@cello-protocol/gateway 0.0.1

package/dist/detect/sanitize.d.ts

@@ -0,0 +1,50 @@
+/**
+ * M9-IN-001 — inbound Layer-1 deterministic sanitization.
+ *
+ * Pure function, no model, no network (INV-1). Runs the ordered steps from the attack-corpus §1
+ * pipeline that need no external engine: size cap (first — AC-005), invisible/smuggled-Unicode
+ * strip (AC-001 / SI-001), confusables normalization (NFKC + script-lookalike map), encoded-
+ * payload decode, Shannon-entropy scoring (AC-003), and chat-template/special-token strip (AC-004).
+ *
+ * The Step-9 injection-pattern match (AC-002) is a SEPARATE concern: it requires a linear-time
+ * RE2 engine (no native RegExp — ReDoS). The RE2 binding is a pending decision, so that step is
+ * not wired here yet; this module exposes the sanitized text + notes that the pattern matcher and
+ * the M9-IN-002 scanner will consume.
+ */
+/** Default per-message byte cap — mirrors the daemon's 1 MB content cap. */
+export declare const DEFAULT_MAX_BYTES = 1000000;
+export interface SanitizationNote {
+    step: "invisible_strip" | "confusables" | "decode" | "entropy" | "special_tokens";
+    detail: string;
+    count?: number;
+}
+export interface SanitizeResult {
+    /** The DELIVERED text: invisible-strip + confusables + special-token strip. Empty on `blocked`. */
+    text: string;
+    /**
+     * The delivered text with encodings additionally decoded — for DETECTION ONLY (the pattern
+     * matcher / entropy). Never delivered to the agent: decoding %XX / &#..; / \x.. in a legitimate
+     * URL or code snippet would corrupt content the receiver needs (M1 review / decode-then-rescan).
+     */
+    decodedForScan: string;
+    /** Per-step detection notes (only steps that fired). */
+    notes: SanitizationNote[];
+    /** A suspicion signal for high-entropy (encoded-blob) content. 0 = nothing suspicious. */
+    entropySuspicion: number;
+    /** Set when the message is rejected outright (e.g. over the size cap) — text is empty. */
+    blocked?: {
+        reason: string;
+        guidance: string;
+    };
+}
+export interface SanitizeOptions {
+    maxBytes?: number;
+}
+export declare function stripInvisible(text: string): {
+    text: string;
+    removed: number;
+};
+/** The space-free, encoded-alphabet, high-entropy tokens (encoded-blob candidates) in `text`. */
+export declare function highEntropyTokens(text: string): string[];
+export declare function sanitizeInbound(content: Uint8Array, opts?: SanitizeOptions): SanitizeResult;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/detect/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/detect/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,iBAAiB,GAAG,aAAa,GAAG,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,0FAA0F;IAC1F,gBAAgB,EAAE,MAAM,CAAC;IACzB,0FAA0F;IAC1F,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAmBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAQ9E;AAwED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxD;AAwBD,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,GAAE,eAAoB,GAAG,cAAc,CA4C/F"}

package/dist/detect/sanitize.js

@@ -0,0 +1,211 @@
+/**
+ * M9-IN-001 — inbound Layer-1 deterministic sanitization.
+ *
+ * Pure function, no model, no network (INV-1). Runs the ordered steps from the attack-corpus §1
+ * pipeline that need no external engine: size cap (first — AC-005), invisible/smuggled-Unicode
+ * strip (AC-001 / SI-001), confusables normalization (NFKC + script-lookalike map), encoded-
+ * payload decode, Shannon-entropy scoring (AC-003), and chat-template/special-token strip (AC-004).
+ *
+ * The Step-9 injection-pattern match (AC-002) is a SEPARATE concern: it requires a linear-time
+ * RE2 engine (no native RegExp — ReDoS). The RE2 binding is a pending decision, so that step is
+ * not wired here yet; this module exposes the sanitized text + notes that the pattern matcher and
+ * the M9-IN-002 scanner will consume.
+ */
+/** Default per-message byte cap — mirrors the daemon's 1 MB content cap. */
+export const DEFAULT_MAX_BYTES = 1_000_000;
+// ── Step 1: invisible / smuggled-Unicode strip ───────────────────────────────
+// Codepoints that are invisible (or direction-altering) to a human but tokenize for an LLM.
+const SINGLE_SMUGGLE = new Set([
+    0x00ad, // soft hyphen
+    0x200b, 0x200c, 0x200d, // zero-width space / non-joiner / joiner
+    0x2060, 0x2061, 0x2062, 0x2063, 0x2064, // word joiner + invisible math operators
+    0xfeff, // BOM / zero-width no-break space
+    0x202a, 0x202b, 0x202c, 0x202d, 0x202e, // bidi embeddings / overrides / pop
+    0x2066, 0x2067, 0x2068, 0x2069, // bidi isolates
+]);
+function isSmuggled(cp) {
+    if (SINGLE_SMUGGLE.has(cp))
+        return true;
+    if (cp >= 0xe0000 && cp <= 0xe007f)
+        return true; // Tags block
+    if (cp >= 0xfe00 && cp <= 0xfe0f)
+        return true; // variation selectors
+    if (cp >= 0xe0100 && cp <= 0xe01ef)
+        return true; // variation selectors supplement
+    return false;
+}
+export function stripInvisible(text) {
+    let out = "";
+    let removed = 0;
+    for (const ch of text) {
+        if (isSmuggled(ch.codePointAt(0))) {
+            removed++;
+            continue;
+        }
+        out += ch;
+    }
+    return { text: out, removed };
+}
+// ── Step 3: confusables normalization ────────────────────────────────────────
+// NFKC folds full-width, mathematical-alphanumeric, enclosed, and other compatibility lookalikes
+// to their base form. NFKC does NOT touch cross-script confusables (Cyrillic/Greek letters that
+// merely LOOK Latin), so those get an explicit map. (A full Unicode confusables.txt integration —
+// 6,800+ pairs — is a follow-up; this covers the common attack scripts.)
+const CYRILLIC_GREEK_CONFUSABLES = {
+    // Cyrillic → Latin
+    "а": "a", "е": "e", "о": "o", "с": "c", "р": "p", "х": "x",
+    "у": "y", "к": "k", "м": "m", "т": "t", "н": "h", "в": "b",
+    "и": "u", "ѕ": "s", "і": "i", "ј": "j", "һ": "h", "ԁ": "d",
+    "А": "A", "В": "B", "Е": "E", "К": "K", "М": "M", "Н": "H",
+    "О": "O", "Р": "P", "С": "C", "Т": "T", "Х": "X", "Ѕ": "S",
+    "І": "I", "Ј": "J",
+    // Greek → Latin
+    "ο": "o", "ν": "v", "α": "a", "ρ": "p", "υ": "u", "κ": "k",
+    "Α": "A", "Β": "B", "Ε": "E", "Κ": "K", "Μ": "M", "Ν": "N",
+    "Ο": "O", "Ρ": "P", "Τ": "T", "Χ": "X",
+};
+function normalizeConfusables(text) {
+    const nfkc = text.normalize("NFKC");
+    let count = 0;
+    const mapped = [...nfkc].map((ch) => {
+        const r = CYRILLIC_GREEK_CONFUSABLES[ch];
+        if (r !== undefined) {
+            count++;
+            return r;
+        }
+        return ch;
+    }).join("");
+    return { text: mapped, changed: mapped !== text, count };
+}
+// ── Step 6: encoded-payload decode ───────────────────────────────────────────
+// Decode HTML entities, percent-encoding, and \x / \u escapes so a word hidden behind an encoding
+// surfaces for downstream pattern matching. (Base64/other-radix BLOCKS are handled by entropy
+// scoring + the Step-7 hidden-instruction handling, not decoded blindly here.)
+const NAMED_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " " };
+function decodeEncoded(text) {
+    let count = 0;
+    let out = text;
+    out = out.replace(/&#x([0-9a-f]+);/gi, (_m, h) => { count++; return safeFromCodePoint(parseInt(h, 16)); });
+    out = out.replace(/&#(\d+);/g, (_m, d) => { count++; return safeFromCodePoint(parseInt(d, 10)); });
+    out = out.replace(/&([a-z]+);/gi, (m, name) => {
+        const v = NAMED_ENTITIES[name.toLowerCase()];
+        if (v === undefined)
+            return m;
+        count++;
+        return v;
+    });
+    out = out.replace(/%([0-9a-f]{2})/gi, (_m, h) => { count++; return safeFromCodePoint(parseInt(h, 16)); });
+    out = out.replace(/\\x([0-9a-f]{2})/gi, (_m, h) => { count++; return safeFromCodePoint(parseInt(h, 16)); });
+    out = out.replace(/\\u\{?([0-9a-f]{1,6})\}?/gi, (_m, h) => { count++; return safeFromCodePoint(parseInt(h, 16)); });
+    return { text: out, changed: out !== text, count };
+}
+function safeFromCodePoint(cp) {
+    if (!Number.isFinite(cp) || cp < 0 || cp > 0x10ffff || (cp >= 0xd800 && cp <= 0xdfff))
+        return "";
+    try {
+        return String.fromCodePoint(cp);
+    }
+    catch {
+        return "";
+    }
+}
+// ── Step 8: Shannon-entropy scoring ──────────────────────────────────────────
+// An encoded payload (base64/hex blob) is a long, space-free, high-entropy token; ordinary prose
+// is short tokens with lower per-character entropy. Count the suspicious tokens.
+const ENTROPY_MIN_TOKEN_LEN = 20;
+const ENTROPY_BITS_THRESHOLD = 4.0;
+function shannonBits(s) {
+    const freq = new Map();
+    for (const ch of s)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    let h = 0;
+    for (const c of freq.values()) {
+        const p = c / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+// An encoded-blob candidate is a long run drawn purely from a base64/base64url/hex alphabet —
+// which excludes URLs, file paths, and prose (they carry `:` `/` `.` or whitespace). This keeps
+// the entropy signal on actual encoded payloads, not legitimate long tokens like a URL.
+const ENCODED_CHARSET = /^[A-Za-z0-9+/=_-]+$/;
+/** The space-free, encoded-alphabet, high-entropy tokens (encoded-blob candidates) in `text`. */
+export function highEntropyTokens(text) {
+    const found = [];
+    for (const token of text.split(/\s+/)) {
+        if (token.length < ENTROPY_MIN_TOKEN_LEN)
+            continue;
+        if (!ENCODED_CHARSET.test(token))
+            continue;
+        if (shannonBits(token) >= ENTROPY_BITS_THRESHOLD)
+            found.push(token);
+    }
+    return found;
+}
+function scoreEntropy(text) {
+    return highEntropyTokens(text).length;
+}
+// ── Step 9 (markers): chat-template / special-token strip ────────────────────
+// Removes privileged-turn markers so they cannot be re-interpreted as a system/instruction turn.
+// These are bounded literals/anchored patterns (no catastrophic backtracking) — distinct from the
+// RE2 injection-pattern step (AC-002), which is parked on the RE2 binding decision.
+const LITERAL_MARKERS = ["[SYSTEM]", "[/SYSTEM]", "<<SYS>>", "<</SYS>>", "[INST]", "[/INST]", "SYSTEM PROMPT:", "<system>", "</system>"];
+function stripSpecialTokens(text) {
+    let out = text;
+    let removed = 0;
+    for (const lit of LITERAL_MARKERS) {
+        const parts = out.split(lit);
+        if (parts.length > 1) {
+            removed += parts.length - 1;
+            out = parts.join(" ");
+        }
+    }
+    out = out.replace(/<\|[a-z0-9_]+\|>/gi, () => { removed++; return " "; });
+    out = out.replace(/###\s*(instruction|response|system|human|assistant)\b:?/gi, () => { removed++; return " "; });
+    out = out.replace(/<\/?s>/gi, () => { removed++; return " "; });
+    return { text: out, removed };
+}
+// ── The pipeline ─────────────────────────────────────────────────────────────
+export function sanitizeInbound(content, opts = {}) {
+    const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BYTES;
+    const notes = [];
+    // AC-005: size cap FIRST — before any decode/normalize work.
+    if (content.length > maxBytes) {
+        return {
+            text: "",
+            decodedForScan: "",
+            notes: [],
+            entropySuspicion: 0,
+            blocked: {
+                reason: "content_too_large",
+                guidance: `Inbound message is ${content.length} bytes, over the ${maxBytes}-byte cap. ` +
+                    "It was rejected before sanitization; the sender must split it into smaller messages.",
+            },
+        };
+    }
+    let text = new TextDecoder("utf-8", { fatal: false }).decode(content);
+    const inv = stripInvisible(text);
+    if (inv.removed > 0)
+        notes.push({ step: "invisible_strip", detail: "stripped invisible/smuggled-Unicode codepoints", count: inv.removed });
+    text = inv.text;
+    const conf = normalizeConfusables(text);
+    if (conf.changed)
+        notes.push({ step: "confusables", detail: "normalized lookalike characters to their base form", count: conf.count });
+    text = conf.text;
+    const tok = stripSpecialTokens(text);
+    if (tok.removed > 0)
+        notes.push({ step: "special_tokens", detail: "stripped chat-template / special-token markers", count: tok.removed });
+    text = tok.text;
+    // Decode is DETECTION-ONLY (decode-then-rescan): it feeds the pattern matcher + entropy, and is
+    // NOT applied to the delivered `text` — decoding %XX / &#..; / \x.. / \u.. in a legitimate URL,
+    // code snippet, or quoted entity would silently corrupt content the receiver needs (M1 review).
+    const dec = decodeEncoded(text);
+    if (dec.changed)
+        notes.push({ step: "decode", detail: "encoded payload detected (decoded for rescan; delivered form unchanged)", count: dec.count });
+    const decodedForScan = dec.text;
+    const entropySuspicion = scoreEntropy(decodedForScan);
+    if (entropySuspicion > 0)
+        notes.push({ step: "entropy", detail: "high-entropy encoded-blob segment(s) detected", count: entropySuspicion });
+    return { text, decodedForScan, notes, entropySuspicion };
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/detect/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/detect/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AA6B3C,gFAAgF;AAChF,4FAA4F;AAC5F,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS;IACrC,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC;IACjE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,yCAAyC;IACjF,MAAM,EAAE,kCAAkC;IAC1C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oCAAoC;IAC5E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB;CACjD,CAAC,CAAC;AACH,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,EAAE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IAC9D,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,sBAAsB;IACrE,IAAI,EAAE,IAAI,OAAO,IAAI,EAAE,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;IAClF,OAAO,KAAK,CAAC;AACf,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,gGAAgG;AAChG,kGAAkG;AAClG,yEAAyE;AACzE,MAAM,0BAA0B,GAA2B;IACzD,mBAAmB;IACnB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAClB,gBAAgB;IAChB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;IAC1D,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG;CACvC,CAAC;AACF,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAAC,KAAK,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAC3C,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,kGAAkG;AAClG,8FAA8F;AAC9F,+EAA+E;AAC/E,MAAM,cAAc,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC/G,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE;QACpD,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,KAAK,EAAE,CAAC;QAAC,OAAO,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5H,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AACD,SAAS,iBAAiB,CAAC,EAAU;IACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,CAAC,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACjG,IAAI,CAAC;QAAC,OAAO,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/D,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACjC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AACD,8FAA8F;AAC9F,gGAAgG;AAChG,wFAAwF;AACxF,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;YAAE,SAAS;QACnD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3C,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,sBAAsB;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,iGAAiG;AACjG,kGAAkG;AAClG,oFAAoF;AACpF,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;AACzI,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAAC,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;IAC/E,CAAC;IACD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,2DAA2D,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACjH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,OAAmB,EAAE,OAAwB,EAAE;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,KAAK,GAAuB,EAAE,CAAC;IAErC,6DAA6D;IAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,EAAE;YACR,cAAc,EAAE,EAAE;YAClB,KAAK,EAAE,EAAE;YACT,gBAAgB,EAAE,CAAC;YACnB,OAAO,EAAE;gBACP,MAAM,EAAE,mBAAmB;gBAC3B,QAAQ,EAAE,sBAAsB,OAAO,CAAC,MAAM,oBAAoB,QAAQ,aAAa;oBACrF,sFAAsF;aACzF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEtE,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,gDAAgD,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3I,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAEhB,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,oDAAoD,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACvI,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAEjB,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,gDAAgD,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1I,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAEhB,gGAAgG;IAChG,gGAAgG;IAChG,gGAAgG;IAChG,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,yEAAyE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACrJ,MAAM,cAAc,GAAG,GAAG,CAAC,IAAI,CAAC;IAEhC,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IACtD,IAAI,gBAAgB,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,+CAA+C,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAE5I,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;AAC3D,CAAC"}

package/dist/detect/secrets.d.ts

@@ -0,0 +1,20 @@
+/** Compile the rule set + the false-positive layer. Returns how many of the 222 rules compiled. */
+export declare function compileSecretRules(): {
+    compiled: number;
+    total: number;
+};
+export declare function secretRulesReady(): boolean;
+export interface SecretFinding {
+    ruleId: string;
+}
+export interface SecretScanResult {
+    text: string;
+    findings: SecretFinding[];
+}
+/**
+ * Redact every detected secret in `input` with a typed placeholder `[REDACTED:<rule-id>]`. The
+ * delivered text never contains a detected secret value (SI-001). Returns the redacted text + the
+ * rules that fired. Returns the input unchanged if the rules were never compiled.
+ */
+export declare function redactSecrets(input: string): SecretScanResult;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/detect/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAuBA,mGAAmG;AACnG,wBAAgB,kBAAkB,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAexE;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,MAAM,WAAW,aAAa;IAAG,MAAM,EAAE,MAAM,CAAA;CAAE;AACjD,MAAM,WAAW,gBAAgB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE;AAmB7E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA6B7D"}

package/dist/detect/secrets.js

@@ -0,0 +1,104 @@
+/**
+ * M9-OUT-001 — outbound secret detection + redaction.
+ *
+ * Adopts the FULL gitleaks dictionary (222 detectors, MIT — see ./gitleaks-rules.ts) plus the
+ * generic keyword-proximity + entropy catch-all (gitleaks' own `generic-api-key` rule, so coverage
+ * is not limited to enumerated formats), with gitleaks' value-level false-positive layer (stopwords
+ * + allow-regexes + per-rule entropy thresholds). Secrets redact by DEFAULT — leaking a credential is
+ * essentially never intended; the rare deliberate send goes through the M9-FEED-001 governance
+ * re-send.
+ *
+ * Every pattern runs on the RE2 engine (the rules are RE2-authored), so a crafted message can never
+ * cause catastrophic backtracking. The keyword pre-filter (run a rule only when one of its keywords
+ * appears) keeps the 222-rule scan fast. Compile once at gateway startup, after initLinearRegex().
+ */
+import { LinearRegex } from "./linear-regex.js";
+import { GITLEAKS_RULES, GITLEAKS_STOPWORDS, GITLEAKS_ALLOW_REGEXES } from "./gitleaks-rules.js";
+let RULES = null;
+let STOPWORDS = [];
+let ALLOW = [];
+/** Compile the rule set + the false-positive layer. Returns how many of the 222 rules compiled. */
+export function compileSecretRules() {
+    const compiled = [];
+    for (const r of GITLEAKS_RULES) {
+        try {
+            compiled.push({ id: r.id, re: new LinearRegex(r.regex), keywords: r.keywords, entropy: r.entropy });
+        }
+        catch {
+            // A rule that does not compile under RE2 is skipped rather than crashing the gateway.
+        }
+    }
+    RULES = compiled;
+    STOPWORDS = GITLEAKS_STOPWORDS.map((s) => s.toLowerCase());
+    ALLOW = GITLEAKS_ALLOW_REGEXES.map((s) => {
+        try {
+            return new LinearRegex(s);
+        }
+        catch {
+            return null;
+        }
+    }).filter((x) => x !== null);
+    return { compiled: compiled.length, total: GITLEAKS_RULES.length };
+}
+export function secretRulesReady() {
+    return RULES !== null;
+}
+function shannonBits(s) {
+    const freq = new Map();
+    for (const ch of s)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    let h = 0;
+    for (const c of freq.values()) {
+        const p = c / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+/** gitleaks' value-level false-positive layer: stopword substring, allow-regex, or below entropy. */
+function isFalsePositive(value, ruleEntropy) {
+    const lower = value.toLowerCase();
+    if (STOPWORDS.some((sw) => lower.includes(sw)))
+        return true;
+    if (ALLOW.some((re) => re.test(value)))
+        return true;
+    if (ruleEntropy > 0 && shannonBits(value) < ruleEntropy)
+        return true;
+    return false;
+}
+/**
+ * Redact every detected secret in `input` with a typed placeholder `[REDACTED:<rule-id>]`. The
+ * delivered text never contains a detected secret value (SI-001). Returns the redacted text + the
+ * rules that fired. Returns the input unchanged if the rules were never compiled.
+ */
+export function redactSecrets(input) {
+    if (!RULES)
+        return { text: input, findings: [] };
+    let text = input;
+    const findings = [];
+    const lowerContent = input.toLowerCase();
+    for (const rule of RULES) {
+        // Keyword pre-filter: skip a rule unless one of its keywords appears (gitleaks' fast path).
+        if (rule.keywords.length > 0 && !rule.keywords.some((k) => lowerContent.includes(k)))
+            continue;
+        // Collect every real-secret value this rule matches (scanning the whole text without a global
+        // flag, by advancing past each match).
+        const secrets = new Set();
+        let offset = 0;
+        let guard = 0;
+        while (offset < text.length && guard++ < 1000) {
+            const m = rule.re.exec(text.slice(offset));
+            if (!m || m.index === undefined)
+                break;
+            const value = (m[1] ?? m[0]) || "";
+            if (value && !isFalsePositive(value, rule.entropy))
+                secrets.add(value);
+            offset += m.index + Math.max(1, m[0].length);
+        }
+        for (const value of secrets) {
+            text = text.split(value).join(`[REDACTED:${rule.id}]`);
+            findings.push({ ruleId: rule.id });
+        }
+    }
+    return { text, findings };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/detect/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIjG,IAAI,KAAK,GAA0B,IAAI,CAAC;AACxC,IAAI,SAAS,GAAa,EAAE,CAAC;AAC7B,IAAI,KAAK,GAAkB,EAAE,CAAC;AAE9B,mGAAmG;AACnG,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,KAAK,GAAG,QAAQ,CAAC;IACjB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC;YAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAKD,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAa,EAAE,WAAmB;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACjD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,4FAA4F;QAC5F,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAE/F,8FAA8F;QAC9F,uCAAuC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM;YACvC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @cello-protocol/gateway — the CELLO security gateway.
+ *
+ * A separate program from the daemon. The daemon imports only the contract
+ * (`SecurityGatewayClient` + verdict types) and a client implementation; all detection lives
+ * here. M9-CORE-001 ships the seam with a pass-through; later stories add the pipeline.
+ */
+export type { ScreenDirection, ScreenDisposition, GovernanceDisposition, GovernanceEvent, ScreenContext, ScreenVerdict, SecurityGatewayClient, } from "./types.js";
+export { OutboundScreener } from "./screen/outbound.js";
+export type { OutboundVerdict, OutboundScreenerOptions, OutboundScreenContext } from "./screen/outbound.js";
+export { InboundScreener } from "./screen/inbound.js";
+export type { InboundVerdict, InboundScreenerOptions } from "./screen/inbound.js";
+export { initLinearRegex, linearRegexEngine, LinearRegex } from "./detect/linear-regex.js";
+export { compileInjectionPatterns, scanInjectionPatterns, injectionPatternsReady } from "./detect/injection-patterns.js";
+export { compileSecretRules, redactSecrets, secretRulesReady } from "./detect/secrets.js";
+export type { SecretFinding, SecretScanResult } from "./detect/secrets.js";
+export { screenInboundLanguage } from "./detect/language.js";
+export type { LanguageVerdict, LanguageOptions, Script } from "./detect/language.js";
+export { InjectionScanner, scoreToVerdict, BLOCK_THRESHOLD, FLAG_THRESHOLD } from "./detect/injection-scanner.js";
+export type { InjectionClassifier, InjectionVerdict, ScanResult } from "./detect/injection-scanner.js";
+export { isModelInstalled, installModel, verifyModel, sha256File } from "./detect/model-installer.js";
+export type { InstallResult, InstallOptions } from "./detect/model-installer.js";
+export { DEBERTA_MODEL } from "./detect/deberta-model-manifest.js";
+export { GatewayConfigStore } from "./config/config-store.js";
+export type { ConfigDirection, SetResult, ConfigVersionRow } from "./config/config-store.js";
+export { GatewayRecordStore } from "./records/record-store.js";
+export type { RecordDisposition, RecordDirection, RecordInput, SecurityRecord } from "./records/record-store.js";
+export { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, failClosedVerdict } from "./types.js";
+export { PassthroughGatewayClient } from "./passthrough.js";
+export { SCREEN_OUTBOUND, SCREEN_INBOUND, encodeFrame, FrameDecoder, } from "./protocol.js";
+export type { ScreenMethod, WireScreenRequest, WireScreenResponse } from "./protocol.js";
+export { createGatewayServer } from "./server.js";
+export type { GatewayScreenFn, GatewayServerOptions, GatewayServerHandle, GatewayLogger, } from "./server.js";
+export { LocalSidecarGatewayClient } from "./client.js";
+export type { LocalSidecarGatewayClientOptions } from "./client.js";
+export { spawnGatewaySidecar, GATEWAY_READY_TOKEN } from "./spawn.js";
+export type { SpawnGatewayOptions, SpawnedGateway } from "./spawn.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIlF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAClH,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,25 @@
+// The composed inbound/outbound screens (the gateway runs these; M9-FEED-001 renders the verdict).
+export { OutboundScreener } from "./screen/outbound.js";
+export { InboundScreener } from "./screen/inbound.js";
+// The RE2 linear-time regex engine (native re2 preferred, re2-wasm fallback) + the injection
+// pattern scanner (M9-IN-001 Step-9). initLinearRegex() must be awaited once before use.
+export { initLinearRegex, linearRegexEngine, LinearRegex } from "./detect/linear-regex.js";
+export { compileInjectionPatterns, scanInjectionPatterns, injectionPatternsReady } from "./detect/injection-patterns.js";
+export { compileSecretRules, redactSecrets, secretRulesReady } from "./detect/secrets.js";
+export { screenInboundLanguage } from "./detect/language.js";
+export { InjectionScanner, scoreToVerdict, BLOCK_THRESHOLD, FLAG_THRESHOLD } from "./detect/injection-scanner.js";
+export { isModelInstalled, installModel, verifyModel, sha256File } from "./detect/model-installer.js";
+export { DEBERTA_MODEL } from "./detect/deberta-model-manifest.js";
+export { GatewayConfigStore } from "./config/config-store.js";
+export { GatewayRecordStore } from "./records/record-store.js";
+export { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, failClosedVerdict } from "./types.js";
+export { PassthroughGatewayClient } from "./passthrough.js";
+// Wire protocol (shared by the local sidecar; Phase 2's mTLS gateway reuses these shapes).
+export { SCREEN_OUTBOUND, SCREEN_INBOUND, encodeFrame, FrameDecoder, } from "./protocol.js";
+// The gateway server (the separate program) + the screen-function and logger seams.
+export { createGatewayServer } from "./server.js";
+// The daemon's local-sidecar adapter.
+export { LocalSidecarGatewayClient } from "./client.js";
+// Spawn the gateway as a child process (composition root + tests).
+export { spawnGatewaySidecar, GATEWAY_READY_TOKEN } from "./spawn.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,mGAAmG;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,6FAA6F;AAC7F,yFAAyF;AACzF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAElH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEtG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,2FAA2F;AAC3F,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,oFAAoF;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQlD,sCAAsC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAGxD,mEAAmE;AACnE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/passthrough.d.ts

@@ -0,0 +1,18 @@
+import type { ScreenContext, ScreenVerdict, SecurityGatewayClient } from "./types.js";
+/**
+ * The null-object gateway client: screens nothing, always allows.
+ *
+ * This is the daemon's default when no gateway is configured (backward compatibility for the
+ * many daemon/SNM tests written before M9, and for a deployment that has not enabled the
+ * security layer). It still RETURNS a verdict (`allow`) — so SI-001 ("never act on content
+ * without a verdict") holds even on the default path; "no gateway configured" means
+ * "always-allow verdict", not "no verdict".
+ *
+ * It contains no detection logic. Real screening lives in the gateway PROGRAM (the server +
+ * the local sidecar / remote client), never in the daemon.
+ */
+export declare class PassthroughGatewayClient implements SecurityGatewayClient {
+    screenOutbound(content: Uint8Array, _ctx: ScreenContext): Promise<ScreenVerdict>;
+    screenInbound(content: Uint8Array, _ctx: ScreenContext): Promise<ScreenVerdict>;
+}
+//# sourceMappingURL=passthrough.d.ts.map

package/dist/passthrough.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passthrough.d.ts","sourceRoot":"","sources":["../src/passthrough.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEtF;;;;;;;;;;;GAWG;AACH,qBAAa,wBAAyB,YAAW,qBAAqB;IAC9D,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAIhF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;CAGtF"}

package/dist/passthrough.js

@@ -0,0 +1,21 @@
+/**
+ * The null-object gateway client: screens nothing, always allows.
+ *
+ * This is the daemon's default when no gateway is configured (backward compatibility for the
+ * many daemon/SNM tests written before M9, and for a deployment that has not enabled the
+ * security layer). It still RETURNS a verdict (`allow`) — so SI-001 ("never act on content
+ * without a verdict") holds even on the default path; "no gateway configured" means
+ * "always-allow verdict", not "no verdict".
+ *
+ * It contains no detection logic. Real screening lives in the gateway PROGRAM (the server +
+ * the local sidecar / remote client), never in the daemon.
+ */
+export class PassthroughGatewayClient {
+    async screenOutbound(content, _ctx) {
+        return { disposition: "allow", content };
+    }
+    async screenInbound(content, _ctx) {
+        return { disposition: "allow", content };
+    }
+}
+//# sourceMappingURL=passthrough.js.map

package/dist/passthrough.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passthrough.js","sourceRoot":"","sources":["../src/passthrough.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,wBAAwB;IACnC,KAAK,CAAC,cAAc,CAAC,OAAmB,EAAE,IAAmB;QAC3D,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAmB,EAAE,IAAmB;QAC1D,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;CACF"}

package/dist/protocol.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The daemon ↔ gateway wire protocol.
+ *
+ * Framing: a 4-byte big-endian length prefix followed by a UTF-8 JSON payload. Content bytes
+ * ride as base64 inside the JSON (binary-safe over a text protocol). This is the local-sidecar
+ * transport (Unix domain socket); Phase 2 swaps the socket for mTLS but keeps these message
+ * shapes, so the remote gateway is a transport change, not a protocol change.
+ */
+import type { ScreenDirection, ScreenDisposition, GovernanceEvent, GovernanceDecision } from "./types.js";
+export declare const SCREEN_OUTBOUND = "screen_outbound";
+export declare const SCREEN_INBOUND = "screen_inbound";
+export type ScreenMethod = typeof SCREEN_OUTBOUND | typeof SCREEN_INBOUND;
+/** A screen request on the wire. `content` is base64. */
+export interface WireScreenRequest {
+    id: number;
+    method: ScreenMethod;
+    content: string;
+    ctx: {
+        direction: ScreenDirection;
+        agentName: string;
+        sessionId: string;
+        correlationId?: string;
+        /** The agent's governance re-send decisions, keyed by flagId (M9-FEED-001 §6). Outbound only. */
+        governanceDecisions?: Record<string, GovernanceDecision>;
+    };
+}
+/** A screen response on the wire. `content` is base64, present ONLY when the gateway transformed it. */
+export interface WireScreenResponse {
+    id: number;
+    verdict: {
+        disposition: ScreenDisposition;
+        content?: string;
+        reason?: string;
+        guidance?: string;
+        /** Governance findings — plain JSON, carried verbatim (M9-FEED-001 renders them). */
+        events?: GovernanceEvent[];
+        /** A content-rejection block (vs a transient fail-closed one). See ScreenVerdict.terminal. */
+        terminal?: boolean;
+    };
+}
+/** Encode an object as a length-prefixed JSON frame. */
+export declare function encodeFrame(obj: unknown): Buffer;
+/**
+ * A stateful decoder for length-prefixed JSON frames arriving as arbitrary socket chunks.
+ * Feed it each chunk; it invokes `onFrame` for every complete frame. `onError` fires on a
+ * frame that exceeds MAX_FRAME_BYTES or fails to parse — the caller should drop the connection.
+ */
+export declare class FrameDecoder {
+    #private;
+    constructor(onFrame: (obj: unknown) => void, onError: (err: Error) => void);
+    push(chunk: Buffer): void;
+}
+//# sourceMappingURL=protocol.d.ts.map

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAE1G,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,OAAO,eAAe,GAAG,OAAO,cAAc,CAAC;AAE1E,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE;QACH,SAAS,EAAE,eAAe,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iGAAiG;QACjG,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;KAC1D,CAAC;CACH;AAED,wGAAwG;AACxG,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE;QACP,WAAW,EAAE,iBAAiB,CAAC;QAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,qFAAqF;QACrF,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;QAC3B,8FAA8F;QAC9F,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;CACH;AAOD,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAMhD;AAED;;;;GAIG;AACH,qBAAa,YAAY;;gBAKX,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI;IAK1E,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;CAoB1B"}