@deftai/directive-core 0.55.0

package/dist/cache/paths.d.ts

@@ -0,0 +1,7 @@
+/** Validate a cache key for the given source. */
+export declare function validateKey(source: string, key: string): void;
+/** Return `<cacheRoot>/<source>/<key>/` with path segments from `/` in key. */
+export declare function entryDir(source: string, key: string, cacheRoot?: string): string;
+/** Return `<cacheRoot>/quarantine-audit.jsonl`. */
+export declare function auditPath(cacheRoot?: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/cache/paths.js

@@ -0,0 +1,27 @@
+import { join } from "node:path";
+import { ALLOWED_SOURCES, DEFAULT_CACHE_ROOT, GH_KEY_RE } from "./constants.js";
+import { CacheError } from "./errors.js";
+/** Validate a cache key for the given source. */
+export function validateKey(source, key) {
+    if (source === "github-issue") {
+        if (!GH_KEY_RE.test(key)) {
+            throw new CacheError(`invalid github-issue key '${key}': expected '<owner>/<repo>/<N>' ` +
+                "(alphanumerics, '.', '_', '-' only; N positive integer)");
+        }
+        return;
+    }
+    throw new CacheError(`unknown source '${source}': v1 supports ${JSON.stringify([...ALLOWED_SOURCES].sort())}`);
+}
+/** Return `<cacheRoot>/<source>/<key>/` with path segments from `/` in key. */
+export function entryDir(source, key, cacheRoot = DEFAULT_CACHE_ROOT) {
+    if (!ALLOWED_SOURCES.includes(source)) {
+        throw new CacheError(`unknown source '${source}': v1 supports ${JSON.stringify([...ALLOWED_SOURCES].sort())}`);
+    }
+    validateKey(source, key);
+    return join(cacheRoot, source, ...key.split("/"));
+}
+/** Return `<cacheRoot>/quarantine-audit.jsonl`. */
+export function auditPath(cacheRoot = DEFAULT_CACHE_ROOT) {
+    return join(cacheRoot, "quarantine-audit.jsonl");
+}
+//# sourceMappingURL=paths.js.map

package/dist/cache/quota.d.ts

@@ -0,0 +1,56 @@
+export declare const DEFAULT_MAX_BYTES: number;
+export declare const DEFAULT_MAX_ENTRIES = 10000;
+export declare const ENV_MAX_BYTES = "DEFT_CACHE_MAX_BYTES";
+export declare const ENV_MAX_ENTRIES = "DEFT_CACHE_MAX_ENTRIES";
+export declare const CAP_DISABLED = 0;
+export interface CacheCaps {
+    maxBytes: number;
+    maxEntries: number;
+}
+export declare function bytesEnforced(caps: CacheCaps): boolean;
+export declare function entriesEnforced(caps: CacheCaps): boolean;
+export declare function anyEnforced(caps: CacheCaps): boolean;
+export declare function resolveCaps(options?: {
+    maxBytes?: number | null;
+    maxEntries?: number | null;
+}): CacheCaps;
+export interface EntryUsage {
+    entryDir: string;
+    source: string;
+    key: string;
+    sizeBytes: number;
+    lastAccessed: number;
+    metaPresent: boolean;
+}
+export interface UsageReport {
+    totalBytes: number;
+    totalEntries: number;
+    entries: EntryUsage[];
+}
+export declare function scanUsage(cacheRoot: string, sources?: readonly string[]): UsageReport;
+export declare function lruOrder(usage: UsageReport): EntryUsage[];
+export declare function capBreached(usage: UsageReport, caps: CacheCaps, incomingBytes?: number, incomingEntries?: number): boolean;
+export type EvictCallback = (victim: EntryUsage, reason: string, caps: CacheCaps) => void;
+export declare function evictLru(cacheRoot: string, options: {
+    sources?: readonly string[];
+    caps: CacheCaps;
+    incomingBytes?: number;
+    incomingEntries?: number;
+    protectKeys?: ReadonlyArray<[string, string]>;
+    onEvict?: EvictCallback;
+}): EntryUsage[];
+export interface EnforceResult {
+    evicted: EntryUsage[];
+    finalUsage: UsageReport;
+    wouldBreach: boolean;
+}
+export declare function predictEvictionSet(cacheRoot: string, caps: CacheCaps, sources?: readonly string[]): EntryUsage[];
+export declare function enforceCaps(cacheRoot: string, options?: {
+    sources?: readonly string[];
+    caps?: CacheCaps | null;
+    incomingBytes?: number;
+    incomingEntries?: number;
+    protectKeys?: ReadonlyArray<[string, string]>;
+    onEvict?: EvictCallback;
+}): EnforceResult;
+//# sourceMappingURL=quota.d.ts.map

package/dist/cache/quota.js

@@ -0,0 +1,191 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { ALLOWED_SOURCES } from "./constants.js";
+import { removeEntryDir } from "./io.js";
+export const DEFAULT_MAX_BYTES = 100 * 1024 * 1024;
+export const DEFAULT_MAX_ENTRIES = 10_000;
+export const ENV_MAX_BYTES = "DEFT_CACHE_MAX_BYTES";
+export const ENV_MAX_ENTRIES = "DEFT_CACHE_MAX_ENTRIES";
+export const CAP_DISABLED = 0;
+export function bytesEnforced(caps) {
+    return caps.maxBytes > 0;
+}
+export function entriesEnforced(caps) {
+    return caps.maxEntries > 0;
+}
+export function anyEnforced(caps) {
+    return bytesEnforced(caps) || entriesEnforced(caps);
+}
+function parseIntEnv(name, defaultValue) {
+    const raw = process.env[name];
+    if (raw === undefined || raw === "")
+        return defaultValue;
+    const value = Number.parseInt(raw, 10);
+    if (Number.isNaN(value) || value < 0)
+        return CAP_DISABLED;
+    return value;
+}
+export function resolveCaps(options) {
+    let maxBytes = options?.maxBytes ?? parseIntEnv(ENV_MAX_BYTES, DEFAULT_MAX_BYTES);
+    let maxEntries = options?.maxEntries ?? parseIntEnv(ENV_MAX_ENTRIES, DEFAULT_MAX_ENTRIES);
+    if (maxBytes < 0)
+        maxBytes = CAP_DISABLED;
+    if (maxEntries < 0)
+        maxEntries = CAP_DISABLED;
+    return { maxBytes, maxEntries };
+}
+function readMetaSize(metaPath) {
+    try {
+        const meta = JSON.parse(readFileSync(metaPath, "utf8"));
+        if (typeof meta !== "object" || meta === null)
+            return [0, "", "", false];
+        const size = meta.size_bytes;
+        const src = meta.source;
+        const key = meta.key;
+        const sizeBytes = typeof size === "number" && size >= 0 ? size : 0;
+        return [
+            sizeBytes,
+            typeof src === "string" ? src : "",
+            typeof key === "string" ? key : "",
+            true,
+        ];
+    }
+    catch {
+        return [0, "", "", false];
+    }
+}
+function collectMetaPaths(srcRoot) {
+    const found = [];
+    function walk(dir) {
+        if (!existsSync(dir))
+            return;
+        for (const name of readdirSync(dir, { withFileTypes: true })) {
+            const full = join(dir, name.name);
+            if (name.isDirectory()) {
+                walk(full);
+            }
+            else if (name.name === "meta.json") {
+                found.push(full);
+            }
+        }
+    }
+    walk(srcRoot);
+    return found;
+}
+export function scanUsage(cacheRoot, sources = ALLOWED_SOURCES) {
+    if (!existsSync(cacheRoot)) {
+        return { totalBytes: 0, totalEntries: 0, entries: [] };
+    }
+    const entries = [];
+    let totalBytes = 0;
+    for (const src of sources) {
+        const srcRoot = join(cacheRoot, src);
+        if (!existsSync(srcRoot))
+            continue;
+        for (const metaPath of collectMetaPaths(srcRoot)) {
+            const [size, metaSrc, metaKey, present] = readMetaSize(metaPath);
+            let mtime = 0;
+            try {
+                mtime = statSync(metaPath).mtimeMs / 1000;
+            }
+            catch {
+                mtime = 0;
+            }
+            const relKey = metaKey ||
+                metaPath
+                    .slice(srcRoot.length + 1, metaPath.length - "/meta.json".length)
+                    .split(/[/\\]/)
+                    .join("/");
+            entries.push({
+                entryDir: join(metaPath, ".."),
+                source: metaSrc || src,
+                key: relKey,
+                sizeBytes: size,
+                lastAccessed: mtime,
+                metaPresent: present,
+            });
+            totalBytes += size;
+        }
+    }
+    return { totalBytes, totalEntries: entries.length, entries };
+}
+export function lruOrder(usage) {
+    return [...usage.entries].sort((a, b) => a.lastAccessed - b.lastAccessed || a.entryDir.localeCompare(b.entryDir));
+}
+export function capBreached(usage, caps, incomingBytes = 0, incomingEntries = 0) {
+    if (bytesEnforced(caps) && usage.totalBytes + incomingBytes > caps.maxBytes)
+        return true;
+    return entriesEnforced(caps) && usage.totalEntries + incomingEntries > caps.maxEntries;
+}
+export function evictLru(cacheRoot, options) {
+    const caps = options.caps;
+    if (!anyEnforced(caps))
+        return [];
+    const sources = options.sources ?? ALLOWED_SOURCES;
+    const protect = new Set((options.protectKeys ?? []).map(([s, k]) => `${s}\0${k}`));
+    const usage = scanUsage(cacheRoot, sources);
+    const incomingBytes = options.incomingBytes ?? 0;
+    const incomingEntries = options.incomingEntries ?? 0;
+    if (!capBreached(usage, caps, incomingBytes, incomingEntries))
+        return [];
+    const ordered = lruOrder(usage).filter((e) => !protect.has(`${e.source}\0${e.key}`));
+    if (ordered.length === 0)
+        return [];
+    const evicted = [];
+    let runningBytes = usage.totalBytes;
+    let runningEntries = usage.totalEntries;
+    for (const victim of ordered) {
+        const bytesBreach = bytesEnforced(caps) && runningBytes + incomingBytes > caps.maxBytes;
+        const entriesBreach = entriesEnforced(caps) && runningEntries + incomingEntries > caps.maxEntries;
+        if (!bytesBreach && !entriesBreach)
+            break;
+        const reasons = [];
+        if (bytesBreach)
+            reasons.push("size_cap");
+        if (entriesBreach)
+            reasons.push("entry_cap");
+        const reason = reasons.join("+") || "unknown";
+        options.onEvict?.(victim, reason, caps);
+        removeEntryDir(victim.entryDir);
+        evicted.push(victim);
+        runningBytes -= victim.sizeBytes;
+        runningEntries -= 1;
+    }
+    return evicted;
+}
+export function predictEvictionSet(cacheRoot, caps, sources = ALLOWED_SOURCES) {
+    if (!anyEnforced(caps))
+        return [];
+    const usage = scanUsage(cacheRoot, sources);
+    if (!capBreached(usage, caps))
+        return [];
+    const ordered = lruOrder(usage);
+    const evicted = [];
+    let runningBytes = usage.totalBytes;
+    let runningEntries = usage.totalEntries;
+    for (const entry of ordered) {
+        if (!(bytesEnforced(caps) && runningBytes > caps.maxBytes) &&
+            !(entriesEnforced(caps) && runningEntries > caps.maxEntries)) {
+            break;
+        }
+        evicted.push(entry);
+        runningBytes -= entry.sizeBytes;
+        runningEntries -= 1;
+    }
+    return evicted;
+}
+export function enforceCaps(cacheRoot, options = {}) {
+    const resolved = options.caps ?? resolveCaps();
+    const evicted = evictLru(cacheRoot, {
+        sources: options.sources,
+        caps: resolved,
+        incomingBytes: options.incomingBytes,
+        incomingEntries: options.incomingEntries,
+        protectKeys: options.protectKeys,
+        onEvict: options.onEvict,
+    });
+    const finalUsage = scanUsage(cacheRoot, options.sources);
+    const wouldBreach = capBreached(finalUsage, resolved, options.incomingBytes ?? 0, options.incomingEntries ?? 0);
+    return { evicted, finalUsage, wouldBreach };
+}
+//# sourceMappingURL=quota.js.map

package/dist/cache/scanner.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Quarantine scanner v2 port (mirrors `scripts/cache_scanner.py`).
+ * SCANNER_VERSION must stay in lockstep with the Python module.
+ */
+export declare const SCANNER_VERSION = "2.1.0";
+export interface ScanFlag {
+    category: string;
+    severity: string;
+    detail: string;
+    match_count: number;
+}
+export interface ScanResult {
+    passed: boolean;
+    scanner_version: string;
+    flags: ScanFlag[];
+    transformed_content: string;
+    scanned_at: string;
+}
+/**
+ * Linear, backtracking-free recognizer equivalent to the old `BODY_VECTOR_RE`.
+ * Scans the line once; byte-identical match semantics to the prior regex.
+ */
+export declare function lineHasShellVector(line: string): boolean;
+/** Run scanner v2 over content markdown. */
+export declare function scan(contentMd: string, scannedAt?: string): ScanResult;
+/** Map scan flags for meta.json (omit match_count when zero). */
+export declare function flagsForMeta(flags: readonly ScanFlag[]): Array<Record<string, unknown>>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/cache/scanner.js

@@ -0,0 +1,362 @@
+import { parseMarkdownHeading } from "../text/redos-safe.js";
+/**
+ * Quarantine scanner v2 port (mirrors `scripts/cache_scanner.py`).
+ * SCANNER_VERSION must stay in lockstep with the Python module.
+ */
+export const SCANNER_VERSION = "2.1.0";
+const CREDENTIAL_PATTERNS = [
+    ["github-pat", /\bgh[pousr]_[A-Za-z0-9]{30,}\b/],
+    ["anthropic-api-key", /\bsk-ant-[A-Za-z0-9_-]{20,}\b/],
+    ["openai-api-key", /\bsk-[A-Za-z0-9]{20,}\b/],
+    ["slack-token", /\bxox[bp]-[A-Za-z0-9-]{20,}\b/],
+    ["aws-access-key", /\bAKIA[0-9A-Z]{16}\b/],
+    ["pem-private-key", /-----BEGIN (?:RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/],
+    ["bearer-token", /\bBearer\s+[A-Za-z0-9_.~+/=-]{20,}\b/],
+    ["jwt", /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/],
+];
+const INVISIBLE_RANGES = [
+    [0x200b, 0x200f],
+    [0x202a, 0x202e],
+    [0x2060, 0x2060],
+    [0x2066, 0x2069],
+    [0xfeff, 0xfeff],
+    [0xe0000, 0xe007f],
+];
+const INJECTION_OVERRIDE_RE = /\b(?:ignore|disregard|forget|override|bypass)\s+(?:the\s+|all\s+|any\s+)?(?:previous|prior|above|earlier|all|your|preceding|original|system)\b/i;
+const HEADING_ROLE_PREFIXES = [
+    "SYSTEM",
+    "ASSISTANT",
+    "USER",
+    "AGENT",
+    "TOOL",
+    "FUNCTION",
+    "OVERRIDE",
+    "DIRECTIVE",
+    "ROLE",
+    "PROMPT",
+    "INSTRUCTION",
+    "INSTRUCTIONS",
+];
+const HEADING_ROLE_PREFIX_RE = new RegExp(`^(?:${HEADING_ROLE_PREFIXES.map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\s*:`, "i");
+// #1811 follow-up: the previous `BODY_VECTOR_RE` regex (`(?:curl|wget|fetch)\s+
+// [^|\n]*\|...`) is a CodeQL `js/polynomial-redos` hazard -- `\s+` overlaps
+// `[^|\n]*`, so a line like `curl ` + a long run of spaces with no pipe forces
+// polynomial backtracking. The recognizer below scans each line ONCE for the
+// same three vectors, preserving byte-identical match semantics:
+//   1. curl/wget/fetch <args> | sh|bash|zsh|ksh  (pipe-to-shell)
+//   2. base64 -d | --decode | -D                 (decode flag, word-bounded)
+//   3. eval followed by ( $ " ' ` delimiter
+const PIPE_SHELL_KEYWORDS = ["curl", "wget", "fetch"];
+const SHELL_TARGETS = ["sh", "bash", "zsh", "ksh"];
+const EVAL_DELIMITERS = new Set(["(", "$", '"', "'", "`"]);
+const WS_RE = /\s/;
+function isAsciiWordChar(ch) {
+    if (ch === undefined)
+        return false;
+    return ((ch >= "a" && ch <= "z") || (ch >= "A" && ch <= "Z") || (ch >= "0" && ch <= "9") || ch === "_");
+}
+function isWs(ch) {
+    return ch !== undefined && WS_RE.test(ch);
+}
+/** `\b` immediately before index `i` (keyword first char is always a word char). */
+function wordBoundaryBefore(line, i) {
+    return i === 0 || !isAsciiWordChar(line[i - 1]);
+}
+/** `\b` immediately after index `j` (token last char is always a word char). */
+function wordBoundaryAfter(line, j) {
+    return j >= line.length || !isAsciiWordChar(line[j]);
+}
+function matchesAt(line, i, token) {
+    return line.slice(i, i + token.length).toLowerCase() === token;
+}
+/** Mirror `(?:curl|wget|fetch)\s+[^|\n]*\|\s*(?:sh|bash|zsh|ksh)\b` at start `i`. */
+function pipeToShellAt(line, i, kw) {
+    const afterKw = i + kw.length;
+    // `\s+` requires at least one whitespace char right after the keyword.
+    if (!isWs(line[afterKw]))
+        return false;
+    // `[^|\n]*\|`: the first pipe after the keyword, with no intervening newline.
+    let p = afterKw + 1;
+    while (p < line.length) {
+        const ch = line[p];
+        if (ch === "|")
+            break;
+        if (ch === "\n")
+            return false;
+        p += 1;
+    }
+    if (p >= line.length || line[p] !== "|")
+        return false;
+    // `\s*` after the pipe.
+    let q = p + 1;
+    while (isWs(line[q]))
+        q += 1;
+    // `(?:sh|bash|zsh|ksh)\b`.
+    for (const target of SHELL_TARGETS) {
+        if (matchesAt(line, q, target) && wordBoundaryAfter(line, q + target.length)) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Mirror `\bbase64\s+(?:-d|--decode|-D)\b` at start `i`. */
+function base64DecodeAt(line, i) {
+    if (!wordBoundaryBefore(line, i))
+        return false;
+    const afterKw = i + "base64".length;
+    if (!isWs(line[afterKw]))
+        return false;
+    let j = afterKw + 1;
+    while (isWs(line[j]))
+        j += 1;
+    // `--decode` (word-bounded), case-insensitive.
+    if (matchesAt(line, j, "--decode") && wordBoundaryAfter(line, j + 8))
+        return true;
+    // `-d` / `-D` (word-bounded): dash + d, with a boundary after.
+    if (line[j] === "-") {
+        const flag = line[j + 1];
+        if (flag === "d" || flag === "D") {
+            return wordBoundaryAfter(line, j + 2);
+        }
+    }
+    return false;
+}
+/** Mirror `\beval\s*[($"'`+"`"+`]` at start `i`. */
+function evalDelimiterAt(line, i) {
+    if (!wordBoundaryBefore(line, i))
+        return false;
+    let j = i + "eval".length;
+    while (isWs(line[j]))
+        j += 1;
+    const ch = line[j];
+    return ch !== undefined && EVAL_DELIMITERS.has(ch);
+}
+/**
+ * Linear, backtracking-free recognizer equivalent to the old `BODY_VECTOR_RE`.
+ * Scans the line once; byte-identical match semantics to the prior regex.
+ */
+export function lineHasShellVector(line) {
+    for (let i = 0; i < line.length; i += 1) {
+        for (const kw of PIPE_SHELL_KEYWORDS) {
+            if (matchesAt(line, i, kw) && pipeToShellAt(line, i, kw))
+                return true;
+        }
+        if (matchesAt(line, i, "base64") && base64DecodeAt(line, i))
+            return true;
+        if (matchesAt(line, i, "eval") && evalDelimiterAt(line, i))
+            return true;
+    }
+    return false;
+}
+const FENCE_RE = /^(```|~~~)/;
+const QUARANTINE_FENCE_OPEN = "```quarantined";
+const QUARANTINE_FENCE_CLOSE = "```";
+function isInvisible(ch) {
+    const cp = ch.codePointAt(0);
+    if (cp === undefined)
+        return false;
+    return INVISIBLE_RANGES.some(([lo, hi]) => cp >= lo && cp <= hi);
+}
+function stripInvisible(text) {
+    if (!text)
+        return [text, []];
+    const outChars = [];
+    const seen = new Map();
+    for (const ch of text) {
+        if (isInvisible(ch)) {
+            const cp = ch.codePointAt(0);
+            if (!seen.has(cp)) {
+                seen.set(cp, `U+${cp.toString(16).toUpperCase().padStart(4, "0")}`);
+            }
+            continue;
+        }
+        outChars.push(ch);
+    }
+    return [outChars.join(""), [...seen.values()]];
+}
+function detectCredentials(text) {
+    const flags = [];
+    if (!text)
+        return flags;
+    for (const [label, pattern] of CREDENTIAL_PATTERNS) {
+        const re = new RegExp(pattern.source, pattern.flags);
+        const matches = text.match(new RegExp(re.source, `${re.flags}g`));
+        if (!matches || matches.length === 0)
+            continue;
+        flags.push({
+            category: "credentials",
+            severity: "hard-fail",
+            detail: `matched credentials pattern: ${label}`,
+            match_count: matches.length,
+        });
+    }
+    return flags;
+}
+function headingText(line) {
+    const match = parseMarkdownHeading(line);
+    if (match === null)
+        return null;
+    return match.text.trim();
+}
+function headingSignal(text) {
+    if (INJECTION_OVERRIDE_RE.test(text))
+        return true;
+    return HEADING_ROLE_PREFIX_RE.test(text);
+}
+function bodyHasShellVector(bodyLines) {
+    let inFence = null;
+    for (const ln of bodyLines) {
+        const fenceMatch = FENCE_RE.exec(ln);
+        if (fenceMatch) {
+            const delim = fenceMatch[1] ?? "";
+            if (inFence === null) {
+                inFence = delim;
+            }
+            else if (ln.trimEnd() === inFence) {
+                inFence = null;
+            }
+            continue;
+        }
+        if (inFence !== null)
+            continue;
+        if (lineHasShellVector(ln))
+            return true;
+    }
+    return false;
+}
+function detectInjectionHeading(text) {
+    if (!text)
+        return [text, null];
+    const lines = text.split("\n");
+    const out = [];
+    let inFence = null;
+    let sectionsWrapped = 0;
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i] ?? "";
+        const fenceMatch = FENCE_RE.exec(line);
+        if (fenceMatch) {
+            const delim = fenceMatch[1] ?? "";
+            if (inFence === null) {
+                inFence = delim;
+            }
+            else if (line.trimEnd() === inFence) {
+                inFence = null;
+            }
+            out.push(line);
+            i += 1;
+            continue;
+        }
+        if (inFence !== null) {
+            out.push(line);
+            i += 1;
+            continue;
+        }
+        const hText = headingText(line);
+        if (hText !== null) {
+            let sectionEnd = i + 1;
+            while (sectionEnd < lines.length) {
+                const nxt = lines[sectionEnd] ?? "";
+                const nestedFence = FENCE_RE.exec(nxt);
+                if (nestedFence) {
+                    sectionEnd += 1;
+                    const nested = (nestedFence[1] ?? "").slice(0, 3);
+                    while (sectionEnd < lines.length && (lines[sectionEnd] ?? "").trimEnd() !== nested) {
+                        sectionEnd += 1;
+                    }
+                    sectionEnd += 1;
+                    continue;
+                }
+                if (parseMarkdownHeading(nxt) !== null)
+                    break;
+                sectionEnd += 1;
+            }
+            const bodyLines = lines.slice(i + 1, sectionEnd);
+            const hSignal = headingSignal(hText);
+            const bSignal = bodyHasShellVector(bodyLines);
+            if (hSignal || bSignal) {
+                out.push(QUARANTINE_FENCE_OPEN);
+                for (let j = i; j < sectionEnd; j += 1) {
+                    out.push(lines[j] ?? "");
+                }
+                out.push(QUARANTINE_FENCE_CLOSE);
+                sectionsWrapped += 1;
+                i = sectionEnd;
+                continue;
+            }
+            for (let j = i; j < sectionEnd; j += 1) {
+                out.push(lines[j] ?? "");
+            }
+            i = sectionEnd;
+            continue;
+        }
+        if (headingSignal(line) || lineHasShellVector(line)) {
+            out.push(QUARANTINE_FENCE_OPEN);
+            out.push(line);
+            out.push(QUARANTINE_FENCE_CLOSE);
+            sectionsWrapped += 1;
+            i += 1;
+            continue;
+        }
+        out.push(line);
+        i += 1;
+    }
+    const suffix = text.endsWith("\n") ? "\n" : "";
+    const wrappedText = `${out.join("\n")}${suffix}`;
+    if (sectionsWrapped === 0)
+        return [wrappedText, null];
+    return [
+        wrappedText,
+        {
+            category: "injection-heading",
+            severity: "fence-and-pass",
+            detail: `wrapped ${sectionsWrapped} injection-shaped section(s) in \`quarantined\` fence (v2.1.0 strict-signal policy)`,
+            match_count: sectionsWrapped,
+        },
+    ];
+}
+/** Run scanner v2 over content markdown. */
+export function scan(contentMd, scannedAt) {
+    const timestamp = scannedAt ?? new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+    const flags = [];
+    const [stripped, removedLabels] = stripInvisible(contentMd);
+    if (removedLabels.length > 0) {
+        let totalStripped = 0;
+        for (const ch of contentMd ?? "") {
+            if (isInvisible(ch))
+                totalStripped += 1;
+        }
+        flags.push({
+            category: "invisible-unicode",
+            severity: "strip-and-pass",
+            detail: `stripped ${totalStripped} invisible-unicode codepoint(s): ${removedLabels.join(", ")}`,
+            match_count: totalStripped,
+        });
+    }
+    flags.push(...detectCredentials(stripped));
+    const [wrapped, injFlag] = detectInjectionHeading(stripped);
+    if (injFlag !== null)
+        flags.push(injFlag);
+    const passed = !flags.some((f) => f.severity === "hard-fail");
+    return {
+        passed,
+        scanner_version: SCANNER_VERSION,
+        flags,
+        transformed_content: wrapped,
+        scanned_at: timestamp,
+    };
+}
+/** Map scan flags for meta.json (omit match_count when zero). */
+export function flagsForMeta(flags) {
+    return flags.map((f) => {
+        const out = {
+            category: f.category,
+            severity: f.severity,
+            detail: f.detail,
+        };
+        if (f.match_count)
+            out.match_count = f.match_count;
+        return out;
+    });
+}
+//# sourceMappingURL=scanner.js.map

package/dist/cache/test-helpers.d.ts

@@ -0,0 +1,10 @@
+import type { Clock } from "./time.js";
+/** Fixed clock for deterministic TTL tests. */
+export declare class FixedClock implements Clock {
+    private current;
+    constructor(start: Date);
+    now(): Date;
+    setNow(dt: Date): void;
+    advanceSeconds(seconds: number): void;
+}
+//# sourceMappingURL=test-helpers.d.ts.map