@mcp-index/sdk 0.1.0

package/dist/src/provenance.js

@@ -0,0 +1,221 @@
+/**
+ * Provenance — the immutable record attached to EVERY surfaced finding, and the
+ * load-bearing `requireProvenance` choke. A port of Python
+ * `tooling/cse/provenance.py` + `guardrails.require_provenance`. NOTHING surfaces
+ * without a COMPLETE provenance record (the over-claim guard, fail-closed).
+ */
+import { hashTool } from "./canonical.js";
+import { mdText } from "./render.js";
+import { Decision } from "./preflight.js";
+import { ChangeKind } from "./schemaDiff.js";
+export var VerdictScope;
+(function (VerdictScope) {
+    VerdictScope["STRUCTURAL_ONLY"] = "structural_only";
+    VerdictScope["SEMANTIC_ONLY"] = "semantic_only";
+    VerdictScope["BEHAVIORAL"] = "behavioral";
+})(VerdictScope || (VerdictScope = {}));
+export var HonestFraming;
+(function (HonestFraming) {
+    HonestFraming["CONTRACT_DIFF_NOT_SAFETY"] = "contract-diff not a safety verdict";
+    HonestFraming["BEHAVIORAL_NEEDED"] = "static inconclusive; behavioral validation needed";
+    HonestFraming["VISIBILITY_NOT_BLAME"] = "consumer-visibility not maintainer-blame";
+    HonestFraming["HEALTHY"] = "";
+})(HonestFraming || (HonestFraming = {}));
+const MAX_EVIDENCE_FIELD = 4096;
+const TRUNC_MARK = "…[truncated]";
+function bounded(s) {
+    if (s.length <= MAX_EVIDENCE_FIELD)
+        return s;
+    return s.slice(0, MAX_EVIDENCE_FIELD) + TRUNC_MARK;
+}
+/** The completeness predicate the load-bearing choke gates on (port of
+ * `Provenance.is_complete`). Each string field is trimmed before the check, so a
+ * whitespace-only value is rejected as empty. Evidence MAY be empty. */
+export function isComplete(p) {
+    const s = p.subject;
+    const wf = p.whatFired;
+    return Boolean(s.serverId.trim() &&
+        s.tool.trim() &&
+        s.capturedAt.trim() &&
+        s.source.trim() &&
+        wf.classifierId.trim() &&
+        p.reproduceHandle.trim());
+}
+/** Render-safe one-line summary (does NOT emit raw evidence values). */
+export function renderProvenance(p) {
+    const sid = mdText(p.subject.serverId);
+    const tool = mdText(p.subject.tool);
+    const kinds = [...new Set(p.whatFired.changeKinds.map((k) => k.toString()))].sort().join(", ");
+    const framing = p.honestFraming || "healthy";
+    return (`${sid}/${tool} — ${p.whatFired.verdict} ` +
+        `(tier ${p.whatFired.tierReached}, scope ${p.whatFired.verdictScope}): ` +
+        `${kinds || "no change"} — ${framing}`);
+}
+export function provenanceAsDict(p) {
+    return {
+        subject: {
+            server_id: p.subject.serverId,
+            tool: p.subject.tool,
+            definition_hash_old: p.subject.definitionHashOld,
+            definition_hash_new: p.subject.definitionHashNew,
+            captured_at: p.subject.capturedAt,
+            source: p.subject.source,
+        },
+        what_fired: {
+            change_kinds: p.whatFired.changeKinds.map((k) => k.toString()),
+            classifier_id: p.whatFired.classifierId,
+            tier_reached: p.whatFired.tierReached,
+            verdict: p.whatFired.verdict,
+            verdict_scope: p.whatFired.verdictScope,
+        },
+        evidence: p.evidence.map((e) => ({
+            path: e.path,
+            kind: e.kind.toString(),
+            before: e.before,
+            after: e.after,
+        })),
+        honest_framing: p.honestFraming,
+        reproduce_handle: p.reproduceHandle,
+    };
+}
+function scopeForTier(tier) {
+    if (tier >= 3)
+        return VerdictScope.BEHAVIORAL;
+    if (tier === 2)
+        return VerdictScope.SEMANTIC_ONLY;
+    return VerdictScope.STRUCTURAL_ONLY;
+}
+function framingFor(verdict) {
+    if (verdict.decision === Decision.INCONCLUSIVE)
+        return HonestFraming.BEHAVIORAL_NEEDED;
+    if (verdict.decision === Decision.HOLD || verdict.drift.length > 0)
+        return HonestFraming.CONTRACT_DIFF_NOT_SAFETY;
+    return HonestFraming.HEALTHY;
+}
+function evidenceFromDrift(drift, descBefore, descAfter) {
+    const fields = [];
+    const hasDescChange = drift.some((c) => c.kind === ChangeKind.DESCRIPTION_ONLY);
+    for (const c of drift) {
+        let before = null;
+        let after = null;
+        if (c.kind === ChangeKind.DESCRIPTION_ONLY) {
+            before = descBefore !== null ? bounded(descBefore) : null;
+            after = descAfter !== null ? bounded(descAfter) : null;
+        }
+        if (after === null && before === null) {
+            after = bounded(c.detail);
+        }
+        fields.push({ path: c.path, kind: c.kind, before, after });
+    }
+    if (!hasDescChange && (descBefore !== null || descAfter !== null)) {
+        fields.push({
+            path: "description",
+            kind: ChangeKind.DESCRIPTION_ONLY,
+            before: descBefore !== null ? bounded(descBefore) : null,
+            after: descAfter !== null ? bounded(descAfter) : null,
+        });
+    }
+    return fields;
+}
+function hashOrNull(defn) {
+    if (defn === null)
+        return null;
+    try {
+        return hashTool(defn);
+    }
+    catch {
+        return null;
+    }
+}
+/** Build a COMPLETE Provenance from a verdict + the contracts that produced it.
+ * Port of `provenance.from_verdict`. */
+export function fromVerdict(verdict, opts) {
+    const classifierId = opts.classifierId ?? "gate.static-drift";
+    const source = opts.source ?? "gate";
+    const oldHash = hashOrNull(opts.oldSchema);
+    const newHash = hashOrNull(opts.newSchema);
+    const scope = scopeForTier(opts.tierReached);
+    const now = opts.capturedAt ?? new Date().toISOString();
+    const kinds = verdict.drift.map((c) => c.kind);
+    const evidence = evidenceFromDrift(verdict.drift, verdict.descBefore, verdict.descAfter);
+    const handle = `${classifierId}|tier=${opts.tierReached}|` +
+        `old=${oldHash ?? "∅"}|new=${newHash ?? "∅"}|` +
+        `verdict=${verdict.decision}`;
+    return {
+        subject: {
+            serverId: opts.serverId,
+            tool: opts.tool,
+            definitionHashOld: oldHash,
+            definitionHashNew: newHash,
+            capturedAt: now,
+            source,
+        },
+        whatFired: {
+            changeKinds: kinds,
+            classifierId,
+            tierReached: opts.tierReached,
+            verdict: verdict.decision,
+            verdictScope: scope,
+        },
+        evidence,
+        honestFraming: framingFor(verdict),
+        reproduceHandle: handle,
+    };
+}
+export class GuardrailError extends Error {
+}
+/** THE choke every surface path passes through. Returns the COMPLETE Provenance,
+ * or THROWS `GuardrailError` (fail-closed -> nothing surfaces). Port of
+ * `guardrails.require_provenance`. */
+export function requireProvenance(prov) {
+    if (prov === null || prov === undefined) {
+        throw new GuardrailError("no provenance attached — fail-closed: nothing may surface without a complete provenance record");
+    }
+    if (!isComplete(prov)) {
+        throw new GuardrailError("provenance record is INCOMPLETE (missing a load-bearing field) — fail-closed, nothing surfaces");
+    }
+    return prov;
+}
+/** Build provenance for a USER-FACING surface and run it through the choke.
+ * Returns the COMPLETE record, or null when it cannot be built / the choke
+ * refuses (fail-closed). Port of `provenance.surface_provenance`. */
+export function surfaceProvenance(verdict, opts) {
+    try {
+        const prov = fromVerdict(verdict, opts);
+        return requireProvenance(prov);
+    }
+    catch {
+        return null;
+    }
+}
+const GREEN_WORDS = ["safe", "verified", "clean", "pass", "passed", "all clear", "all-clear", "secure", "trusted"];
+const GREEN_RE = new RegExp("(?<![\\w-])(" + GREEN_WORDS.map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|") + ")(?![\\w-])", "i");
+/** Fail-closed honest-voice check: throw if a consumer string uses a banned
+ * green word. Port of `guardrails.assert_no_green_words`. */
+export function assertNoGreenWords(text) {
+    const m = GREEN_RE.exec(text);
+    if (m !== null) {
+        throw new GuardrailError(`consumer output contains a banned 'green word': '${m[1]}'`);
+    }
+}
+// The neutral placeholder a green word is REDACTED to (FIX 4 / M3). An attacker can
+// NAME a tool with a green word ("all-clear-verified-scanner") to smuggle banned
+// reassurance into a HOLD banner. We REDACT the offending token (NOT refuse the whole
+// HOLD — a refusal would let an attacker SUPPRESS a legitimate HOLD by naming their
+// tool "safe"). The placeholder carries no green word itself.
+const REDACTED_GREEN_WORD = "[redacted]";
+// A GLOBAL variant of the green-word matcher, built from the SAME `GREEN_WORDS`
+// source so the redaction word-list can never drift from `assertNoGreenWords`. A
+// separate object (with the `g` flag) is used for `.replace`, keeping the stateful
+// `lastIndex` of a global regex out of `assertNoGreenWords`'s `.exec`.
+const GREEN_RE_GLOBAL = new RegExp(GREEN_RE.source, "gi");
+/** Replace every banned green word in a consumer-facing string with a neutral
+ * placeholder, so an ATTACKER-DERIVED token (a tool name interpolated into a HOLD
+ * banner) cannot surface banned reassurance verbatim (M3). Whole-word,
+ * case-insensitive — reuses the SAME word-list as `assertNoGreenWords`, so the two
+ * can never disagree. The output passes `assertNoGreenWords`. Port of
+ * `gate.redact_green_words`. */
+export function redactGreenWords(text) {
+    return text.replace(GREEN_RE_GLOBAL, REDACTED_GREEN_WORD);
+}
+//# sourceMappingURL=provenance.js.map

package/dist/src/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/provenance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,MAAM,CAAN,IAAY,YAIX;AAJD,WAAY,YAAY;IACtB,mDAAmC,CAAA;IACnC,+CAA+B,CAAA;IAC/B,yCAAyB,CAAA;AAC3B,CAAC,EAJW,YAAY,KAAZ,YAAY,QAIvB;AAED,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,gFAA+D,CAAA;IAC/D,wFAAuE,CAAA;IACvE,kFAAiE,CAAA;IACjE,6BAAY,CAAA;AACd,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,CAAC,MAAM,IAAI,kBAAkB;QAAE,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,GAAG,UAAU,CAAC;AACrD,CAAC;AAkCD;;wEAEwE;AACxE,MAAM,UAAU,UAAU,CAAC,CAAa;IACtC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IACpB,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;IACvB,OAAO,OAAO,CACZ,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;QACf,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;QACb,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE;QACnB,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACf,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE;QACtB,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,CAC3B,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,CAAC,CAAC,aAAa,IAAI,SAAS,CAAC;IAC7C,OAAO,CACL,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG;QAC1C,SAAS,CAAC,CAAC,SAAS,CAAC,WAAW,WAAW,CAAC,CAAC,SAAS,CAAC,YAAY,KAAK;QACxE,GAAG,KAAK,IAAI,WAAW,MAAM,OAAO,EAAE,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,CAAa;IAC5C,OAAO;QACL,OAAO,EAAE;YACP,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ;YAC7B,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI;YACpB,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAChD,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB;YAChD,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU;YACjC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM;SACzB;QACD,UAAU,EAAE;YACV,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9D,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC,YAAY;YACvC,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW;YACrC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO;YAC5B,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC,YAAY;SACxC;QACD,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE;YACvB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;QACH,cAAc,EAAE,CAAC,CAAC,aAAa;QAC/B,gBAAgB,EAAE,CAAC,CAAC,eAAe;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,UAAU,CAAC;IAC9C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC,aAAa,CAAC;IAClD,OAAO,YAAY,CAAC,eAAe,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,OAAyB;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,YAAY;QAAE,OAAO,aAAa,CAAC,iBAAiB,CAAC;IACvF,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAChE,OAAO,aAAa,CAAC,wBAAwB,CAAC;IAChD,OAAO,aAAa,CAAC,OAAO,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAwB,EACxB,UAAyB,EACzB,SAAwB;IAExB,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAChF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,gBAAgB,EAAE,CAAC;YAC3C,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,KAAK,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACtC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,aAAa,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,UAAU,CAAC,gBAAgB;YACjC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YACxD,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,IAAoB;IACtC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;wCACwC;AACxC,MAAM,UAAU,WAAW,CACzB,OAAyB,EACzB,IASC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACzF,MAAM,MAAM,GACV,GAAG,YAAY,SAAS,IAAI,CAAC,WAAW,GAAG;QAC3C,OAAO,OAAO,IAAI,GAAG,QAAQ,OAAO,IAAI,GAAG,GAAG;QAC9C,WAAW,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChC,OAAO;QACL,OAAO,EAAE;YACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,iBAAiB,EAAE,OAAO;YAC1B,iBAAiB,EAAE,OAAO;YAC1B,UAAU,EAAE,GAAG;YACf,MAAM;SACP;QACD,SAAS,EAAE;YACT,WAAW,EAAE,KAAK;YAClB,YAAY;YACZ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,OAAO,CAAC,QAAQ;YACzB,YAAY,EAAE,KAAK;SACpB;QACD,QAAQ;QACR,aAAa,EAAE,UAAU,CAAC,OAAO,CAAC;QAClC,eAAe,EAAE,MAAM;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;CAAG;AAE5C;;sCAEsC;AACtC,MAAM,UAAU,iBAAiB,CAAC,IAAmC;IACnE,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,cAAc,CACtB,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,cAAc,CACtB,gGAAgG,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,iBAAiB,CAC/B,OAAyB,EACzB,IAOC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACnH,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,EAC3G,GAAG,CACJ,CAAC;AAEF;6DAC6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,cAAc,CAAC,oDAAoD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,iFAAiF;AACjF,sFAAsF;AACtF,oFAAoF;AACpF,8DAA8D;AAC9D,MAAM,mBAAmB,GAAG,YAAY,CAAC;AAEzC,gFAAgF;AAChF,iFAAiF;AACjF,mFAAmF;AACnF,uEAAuE;AACvE,MAAM,eAAe,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAE1D;;;;;gCAKgC;AAChC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;AAC5D,CAAC"}

package/dist/src/render.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Render-safe text neutralization — a port of Python `report._md_text` +
+ * `_strip_control`. Strips ALL C0/C1/DEL control bytes (incl. ESC `\x1b`, the
+ * ANSI cursor/colour-escape banner-forgery vector) FIRST, then HTML-escapes,
+ * then backslash-escapes markdown metacharacters, then folds CR/LF to spaces.
+ * Always embed the result mid-line.
+ */
+/** Neutralize untrusted text for inline embedding in a markdown/terminal banner. */
+export declare function mdText(s: string): string;
+//# sourceMappingURL=render.d.ts.map

package/dist/src/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAyBH,oFAAoF;AACpF,wBAAgB,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CASxC"}

package/dist/src/render.js

@@ -0,0 +1,38 @@
+/**
+ * Render-safe text neutralization — a port of Python `report._md_text` +
+ * `_strip_control`. Strips ALL C0/C1/DEL control bytes (incl. ESC `\x1b`, the
+ * ANSI cursor/colour-escape banner-forgery vector) FIRST, then HTML-escapes,
+ * then backslash-escapes markdown metacharacters, then folds CR/LF to spaces.
+ * Always embed the result mid-line.
+ */
+// C0/C1 + DEL, EXCLUDING \t \n \r (handled as whitespace). ESC (\x1b) is in set.
+// eslint-disable-next-line no-control-regex
+const CONTROL_BYTES = /[\x00-\x08\x0b-\x1f\x7f]/g;
+// Mirror Python report._MD_SPECIAL EXACTLY ("\\`*_[]()|~"). Escaping MORE than Python (e.g. `-`)
+// breaks green-word redaction parity: `all-clear` would become `all\-clear`, which GREEN_RE no
+// longer matches, so the green word survives un-redacted (TS diverging from Python). Keep this set
+// identical to Python so both md-escaping AND green-word redaction stay in parity.
+const MD_SPECIAL = ["\\", "`", "*", "_", "[", "]", "(", ")", "|", "~"];
+function htmlEscape(s) {
+    return s
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#x27;");
+}
+function stripControl(s) {
+    return s.replace(CONTROL_BYTES, "").replace(/\t/g, " ");
+}
+/** Neutralize untrusted text for inline embedding in a markdown/terminal banner. */
+export function mdText(s) {
+    let out = stripControl(s);
+    out = htmlEscape(out);
+    // backslash must be escaped via MD_SPECIAL (it's first in the list), but
+    // htmlEscape already ran; replicate Python order (escape each MD special).
+    for (const ch of MD_SPECIAL) {
+        out = out.split(ch).join("\\" + ch);
+    }
+    return out.replace(/\r/g, " ").replace(/\n/g, " ");
+}
+//# sourceMappingURL=render.js.map

package/dist/src/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../../src/render.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,iFAAiF;AACjF,4CAA4C;AAC5C,MAAM,aAAa,GAAG,2BAA2B,CAAC;AAElD,iGAAiG;AACjG,+FAA+F;AAC/F,mGAAmG;AACnG,mFAAmF;AACnF,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEvE,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC;SACL,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,MAAM,CAAC,CAAS;IAC9B,IAAI,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1B,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACtB,yEAAyE;IACzE,2EAA2E;IAC3E,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC"}

package/dist/src/risk.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Structural risk leg — a port of Python `tooling/cse/risk.py`. Pure,
+ * deterministic, total (never throws on a malformed/hostile schema), fail-closed
+ * (absence of a positive read signal resolves toward higher risk). The gate uses
+ * it for the Gate-3 risk-escalation check on an otherwise-benign drift.
+ */
+export declare enum BlastRadius {
+    LOW = "low",
+    MED = "med",
+    HIGH = "high"
+}
+export declare enum DomainClass {
+    PAYMENTS = "payments",
+    INFRA = "infra",
+    COMMS = "comms",
+    DATA = "data",
+    UNKNOWN = "unknown"
+}
+export declare function blastRank(blast: BlastRadius): number;
+export interface RiskAssessment {
+    readonly nameWriteish: boolean;
+    readonly hasWritePayloadParam: boolean;
+    readonly requiresCredential: boolean;
+    readonly sideEffectIntent: boolean;
+    readonly domainClass: DomainClass;
+    readonly blastRadius: BlastRadius;
+    readonly looksReadOnly: boolean;
+    readonly signals: readonly string[];
+}
+/** Structural risk assessment (port of `risk.assess`). */
+export declare function assess(name: string, description: string, inputSchema: unknown): RiskAssessment;
+//# sourceMappingURL=risk.d.ts.map

package/dist/src/risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.d.ts","sourceRoot":"","sources":["../../src/risk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA2CH,oBAAY,WAAW;IACrB,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,oBAAY,WAAW;IACrB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,IAAI,SAAS;IACb,OAAO,YAAY;CACpB;AAQD,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAsED,0DAA0D;AAC1D,wBAAgB,MAAM,CACpB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,OAAO,GACnB,cAAc,CAwDhB"}

package/dist/src/risk.js

@@ -0,0 +1,179 @@
+/**
+ * Structural risk leg — a port of Python `tooling/cse/risk.py`. Pure,
+ * deterministic, total (never throws on a malformed/hostile schema), fail-closed
+ * (absence of a positive read signal resolves toward higher risk). The gate uses
+ * it for the Gate-3 risk-escalation check on an otherwise-benign drift.
+ */
+import { nameTokens, sideEffectStems, nameIsWriteish, hasSideEffectIntent } from "./lexicon.js";
+const MAX_TEXT = 8192;
+const WALK_MAX_NODES = 2000;
+const WALK_HARD_DEPTH = 12;
+const WRITE_PAYLOAD_PARAMS = new Set(("content body payload file attachment upload destination recipient amount " +
+    "email message sms subject html markdown document blob bytes " +
+    "command cmd code script exec eval sql shell expr").split(" "));
+const CREDENTIAL_TOKENS = new Set(("token apikey credential credentials secret bearer oauth password passwd " +
+    "auth authorization key").split(" "));
+const DOMAIN_TOKENS = {
+    payments: new Set(("pay payment charge invoice billing wallet refund transaction transfer " +
+        "deposit withdraw checkout purchase escrow disburse settle").split(" ")),
+    infra: new Set(("deploy provision server container cluster instance kubernetes k8s vm " +
+        "node terminate reboot scale infra infrastructure dns").split(" ")),
+    comms: new Set(("email mail message send notify notification sms slack webhook post tweet " +
+        "publish broadcast dm").split(" ")),
+    data: new Set(("read get list query fetch search lookup describe show view data record " +
+        "index dataset row table report metric stats history").split(" ")),
+};
+const DOMAIN_PRECEDENCE = ["payments", "infra", "comms", "data"];
+export var BlastRadius;
+(function (BlastRadius) {
+    BlastRadius["LOW"] = "low";
+    BlastRadius["MED"] = "med";
+    BlastRadius["HIGH"] = "high";
+})(BlastRadius || (BlastRadius = {}));
+export var DomainClass;
+(function (DomainClass) {
+    DomainClass["PAYMENTS"] = "payments";
+    DomainClass["INFRA"] = "infra";
+    DomainClass["COMMS"] = "comms";
+    DomainClass["DATA"] = "data";
+    DomainClass["UNKNOWN"] = "unknown";
+})(DomainClass || (DomainClass = {}));
+const BLAST_RANK = {
+    [BlastRadius.LOW]: 0,
+    [BlastRadius.MED]: 1,
+    [BlastRadius.HIGH]: 2,
+};
+export function blastRank(blast) {
+    return BLAST_RANK[blast];
+}
+function stemmed(tokens) {
+    const out = new Set();
+    for (const t of tokens) {
+        for (const s of sideEffectStems(t))
+            out.add(s);
+    }
+    return out;
+}
+function intersect(a, b) {
+    const out = new Set();
+    for (const x of a)
+        if (b.has(x))
+            out.add(x);
+    return out;
+}
+function isDict(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function schemaParamTokens(inputSchema) {
+    const tokens = new Set();
+    const budget = { n: WALK_MAX_NODES };
+    let truncated = false;
+    const walk = (node, depth) => {
+        if (budget.n <= 0 || depth >= WALK_HARD_DEPTH) {
+            truncated = true;
+            return;
+        }
+        budget.n -= 1;
+        if (!isDict(node))
+            return;
+        const props = node["properties"];
+        if (isDict(props)) {
+            for (const [key, sub] of Object.entries(props)) {
+                for (const t of nameTokens(key))
+                    tokens.add(t);
+                walk(sub, depth + 1);
+            }
+        }
+        const items = node["items"];
+        if (isDict(items))
+            walk(items, depth + 1);
+        else if (Array.isArray(items))
+            for (const it of items)
+                walk(it, depth + 1);
+        for (const comp of ["oneOf", "anyOf", "allOf", "prefixItems"]) {
+            const branches = node[comp];
+            if (Array.isArray(branches))
+                for (const it of branches)
+                    walk(it, depth + 1);
+        }
+        const ap = node["additionalProperties"];
+        if (isDict(ap))
+            walk(ap, depth + 1);
+    };
+    if (isDict(inputSchema))
+        walk(inputSchema, 0);
+    return [tokens, truncated];
+}
+function classifyDomain(ndTokens) {
+    const stems = stemmed(ndTokens);
+    for (const dom of DOMAIN_PRECEDENCE) {
+        if ([...stems].some((s) => DOMAIN_TOKENS[dom].has(s))) {
+            return dom;
+        }
+    }
+    return DomainClass.UNKNOWN;
+}
+function union(a, b) {
+    const out = new Set(a);
+    for (const x of b)
+        out.add(x);
+    return out;
+}
+/** Structural risk assessment (port of `risk.assess`). */
+export function assess(name, description, inputSchema) {
+    name = name.slice(0, MAX_TEXT);
+    description = description.slice(0, MAX_TEXT);
+    const ndTokens = union(nameTokens(name), nameTokens(description));
+    const [paramTokens, truncated] = schemaParamTokens(inputSchema);
+    const nameWriteish = nameIsWriteish(name);
+    const sideEffectIntent = hasSideEffectIntent(name, description);
+    const matchedPayload = intersect(stemmed(paramTokens), WRITE_PAYLOAD_PARAMS);
+    const hasWritePayloadParam = matchedPayload.size > 0 || truncated;
+    const requiresCredential = intersect(stemmed(union(ndTokens, paramTokens)), CREDENTIAL_TOKENS).size > 0;
+    const domainClass = classifyDomain(ndTokens);
+    let blast;
+    if (domainClass === DomainClass.PAYMENTS || (nameWriteish && requiresCredential)) {
+        blast = BlastRadius.HIGH;
+    }
+    else if (nameWriteish ||
+        hasWritePayloadParam ||
+        sideEffectIntent ||
+        domainClass === DomainClass.INFRA ||
+        domainClass === DomainClass.COMMS ||
+        domainClass === DomainClass.UNKNOWN) {
+        blast = BlastRadius.MED;
+    }
+    else {
+        blast = BlastRadius.LOW;
+    }
+    const looksReadOnly = domainClass === DomainClass.DATA &&
+        !nameWriteish &&
+        !hasWritePayloadParam &&
+        !sideEffectIntent;
+    const signals = [];
+    if (nameWriteish)
+        signals.push("name carries a mutating verb");
+    if (matchedPayload.size > 0)
+        signals.push(`write/actionable param present ([${[...matchedPayload].sort().map((s) => `'${s}'`).join(", ")}])`);
+    if (truncated)
+        signals.push("schema too large/deep to fully analyze (fail-closed)");
+    if (sideEffectIntent)
+        signals.push("name/description carries side-effecting intent");
+    if (requiresCredential)
+        signals.push("requires a credential to act");
+    if (domainClass !== DomainClass.UNKNOWN)
+        signals.push(`domain=${domainClass}`);
+    if (looksReadOnly)
+        signals.push("structurally read-only (read-ish domain, no write signal)");
+    return {
+        nameWriteish,
+        hasWritePayloadParam,
+        requiresCredential,
+        sideEffectIntent,
+        domainClass,
+        blastRadius: blast,
+        looksReadOnly,
+        signals,
+    };
+}
+//# sourceMappingURL=risk.js.map

package/dist/src/risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../src/risk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEhG,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,CACE,2EAA2E;IAC3E,8DAA8D;IAC9D,kDAAkD,CACnD,CAAC,KAAK,CAAC,GAAG,CAAC,CACb,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,CACE,0EAA0E;IAC1E,wBAAwB,CACzB,CAAC,KAAK,CAAC,GAAG,CAAC,CACb,CAAC;AAEF,MAAM,aAAa,GAAgC;IACjD,QAAQ,EAAE,IAAI,GAAG,CACf,CAAC,wEAAwE;QACvE,2DAA2D,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAC1E;IACD,KAAK,EAAE,IAAI,GAAG,CACZ,CAAC,uEAAuE;QACtE,sDAAsD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CACrE;IACD,KAAK,EAAE,IAAI,GAAG,CACZ,CAAC,2EAA2E;QAC1E,sBAAsB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CACrC;IACD,IAAI,EAAE,IAAI,GAAG,CACX,CAAC,yEAAyE;QACxE,qDAAqD,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CACpE;CACF,CAAC;AACF,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEjE,MAAM,CAAN,IAAY,WAIX;AAJD,WAAY,WAAW;IACrB,0BAAW,CAAA;IACX,0BAAW,CAAA;IACX,4BAAa,CAAA;AACf,CAAC,EAJW,WAAW,KAAX,WAAW,QAItB;AAED,MAAM,CAAN,IAAY,WAMX;AAND,WAAY,WAAW;IACrB,oCAAqB,CAAA;IACrB,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,4BAAa,CAAA;IACb,kCAAmB,CAAA;AACrB,CAAC,EANW,WAAW,KAAX,WAAW,QAMtB;AAED,MAAM,UAAU,GAAgC;IAC9C,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;IACpB,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;IACpB,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,KAAkB;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAaD,SAAS,OAAO,CAAC,MAAmB;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,CAAc,EAAE,CAAsB;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAoB;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;IACrC,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QAClD,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,eAAe,EAAE,CAAC;YAC9C,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC/C,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC/C,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;aACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,MAAM,EAAE,IAAI,KAAK;gBAAE,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;YAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,KAAK,MAAM,EAAE,IAAI,QAAQ;oBAAE,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC;IAEF,IAAI,MAAM,CAAC,WAAW,CAAC;QAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,QAAqB;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,GAAkB,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,CAAC;AAC7B,CAAC;AAED,SAAS,KAAK,CAAC,CAAc,EAAE,CAAc;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,MAAM,CACpB,IAAY,EACZ,WAAmB,EACnB,WAAoB;IAEpB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/B,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAEhE,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC7E,MAAM,oBAAoB,GAAG,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC;IAClE,MAAM,kBAAkB,GACtB,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE7C,IAAI,KAAkB,CAAC;IACvB,IAAI,WAAW,KAAK,WAAW,CAAC,QAAQ,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC,EAAE,CAAC;QACjF,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC;IAC3B,CAAC;SAAM,IACL,YAAY;QACZ,oBAAoB;QACpB,gBAAgB;QAChB,WAAW,KAAK,WAAW,CAAC,KAAK;QACjC,WAAW,KAAK,WAAW,CAAC,KAAK;QACjC,WAAW,KAAK,WAAW,CAAC,OAAO,EACnC,CAAC;QACD,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC;IAC1B,CAAC;IAED,MAAM,aAAa,GACjB,WAAW,KAAK,WAAW,CAAC,IAAI;QAChC,CAAC,YAAY;QACb,CAAC,oBAAoB;QACrB,CAAC,gBAAgB,CAAC;IAEpB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,YAAY;QAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC/D,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnH,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACpF,IAAI,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACrF,IAAI,kBAAkB;QAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACrE,IAAI,WAAW,KAAK,WAAW,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC;IAC/E,IAAI,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAE7F,OAAO;QACL,YAAY;QACZ,oBAAoB;QACpB,kBAAkB;QAClB,gBAAgB;QAChB,WAAW;QACX,WAAW,EAAE,KAAK;QAClB,aAAa;QACb,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/src/scan.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Static schema-content marker scan — a port of the boolean core of Python
+ * `trust/schema_scan.py`. We only need "is a hostile marker present?" for the
+ * Gate-4 marker check, so this returns a boolean rather than the full
+ * DimensionFinding (the Python `scan_schema(...) is not None` predicate).
+ *
+ * A TRIPWIRE, not a calibrated detector: catches KNOWN hostile markers at high
+ * precision, evadable by novel encodings. Same regexes, same string-key walk.
+ */
+export declare const STRING_KEYS: ReadonlySet<string>;
+/** True iff the input schema encodes a known hostile marker (credential-path,
+ * exfil instruction, or injection directive). Port of
+ * `scan_schema(...) is not None`. */
+export declare function scanSchemaHasMarker(inputSchema: Record<string, unknown>): boolean;
+//# sourceMappingURL=scan.d.ts.map

package/dist/src/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAS1C,CAAC;AA+BH;;qCAEqC;AACrC,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CASjF"}

package/dist/src/scan.js

@@ -0,0 +1,88 @@
+/**
+ * Static schema-content marker scan — a port of the boolean core of Python
+ * `trust/schema_scan.py`. We only need "is a hostile marker present?" for the
+ * Gate-4 marker check, so this returns a boolean rather than the full
+ * DimensionFinding (the Python `scan_schema(...) is not None` predicate).
+ *
+ * A TRIPWIRE, not a calibrated detector: catches KNOWN hostile markers at high
+ * precision, evadable by novel encodings. Same regexes, same string-key walk.
+ */
+const CREDENTIAL_PATH = new RegExp("(?:[/\\\\~]\\.?(?:ssh|aws|gnupg)\\b)" +
+    "|(?:[/\\\\](?:credentials?|secrets?|vault|keys?|private[_-]?keys?)\\b)" +
+    "|(?:\\b(?:id_rsa|\\.pem|\\.env|/var/secrets|\\.config/credentials)\\b)", "i");
+const EXFIL_INSTRUCTION = new RegExp("\\b(?:mirror|exfiltrat\\w*|forward|transmit|relay|smuggle|leak|harvest|replicate|stage)\\b" +
+    ".{0,48}?\\b(?:to|into|channel|webhook|endpoint|inbox|hook|server|outbound|operator)\\b" +
+    "|\\b(?:webhook-delta|slack-hook|discord-relay|teams-forward)\\b" +
+    "|https?://", "i");
+const INJECTION = new RegExp("\\b(?:ignore (?:all )?(?:previous|prior)|disregard (?:previous|prior|the above))\\b" +
+    "|^\\s*(?:SYSTEM|ADMIN)\\s*:" +
+    "|\\[(?:ADMIN|SYSTEM)\\]" +
+    "|\\b(?:pre-?approved|mark (?:this|it) (?:as )?(?:safe|benign|trusted))\\b", "im");
+// The schema sub-keys that carry literal strings a hostile author controls. We
+// scan their string VALUES (not the structural keys themselves). MIRRORS the
+// BROADENED Python `trust.schema_scan._STRING_KEYS` — broadened to also cover the
+// agent-/judge-consumed annotation channels `examples`, `$comment`, and
+// `markdownDescription` (a marker smuggled into any of them reaches the model just
+// like one in `description`). Kept as a sorted, exported set so the parity test can
+// assert TS covers EVERY key the live Python scanner covers (no fail-OPEN divergence).
+export const STRING_KEYS = new Set([
+    "pattern",
+    "default",
+    "const",
+    "title",
+    "description",
+    "examples",
+    "$comment",
+    "markdownDescription",
+]);
+function isDict(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function walkStrings(node, out) {
+    if (isDict(node)) {
+        for (const [k, v] of Object.entries(node)) {
+            if (STRING_KEYS.has(k)) {
+                // A scanned key whose value is a bare string, OR a LIST of bare strings
+                // (e.g. `examples: ["...", "..."]`, `enum`-style value arrays). A hostile
+                // author can hide a marker in any list element, so scan each bare string.
+                if (typeof v === "string") {
+                    out.push(v);
+                }
+                else if (Array.isArray(v)) {
+                    for (const item of v)
+                        if (typeof item === "string")
+                            out.push(item);
+                }
+                else {
+                    walkStrings(v, out);
+                }
+            }
+            else if (k === "enum" && Array.isArray(v)) {
+                for (const item of v)
+                    if (typeof item === "string")
+                        out.push(item);
+            }
+            else {
+                walkStrings(v, out);
+            }
+        }
+    }
+    else if (Array.isArray(node)) {
+        for (const item of node)
+            walkStrings(item, out);
+    }
+}
+/** True iff the input schema encodes a known hostile marker (credential-path,
+ * exfil instruction, or injection directive). Port of
+ * `scan_schema(...) is not None`. */
+export function scanSchemaHasMarker(inputSchema) {
+    const strings = [];
+    walkStrings(inputSchema, strings);
+    for (const s of strings) {
+        if (CREDENTIAL_PATH.test(s) || EXFIL_INSTRUCTION.test(s) || INJECTION.test(s)) {
+            return true;
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=scan.js.map

package/dist/src/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,eAAe,GAAG,IAAI,MAAM,CAChC,sCAAsC;IACpC,wEAAwE;IACxE,wEAAwE,EAC1E,GAAG,CACJ,CAAC;AAEF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,4FAA4F;IAC1F,wFAAwF;IACxF,iEAAiE;IACjE,YAAY,EACd,GAAG,CACJ,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,qFAAqF;IACnF,6BAA6B;IAC7B,yBAAyB;IACzB,2EAA2E,EAC7E,IAAI,CACL,CAAC;AAEF,+EAA+E;AAC/E,6EAA6E;AAC7E,kFAAkF;AAClF,wEAAwE;AACxE,mFAAmF;AACnF,oFAAoF;AACpF,uFAAuF;AACvF,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IACtD,SAAS;IACT,SAAS;IACT,OAAO;IACP,OAAO;IACP,aAAa;IACb,UAAU;IACV,UAAU;IACV,qBAAqB;CACtB,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,WAAW,CAAC,IAAa,EAAE,GAAa;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvB,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5B,KAAK,MAAM,IAAI,IAAI,CAAC;wBAAE,IAAI,OAAO,IAAI,KAAK,QAAQ;4BAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrE,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,KAAK,MAAM,IAAI,IAAI,CAAC;oBAAE,IAAI,OAAO,IAAI,KAAK,QAAQ;wBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;qCAEqC;AACrC,MAAM,UAAU,mBAAmB,CAAC,WAAoC;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}