        return this.db.prepare('SELECT * FROM tool_chain_detections ORDER BY created_at DESC LIMIT ?').all(limit);
+    }
+    getBySession(sessionId) {
+        return this.db.prepare('SELECT * FROM tool_chain_detections WHERE session_id = ? ORDER BY created_at DESC').all(sessionId);
+    }
+    purgeOlderThan(hours) {
+        const result = this.db.prepare(`DELETE FROM tool_chain_detections WHERE created_at < datetime('now', '-' || ? || ' hours')`).run(hours);
+        return result.changes;
+    }
+}
+exports.ToolChainDetectionsRepository = ToolChainDetectionsRepository;
+//# sourceMappingURL=tool-chain-detections.js.map

package/dist/storage/repositories/tool-chain-detections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-chain-detections.js","sourceRoot":"","sources":["../../../src/storage/repositories/tool-chain-detections.ts"],"names":[],"mappings":";;;AAWA,MAAa,6BAA6B;IAChC,EAAE,CAAoB;IAE9B,YAAY,EAAqB;QAC/B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,MAAM,CAAC,MAMN;QACC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;KAGf,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IAED,SAAS,CAAC,QAAgB,EAAE;QAC1B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CACpB,sEAAsE,CACvE,CAAC,GAAG,CAAC,KAAK,CAA+B,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CACpB,mFAAmF,CACpF,CAAC,GAAG,CAAC,SAAS,CAA+B,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,4FAA4F,CAC7F,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACb,OAAO,MAAM,CAAC,OAAO,CAAC;IACxB,CAAC;CACF;AAtCD,sEAsCC"}

package/dist/tool-guard/chain-detector.d.ts

@@ -0,0 +1,18 @@
+import type { ToolChainRule } from './chain-rules.js';
+export interface ToolCallEntry {
+    category: string;
+    timestamp: number;
+}
+export interface ToolChainMatch {
+    rule: ToolChainRule;
+    matchedSequence: string[];
+}
+export declare class ChainDetector {
+    private sessionWindows;
+    private maxWindowSize;
+    constructor(maxWindowSize?: number);
+    recordToolCall(sessionId: string, category: string): void;
+    checkChains(sessionId: string, rules: ToolChainRule[]): ToolChainMatch | null;
+    cleanup(sessionId: string): void;
+}
+//# sourceMappingURL=chain-detector.d.ts.map

package/dist/tool-guard/chain-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-detector.d.ts","sourceRoot":"","sources":["../../src/tool-guard/chain-detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAID,qBAAa,aAAa;IACxB,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,aAAa,CAAS;gBAElB,aAAa,GAAE,MAAwB;IAInD,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAazD,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,cAAc,GAAG,IAAI;IAgC7E,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;CAGjC"}

package/dist/tool-guard/chain-detector.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ChainDetector = void 0;
+const MAX_WINDOW_SIZE = 50;
+class ChainDetector {
+    sessionWindows = new Map();
+    maxWindowSize;
+    constructor(maxWindowSize = MAX_WINDOW_SIZE) {
+        this.maxWindowSize = maxWindowSize;
+    }
+    recordToolCall(sessionId, category) {
+        let window = this.sessionWindows.get(sessionId);
+        if (!window) {
+            window = [];
+            this.sessionWindows.set(sessionId, window);
+        }
+        window.push({ category, timestamp: Date.now() });
+        // Trim to max window size
+        if (window.length > this.maxWindowSize) {
+            window.splice(0, window.length - this.maxWindowSize);
+        }
+    }
+    checkChains(sessionId, rules) {
+        const window = this.sessionWindows.get(sessionId);
+        if (!window || window.length < 2)
+            return null;
+        const now = Date.now();
+        for (const rule of rules) {
+            const windowMs = rule.windowSeconds * 1000;
+            // Walk backward through the window looking for the sequence in order
+            // The last element of the sequence should be the most recent matching entry
+            const seq = rule.sequence;
+            let seqIdx = seq.length - 1;
+            const matched = new Array(seq.length);
+            for (let i = window.length - 1; i >= 0 && seqIdx >= 0; i--) {
+                const entry = window[i];
+                if (now - entry.timestamp > windowMs)
+                    break; // outside time window
+                if (entry.category === seq[seqIdx]) {
+                    matched[seqIdx] = entry.category;
+                    seqIdx--;
+                }
+            }
+            if (seqIdx < 0) {
+                return { rule, matchedSequence: matched };
+            }
+        }
+        return null;
+    }
+    cleanup(sessionId) {
+        this.sessionWindows.delete(sessionId);
+    }
+}
+exports.ChainDetector = ChainDetector;
+//# sourceMappingURL=chain-detector.js.map

package/dist/tool-guard/chain-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-detector.js","sourceRoot":"","sources":["../../src/tool-guard/chain-detector.ts"],"names":[],"mappings":";;;AAYA,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAa,aAAa;IAChB,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,aAAa,CAAS;IAE9B,YAAY,gBAAwB,eAAe;QACjD,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;IACrC,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,QAAgB;QAChD,IAAI,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,CAAC;YACZ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjD,0BAA0B;QAC1B,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,WAAW,CAAC,SAAiB,EAAE,KAAsB;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAE3C,qEAAqE;YACrE,4EAA4E;YAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC1B,IAAI,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAa,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEhD,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxB,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,QAAQ;oBAAE,MAAM,CAAC,sBAAsB;gBACnE,IAAI,KAAK,CAAC,QAAQ,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnC,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;oBACjC,MAAM,EAAE,CAAC;gBACX,CAAC;YACH,CAAC;YAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;gBACf,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;CACF;AAxDD,sCAwDC"}

package/dist/tool-guard/chain-rules.d.ts

@@ -0,0 +1,10 @@
+export interface ToolChainRule {
+    id: string;
+    name: string;
+    description: string;
+    sequence: string[];
+    windowSeconds: number;
+    action: 'warn' | 'block';
+}
+export declare const BUILTIN_CHAIN_RULES: ToolChainRule[];
+//# sourceMappingURL=chain-rules.d.ts.map

package/dist/tool-guard/chain-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-rules.d.ts","sourceRoot":"","sources":["../../src/tool-guard/chain-rules.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,mBAAmB,EAAE,aAAa,EAyB9C,CAAC"}

package/dist/tool-guard/chain-rules.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILTIN_CHAIN_RULES = void 0;
+exports.BUILTIN_CHAIN_RULES = [
+    {
+        id: 'chain-exfil-after-cred',
+        name: 'Exfiltration after credential access',
+        description: 'Network data transfer detected after credential file access within 5 minutes',
+        sequence: ['credential-access', 'network-exfil'],
+        windowSeconds: 300,
+        action: 'block',
+    },
+    {
+        id: 'chain-destruct-after-exec',
+        name: 'Destructive action after code execution',
+        description: 'Destructive filesystem operation detected after remote code execution within 3 minutes',
+        sequence: ['code-execution', 'destructive-fs'],
+        windowSeconds: 180,
+        action: 'warn',
+    },
+    {
+        id: 'chain-publish-after-cred',
+        name: 'Package publish after credential access',
+        description: 'Package publish detected after credential access within 10 minutes',
+        sequence: ['credential-access', 'package-publish'],
+        windowSeconds: 600,
+        action: 'block',
+    },
+];
+//# sourceMappingURL=chain-rules.js.map

package/dist/tool-guard/chain-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain-rules.js","sourceRoot":"","sources":["../../src/tool-guard/chain-rules.ts"],"names":[],"mappings":";;;AASa,QAAA,mBAAmB,GAAoB;IAClD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EAAE,8EAA8E;QAC3F,QAAQ,EAAE,CAAC,mBAAmB,EAAE,eAAe,CAAC;QAChD,aAAa,EAAE,GAAG;QAClB,MAAM,EAAE,OAAO;KAChB;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,yCAAyC;QAC/C,WAAW,EAAE,wFAAwF;QACrG,QAAQ,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;QAC9C,aAAa,EAAE,GAAG;QAClB,MAAM,EAAE,MAAM;KACf;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,yCAAyC;QAC/C,WAAW,EAAE,oEAAoE;QACjF,QAAQ,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;QAClD,aAAa,EAAE,GAAG;QAClB,MAAM,EAAE,OAAO;KAChB;CACF,CAAC"}

package/dist/tool-guard/taint-tracker.d.ts

@@ -0,0 +1,24 @@
+export interface TaintMark {
+    sessionId: string;
+    requestId: string;
+    patternName: string;
+    fingerprint: string;
+    timestamp: number;
+}
+export interface TaintMatch {
+    patternName: string;
+    fingerprint: string;
+}
+export declare class TaintTracker {
+    private sessionTaints;
+    private ttlMs;
+    constructor(ttlMinutes?: number);
+    /** Create a fingerprint from matched content: SHA256 first 16 hex chars */
+    static fingerprint(content: string): string;
+    markTaint(sessionId: string, requestId: string, patternName: string, matchedContent: string): string;
+    /** Check if tool input contains any tainted content fingerprints */
+    checkToolInput(sessionId: string, toolInput: string): TaintMatch | null;
+    getActiveTaints(sessionId: string): TaintMark[];
+    cleanup(sessionId: string): void;
+}
+//# sourceMappingURL=taint-tracker.d.ts.map

package/dist/tool-guard/taint-tracker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-tracker.d.ts","sourceRoot":"","sources":["../../src/tool-guard/taint-tracker.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,KAAK,CAAS;gBAEV,UAAU,GAAE,MAAW;IAInC,2EAA2E;IAC3E,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAI3C,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM;IAiBpG,oEAAoE;IACpE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAoBvE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,EAAE;IAa/C,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;CAGjC"}