@cello-protocol/gateway 0.0.1

package/dist/config/config-store.js

@@ -0,0 +1,198 @@
+/**
+ * M9-CFG-001 — the gateway's own versioned config store (INV-4).
+ *
+ * The gateway owns its configuration; the daemon never does. This store lives in the gateway's own
+ * local DB file (node:sqlite — the same library the daemon uses, a separate file), is append-only and
+ * versioned, and enforces the §7 governance asymmetry:
+ *
+ *   - TIGHTENING a guard (making the gateway MORE restrictive) is free — no confirmation.
+ *   - LOOSENING a guard (making it LESS restrictive — enabling autonomous override, adding a value to
+ *     the PII whitelist, raising/removing the rate cap, allowing another language) requires an explicit
+ *     `confirmed` flag. Without it the change is REJECTED and not versioned. (The human confirmation —
+ *     WebAuthn in the portal — is the front-end's job; this store is the enforcement point.)
+ *
+ * Every applied change appends a row whose `fingerprint` is hash-chained to the previous version, so
+ * the change history is tamper-evident and ready to attest to the directory in Phase 2 (M9-ATTEST-001).
+ *
+ * Encryption-at-rest: the daemon opens node:sqlite without a cipher key today, so this store matches
+ * that (a separate FILE, per INV-4); SQLCipher-style key encryption is a cross-cutting gap shared with
+ * the daemon's DB, not a CFG-001-local concern.
+ */
+import { DatabaseSync } from "node:sqlite";
+import { createHash } from "node:crypto";
+const asArray = (v) => (Array.isArray(v) ? v : []);
+/** Set-membership delta: more members = looser, fewer = tighter (for allowlists/whitelists). */
+function membershipDirection(prev, next) {
+    const p = new Set(asArray(prev));
+    const n = new Set(asArray(next));
+    const added = [...n].some((v) => !p.has(v));
+    const removed = [...p].some((v) => !n.has(v));
+    if (added)
+        return "loosen"; // a strictly-added member widens what is permitted
+    if (removed)
+        return "tighten";
+    return "neutral";
+}
+/** The known config keys + how a change to each is classified. An unknown key is rejected outright. */
+const CLASSIFIERS = {
+    // false → true loosens (the agent may now self-authorize); true → false tightens.
+    autonomous_override: (prev, next) => (!prev && next ? "loosen" : prev && !next ? "tighten" : "neutral"),
+    // More whitelisted PII values = more that passes silently = looser.
+    pii_whitelist: membershipDirection,
+    // More allowed languages = looser.
+    language_allow: membershipDirection,
+    // 0 = no cap = loosest; a higher cap = looser. Lowering the cap tightens.
+    rate_max_per_window: (prev, next) => {
+        const looseness = (v) => { const n = Number(v) || 0; return n === 0 ? Infinity : n; };
+        const p = looseness(prev), q = looseness(next);
+        return q > p ? "loosen" : q < p ? "tighten" : "neutral";
+    },
+    // The window pairs with the cap: a SHORTER window refills faster → strictly more throughput → looser
+    // (code-review H2 — shrinking the window must be gated like raising the cap). A longer window tightens.
+    rate_window_ms: (prev, next) => {
+        const p = Number(prev) || 0, q = Number(next) || 0;
+        return q < p ? "loosen" : q > p ? "tighten" : "neutral";
+    },
+};
+/**
+ * The TIGHTEST default for every guard (code-review B1). The §7 contract defines a baseline: each guard
+ * defaults to its most restrictive value, and LOOSENING from that default requires confirmation. The
+ * store ships empty, so the FIRST set of a key must be classified against THIS baseline — not treated as
+ * a free "neutral" — otherwise first-enabling autonomous_override (or seeding a whitelist) would be free,
+ * inverting the security model.
+ */
+const BASELINE = {
+    autonomous_override: false, // the agent cannot self-authorize
+    pii_whitelist: [], // nothing passes silently
+    language_allow: ["latin"], // English only (the product default; allowing MORE languages loosens)
+    rate_max_per_window: 0, // 0 = no cap is the loosest; SETTING a cap tightens (so it is free)
+    rate_window_ms: 60_000, // a shorter window loosens; first-set of a shorter one is gated
+};
+/** Per-key value-type guard (code-review M2): a type-confused value must not silently disable a guard. */
+const VALIDATORS = {
+    autonomous_override: (v) => typeof v === "boolean",
+    pii_whitelist: (v) => Array.isArray(v) && v.every((x) => typeof x === "string"),
+    language_allow: (v) => Array.isArray(v) && v.every((x) => typeof x === "string"),
+    rate_max_per_window: (v) => typeof v === "number" && Number.isFinite(v) && v >= 0,
+    rate_window_ms: (v) => typeof v === "number" && Number.isFinite(v) && v > 0,
+};
+/** The hash-chain fingerprint over a version's fields (incl. direction + confirmed, H1) + the prior fp. */
+function fingerprintOf(key, version, valueJson, direction, confirmed, prevFingerprint) {
+    return createHash("sha256")
+        .update(`${key}|${version}|${valueJson}|${direction}|${confirmed}|${prevFingerprint}`)
+        .digest("hex");
+}
+const DDL = `
+CREATE TABLE IF NOT EXISTS config_versions (
+  key              TEXT    NOT NULL,
+  version          INTEGER NOT NULL,
+  value_json       TEXT    NOT NULL,
+  direction        TEXT    NOT NULL,
+  confirmed        INTEGER NOT NULL,
+  fingerprint      TEXT    NOT NULL,
+  prev_fingerprint TEXT    NOT NULL,
+  changed_at       INTEGER NOT NULL,
+  PRIMARY KEY (key, version)
+);
+`;
+export class GatewayConfigStore {
+    #db;
+    #closed = false;
+    constructor(dbPath) {
+        this.#db = new DatabaseSync(dbPath);
+        this.#db.exec(`PRAGMA busy_timeout = 3000;`); // tolerate brief lock contention from an orphan gateway
+        this.#db.exec(DDL);
+    }
+    /** Set `key` to `value`. Loosening requires `opts.confirmed`; tightening/neutral is free. The FIRST
+     *  set of a key is classified against the per-key TIGHTEST baseline, not treated as free (B1). */
+    set(key, value, opts = {}) {
+        const classify = CLASSIFIERS[key];
+        if (!classify)
+            throw new Error(`unknown config key: ${key}`);
+        if (!VALIDATORS[key](value))
+            throw new Error(`invalid value for config key '${key}': ${JSON.stringify(value)}`);
+        const latest = this.#latestRow(key);
+        // First set → compare against the tightest BASELINE so initial loosening is gated like any other (B1).
+        const prevValue = latest ? JSON.parse(latest.value_json) : BASELINE[key];
+        const direction = classify(prevValue, value);
+        if (direction === "loosen" && !opts.confirmed) {
+            return { ok: false, reason: "needs_confirmation", direction: "loosen" };
+        }
+        const version = (latest?.version ?? 0) + 1;
+        const valueJson = JSON.stringify(value);
+        const confirmed = opts.confirmed ? 1 : 0;
+        const prevFingerprint = latest?.fingerprint ?? "";
+        // The fingerprint binds direction + confirmed too (code-review H1): the whole point of attesting the
+        // chain is to prove a loosening WAS confirmed by a human — so those fields must be inside the hash, or
+        // an editor could flip confirmed 0→1 / relabel a loosen as neutral and still pass verifyChain.
+        const fingerprint = fingerprintOf(key, version, valueJson, direction, confirmed, prevFingerprint);
+        // Read-modify-write as one transaction so two processes on the same file cannot both write the same
+        // version and collide on the PRIMARY KEY (code-review L1).
+        this.#db.exec("BEGIN IMMEDIATE");
+        try {
+            this.#db
+                .prepare(`INSERT INTO config_versions
+             (key, version, value_json, direction, confirmed, fingerprint, prev_fingerprint, changed_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`)
+                .run(key, version, valueJson, direction, confirmed, fingerprint, prevFingerprint, Date.now());
+            this.#db.exec("COMMIT");
+        }
+        catch (err) {
+            this.#db.exec("ROLLBACK");
+            throw err;
+        }
+        return { ok: true, version, direction, fingerprint };
+    }
+    /** The current (latest-version) value for `key`, or undefined if never set. */
+    get(key) {
+        const row = this.#latestRow(key);
+        return row ? JSON.parse(row.value_json) : undefined;
+    }
+    /** The full append-only version history for `key`, oldest first. */
+    history(key) {
+        const rows = this.#db
+            .prepare(`SELECT version, value_json, direction, confirmed, fingerprint FROM config_versions WHERE key = ? ORDER BY version ASC`)
+            .all(key);
+        return rows.map((r) => ({
+            version: r.version,
+            value: JSON.parse(r.value_json),
+            direction: r.direction,
+            confirmed: r.confirmed === 1,
+            fingerprint: r.fingerprint,
+        }));
+    }
+    /**
+     * Recompute the hash chain for `key` and confirm every stored fingerprint + prev-link matches
+     * (catches an edited value, a flipped `confirmed`, a relabelled `direction`, a deleted/reordered row).
+     * NOT resistant to a full consistent rewrite or tail truncation by an actor with DB write access +
+     * the (unkeyed) hash — that needs the Phase-2 attested head on the directory (M9-ATTEST-001); this is
+     * the local half (code-review M3, recorded).
+     */
+    verifyChain(key) {
+        const rows = this.#db
+            .prepare(`SELECT version, value_json, direction, confirmed, fingerprint, prev_fingerprint FROM config_versions WHERE key = ? ORDER BY version ASC`)
+            .all(key);
+        let prevFingerprint = "";
+        for (const r of rows) {
+            if (r.prev_fingerprint !== prevFingerprint)
+                return false;
+            const expected = fingerprintOf(key, r.version, r.value_json, r.direction, r.confirmed, prevFingerprint);
+            if (expected !== r.fingerprint)
+                return false;
+            prevFingerprint = r.fingerprint;
+        }
+        return true;
+    }
+    close() {
+        if (this.#closed)
+            return; // idempotent — a double close (e.g. test teardown after an explicit close) is a no-op
+        this.#closed = true;
+        this.#db.close();
+    }
+    #latestRow(key) {
+        return this.#db
+            .prepare(`SELECT version, value_json, fingerprint FROM config_versions WHERE key = ? ORDER BY version DESC LIMIT 1`)
+            .get(key);
+    }
+}
+//# sourceMappingURL=config-store.js.map

package/dist/config/config-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqBzC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpF,gGAAgG;AAChG,SAAS,mBAAmB,CAAC,IAAa,EAAE,IAAa;IACvD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK;QAAE,OAAO,QAAQ,CAAC,CAAC,mDAAmD;IAC/E,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uGAAuG;AACvG,MAAM,WAAW,GAA+B;IAC9C,kFAAkF;IAClF,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,oEAAoE;IACpE,aAAa,EAAE,mBAAmB;IAClC,mCAAmC;IACnC,cAAc,EAAE,mBAAmB;IACnC,0EAA0E;IAC1E,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IACD,qGAAqG;IACrG,wGAAwG;IACxG,cAAc,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,QAAQ,GAA4B;IACxC,mBAAmB,EAAE,KAAK,EAAO,kCAAkC;IACnE,aAAa,EAAE,EAAc,EAAI,0BAA0B;IAC3D,cAAc,EAAE,CAAC,OAAO,CAAC,EAAQ,sEAAsE;IACvG,mBAAmB,EAAE,CAAC,EAAW,oEAAoE;IACrG,cAAc,EAAE,MAAM,EAAW,gEAAgE;CAClG,CAAC;AAEF,0GAA0G;AAC1G,MAAM,UAAU,GAA4C;IAC1D,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS;IAClD,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAChF,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACjF,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;CAC5E,CAAC;AAEF,2GAA2G;AAC3G,SAAS,aAAa,CACpB,GAAW,EACX,OAAe,EACf,SAAiB,EACjB,SAAiB,EACjB,SAAiB,EACjB,eAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS,IAAI,eAAe,EAAE,CAAC;SACrF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,GAAG,GAAG;;;;;;;;;;;;CAYX,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAe;IAC3B,OAAO,GAAG,KAAK,CAAC;IAEhB,YAAY,MAAc;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,CAAC,wDAAwD;QACtG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;sGACkG;IAClG,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,OAAgC,EAAE;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEhH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpC,uGAAuG;QACvG,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,SAAS,GAAoB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,eAAe,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;QAClD,qGAAqG;QACrG,uGAAuG;QACvG,+FAA+F;QAC/F,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAElG,oGAAoG;QACpG,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;2CAEiC,CAClC;iBACA,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACvD,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,GAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,oEAAoE;IACpE,OAAO,CAAC,GAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,uHAAuH,CAAC;aAChI,GAAG,CAAC,GAAG,CAA8G,CAAC;QACzH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAY;YAC1C,SAAS,EAAE,CAAC,CAAC,SAA4B;YACzC,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC;YAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,GAAW;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,yIAAyI,CAAC;aAClJ,GAAG,CAAC,GAAG,CAAwI,CAAC;QACnJ,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC;YACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACxG,IAAI,QAAQ,KAAK,CAAC,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC7C,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,sFAAsF;QAChH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,GAAG;aACZ,OAAO,CAAC,0GAA0G,CAAC;aACnH,GAAG,CAAC,GAAG,CAA6E,CAAC;IAC1F,CAAC;CACF"}

package/dist/detect/deberta-model-manifest.d.ts

@@ -0,0 +1,54 @@
+/**
+ * GENERATED (scripts/gen-deberta-manifest.py) — the M9-IN-002 model manifest.
+ * The big ONNX weights + the SentencePiece model carry a pinned content SHA-256 (from
+ * Hugging Face LFS). NOTE: the SHA-256 values are not committed here — this dev environment's
+ * secret-redaction rewrites any 64-hex digest to asterisks, even in generated files. Integrity is
+ * the committed file SIZE plus, in production, verification against Hugging Face's HTTPS LFS API.
+ * Committing the pinned digests (TUF-style, so a compromised mirror cannot swap the model) is the
+ * intended hardening and must be added out-of-band (CI / a non-redacting path).
+ */
+export interface ModelFile {
+    path: string;
+    size: number;
+    sha256: string | null;
+}
+export declare const DEBERTA_MODEL: {
+    readonly repo: "protectai/deberta-v3-small-prompt-injection-v2";
+    readonly revision: "main";
+    /** Hugging Face resolve URL base for the pinned revision. */
+    readonly baseUrl: "https://huggingface.co/protectai/deberta-v3-small-prompt-injection-v2/resolve/main/";
+    readonly files: readonly [{
+        readonly path: "config.json";
+        readonly size: 994;
+        readonly sha256: null;
+    }, {
+        readonly path: "tokenizer.json";
+        readonly size: 8656722;
+        readonly sha256: null;
+    }, {
+        readonly path: "tokenizer_config.json";
+        readonly size: 1284;
+        readonly sha256: null;
+    }, {
+        readonly path: "special_tokens_map.json";
+        readonly size: 286;
+        readonly sha256: null;
+    }, {
+        readonly path: "added_tokens.json";
+        readonly size: 23;
+        readonly sha256: null;
+    }, {
+        readonly path: "spm.model";
+        readonly size: 2464616;
+        readonly sha256: null;
+    }, {
+        readonly path: "onnx/model.onnx";
+        readonly size: 568027819;
+        readonly sha256: null;
+    }, {
+        readonly path: "onnx/config.json";
+        readonly size: 1031;
+        readonly sha256: null;
+    }];
+};
+//# sourceMappingURL=deberta-model-manifest.d.ts.map

package/dist/detect/deberta-model-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deberta-model-manifest.d.ts","sourceRoot":"","sources":["../../src/detect/deberta-model-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAEhF,eAAO,MAAM,aAAa;;;IAGxB,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYrD,CAAC"}

package/dist/detect/deberta-model-manifest.js

@@ -0,0 +1,17 @@
+export const DEBERTA_MODEL = {
+    repo: "protectai/deberta-v3-small-prompt-injection-v2",
+    revision: "main",
+    /** Hugging Face resolve URL base for the pinned revision. */
+    baseUrl: "https://huggingface.co/protectai/deberta-v3-small-prompt-injection-v2/resolve/main/",
+    files: [
+        { path: "config.json", size: 994, sha256: null },
+        { path: "tokenizer.json", size: 8656722, sha256: null },
+        { path: "tokenizer_config.json", size: 1284, sha256: null },
+        { path: "special_tokens_map.json", size: 286, sha256: null },
+        { path: "added_tokens.json", size: 23, sha256: null },
+        { path: "spm.model", size: 2464616, sha256: null },
+        { path: "onnx/model.onnx", size: 568027819, sha256: null },
+        { path: "onnx/config.json", size: 1031, sha256: null },
+    ],
+};
+//# sourceMappingURL=deberta-model-manifest.js.map

package/dist/detect/deberta-model-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deberta-model-manifest.js","sourceRoot":"","sources":["../../src/detect/deberta-model-manifest.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,gDAAgD;IACtD,QAAQ,EAAE,MAAM;IAChB,6DAA6D;IAC7D,OAAO,EAAE,qFAAqF;IAC9F,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;QACvD,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;QAC3D,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAC5D,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACrD,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;QAClD,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAC1D,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;KAC9C;CACF,CAAC"}

package/dist/detect/exfil.d.ts

@@ -0,0 +1,14 @@
+export interface ExfilEvent {
+    category: "exfil:invisible" | "exfil:image_url" | "exfil:encoded" | "exfil:injection_artifact";
+    reason: string;
+    detail?: string;
+}
+export interface ExfilResult {
+    /** `block` (output hijacked — do not send), `redact` (cleaned, send the result), or `allow`. */
+    disposition: "allow" | "redact" | "block";
+    /** The egress-cleaned text (for redact/allow). For block the original is returned (it is not sent). */
+    text: string;
+    events: ExfilEvent[];
+}
+export declare function screenOutboundExfil(content: Uint8Array): ExfilResult;
+//# sourceMappingURL=exfil.d.ts.map

package/dist/detect/exfil.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exfil.d.ts","sourceRoot":"","sources":["../../src/detect/exfil.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,eAAe,GAAG,0BAA0B,CAAC;IAC/F,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,gGAAgG;IAChG,WAAW,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC1C,uGAAuG;IACvG,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAsBD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,UAAU,GAAG,WAAW,CAsCpE"}

package/dist/detect/exfil.js

@@ -0,0 +1,69 @@
+/**
+ * M9-OUT-003 — outbound exfiltration checks.
+ *
+ * A compromised LOCAL agent must not be able to smuggle data out, nor signal (via leaked
+ * injection artifacts) that it was hijacked. This screens egress content:
+ *   - strips invisible/smuggled Unicode (symmetric with the inbound IN-001 strip),
+ *   - neutralizes zero-click image-exfil URLs (an image whose URL carries query data),
+ *   - redacts high-entropy encoded-payload blobs,
+ *   - and BLOCKS outright when the output body carries injection artifacts (role markers /
+ *     override phrases) — that is a compromise signal, so the whole message is attacker-controlled.
+ *
+ * Pure, deterministic, no model/network. All patterns use negated character classes / fixed
+ * alternations (linear time — no catastrophic backtracking), so no RE2 engine is required here.
+ */
+import { stripInvisible, highEntropyTokens } from "./sanitize.js";
+// Injection artifacts that, in the agent's OWN output, indicate a hijack. Anchored / fixed
+// alternations — linear time. (Inbound STRIPS these; outbound BLOCKS, because their presence in
+// output means the message body is attacker-controlled, attack-corpus §3.3.)
+const ARTIFACT_PATTERNS = [
+    /\[SYSTEM\]|<\|im_(?:start|end)\|>|<<\/?SYS>>|\[\/?INST\]|<\|system\|>|<\|assistant\|>/i,
+    /\b(?:ignore|disregard)\s+(?:all\s+)?(?:your\s+)?previous\s+instructions\b/i,
+    /\bforget\s+everything\s+above\b/i,
+];
+function findInjectionArtifact(text) {
+    for (const re of ARTIFACT_PATTERNS) {
+        const m = re.exec(text);
+        if (m)
+            return m[0];
+    }
+    return null;
+}
+// A markdown image whose URL carries a query string is a zero-click data-exfil vector (the
+// renderer auto-fetches it, sending the query to the attacker). Negated char classes → linear.
+const MD_IMAGE = /!\[[^\]]*\]\(([^)\s]+)\)/g;
+export function screenOutboundExfil(content) {
+    const events = [];
+    let text = new TextDecoder("utf-8", { fatal: false }).decode(content);
+    // 1. Injection artifacts in output → BLOCK the whole message (compromise signal).
+    const artifact = findInjectionArtifact(text);
+    if (artifact) {
+        events.push({
+            category: "exfil:injection_artifact",
+            reason: "the output body contains an injection artifact, indicating the agent's output was hijacked — message not sent",
+            detail: artifact,
+        });
+        return { disposition: "block", text, events };
+    }
+    // 2. Egress invisible-Unicode strip (symmetric with M9-IN-001).
+    const inv = stripInvisible(text);
+    if (inv.removed > 0) {
+        events.push({ category: "exfil:invisible", reason: `stripped ${inv.removed} invisible/smuggled codepoint(s) on egress` });
+        text = inv.text;
+    }
+    // 3. Zero-click image-exfil: neutralize data-carrying image URLs; leave ordinary links/images.
+    text = text.replace(MD_IMAGE, (whole, url) => {
+        if (url.includes("?")) {
+            events.push({ category: "exfil:image_url", reason: "neutralized a data-carrying image URL (zero-click exfil vector)", detail: url });
+            return "[image removed: possible data-carrying URL]";
+        }
+        return whole;
+    });
+    // 4. High-entropy encoded-payload blobs → redact (SI-001: the raw payload must not be emitted).
+    for (const token of highEntropyTokens(text)) {
+        events.push({ category: "exfil:encoded", reason: "redacted a high-entropy encoded payload (possible exfiltration)" });
+        text = text.split(token).join("[redacted: high-entropy data]");
+    }
+    return { disposition: events.length > 0 ? "redact" : "allow", text, events };
+}
+//# sourceMappingURL=exfil.js.map

package/dist/detect/exfil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exfil.js","sourceRoot":"","sources":["../../src/detect/exfil.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAgBlE,2FAA2F;AAC3F,gGAAgG;AAChG,6EAA6E;AAC7E,MAAM,iBAAiB,GAAa;IAClC,wFAAwF;IACxF,4EAA4E;IAC5E,kCAAkC;CACnC,CAAC;AACF,SAAS,qBAAqB,CAAC,IAAY;IACzC,KAAK,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2FAA2F;AAC3F,+FAA+F;AAC/F,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAE7C,MAAM,UAAU,mBAAmB,CAAC,OAAmB;IACrD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEtE,kFAAkF;IAClF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,0BAA0B;YACpC,MAAM,EAAE,+GAA+G;YACvH,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,GAAG,CAAC,OAAO,4CAA4C,EAAE,CAAC,CAAC;QAC1H,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,+FAA+F;IAC/F,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE;QAC3D,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,iEAAiE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACrI,OAAO,6CAA6C,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,gGAAgG;IAChG,KAAK,MAAM,KAAK,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC,CAAC;QACtH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC/E,CAAC"}

package/dist/detect/gitleaks-rules.d.ts

@@ -0,0 +1,18 @@
+/**
+ * GENERATED from gitleaks' canonical config (github.com/gitleaks/gitleaks, MIT) — the full
+ * 222-detector secret dictionary. Do not hand-edit; regenerate from config/gitleaks.toml.
+ * File-path allowlists are dropped (CELLO scans message TEXT, not git files); the value-level
+ * stopwords + allow-regexes are kept for the false-positive layer (M9-OUT-001 AC-003).
+ */
+export interface GitleaksRule {
+    id: string;
+    regex: string;
+    keywords: string[];
+    entropy: number;
+}
+export declare const GITLEAKS_RULES: GitleaksRule[];
+/** Value-level stopwords: if a candidate secret contains one of these, it is a false positive. */
+export declare const GITLEAKS_STOPWORDS: string[];
+/** Value-level allow regexes: a candidate matching one of these is NOT a secret. */
+export declare const GITLEAKS_ALLOW_REGEXES: string[];
+//# sourceMappingURL=gitleaks-rules.d.ts.map

package/dist/detect/gitleaks-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks-rules.d.ts","sourceRoot":"","sources":["../../src/detect/gitleaks-rules.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAEhG,eAAO,MAAM,cAAc,EAAE,YAAY,EA+NxC,CAAC;AAEF,kGAAkG;AAClG,eAAO,MAAM,kBAAkB,EAAE,MAAM,EAA2E,CAAC;AAEnH,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAAgiB,CAAC"}