@mneme-ai/core 2.70.0 → 2.72.0

package/dist/protoplasm/super_quan/cull.d.ts

@@ -0,0 +1,70 @@
+/**
+ * 💀 CULL — Process Reaper via Antibody Pattern + Quorum
+ *
+ * Closes v2.70 Vuln #4: 6 mneme node processes still alive after single
+ * test session → resource exhaustion over time.
+ *
+ * STRATEGY: every Mneme process writes an antibody to .mneme/cull/<pid>.beat
+ * containing { startedAt, processType, antibody }. On startup, every
+ * Mneme process runs CULL phase:
+ *
+ *   1. Scan .mneme/cull/ for all heartbeats
+ *   2. Filter to processes with same processType as me
+ *   3. Verify each is actually alive (process.kill(pid, 0))
+ *   4. Remove dead heartbeats (cleanup)
+ *   5. Apply policy: if alive count > maxPerType, cull oldest siblings
+ *      until count == maxPerType
+ *
+ * Policy modes:
+ *   - "youngest-wins"  newer process kills older siblings (default)
+ *   - "oldest-wins"    new process refuses to start if maxPerType reached
+ *   - "quorum"         requires majority of siblings to vote out a peer
+ *
+ * Wild twist: MITOSIS BUDGET — process can split (spawn child) but the
+ * child inherits parent's antibody. CULL never kills siblings with
+ * matching parent-antibody chain.
+ */
+export type CullPolicy = "youngest-wins" | "oldest-wins" | "quorum";
+export interface CullHeartbeat {
+    pid: number;
+    ppid: number;
+    startedAt: string;
+    processType: string;
+    antibody: string;
+    parentAntibody?: string;
+    lastBeatAt: string;
+}
+export interface CullConfig {
+    cullDir: string;
+    policy: CullPolicy;
+    maxPerType: Record<string, number>;
+    staleAfterMs: number;
+}
+export declare const DEFAULT_CULL: CullConfig;
+export interface CullReport {
+    scanned: number;
+    removedStale: number;
+    killedSiblings: number;
+    refusedToKill: number;
+    myPid: number;
+    myAntibody: string;
+    finalAlive: number;
+    policy: CullPolicy;
+    reasoning: string[];
+    hmac: string;
+}
+export declare class Cull {
+    readonly cfg: CullConfig;
+    constructor(cfg?: CullConfig);
+    /** Generate a stable per-process antibody. */
+    static makeAntibody(): string;
+    /** Write our heartbeat — call on startup + every N seconds. */
+    beat(processType: string, antibody: string, parentAntibody?: string): void;
+    /** Update lastBeatAt timestamp only. */
+    refresh(antibody: string): void;
+    /** Run CULL phase: scan, clean dead, enforce maxPerType. */
+    enforce(myProcessType: string, myAntibody: string): CullReport;
+    /** Count of alive processes by type (for monitoring). */
+    censusAlive(): Record<string, number>;
+}
+//# sourceMappingURL=cull.d.ts.map

package/dist/protoplasm/super_quan/cull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cull.d.ts","sourceRoot":"","sources":["../../../src/protoplasm/super_quan/cull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAMH,MAAM,MAAM,UAAU,GAAG,eAAe,GAAG,aAAa,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,YAAY,EAAE,UAK1B,CAAC;AAYF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,IAAI;aACa,GAAG,EAAE,UAAU;gBAAf,GAAG,GAAE,UAAyB;IAE1D,8CAA8C;IAC9C,MAAM,CAAC,YAAY,IAAI,MAAM;IAI7B,+DAA+D;IAC/D,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI;IAc1E,wCAAwC;IACxC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAU/B,4DAA4D;IAC5D,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU;IAgF9D,yDAAyD;IACzD,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAWtC"}

package/dist/protoplasm/super_quan/cull.js

@@ -0,0 +1,218 @@
+/**
+ * 💀 CULL — Process Reaper via Antibody Pattern + Quorum
+ *
+ * Closes v2.70 Vuln #4: 6 mneme node processes still alive after single
+ * test session → resource exhaustion over time.
+ *
+ * STRATEGY: every Mneme process writes an antibody to .mneme/cull/<pid>.beat
+ * containing { startedAt, processType, antibody }. On startup, every
+ * Mneme process runs CULL phase:
+ *
+ *   1. Scan .mneme/cull/ for all heartbeats
+ *   2. Filter to processes with same processType as me
+ *   3. Verify each is actually alive (process.kill(pid, 0))
+ *   4. Remove dead heartbeats (cleanup)
+ *   5. Apply policy: if alive count > maxPerType, cull oldest siblings
+ *      until count == maxPerType
+ *
+ * Policy modes:
+ *   - "youngest-wins"  newer process kills older siblings (default)
+ *   - "oldest-wins"    new process refuses to start if maxPerType reached
+ *   - "quorum"         requires majority of siblings to vote out a peer
+ *
+ * Wild twist: MITOSIS BUDGET — process can split (spawn child) but the
+ * child inherits parent's antibody. CULL never kills siblings with
+ * matching parent-antibody chain.
+ */
+import { existsSync, readFileSync, writeFileSync, readdirSync, unlinkSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { createHmac } from "node:crypto";
+export const DEFAULT_CULL = {
+    cullDir: ".mneme/cull",
+    policy: "youngest-wins",
+    maxPerType: { daemon: 1, "nucleus-daemon": 1, mcp: 2, bridge: 1, cli: 10 },
+    staleAfterMs: 60_000,
+};
+function aliveSafe(pid) {
+    if (pid === process.pid)
+        return true;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function killSafe(pid) {
+    if (pid === process.pid)
+        return false;
+    try {
+        process.kill(pid, "SIGTERM");
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export class Cull {
+    cfg;
+    constructor(cfg = DEFAULT_CULL) {
+        this.cfg = cfg;
+    }
+    /** Generate a stable per-process antibody. */
+    static makeAntibody() {
+        return createHmac("sha256", "mneme-cull").update(`${process.pid}::${process.hrtime.bigint()}::${Math.random()}`).digest("hex").slice(0, 12);
+    }
+    /** Write our heartbeat — call on startup + every N seconds. */
+    beat(processType, antibody, parentAntibody) {
+        mkdirSync(this.cfg.cullDir, { recursive: true });
+        const hb = {
+            pid: process.pid,
+            ppid: process.ppid,
+            startedAt: new Date().toISOString(),
+            processType,
+            antibody,
+            parentAntibody,
+            lastBeatAt: new Date().toISOString(),
+        };
+        writeFileSync(join(this.cfg.cullDir, `${process.pid}.beat`), JSON.stringify(hb), { encoding: "utf8" });
+    }
+    /** Update lastBeatAt timestamp only. */
+    refresh(antibody) {
+        const path = join(this.cfg.cullDir, `${process.pid}.beat`);
+        if (!existsSync(path))
+            return;
+        try {
+            const hb = JSON.parse(readFileSync(path, "utf8"));
+            hb.lastBeatAt = new Date().toISOString();
+            writeFileSync(path, JSON.stringify(hb), "utf8");
+        }
+        catch { /* */ }
+    }
+    /** Run CULL phase: scan, clean dead, enforce maxPerType. */
+    enforce(myProcessType, myAntibody) {
+        const reasoning = [];
+        if (!existsSync(this.cfg.cullDir)) {
+            mkdirSync(this.cfg.cullDir, { recursive: true });
+        }
+        const files = readdirSync(this.cfg.cullDir).filter((f) => f.endsWith(".beat"));
+        let scanned = 0, removedStale = 0, killedSiblings = 0, refusedToKill = 0;
+        const aliveOfMyType = [];
+        for (const f of files) {
+            scanned++;
+            const p = join(this.cfg.cullDir, f);
+            let hb;
+            try {
+                hb = JSON.parse(readFileSync(p, "utf8"));
+            }
+            catch {
+                try {
+                    unlinkSync(p);
+                }
+                catch { /* */ }
+                removedStale++;
+                continue;
+            }
+            const ageMs = Date.now() - new Date(hb.lastBeatAt).getTime();
+            const stillAlive = aliveSafe(hb.pid);
+            if (!stillAlive || ageMs > this.cfg.staleAfterMs) {
+                try {
+                    unlinkSync(p);
+                    removedStale++;
+                    reasoning.push(`removed stale heartbeat pid=${hb.pid} age=${ageMs}ms alive=${stillAlive}`);
+                }
+                catch { /* */ }
+                continue;
+            }
+            if (hb.processType === myProcessType)
+                aliveOfMyType.push(hb);
+        }
+        const limit = this.cfg.maxPerType[myProcessType] ?? 1;
+        if (aliveOfMyType.length > limit) {
+            // Sort by startedAt ASC — oldest first
+            aliveOfMyType.sort((a, b) => a.startedAt.localeCompare(b.startedAt));
+            const excess = aliveOfMyType.length - limit;
+            if (this.cfg.policy === "oldest-wins") {
+                // Refuse: don't kill anyone; report so caller can self-exit
+                refusedToKill = excess;
+                reasoning.push(`oldest-wins policy: ${excess} excess sibling(s) — caller should exit (suicide)`);
+            }
+            else if (this.cfg.policy === "quorum") {
+                // Need majority vote — for now, conservative: kill only if alone is "newest"
+                const myStartTime = aliveOfMyType.find((h) => h.pid === process.pid)?.startedAt ?? new Date().toISOString();
+                const olderThanMe = aliveOfMyType.filter((h) => h.startedAt < myStartTime).length;
+                if (olderThanMe > (aliveOfMyType.length / 2)) {
+                    refusedToKill = excess;
+                    reasoning.push(`quorum policy: I am newer than majority — refusing to kill`);
+                }
+                else {
+                    // I am the elder; cull oldest excess
+                    for (let i = 0; i < excess; i++) {
+                        const victim = aliveOfMyType[i];
+                        if (victim.pid === process.pid)
+                            continue;
+                        // Don't kill mitosis siblings (matching parent_antibody chain)
+                        if (victim.parentAntibody && victim.parentAntibody === myAntibody) {
+                            refusedToKill++;
+                            reasoning.push(`refused to kill mitosis child pid=${victim.pid}`);
+                            continue;
+                        }
+                        if (killSafe(victim.pid)) {
+                            killedSiblings++;
+                            reasoning.push(`killed sibling pid=${victim.pid} (started ${victim.startedAt})`);
+                        }
+                        else {
+                            refusedToKill++;
+                            reasoning.push(`could not kill pid=${victim.pid} (permission?)`);
+                        }
+                    }
+                }
+            }
+            else {
+                // "youngest-wins" (default) — newer process (likely me) kills older siblings
+                for (let i = 0; i < excess; i++) {
+                    const victim = aliveOfMyType[i];
+                    if (victim.pid === process.pid)
+                        continue;
+                    if (victim.parentAntibody && victim.parentAntibody === myAntibody) {
+                        refusedToKill++;
+                        reasoning.push(`refused to kill mitosis child pid=${victim.pid}`);
+                        continue;
+                    }
+                    if (killSafe(victim.pid)) {
+                        killedSiblings++;
+                        reasoning.push(`culled older sibling pid=${victim.pid}`);
+                    }
+                    else {
+                        refusedToKill++;
+                    }
+                }
+            }
+        }
+        const finalAlive = aliveOfMyType.length - killedSiblings;
+        const body = { scanned, removedStale, killedSiblings, refusedToKill, finalAlive, processType: myProcessType, myAntibody };
+        const hmac = createHmac("sha256", "cull-report").update(JSON.stringify(body)).digest("hex").slice(0, 16);
+        return {
+            scanned, removedStale, killedSiblings, refusedToKill,
+            myPid: process.pid, myAntibody, finalAlive,
+            policy: this.cfg.policy, reasoning, hmac,
+        };
+    }
+    /** Count of alive processes by type (for monitoring). */
+    censusAlive() {
+        if (!existsSync(this.cfg.cullDir))
+            return {};
+        const counts = {};
+        for (const f of readdirSync(this.cfg.cullDir).filter((f) => f.endsWith(".beat"))) {
+            try {
+                const hb = JSON.parse(readFileSync(join(this.cfg.cullDir, f), "utf8"));
+                if (aliveSafe(hb.pid))
+                    counts[hb.processType] = (counts[hb.processType] ?? 0) + 1;
+            }
+            catch { /* */ }
+        }
+        return counts;
+    }
+}
+//# sourceMappingURL=cull.js.map

package/dist/protoplasm/super_quan/cull.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cull.js","sourceRoot":"","sources":["../../../src/protoplasm/super_quan/cull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqBzC,MAAM,CAAC,MAAM,YAAY,GAAe;IACtC,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,eAAe;IACvB,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IAC1E,YAAY,EAAE,MAAM;CACrB,CAAC;AAEF,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC5E,CAAC;AAeD,MAAM,OAAO,IAAI;IACa;IAA5B,YAA4B,MAAkB,YAAY;QAA9B,QAAG,GAAH,GAAG,CAA2B;IAAG,CAAC;IAE9D,8CAA8C;IAC9C,MAAM,CAAC,YAAY;QACjB,OAAO,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9I,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC,WAAmB,EAAE,QAAgB,EAAE,cAAuB;QACjE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,EAAE,GAAkB;YACxB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW;YACX,QAAQ;YACR,cAAc;YACd,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACzG,CAAC;IAED,wCAAwC;IACxC,OAAO,CAAC,QAAgB;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkB,CAAC;YACnE,EAAE,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACzC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,aAAqB,EAAE,UAAkB;QAC/C,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,IAAI,OAAO,GAAG,CAAC,EAAE,YAAY,GAAG,CAAC,EAAE,cAAc,GAAG,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC;QACzE,MAAM,aAAa,GAAoB,EAAE,CAAC;QAE1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpC,IAAI,EAAiB,CAAC;YACtB,IAAI,CAAC;gBAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;YAAC,CAAC;YAClE,MAAM,CAAC;gBAAC,IAAI,CAAC;oBAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAC,YAAY,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAE1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7D,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAErC,IAAI,CAAC,UAAU,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;gBACjD,IAAI,CAAC;oBAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBAAC,YAAY,EAAE,CAAC;oBAAC,SAAS,CAAC,IAAI,CAAC,+BAA+B,EAAE,CAAC,GAAG,QAAQ,KAAK,YAAY,UAAU,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAClI,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YAED,IAAI,EAAE,CAAC,WAAW,KAAK,aAAa;gBAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC;YACjC,uCAAuC;YACvC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACrE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC;YAE5C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACtC,4DAA4D;gBAC5D,aAAa,GAAG,MAAM,CAAC;gBACvB,SAAS,CAAC,IAAI,CAAC,uBAAuB,MAAM,mDAAmD,CAAC,CAAC;YACnG,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxC,6EAA6E;gBAC7E,MAAM,WAAW,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC5G,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC;gBAClF,IAAI,WAAW,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC7C,aAAa,GAAG,MAAM,CAAC;oBACvB,SAAS,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;gBAC/E,CAAC;qBAAM,CAAC;oBACN,qCAAqC;oBACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;wBAChC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;wBAChC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;4BAAE,SAAS;wBACzC,+DAA+D;wBAC/D,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;4BAAC,aAAa,EAAE,CAAC;4BAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;4BAAC,SAAS;wBAAC,CAAC;wBACpK,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;4BAAC,cAAc,EAAE,CAAC;4BAAC,SAAS,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,GAAG,aAAa,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;wBAAC,CAAC;6BAC5H,CAAC;4BAAC,aAAa,EAAE,CAAC;4BAAC,SAAS,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC;wBAAC,CAAC;oBAC7F,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,6EAA6E;gBAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAChC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;oBAChC,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;wBAAE,SAAS;oBACzC,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;wBAAC,aAAa,EAAE,CAAC;wBAAC,SAAS,CAAC,IAAI,CAAC,qCAAqC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBACpK,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAC,cAAc,EAAE,CAAC;wBAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;oBAAC,CAAC;yBACpG,CAAC;wBAAC,aAAa,EAAE,CAAC;oBAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,GAAG,cAAc,CAAC;QACzD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;QAC1H,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEzG,OAAO;YACL,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa;YACpD,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU;YAC1C,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI;SACzC,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,WAAW;QACT,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAkB,CAAC;gBACxF,IAAI,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC;oBAAE,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACpF,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/protoplasm/super_quan/guards.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * 🛡 Tests for HOMOGRAPH GUARD + INPUT SIZE GUARD
+ *
+ * Direct regression pin for the 2 v2.70 vulns user reported.
+ */
+export {};
+//# sourceMappingURL=guards.test.d.ts.map

package/dist/protoplasm/super_quan/guards.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.test.d.ts","sourceRoot":"","sources":["../../../src/protoplasm/super_quan/guards.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/protoplasm/super_quan/guards.test.js

@@ -0,0 +1,142 @@
+/**
+ * 🛡 Tests for HOMOGRAPH GUARD + INPUT SIZE GUARD
+ *
+ * Direct regression pin for the 2 v2.70 vulns user reported.
+ */
+import { describe, it, expect } from "vitest";
+import { canonicalize, shouldReVerify } from "./homograph_guard.js";
+import { checkInputSize, emitEnvelope, detectInputSource } from "./input_size_guard.js";
+describe("🛡 HOMOGRAPH GUARD — Vuln #1 closure", () => {
+    it("REGRESSION: '٢.70.0' (Arabic-Indic ٢) canonicalizes to '2.70.0'", () => {
+        const r = canonicalize("Mneme is ٢.70.0");
+        expect(r.canonical).toContain("2.70.0");
+        expect(r.flags).toContain("homograph_detected");
+        expect(r.digitsTransliterated).toBeGreaterThanOrEqual(1);
+        expect(shouldReVerify(r)).toBe(true);
+    });
+    it("Thai digits ๒.๗๐.๐ → 2.70.0", () => {
+        const r = canonicalize("version ๒.๗๐.๐");
+        expect(r.canonical).toContain("2.70.0");
+        expect(r.flags).toContain("homograph_detected");
+    });
+    it("Fullwidth digits ２.７０.０ → 2.70.0", () => {
+        const r = canonicalize("see ２.７０.０ here");
+        expect(r.canonical).toContain("2.70.0");
+        expect(r.digitsTransliterated).toBeGreaterThanOrEqual(4);
+    });
+    it("Bengali digits ২.৭০.০ → 2.70.0", () => {
+        const r = canonicalize("v ২.৭০.০");
+        expect(r.canonical).toContain("2.70.0");
+    });
+    it("Math bold digits 𝟐.𝟕𝟎.𝟎 → 2.70.0", () => {
+        const r = canonicalize("𝟐.𝟕𝟎.𝟎");
+        expect(r.canonical).toContain("2.70.0");
+    });
+    it("Cyrillic 'а' (U+0430) → Latin 'a'", () => {
+        const r = canonicalize("аpple"); // first char is Cyrillic
+        expect(r.canonical).toBe("apple");
+        expect(r.flags).toContain("homograph_detected");
+        expect(r.confusablesReplaced).toBeGreaterThanOrEqual(1);
+    });
+    it("BIDI override (U+202E) detected and stripped", () => {
+        const r = canonicalize("hello‮world");
+        expect(r.flags).toContain("rtl_override");
+        expect(r.canonical).toBe("helloworld");
+    });
+    it("Zero-width space stripped", () => {
+        const r = canonicalize("hello​world");
+        expect(r.flags).toContain("zwsp_injected");
+        expect(r.canonical).toBe("helloworld");
+    });
+    it("Control chars stripped", () => {
+        const r = canonicalize("hello\x00world\x07");
+        expect(r.flags).toContain("control_char_injected");
+        expect(r.canonical).toBe("helloworld");
+    });
+    it("Pure ASCII input passes unchanged (no flags)", () => {
+        const r = canonicalize("Mneme is 2.70.0");
+        expect(r.canonical).toBe("Mneme is 2.70.0");
+        expect(r.flags.length).toBe(0);
+        expect(shouldReVerify(r)).toBe(false);
+    });
+    it("Mixed-script Latin+Cyrillic flagged", () => {
+        // Use a Cyrillic letter that's NOT in our confusable map so canonicalize
+        // keeps it as Cyrillic → mixed script remains
+        const r = canonicalize("hello Жорж");
+        expect(r.flags).toContain("mixed_script");
+    });
+    it("All homograph defenses compose: BIDI + zwsp + Arabic-Indic together", () => {
+        const r = canonicalize("‮v​٢.٧٠.٠\x00");
+        expect(r.flags).toContain("rtl_override");
+        expect(r.flags).toContain("zwsp_injected");
+        expect(r.flags).toContain("control_char_injected");
+        expect(r.flags).toContain("homograph_detected");
+        expect(r.canonical).toContain("v2.70.0");
+    });
+});
+describe("🛡 INPUT SIZE GUARD — Vuln #2 closure", () => {
+    it("REGRESSION: 28K char argv input → rejected with JSON envelope (NOT silent)", () => {
+        const big = "a".repeat(28_000);
+        const r = checkInputSize(big, { source: "argv" });
+        expect(r.ok).toBe(false);
+        expect(r.envelope.error).toBe("INPUT_TOO_LARGE");
+        expect(r.envelope.sizeReceived).toBe(28_000);
+        expect(r.envelope.hint).toContain("stdin");
+        expect(r.receipt).toContain("28000B");
+    });
+    it("Same 28K input via stdin → accepted (10MB limit)", () => {
+        const big = "a".repeat(28_000);
+        const r = checkInputSize(big, { source: "stdin" });
+        expect(r.ok).toBe(true);
+        expect(r.envelope.error).toBeUndefined();
+    });
+    it("--allow-truncate accepts oversized input + flags truncation", () => {
+        const big = "x".repeat(50_000);
+        const r = checkInputSize(big, { source: "argv", allowTruncate: true });
+        expect(r.ok).toBe(true);
+        expect(r.truncated).toBe(true);
+        expect(r.truncatedAt).toBe(24_000);
+        expect(r.envelope.hint).toContain("first");
+    });
+    it("emitEnvelope always writes JSON, returns appropriate exit code", () => {
+        const collected = [];
+        const big = "a".repeat(30_000);
+        const r = checkInputSize(big, { source: "argv" });
+        const exitCode = emitEnvelope(r, (s) => collected.push(s));
+        expect(collected.length).toBe(1);
+        const parsed = JSON.parse(collected[0]);
+        expect(parsed.ok).toBe(false);
+        expect(exitCode).toBe(2); // distinct from generic crash exit 1
+    });
+    it("Small input via argv passes through", () => {
+        const r = checkInputSize("hello world", { source: "argv" });
+        expect(r.ok).toBe(true);
+        expect(r.truncated).toBe(false);
+        expect(r.envelope.ok).toBe(true);
+    });
+    it("Custom limit honored", () => {
+        const r = checkInputSize("12345", { source: "argv", customLimit: 3 });
+        expect(r.ok).toBe(false);
+        expect(r.limit).toBe(3);
+    });
+    it("Receipt includes head + tail for tamper-evident size proof", () => {
+        const r = checkInputSize("hello world this is a test input", { source: "argv" });
+        expect(r.receipt).toContain("hello");
+        expect(r.receipt).toMatch(/B head=/);
+    });
+    it("Envelope is a single-line JSON (safe for shell consumers)", () => {
+        const big = "x".repeat(40_000);
+        const r = checkInputSize(big, { source: "argv" });
+        const lines = [];
+        emitEnvelope(r, (s) => lines.push(s));
+        expect(lines.length).toBe(1);
+        expect(lines[0].endsWith("\n")).toBe(true);
+        // No newlines inside JSON body
+        expect(lines[0].slice(0, -1).split("\n").length).toBe(1);
+    });
+    it("detectInputSource returns a valid source", () => {
+        const s = detectInputSource();
+        expect(["argv", "stdin", "file", "unknown"]).toContain(s);
+    });
+});
+//# sourceMappingURL=guards.test.js.map

package/dist/protoplasm/super_quan/guards.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.test.js","sourceRoot":"","sources":["../../../src/protoplasm/super_quan/guards.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAExF,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;QACzC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAM,yBAAyB;QAC/D,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,yEAAyE;QACzE,8CAA8C;QAC9C,MAAM,CAAC,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAU,qCAAqC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,GAAG,cAAc,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACtE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAG,cAAc,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,+BAA+B;QAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/protoplasm/super_quan/homograph_guard.d.ts

@@ -0,0 +1,47 @@
+/**
+ * 🛡 HOMOGRAPH GUARD — Unicode normalization + confusable detection
+ *
+ * Closes the v2.70 vuln: "٢.70.0" (Arabic-Indic digit) passed as MIXED
+ * instead of REFUTED → attacker bypassed version check by spelling the
+ * digit in a non-ASCII script.
+ *
+ * Solution stacks 4 lenses:
+ *   1. NFKC normalize     → canonicalizes compatibility forms
+ *   2. Digit transliterate → maps all Unicode digits → ASCII 0-9
+ *   3. Confusable scan     → flags homoglyph attempts (UTS #39 subset)
+ *   4. Pipeline annotation → caller knows input was canonicalized
+ *
+ * API:
+ *   canonicalize(input) → { canonical, original, flags, transformations }
+ *
+ * Output flags drive verdict:
+ *   "homograph_detected"    → version claim has non-ASCII digits
+ *   "mixed_script"          → claim mixes script families (suspicious)
+ *   "rtl_override"          → contains BIDI override (U+202E)
+ *   "control_char_injected" → contains null / BEL / BS / etc.
+ *   "zwsp_injected"         → zero-width space / joiner
+ *
+ * No external Unicode tables — uses Node's built-in normalize() + a
+ * small curated confusable map.
+ */
+export interface CanonicalizeResult {
+    original: string;
+    canonical: string;
+    flags: string[];
+    transformations: string[];
+    confusablesReplaced: number;
+    digitsTransliterated: number;
+}
+export declare function canonicalize(input: string): CanonicalizeResult;
+/**
+ * Convenience: given a claim, return whether it's safe to verify as-is
+ * or needs caller to re-verify on the canonical form.
+ *
+ * Caller should:
+ *   const c = canonicalize(input);
+ *   if (c.flags.includes("homograph_detected")) {
+ *     // verify on c.canonical instead — annotate verdict with c.flags
+ *   }
+ */
+export declare function shouldReVerify(result: CanonicalizeResult): boolean;
+//# sourceMappingURL=homograph_guard.d.ts.map

package/dist/protoplasm/super_quan/homograph_guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"homograph_guard.d.ts","sourceRoot":"","sources":["../../../src/protoplasm/super_quan/homograph_guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAsEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAsE9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAElE"}