@coderifts/agent-guard 1.0.0 → 1.2.0

package/dist/cjs/resolver-glob.js

@@ -0,0 +1,65 @@
+"use strict";
+/**
+ * resolver-glob — a correct POSIX-path glob matcher for SSOT selection (§5). The naive `fnmatch`
+ * fails on the double-star token (which must span zero-or-more path segments); this handles it (plus
+ * `*` / `?`) precisely so a `generated` double-star pattern matches `generated/x.json`,
+ * `a/generated/b.yaml`, etc., but not `src/x.yaml`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globToRegExp = globToRegExp;
+exports.matchGlob = matchGlob;
+exports.matchAny = matchAny;
+exports.firstMatchIndex = firstMatchIndex;
+/** Compile a glob to an anchored RegExp. Double-star spans segments; `*`/`?` stay within a segment. */
+function globToRegExp(glob) {
+    let re = '';
+    for (let i = 0; i < glob.length; i += 1) {
+        const c = glob[i];
+        if (c === '*') {
+            if (glob[i + 1] === '*') {
+                i += 1;
+                if (glob[i + 1] === '/') {
+                    re += '(?:.*/)?';
+                    i += 1;
+                }
+                else {
+                    re += '.*';
+                }
+            }
+            else {
+                re += '[^/]*';
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else if ('.+^${}()|[]\\'.includes(c)) {
+            re += `\\${c}`;
+        }
+        else {
+            re += c;
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+/** True iff `path` matches `glob`. */
+function matchGlob(glob, path) {
+    return globToRegExp(glob).test(path);
+}
+/** True iff `path` matches ANY of the globs (also accepts an exact-path equality). */
+function matchAny(globs, path) {
+    if (!Array.isArray(globs))
+        return false;
+    return globs.some((g) => g === path || matchGlob(g, path));
+}
+/** Index of the FIRST glob matching `path` (exact or glob), else -1 (first-match-wins). */
+function firstMatchIndex(globs, path) {
+    if (!Array.isArray(globs))
+        return -1;
+    for (let i = 0; i < globs.length; i += 1) {
+        if (globs[i] === path || matchGlob(globs[i], path))
+            return i;
+    }
+    return -1;
+}
+//# sourceMappingURL=resolver-glob.js.map

package/dist/cjs/resolver-glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-glob.js","sourceRoot":"","sources":["../../src/resolver-glob.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAGH,oCAoBC;AAGD,8BAEC;AAGD,4BAGC;AAGD,0CAMC;AAzCD,uGAAuG;AACvG,SAAgB,YAAY,CAAC,IAAY;IACvC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAAC,EAAE,IAAI,UAAU,CAAC;oBAAC,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;qBAAM,CAAC;oBAAC,EAAE,IAAI,IAAI,CAAC;gBAAC,CAAC;YAC7E,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,sCAAsC;AACtC,SAAgB,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,sFAAsF;AACtF,SAAgB,QAAQ,CAAC,KAA2B,EAAE,IAAY;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,2FAA2F;AAC3F,SAAgB,eAAe,CAAC,KAA2B,EAAE,IAAY;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/cjs/resolver-yaml.d.ts

@@ -0,0 +1,20 @@
+/**
+ * resolver-yaml — a MINIMAL, deterministic YAML/JSON reader for the artifact resolver's $ref bundler.
+ *
+ * The guard package has no YAML dependency; the resolver only needs to parse the constrained YAML
+ * that appears in OpenAPI/AsyncAPI contract docs (block mappings, flow mappings, quoted keys, scalar
+ * values, and `$ref` strings) to inline external file refs into a deterministic JSON bundle (§4.3).
+ * It is NOT a general YAML engine — anything outside the supported subset throws, and the resolver
+ * turns that into a `parse_error` unresolved entry (never a fabricated document).
+ *
+ * Determinism: plain scalars are kept as raw strings (no lossy type coercion), so parse→serialize is
+ * byte-stable per input.
+ */
+export declare class YamlLiteError extends Error {
+    constructor(message: string);
+}
+/** Parse a JSON or (subset) YAML document to a plain JS value. Throws YamlLiteError on unsupported input. */
+export declare function parseDoc(text: string): unknown;
+/** Deterministic JSON serialization with recursively sorted object keys (byte-stable — §4.3, A6). */
+export declare function stableStringify(value: unknown): string;
+//# sourceMappingURL=resolver-yaml.d.ts.map

package/dist/cjs/resolver-yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-yaml.d.ts","sourceRoot":"","sources":["../../src/resolver-yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAC5B;AAID,6GAA6G;AAC7G,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAc9C;AAiJD,qGAAqG;AACrG,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEtD"}

package/dist/cjs/resolver-yaml.js

@@ -0,0 +1,235 @@
+"use strict";
+/**
+ * resolver-yaml — a MINIMAL, deterministic YAML/JSON reader for the artifact resolver's $ref bundler.
+ *
+ * The guard package has no YAML dependency; the resolver only needs to parse the constrained YAML
+ * that appears in OpenAPI/AsyncAPI contract docs (block mappings, flow mappings, quoted keys, scalar
+ * values, and `$ref` strings) to inline external file refs into a deterministic JSON bundle (§4.3).
+ * It is NOT a general YAML engine — anything outside the supported subset throws, and the resolver
+ * turns that into a `parse_error` unresolved entry (never a fabricated document).
+ *
+ * Determinism: plain scalars are kept as raw strings (no lossy type coercion), so parse→serialize is
+ * byte-stable per input.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.YamlLiteError = void 0;
+exports.parseDoc = parseDoc;
+exports.stableStringify = stableStringify;
+class YamlLiteError extends Error {
+    constructor(message) { super(message); this.name = 'YamlLiteError'; }
+}
+exports.YamlLiteError = YamlLiteError;
+/** Parse a JSON or (subset) YAML document to a plain JS value. Throws YamlLiteError on unsupported input. */
+function parseDoc(text) {
+    const trimmed = text.trimStart();
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+        try {
+            return JSON.parse(text);
+        }
+        catch (e) {
+            throw new YamlLiteError(`invalid JSON: ${e.message}`);
+        }
+    }
+    const lines = [];
+    for (const raw of text.split('\n')) {
+        const trimmedLine = raw.trim();
+        if (trimmedLine === '' || trimmedLine.startsWith('#'))
+            continue;
+        lines.push({ indent: raw.length - raw.trimStart().length, text: trimmedLine });
+    }
+    if (lines.length === 0)
+        return null;
+    const [value] = parseBlock(lines, 0, lines[0].indent);
+    return value;
+}
+function parseBlock(lines, start, indent) {
+    if (start >= lines.length)
+        return [null, start];
+    const first = lines[start];
+    if (first.text === '-' || first.text.startsWith('- '))
+        return parseSequence(lines, start, indent);
+    return parseMapping(lines, start, indent);
+}
+function parseMapping(lines, start, indent) {
+    const obj = {};
+    let i = start;
+    while (i < lines.length && lines[i].indent === indent) {
+        const { key, rest } = splitKeyValue(lines[i].text);
+        i += 1;
+        if (rest === '') {
+            if (i < lines.length && lines[i].indent > indent) {
+                const [child, next] = parseBlock(lines, i, lines[i].indent);
+                obj[key] = child;
+                i = next;
+            }
+            else {
+                obj[key] = null;
+            }
+        }
+        else {
+            obj[key] = parseScalarOrFlow(rest);
+        }
+    }
+    return [obj, i];
+}
+function parseSequence(lines, start, indent) {
+    const arr = [];
+    let i = start;
+    while (i < lines.length && lines[i].indent === indent && (lines[i].text === '-' || lines[i].text.startsWith('- '))) {
+        const itemText = lines[i].text.slice(1).trim();
+        i += 1;
+        if (itemText === '') {
+            if (i < lines.length && lines[i].indent > indent) {
+                const [child, next] = parseBlock(lines, i, lines[i].indent);
+                arr.push(child);
+                i = next;
+            }
+            else {
+                arr.push(null);
+            }
+        }
+        else {
+            arr.push(parseScalarOrFlow(itemText));
+        }
+    }
+    return [arr, i];
+}
+/** Split "key: rest" honoring a quoted key; the separator is the first top-level colon. */
+function splitKeyValue(text) {
+    let key;
+    let idx;
+    if (text[0] === "'" || text[0] === '"') {
+        const q = text[0];
+        let j = 1;
+        while (j < text.length && text[j] !== q)
+            j += 1;
+        key = text.slice(1, j);
+        idx = text.indexOf(':', j);
+    }
+    else {
+        idx = text.indexOf(':');
+        key = idx === -1 ? text : text.slice(0, idx);
+    }
+    if (idx === -1)
+        return { key: key.trim(), rest: '' };
+    return { key: key.trim(), rest: text.slice(idx + 1).trim() };
+}
+function parseScalarOrFlow(s) {
+    const t = s.trim();
+    if (t === '' || t === '~' || t === 'null')
+        return null;
+    if (t[0] === '{' || t[0] === '[')
+        return parseFlow(t).value;
+    if (t[0] === "'" || t[0] === '"')
+        return unquote(t);
+    return t;
+}
+function unquote(t) {
+    const q = t[0];
+    let j = 1;
+    let out = '';
+    while (j < t.length && t[j] !== q) {
+        out += t[j];
+        j += 1;
+    }
+    return out;
+}
+function parseFlow(s) {
+    if (s[0] === '{')
+        return parseFlowMap(s);
+    if (s[0] === '[')
+        return parseFlowSeq(s);
+    throw new YamlLiteError(`not a flow collection: ${s.slice(0, 20)}`);
+}
+function parseFlowMap(s) {
+    const obj = {};
+    let i = 1;
+    while (i < s.length) {
+        while (i < s.length && (s[i] === ' ' || s[i] === ','))
+            i += 1;
+        if (s[i] === '}')
+            return { value: obj, end: i + 1 };
+        let key;
+        if (s[i] === "'" || s[i] === '"') {
+            const q = s[i];
+            let j = i + 1;
+            let k = '';
+            while (j < s.length && s[j] !== q) {
+                k += s[j];
+                j += 1;
+            }
+            key = k;
+            i = j + 1;
+        }
+        else {
+            let k = '';
+            while (i < s.length && s[i] !== ':' && s[i] !== '}' && s[i] !== ',') {
+                k += s[i];
+                i += 1;
+            }
+            key = k.trim();
+        }
+        while (i < s.length && (s[i] === ' ' || s[i] === ':'))
+            i += 1;
+        const [val, next] = readFlowValue(s, i);
+        obj[key] = val;
+        i = next;
+    }
+    throw new YamlLiteError(`unterminated flow map: ${s.slice(0, 40)}`);
+}
+function parseFlowSeq(s) {
+    const arr = [];
+    let i = 1;
+    while (i < s.length) {
+        while (i < s.length && (s[i] === ' ' || s[i] === ','))
+            i += 1;
+        if (s[i] === ']')
+            return { value: arr, end: i + 1 };
+        const [val, next] = readFlowValue(s, i);
+        arr.push(val);
+        i = next;
+    }
+    throw new YamlLiteError(`unterminated flow seq: ${s.slice(0, 40)}`);
+}
+function readFlowValue(s, start) {
+    let i = start;
+    while (i < s.length && s[i] === ' ')
+        i += 1;
+    if (s[i] === '{' || s[i] === '[') {
+        const { value, end } = parseFlow(s.slice(i));
+        return [value, i + end];
+    }
+    if (s[i] === "'" || s[i] === '"') {
+        const q = s[i];
+        let j = i + 1;
+        let out = '';
+        while (j < s.length && s[j] !== q) {
+            out += s[j];
+            j += 1;
+        }
+        return [out, j + 1];
+    }
+    let out = '';
+    while (i < s.length && s[i] !== ',' && s[i] !== '}' && s[i] !== ']') {
+        out += s[i];
+        i += 1;
+    }
+    return [out.trim(), i];
+}
+/** Deterministic JSON serialization with recursively sorted object keys (byte-stable — §4.3, A6). */
+function stableStringify(value) {
+    return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const k of Object.keys(value).sort()) {
+            out[k] = sortKeys(value[k]);
+        }
+        return out;
+    }
+    return value;
+}
+//# sourceMappingURL=resolver-yaml.js.map

package/dist/cjs/resolver-yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver-yaml.js","sourceRoot":"","sources":["../../src/resolver-yaml.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AASH,4BAcC;AAkJD,0CAEC;AAzKD,MAAa,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC;CAC9E;AAFD,sCAEC;AAID,6GAA6G;AAC7G,SAAgB,QAAQ,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,MAAM,IAAI,aAAa,CAAC,iBAAkB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IAClH,CAAC;IACD,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,WAAW,KAAK,EAAE,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAChE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAClG,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IAChE,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACjD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC5D,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACjB,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,MAAc;IACjE,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,CAAC,IAAI,CAAC,CAAC;QACP,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACjD,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC5D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,GAAW,CAAC;IAChB,IAAI,GAAW,CAAC;IAChB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAChD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvB,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACrD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YACzD,GAAG,GAAG,CAAC,CAAC;YAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAC3F,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACf,CAAC,GAAG,IAAI,CAAC;IACX,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,GAAG,IAAI,CAAC;IACX,CAAC;IACD,MAAM,IAAI,aAAa,CAAC,0BAA0B,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,CAAS,EAAE,KAAa;IAC7C,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,qGAAqG;AACrG,SAAgB,eAAe,CAAC,KAAc;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cjs/session-taint.d.ts

@@ -0,0 +1,97 @@
+/**
+ * @coderifts/agent-guard — process-local session-taint detector (SEPARATE surface).
+ *
+ * Implements session-taint-detector-SPEC.md verbatim: a multi-call taint tracker that flags when a
+ * session both accumulates contract taint AND emits an SSOT sink — closing the gap where a sequence
+ * passes single-call DG-1 yet mutates SSOT. Additive: the frozen `builtinDetector.detect()` is NOT
+ * touched. Versioned SEPARATELY (session-taint/1.0.0), monotonic toward caution.
+ *
+ * Normative: flag ⇔ ssot_sink_events ≠ ∅ ∧ tainted. Fixture-faithful classifier order (§1.6: NON_SINK
+ * first, so snapshot/prettier stay under-set — a documented, Peter-accepted quirk; flag unaffected).
+ */
+import type { ToolCallDescriptor } from './types.js';
+export declare const SESSION_TAINT_VERSION = "session-taint/1.0.0";
+export type PathClass = 'prose' | 'scratch' | 'migration' | 'ssot' | 'code_or_config' | 'other';
+export declare function pathClass(p: string): PathClass;
+export type PendingRename = {
+    from: string;
+    to: string;
+} | {
+    drop: string;
+};
+export interface SessionState {
+    scratch_writes: string[];
+    contract_looking_scratch: string[];
+    encoded_fragments: string[];
+    intermediate_artifacts: string[];
+    pending_renames: PendingRename[];
+    optional_fields_added: string[];
+    required_fields_declared: string[];
+    ssot_paths_touched: string[];
+    ssot_sink_events: string[];
+    ssot_invalidated: boolean;
+    reverse_snapshot: boolean;
+    formatter_only_ssot: boolean;
+    store_keys: string[];
+    tainted: boolean;
+}
+export declare function emptySessionState(): SessionState;
+/** Serialize to the fixture's projected form (pending_renames -> "from->to" | "drop:name"). */
+export declare function projectState(s: SessionState): Record<string, unknown>;
+export type CmdClass = 'non_sink' | 'ssot_invalidate' | 'ssot_sink' | 'reverse_snapshot' | 'formatter' | 'unknown_script';
+export declare function classifyCommand(command: string, action: string, cfg?: SessionTaintConfig): CmdClass;
+export declare function updateSession(state: SessionState, call: {
+    toolName?: string;
+    arguments?: unknown;
+}, cfg?: SessionTaintConfig): SessionState;
+export declare function computeTainted(s: SessionState): boolean;
+export interface SessionEval {
+    flag: boolean;
+    trip: boolean;
+    key_signal: string | null;
+}
+export declare function deriveKeySignal(s: SessionState): string;
+/** flag ⇔ (ssot_sink_events ≠ ∅ || sink_seen) ∧ (tainted || overflow). */
+export declare function evaluate(state: SessionState, prevFlagged?: boolean, opts?: {
+    overflow?: boolean;
+    sinkSeen?: boolean;
+}): SessionEval;
+export interface SessionTaintConfig {
+    extraSinkPatterns?: RegExp[];
+    extraNonSinkPatterns?: RegExp[];
+    maxCalls?: number;
+    maxPathsTracked?: number;
+    maxSinkEvents?: number;
+    maxStateBytes?: number;
+    ttlMs?: number;
+    bindCwd?: boolean;
+    sessionId?: string;
+    sessionTaintSeverity?: 'caution' | 'stop';
+}
+export interface SessionTaintObservation {
+    flag: boolean;
+    trip: boolean;
+    key_signal: string | null;
+    state: Readonly<SessionState>;
+    version: typeof SESSION_TAINT_VERSION;
+    overflow: boolean;
+    severity: 'caution' | 'stop';
+}
+export declare class SessionTaintTracker {
+    readonly version = "session-taint/1.0.0";
+    private state;
+    private prevFlag;
+    private callCount;
+    private overflow;
+    private sinkSeen;
+    private lastObserveAt;
+    private cfg;
+    constructor(config?: SessionTaintConfig);
+    private pathTotal;
+    observe(call: ToolCallDescriptor): SessionTaintObservation;
+    status(): SessionTaintObservation;
+    reset(): void;
+    private snapshot;
+    private now;
+}
+//# sourceMappingURL=session-taint.d.ts.map

package/dist/cjs/session-taint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-taint.d.ts","sourceRoot":"","sources":["../../src/session-taint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAiB3D,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAEhG,wBAAgB,SAAS,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,CAO9C;AAGD,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,EAAE,MAAM,EAAE,CAAC;IACnC,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,iBAAiB,IAAI,YAAY,CAOhD;AAED,+FAA+F;AAC/F,wBAAgB,YAAY,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBrE;AAyBD,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,iBAAiB,GAAG,WAAW,GAAG,kBAAkB,GAAG,WAAW,GAAG,gBAAgB,CAAC;AAE1H,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,kBAAuB,GAAG,QAAQ,CAUvG;AAKD,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,EAAE,GAAG,GAAE,kBAAuB,GAAG,YAAY,CA0E/I;AAGD,wBAAgB,cAAc,CAAC,CAAC,EAAE,YAAY,GAAG,OAAO,CAWvD;AAGD,MAAM,WAAW,WAAW;IAAG,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAAE;AAEzF,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,CAQvD;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,UAAQ,EAAE,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,WAAW,CAKrI;AAGD,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC9B,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,SAAS,GAAG,MAAM,CAAC;CAC9B;AAID,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,OAAO,yBAAyB;IACzC,OAAO,CAAC,KAAK,CAAuB;IACpC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,GAAG,CAAqB;gBAEpB,MAAM,GAAE,kBAAuB;IAE3C,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,IAAI,EAAE,kBAAkB,GAAG,uBAAuB;IAsB1D,MAAM,IAAI,uBAAuB;IAEjC,KAAK,IAAI,IAAI;IAKb,OAAO,CAAC,QAAQ;IAYhB,OAAO,CAAC,GAAG;CACZ"}