@cello-protocol/gateway 0.0.1

package/dist/detect/language.js

@@ -0,0 +1,85 @@
+/**
+ * M9-IN-003 — inbound language allowlist (default: English).
+ *
+ * Holds inbound content confidently in a non-allowlisted language, so a jailbreak phrased in a
+ * low-resource language can't dodge English-trained screening — WITHOUT blocking legitimate short
+ * messages on a guess (AC-002), and with no model and no network call (INV-1).
+ *
+ * v1 uses dominant Unicode SCRIPT (the story's "script inspection covers most of it"): a message
+ * confidently dominated by a non-Latin script (Cyrillic, Greek, Arabic, Hebrew, CJK, Devanagari,
+ * Thai, …) is outside the {English=Latin} allowlist and is held. Latin-script text is allowed —
+ * distinguishing Latin-script LANGUAGES (English vs French/Spanish) needs a trained classifier and
+ * is a separate design session (Andre, 2026-06-23). Short / low-letter-count messages are allowed.
+ *
+ * This is the DETECTOR. Delivering the held note to the operator + the terminal-block inbound
+ * handling (ack-and-record without delivering, distinct from the transient fail-closed hold) is the
+ * integration step (M9-FEED-001 / the gate / the L4 terminal-vs-transient split).
+ */
+function scriptOf(cp) {
+    // Returns the script for a LETTER codepoint, or null for non-letters (digits/punct/space/emoji).
+    if ((cp >= 0x41 && cp <= 0x5a) || (cp >= 0x61 && cp <= 0x7a) ||
+        (cp >= 0xc0 && cp <= 0x24f) || (cp >= 0x1e00 && cp <= 0x1eff))
+        return "latin";
+    if (cp >= 0x400 && cp <= 0x4ff)
+        return "cyrillic";
+    if ((cp >= 0x370 && cp <= 0x3ff) || (cp >= 0x1f00 && cp <= 0x1fff))
+        return "greek";
+    if ((cp >= 0x600 && cp <= 0x6ff) || (cp >= 0x750 && cp <= 0x77f))
+        return "arabic";
+    if (cp >= 0x590 && cp <= 0x5ff)
+        return "hebrew";
+    if ((cp >= 0x4e00 && cp <= 0x9fff) || (cp >= 0x3400 && cp <= 0x4dbf))
+        return "han";
+    if (cp >= 0x3040 && cp <= 0x30ff)
+        return "kana";
+    if ((cp >= 0xac00 && cp <= 0xd7af) || (cp >= 0x1100 && cp <= 0x11ff))
+        return "hangul";
+    if (cp >= 0x900 && cp <= 0x97f)
+        return "devanagari";
+    if (cp >= 0xe00 && cp <= 0xe7f)
+        return "thai";
+    // A letter we don't bucket finely — count it as "other" only if it is clearly a letter.
+    if (cp > 0x2bf && !(cp >= 0x2000 && cp <= 0x2bff))
+        return "other";
+    return null;
+}
+const SCRIPT_LABEL = {
+    latin: "Latin", cyrillic: "Cyrillic", greek: "Greek", arabic: "Arabic", hebrew: "Hebrew",
+    han: "Han/CJK", kana: "Japanese kana", hangul: "Korean Hangul", devanagari: "Devanagari",
+    thai: "Thai", other: "a non-Latin",
+};
+export function screenInboundLanguage(text, opts = {}) {
+    const allow = new Set(opts.allow ?? ["latin"]);
+    const minLetters = opts.minLetters ?? 12;
+    const minShare = opts.minShare ?? 0.5;
+    const counts = new Map();
+    let total = 0;
+    for (const ch of text) {
+        const s = scriptOf(ch.codePointAt(0));
+        if (!s)
+            continue;
+        counts.set(s, (counts.get(s) ?? 0) + 1);
+        total++;
+    }
+    // Not enough letters to be confident → allow (don't block short/ambiguous, AC-002).
+    if (total < minLetters)
+        return { allowed: true };
+    let dominant = "latin";
+    let max = 0;
+    for (const [s, n] of counts)
+        if (n > max) {
+            max = n;
+            dominant = s;
+        }
+    // Allowed script dominant, or the dominant non-allowed script isn't a clear majority → allow.
+    if (allow.has(dominant) || max / total < minShare)
+        return { allowed: true };
+    return {
+        allowed: false,
+        script: dominant,
+        reason: `This message is predominantly ${SCRIPT_LABEL[dominant]} script, outside the gateway's ` +
+            `language allowlist (default: English). It was held. To allow this language, add its script ` +
+            `to the gateway language allowlist.`,
+    };
+}
+//# sourceMappingURL=language.js.map

package/dist/detect/language.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"language.js","sourceRoot":"","sources":["../../src/detect/language.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAyBH,SAAS,QAAQ,CAAC,EAAU;IAC1B,iGAAiG;IACjG,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAClF,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK;QAAE,OAAO,UAAU,CAAC;IAClD,IAAI,CAAC,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IACnF,IAAI,CAAC,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClF,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAChD,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtF,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK;QAAE,OAAO,YAAY,CAAC;IACpD,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC;IAC9C,wFAAwF;IACxF,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC;IAClE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,YAAY,GAA2B;IAC3C,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ;IACxF,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY;IACxF,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa;CACnC,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,OAAwB,EAAE;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC;IAEtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC;QACvC,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,KAAK,EAAE,CAAC;IACV,CAAC;IAED,oFAAoF;IACpF,IAAI,KAAK,GAAG,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEjD,IAAI,QAAQ,GAAW,OAAO,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM;QAAE,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;YAAC,GAAG,GAAG,CAAC,CAAC;YAAC,QAAQ,GAAG,CAAC,CAAC;QAAC,CAAC;IAEpE,8FAA8F;IAC9F,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,KAAK,GAAG,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE5E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,QAAQ;QAChB,MAAM,EACJ,iCAAiC,YAAY,CAAC,QAAQ,CAAC,iCAAiC;YACxF,6FAA6F;YAC7F,oCAAoC;KACvC,CAAC;AACJ,CAAC"}

package/dist/detect/linear-regex.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Resolve the RE2 engine: native first, WASM fallback. Idempotent. Returns which engine is live.
+ * Throws only if NEITHER engine can load (re2-wasm is a hard dependency, so that should not happen).
+ */
+export declare function initLinearRegex(): Promise<"native" | "wasm">;
+/** Which RE2 engine is live (`native`, `wasm`, or `uninitialized`). For the gateway `doctor` report. */
+export declare function linearRegexEngine(): "native" | "wasm" | "uninitialized";
+/** A compiled linear-time pattern. Construct only after `initLinearRegex()` has resolved. */
+export declare class LinearRegex {
+    #private;
+    /** @param flags RegExp-style flags (e.g. "i"). The unicode flag is forced on for the WASM engine. */
+    constructor(pattern: string, flags?: string);
+    /** True iff the pattern matches anywhere in `s`. Linear time, guaranteed. */
+    test(s: string): boolean;
+    /** The first matched substring, or null. */
+    match(s: string): string | null;
+    /** The first match as a `RegExpExecArray` (with `.index` and capture groups), or null. */
+    exec(s: string): RegExpExecArray | null;
+}
+//# sourceMappingURL=linear-regex.d.ts.map

package/dist/detect/linear-regex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-regex.d.ts","sourceRoot":"","sources":["../../src/detect/linear-regex.ts"],"names":[],"mappings":"AAqBA;;;GAGG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAoBlE;AAED,wGAAwG;AACxG,wBAAgB,iBAAiB,IAAI,QAAQ,GAAG,MAAM,GAAG,eAAe,CAEvE;AAED,6FAA6F;AAC7F,qBAAa,WAAW;;IAGtB,qGAAqG;gBACzF,OAAO,EAAE,MAAM,EAAE,KAAK,SAAK;IAOvC,6EAA6E;IAC7E,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO;IAIxB,4CAA4C;IAC5C,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAK/B,0FAA0F;IAC1F,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;CAGxC"}

package/dist/detect/linear-regex.js

@@ -0,0 +1,70 @@
+/**
+ * LinearRegex — a linear-time (RE2) regular expression behind ONE interface, used for any pattern
+ * that runs against adversary-controlled content (injection-pattern matching, the gitleaks set).
+ *
+ * RE2 guarantees time linear in the input — no catastrophic backtracking, so a crafted message can
+ * never peg the gateway (ReDoS), which would otherwise be both a DoS and a way to force a timeout
+ * verdict. We prefer the MAINTAINED native engine (`re2`, an optionalDependency) and fall back to
+ * the WASM build (`re2-wasm`, a regular dependency that always installs with no compile) when the
+ * native addon did not build on the operator's machine. Either way: real RE2, same guarantee.
+ *
+ * `initLinearRegex()` MUST be awaited once at gateway startup (the WASM fallback is an async import).
+ * After that, `new LinearRegex(...)` is synchronous.
+ */
+import { createRequire } from "node:module";
+let factory = null;
+let engine = "uninitialized";
+/**
+ * Resolve the RE2 engine: native first, WASM fallback. Idempotent. Returns which engine is live.
+ * Throws only if NEITHER engine can load (re2-wasm is a hard dependency, so that should not happen).
+ */
+export async function initLinearRegex() {
+    if (factory)
+        return engine;
+    // Native `re2` is CommonJS; load it through createRequire so this ESM module can require() it.
+    // A missing/failed-to-build optional addon throws here — caught, and we fall through to WASM.
+    try {
+        const require = createRequire(import.meta.url);
+        const NativeRE2 = require("re2");
+        factory = (pattern, flags) => new NativeRE2(pattern, flags);
+        engine = "native";
+        return "native";
+    }
+    catch {
+        /* native not available — fall back to WASM */
+    }
+    // `re2-wasm` is ESM and requires the unicode ('u') flag.
+    const wasm = (await import("re2-wasm"));
+    factory = (pattern, flags) => new wasm.RE2(pattern, flags.includes("u") ? flags : flags + "u");
+    engine = "wasm";
+    return "wasm";
+}
+/** Which RE2 engine is live (`native`, `wasm`, or `uninitialized`). For the gateway `doctor` report. */
+export function linearRegexEngine() {
+    return engine;
+}
+/** A compiled linear-time pattern. Construct only after `initLinearRegex()` has resolved. */
+export class LinearRegex {
+    #re;
+    /** @param flags RegExp-style flags (e.g. "i"). The unicode flag is forced on for the WASM engine. */
+    constructor(pattern, flags = "") {
+        if (!factory) {
+            throw new Error("LinearRegex: call and await initLinearRegex() before constructing patterns");
+        }
+        this.#re = factory(pattern, flags);
+    }
+    /** True iff the pattern matches anywhere in `s`. Linear time, guaranteed. */
+    test(s) {
+        return this.#re.test(s);
+    }
+    /** The first matched substring, or null. */
+    match(s) {
+        const m = this.#re.exec(s);
+        return m ? m[0] : null;
+    }
+    /** The first match as a `RegExpExecArray` (with `.index` and capture groups), or null. */
+    exec(s) {
+        return this.#re.exec(s);
+    }
+}
+//# sourceMappingURL=linear-regex.js.map

package/dist/detect/linear-regex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-regex.js","sourceRoot":"","sources":["../../src/detect/linear-regex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAK5C,IAAI,OAAO,GAAsB,IAAI,CAAC;AACtC,IAAI,MAAM,GAAwC,eAAe,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,OAAO;QAAE,OAAO,MAA2B,CAAC;IAEhD,+FAA+F;IAC/F,8FAA8F;IAC9F,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAA+C,CAAC;QAC/E,OAAO,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,GAAG,QAAQ,CAAC;QAClB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,yDAAyD;IACzD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAuD,CAAC;IAC9F,OAAO,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;IAC/F,MAAM,GAAG,MAAM,CAAC;IAChB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,MAAM,OAAO,WAAW;IACb,GAAG,CAAc;IAE1B,qGAAqG;IACrG,YAAY,OAAe,EAAE,KAAK,GAAG,EAAE;QACrC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,6EAA6E;IAC7E,IAAI,CAAC,CAAS;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,CAAS;QACb,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,0FAA0F;IAC1F,IAAI,CAAC,CAAS;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/detect/model-installer.d.ts

@@ -0,0 +1,32 @@
+/** SHA-256 of a file on disk (streamed — never loads the whole 568 MB into memory). */
+export declare function sha256File(path: string): Promise<string>;
+/** Are all the model files present under `dir`? (Existence check; integrity is the SHA verify.) */
+export declare function isModelInstalled(dir: string): Promise<boolean>;
+/** Re-verify the pinned-SHA files of an existing install. Returns the first mismatch, or null. */
+export declare function verifyModel(dir: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    badFile: string;
+}>;
+export interface InstallResult {
+    installed: boolean;
+    /** true when the model was absent and consent was withheld — nothing was downloaded. */
+    needsConsent?: boolean;
+    error?: string;
+}
+export interface InstallOptions {
+    dir: string;
+    /** The operator's explicit consent to download ~568 MB. Without it, nothing is fetched. */
+    consent: boolean;
+    /** Injectable fetch (defaults to global fetch) — tests pass a fake; production uses the network. */
+    fetchImpl?: typeof fetch;
+    onProgress?: (file: string, index: number, total: number) => void;
+}
+/**
+ * Install the model under `dir`. No-ops (returns installed) if already present. Requires `consent`
+ * to download; verifies every pinned SHA-256 and deletes + fails on any mismatch (no partial/tampered
+ * model is ever left in place).
+ */
+export declare function installModel(opts: InstallOptions): Promise<InstallResult>;
+//# sourceMappingURL=model-installer.d.ts.map

package/dist/detect/model-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-installer.d.ts","sourceRoot":"","sources":["../../src/detect/model-installer.ts"],"names":[],"mappings":"AAiBA,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxD;AAED,mGAAmG;AACnG,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASpE;AAED,kGAAkG;AAClG,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAOrG;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,wFAAwF;IACxF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,2FAA2F;IAC3F,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACnE;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAmC/E"}

package/dist/detect/model-installer.js

@@ -0,0 +1,94 @@
+/**
+ * M9-IN-002 — the DeBERTa model installer.
+ *
+ * The model is NOT bundled (it is ~568 MB): the gateway downloads it ONCE, only with explicit
+ * operator consent, verifies the pinned SHA-256 of the weights (so a compromised mirror cannot swap
+ * the model), and caches it locally. When it is absent, Layer-2 is simply off — the gateway never
+ * fails closed on a missing OPTIONAL model (Layer-1 still runs). Consent surfaces via the CLI
+ * (`cello gateway install-model`), an actionable daemon guidance field, or the portal.
+ */
+import { createHash } from "node:crypto";
+import { createReadStream, createWriteStream } from "node:fs";
+import { mkdir, stat, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { DEBERTA_MODEL } from "./deberta-model-manifest.js";
+/** SHA-256 of a file on disk (streamed — never loads the whole 568 MB into memory). */
+export function sha256File(path) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash("sha256");
+        const rs = createReadStream(path);
+        rs.on("error", reject);
+        rs.on("data", (chunk) => hash.update(chunk));
+        rs.on("end", () => resolve(hash.digest("hex")));
+    });
+}
+/** Are all the model files present under `dir`? (Existence check; integrity is the SHA verify.) */
+export async function isModelInstalled(dir) {
+    for (const f of DEBERTA_MODEL.files) {
+        try {
+            await stat(join(dir, f.path));
+        }
+        catch {
+            return false;
+        }
+    }
+    return true;
+}
+/** Re-verify the pinned-SHA files of an existing install. Returns the first mismatch, or null. */
+export async function verifyModel(dir) {
+    for (const f of DEBERTA_MODEL.files) {
+        if (!f.sha256)
+            continue;
+        const got = await sha256File(join(dir, f.path)).catch(() => "");
+        if (got !== f.sha256)
+            return { ok: false, badFile: f.path };
+    }
+    return { ok: true };
+}
+/**
+ * Install the model under `dir`. No-ops (returns installed) if already present. Requires `consent`
+ * to download; verifies every pinned SHA-256 and deletes + fails on any mismatch (no partial/tampered
+ * model is ever left in place).
+ */
+export async function installModel(opts) {
+    if (await isModelInstalled(opts.dir))
+        return { installed: true };
+    if (!opts.consent)
+        return { installed: false, needsConsent: true };
+    const doFetch = opts.fetchImpl ?? fetch;
+    const total = DEBERTA_MODEL.files.length;
+    for (let i = 0; i < total; i++) {
+        const f = DEBERTA_MODEL.files[i];
+        opts.onProgress?.(f.path, i, total);
+        const dest = join(opts.dir, f.path);
+        await mkdir(dirname(dest), { recursive: true });
+        let res;
+        try {
+            res = await doFetch(DEBERTA_MODEL.baseUrl + f.path);
+        }
+        catch (err) {
+            return { installed: false, error: `download failed for ${f.path}: ${err instanceof Error ? err.message : String(err)}` };
+        }
+        if (!res.ok || !res.body)
+            return { installed: false, error: `download failed for ${f.path}: HTTP ${res.status}` };
+        await pipeline(Readable.fromWeb(res.body), createWriteStream(dest));
+        // Integrity: the committed SIZE catches truncation / a wrong file. (Full SHA-256 pinning is the
+        // intended hardening — see the manifest note; the pinned digest is verified here when present.)
+        const downloaded = await stat(dest);
+        if (downloaded.size !== f.size) {
+            await rm(dest, { force: true });
+            return { installed: false, error: `size mismatch for ${f.path}: expected ${f.size}, got ${downloaded.size} — removed` };
+        }
+        if (f.sha256) {
+            const got = await sha256File(dest);
+            if (got !== f.sha256) {
+                await rm(dest, { force: true });
+                return { installed: false, error: `checksum mismatch for ${f.path} — the file was NOT trusted and has been removed` };
+            }
+        }
+    }
+    return { installed: true };
+}
+//# sourceMappingURL=model-installer.js.map

package/dist/detect/model-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-installer.js","sourceRoot":"","sources":["../../src/detect/model-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvB,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,MAAM;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAkBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAoB;IACrD,IAAI,MAAM,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAEnE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3H,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAClH,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA8C,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9G,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,SAAS,UAAU,CAAC,IAAI,YAAY,EAAE,CAAC;QAC1H,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;gBACrB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC,IAAI,kDAAkD,EAAE,CAAC;YACxH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC"}

package/dist/detect/pii.d.ts

@@ -0,0 +1,27 @@
+export type PIICategory = "pii:email" | "pii:ip" | "pii:ssn" | "pii:credit_card" | "pii:phone";
+export interface PIIEvent {
+    category: PIICategory;
+    value: string;
+    /** Deterministic id over (category, value) — the handle the agent passes on a governance re-send. */
+    flagId: string;
+}
+export interface PIIResult {
+    disposition: "allow" | "warn";
+    severity?: "normal" | "bulk";
+    events: PIIEvent[];
+    count: number;
+}
+export interface PIIScreenerOptions {
+    /** The operator's whitelisted PII values (own email/phone …). Normalized on construction. */
+    whitelist: string[];
+    /** Distinct non-whitelisted values in ONE message at/above which the warn is bulk. Default 5. */
+    bulkThreshold?: number;
+    /** Distinct non-whitelisted values across a SESSION at/above which warns escalate to bulk (drip). Default 20. */
+    cumulativeThreshold?: number;
+}
+export declare class OutboundPIIScreener {
+    #private;
+    constructor(opts: PIIScreenerOptions);
+    screen(content: Uint8Array, sessionId: string): PIIResult;
+}
+//# sourceMappingURL=pii.d.ts.map

package/dist/detect/pii.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.d.ts","sourceRoot":"","sources":["../../src/detect/pii.ts"],"names":[],"mappings":"AAeA,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,iBAAiB,GAAG,WAAW,CAAC;AAE/F,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC7B,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,6FAA6F;IAC7F,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iGAAiG;IACjG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iHAAiH;IACjH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAwCD,qBAAa,mBAAmB;;gBAOlB,IAAI,EAAE,kBAAkB;IAUpC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS;CA8C1D"}

package/dist/detect/pii.js

@@ -0,0 +1,119 @@
+/**
+ * M9-OUT-002 — outbound PII: whitelist + warn (NOT blanket redaction).
+ *
+ * Detects email / phone / SSN / credit-card / IP, passes whitelisted values (the operator's own
+ * registered contact details) silently, and warns on the rest — so sharing your own contact is
+ * frictionless while a contact-list dump is caught. A bulk dump is ONE escalated warn (severity),
+ * and a sustained per-session drip escalates too (SI-001). Pure detection + deterministic flag ids;
+ * the warn UX / allow-once / WebAuthn-whitelist-add re-send is M9-FEED-001.
+ *
+ * All patterns are anchored / negated-class (linear time — no RE2 engine needed). Cross-category
+ * overlaps (a phone pattern also matching an SSN/IP/card span) are resolved by priority so each
+ * value is counted once, in its most specific category.
+ */
+import { createHash } from "node:crypto";
+const EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+const IP_RE = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
+const SSN_RE = /\b\d{3}-\d{2}-\d{4}\b/g;
+const CC_RE = /\b(?:\d[ -]?){13,19}\b/g;
+const PHONE_RE = /\+?\d[\d\s().-]{7,}\d/g;
+function flagIdFor(category, value) {
+    return createHash("sha256").update(`${category}:${value}`).digest("hex").slice(0, 12);
+}
+function luhnValid(digits) {
+    let sum = 0;
+    let alt = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let d = digits.charCodeAt(i) - 48;
+        if (d < 0 || d > 9)
+            return false;
+        if (alt) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+        alt = !alt;
+    }
+    return digits.length > 0 && sum % 10 === 0;
+}
+function validIp(value) {
+    const parts = value.split(".");
+    return parts.length === 4 && parts.every((p) => { const n = Number(p); return p.length > 0 && n >= 0 && n <= 255; });
+}
+function normalizeEmail(v) { return v.toLowerCase(); }
+function normalizePhone(v) { return v.replace(/\D/g, ""); }
+function normalizeForWhitelist(category, value) {
+    if (category === "pii:email")
+        return normalizeEmail(value);
+    if (category === "pii:phone")
+        return normalizePhone(value);
+    return value;
+}
+export class OutboundPIIScreener {
+    #whitelist;
+    #bulkThreshold;
+    #cumulativeThreshold;
+    // sessionId → the distinct (category:value) keys of non-whitelisted PII seen across the session.
+    #sessionDistinct = new Map();
+    constructor(opts) {
+        // Whitelist is stored normalized two ways (email lowercase, phone digits) so a raw value matches.
+        this.#whitelist = new Set([
+            ...opts.whitelist.map(normalizeEmail),
+            ...opts.whitelist.map(normalizePhone).filter((p) => p.length > 0),
+        ]);
+        this.#bulkThreshold = opts.bulkThreshold ?? 5;
+        this.#cumulativeThreshold = opts.cumulativeThreshold ?? 20;
+    }
+    screen(content, sessionId) {
+        const text = new TextDecoder("utf-8", { fatal: false }).decode(content);
+        const candidates = [];
+        const collect = (re, category, priority, accept) => {
+            for (const m of text.matchAll(re)) {
+                const value = m[0];
+                if (!accept(value))
+                    continue;
+                candidates.push({ start: m.index ?? 0, end: (m.index ?? 0) + value.length, category, value, priority });
+            }
+        };
+        collect(EMAIL_RE, "pii:email", 0, () => true);
+        collect(IP_RE, "pii:ip", 1, validIp);
+        collect(SSN_RE, "pii:ssn", 2, () => true);
+        collect(CC_RE, "pii:credit_card", 3, (v) => luhnValid(v.replace(/[^0-9]/g, "")));
+        collect(PHONE_RE, "pii:phone", 4, (v) => v.replace(/\D/g, "").length >= 7);
+        // Resolve overlaps: a higher-priority (more specific) match wins its character span.
+        candidates.sort((a, b) => a.priority - b.priority || a.start - b.start);
+        const taken = [];
+        const accepted = [];
+        for (const c of candidates) {
+            if (taken.some(([s, e]) => c.start < e && c.end > s))
+                continue;
+            taken.push([c.start, c.end]);
+            accepted.push(c);
+        }
+        // Drop whitelisted values; dedupe identical (category,value) within the message.
+        const byKey = new Map();
+        for (const c of accepted) {
+            if (this.#whitelist.has(normalizeForWhitelist(c.category, c.value)))
+                continue;
+            const key = `${c.category}:${c.value}`;
+            if (!byKey.has(key))
+                byKey.set(key, { category: c.category, value: c.value, flagId: flagIdFor(c.category, c.value) });
+        }
+        const events = [...byKey.values()];
+        if (events.length === 0)
+            return { disposition: "allow", events: [], count: 0 };
+        // Per-session cumulative view (SI-001 drip).
+        let distinct = this.#sessionDistinct.get(sessionId);
+        if (!distinct) {
+            distinct = new Set();
+            this.#sessionDistinct.set(sessionId, distinct);
+        }
+        for (const e of events)
+            distinct.add(`${e.category}:${e.value}`);
+        const count = events.length;
+        const bulk = count >= this.#bulkThreshold || distinct.size >= this.#cumulativeThreshold;
+        return { disposition: "warn", severity: bulk ? "bulk" : "normal", events, count };
+    }
+}
+//# sourceMappingURL=pii.js.map

package/dist/detect/pii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/detect/pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA6BzC,MAAM,QAAQ,GAAG,iDAAiD,CAAC;AACnE,MAAM,KAAK,GAAG,8BAA8B,CAAC;AAC7C,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,KAAK,GAAG,yBAAyB,CAAC;AACxC,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAE1C,SAAS,SAAS,CAAC,QAAgB,EAAE,KAAa;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,SAAS,CAAC,MAAc;IAC/B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QACvC,GAAG,IAAI,CAAC,CAAC;QACT,GAAG,GAAG,CAAC,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvH,CAAC;AAED,SAAS,cAAc,CAAC,CAAS,IAAY,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACtE,SAAS,cAAc,CAAC,CAAS,IAAY,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,SAAS,qBAAqB,CAAC,QAAqB,EAAE,KAAa;IACjE,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,mBAAmB;IACrB,UAAU,CAAc;IACxB,cAAc,CAAS;IACvB,oBAAoB,CAAS;IACtC,iGAAiG;IACxF,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE3D,YAAY,IAAwB;QAClC,kGAAkG;QAClG,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC;YACxB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC;YACrC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAClE,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,CAAC,OAAmB,EAAE,SAAiB;QAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAExE,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,QAAqB,EAAE,QAAgB,EAAE,MAA8B,EAAE,EAAE;YACtG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC7B,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,KAAK,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAE3E,qFAAqF;QACrF,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAgB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC/D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,iFAAiF;QACjF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,SAAS;YAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAE/E,6CAA6C;QAC7C,IAAI,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAEjE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,cAAc,IAAI,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC;QACxF,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC;CACF"}

package/dist/detect/rate-limit.d.ts

@@ -0,0 +1,44 @@
+/**
+ * M9-OUT-004 — per-agent-identity outbound rate limiting.
+ *
+ * A sliding-window counter keyed on the AGENT IDENTITY (peer-id / agent name), never a source IP —
+ * so a compromised or runaway agent cannot flood a peer or use volume as an exfiltration channel,
+ * while a normal agent's traffic is never throttled or delayed. Pure in-memory, deterministic with
+ * an injectable clock.
+ *
+ * The cap is a configured value (M9-CFG-001 owns the config; this is the enforcement). A throttled
+ * verdict carries a distinct `rate_limited` reason and a retry-after, surfaced to the agent through
+ * the outbound seam's never-hang feedback (M9-CORE-001 / M9-FEED-001).
+ */
+export interface RateLimitConfig {
+    /** Max messages allowed per agent within the window. */
+    maxPerWindow: number;
+    /** The sliding-window length, in milliseconds. */
+    windowMs: number;
+}
+export interface RateLimitVerdict {
+    limited: boolean;
+    reason?: "rate_limited";
+    guidance?: string;
+    /** Milliseconds until the agent may send again (only when limited). */
+    retryAfterMs?: number;
+}
+export declare class OutboundRateLimiter {
+    #private;
+    constructor(config: RateLimitConfig, now?: () => number);
+    /**
+     * READ-ONLY rate check — does NOT consume a slot. Returns a throttle verdict when the agent is
+     * at/over the cap, else `{limited:false}`. Use this to GATE a send; commit the slot with
+     * `record()` only once the message actually reaches the wire (M2 review — block/warn must not
+     * count, and a warn→re-send must not double-count).
+     */
+    peek(agentIdentity: string): RateLimitVerdict;
+    /** Commit one sent message against `agentIdentity`'s cap (call only when it reaches the wire). */
+    record(agentIdentity: string): void;
+    /**
+     * Account one send attempt: `peek()` then `record()` when under the cap. A throttled attempt
+     * records nothing. (Convenience for standalone use; the composition uses peek + conditional record.)
+     */
+    check(agentIdentity: string): RateLimitVerdict;
+}
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/detect/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/detect/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAmB;;gBAMlB,MAAM,EAAE,eAAe,EAAE,GAAG,GAAE,MAAM,MAAyB;IAWzE;;;;;OAKG;IACH,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB;IAmB7C,kGAAkG;IAClG,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI;IAOnC;;;OAGG;IACH,KAAK,CAAC,aAAa,EAAE,MAAM,GAAG,gBAAgB;CAK/C"}

package/dist/detect/rate-limit.js

@@ -0,0 +1,56 @@
+export class OutboundRateLimiter {
+    #config;
+    #now;
+    // agent identity → ascending timestamps of ALLOWED sends still inside the window.
+    #sends = new Map();
+    constructor(config, now = () => Date.now()) {
+        this.#config = config;
+        this.#now = now;
+    }
+    /** The in-window timestamps for `agentIdentity` (read-only — prunes aged-out entries). */
+    #live(agentIdentity, now) {
+        const all = this.#sends.get(agentIdentity);
+        return all ? all.filter((t) => t > now - this.#config.windowMs) : [];
+    }
+    /**
+     * READ-ONLY rate check — does NOT consume a slot. Returns a throttle verdict when the agent is
+     * at/over the cap, else `{limited:false}`. Use this to GATE a send; commit the slot with
+     * `record()` only once the message actually reaches the wire (M2 review — block/warn must not
+     * count, and a warn→re-send must not double-count).
+     */
+    peek(agentIdentity) {
+        const now = this.#now();
+        const live = this.#live(agentIdentity, now);
+        if (live.length >= this.#config.maxPerWindow) {
+            const oldest = live[0];
+            const retryAfterMs = Math.max(1, oldest + this.#config.windowMs - now);
+            return {
+                limited: true,
+                reason: "rate_limited",
+                guidance: `Outbound rate limit reached for this agent (${this.#config.maxPerWindow} messages per ` +
+                    `${Math.round(this.#config.windowMs / 1000)}s). This message was not sent. ` +
+                    `Wait about ${Math.ceil(retryAfterMs / 1000)}s and retry; the window slides as older messages age out.`,
+                retryAfterMs,
+            };
+        }
+        return { limited: false };
+    }
+    /** Commit one sent message against `agentIdentity`'s cap (call only when it reaches the wire). */
+    record(agentIdentity) {
+        const now = this.#now();
+        const live = this.#live(agentIdentity, now);
+        live.push(now);
+        this.#sends.set(agentIdentity, live);
+    }
+    /**
+     * Account one send attempt: `peek()` then `record()` when under the cap. A throttled attempt
+     * records nothing. (Convenience for standalone use; the composition uses peek + conditional record.)
+     */
+    check(agentIdentity) {
+        const v = this.peek(agentIdentity);
+        if (!v.limited)
+            this.record(agentIdentity);
+        return v;
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/detect/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/detect/rate-limit.ts"],"names":[],"mappings":"AA2BA,MAAM,OAAO,mBAAmB;IACrB,OAAO,CAAkB;IACzB,IAAI,CAAe;IAC5B,kFAAkF;IACzE,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE9C,YAAY,MAAuB,EAAE,MAAoB,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;QACvE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,aAAqB,EAAE,GAAW;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,aAAqB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;YACvE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,cAAc;gBACtB,QAAQ,EACN,+CAA+C,IAAI,CAAC,OAAO,CAAC,YAAY,gBAAgB;oBACxF,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,iCAAiC;oBAC5E,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,2DAA2D;gBACzG,YAAY;aACb,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,kGAAkG;IAClG,MAAM,CAAC,aAAqB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAqB;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;CACF"}