@nest-yalc-2/sentinel 2.2.0 → 2.2.1

package/dist/algorithms/rag-groundedness.js

@@ -1,62 +0,0 @@
-"use strict";
-/**
- * # RAG Groundedness & Hallucination Guardrail Engine (`rag-groundedness.ts`)
- * RAG factual claim overlap ratio scoring engine
- * (Academic Ref: *Building LLM-Powered Applications* & *Mastering LLM Applications*).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RagHallucinationGroundednessEngine = void 0;
-class RagHallucinationGroundednessEngine {
-    /**
-     * Computes factual groundedness score as the ratio of generated response claims supported by retrieved context chunks
-     */
-    static evaluateGroundedness(generatedResponse, retrievedContexts, groundednessThreshold = 0.70) {
-        const claims = generatedResponse
-            .split(/[.!?]/)
-            .map((s) => s.trim())
-            .filter((s) => s.length > 0);
-        if (claims.length === 0) {
-            return {
-                groundednessScore: 1.0,
-                isGrounded: true,
-                unsupportedClaims: [],
-                matchedContextFacts: [],
-            };
-        }
-        const combinedContext = retrievedContexts.join(' ').toLowerCase();
-        const contextWords = new Set(combinedContext
-            .split(/[^a-zA-Z0-9]+/)
-            .filter((w) => w.length > 0));
-        let matchedClaimsCount = 0;
-        const unsupportedClaims = [];
-        const matchedContextFacts = [];
-        for (const claim of claims) {
-            const claimWords = claim
-                .toLowerCase()
-                .split(/[^a-zA-Z0-9]+/)
-                .filter((w) => w.length > 3);
-            if (claimWords.length === 0) {
-                matchedClaimsCount++;
-                continue;
-            }
-            const matches = claimWords.filter((w) => contextWords.has(w)).length;
-            const matchRatio = matches / claimWords.length;
-            if (matchRatio >= 0.4) {
-                matchedClaimsCount++;
-                matchedContextFacts.push(claim);
-            }
-            else {
-                unsupportedClaims.push(claim);
-            }
-        }
-        const groundednessScore = matchedClaimsCount / claims.length;
-        const isGrounded = groundednessScore >= groundednessThreshold;
-        return {
-            groundednessScore,
-            isGrounded,
-            unsupportedClaims,
-            matchedContextFacts,
-        };
-    }
-}
-exports.RagHallucinationGroundednessEngine = RagHallucinationGroundednessEngine;

package/dist/algorithms/sbom-verifier.d.ts

@@ -1,24 +0,0 @@
-/**
- * # SBOM & Supply Chain Dependency Integrity Guard (`sbom-verifier.ts`)
- * Package SHA-256 cryptographic hash & dependency integrity validator
- * (Academic Ref: *Intelligent Continuous Security*, O'Reilly - Ch. 7).
- */
-export interface SbomComponentRecord {
-    name: string;
-    version: string;
-    expectedSha256: string;
-    isRevoked: boolean;
-}
-export interface SupplyChainIntegrityReport {
-    isValid: boolean;
-    tamperedComponents: string[];
-    revokedComponents: string[];
-    totalVerified: number;
-}
-export declare class SbomSupplyChainVerifierEngine {
-    static verifyComponent(record: SbomComponentRecord, actualContent: string | Buffer): {
-        matches: boolean;
-        actualHash: string;
-    };
-    static auditSupplyChain(manifest: SbomComponentRecord[], actualComponents: Map<string, string | Buffer>): SupplyChainIntegrityReport;
-}

package/dist/algorithms/sbom-verifier.js

@@ -1,80 +0,0 @@
-"use strict";
-/**
- * # SBOM & Supply Chain Dependency Integrity Guard (`sbom-verifier.ts`)
- * Package SHA-256 cryptographic hash & dependency integrity validator
- * (Academic Ref: *Intelligent Continuous Security*, O'Reilly - Ch. 7).
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SbomSupplyChainVerifierEngine = void 0;
-const crypto = __importStar(require("crypto"));
-class SbomSupplyChainVerifierEngine {
-    static verifyComponent(record, actualContent) {
-        const bytes = typeof actualContent === 'string' ? Buffer.from(actualContent) : actualContent;
-        const actualHash = crypto.createHash('sha256').update(bytes).digest('hex');
-        const matches = actualHash.toLowerCase() === record.expectedSha256.toLowerCase();
-        return { matches, actualHash };
-    }
-    static auditSupplyChain(manifest, actualComponents) {
-        const tamperedComponents = [];
-        const revokedComponents = [];
-        let totalVerified = 0;
-        for (const record of manifest) {
-            if (record.isRevoked) {
-                revokedComponents.push(`${record.name}@${record.version}`);
-            }
-            const content = actualComponents.get(record.name);
-            if (content) {
-                const { matches } = this.verifyComponent(record, content);
-                if (!matches) {
-                    tamperedComponents.push(`${record.name}@${record.version} (Hash mismatch)`);
-                }
-                else {
-                    totalVerified++;
-                }
-            }
-            else {
-                tamperedComponents.push(`${record.name}@${record.version} (Missing component)`);
-            }
-        }
-        return {
-            isValid: tamperedComponents.length === 0 && revokedComponents.length === 0,
-            tamperedComponents,
-            revokedComponents,
-            totalVerified,
-        };
-    }
-}
-exports.SbomSupplyChainVerifierEngine = SbomSupplyChainVerifierEngine;

package/dist/algorithms/shannon-entropy.d.ts

@@ -1,16 +0,0 @@
-/**
- * # Shannon Payload Entropy Evaluator (`shannon-entropy.ts`)
- * Calculates payload information entropy to detect obfuscated, packed, or encrypted payloads
- * (Academic Ref: *Malware Data Science*, No Starch Press).
- */
-export interface EntropyAssessment {
-    entropyScore: number;
-    isSuspicious: boolean;
-    byteLength: number;
-}
-export declare class ShannonEntropyEngine {
-    /**
-     * Calculates Shannon Entropy H(X) = -sum(P(x) * log2(P(x))) for string/buffer payload
-     */
-    static calculateEntropy(payload: string | Buffer): EntropyAssessment;
-}

package/dist/algorithms/shannon-entropy.js

@@ -1,39 +0,0 @@
-"use strict";
-/**
- * # Shannon Payload Entropy Evaluator (`shannon-entropy.ts`)
- * Calculates payload information entropy to detect obfuscated, packed, or encrypted payloads
- * (Academic Ref: *Malware Data Science*, No Starch Press).
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ShannonEntropyEngine = void 0;
-class ShannonEntropyEngine {
-    /**
-     * Calculates Shannon Entropy H(X) = -sum(P(x) * log2(P(x))) for string/buffer payload
-     */
-    static calculateEntropy(payload) {
-        const bytes = typeof payload === 'string' ? Buffer.from(payload) : payload;
-        if (bytes.length === 0) {
-            return { entropyScore: 0.0, isSuspicious: false, byteLength: 0 };
-        }
-        const counts = new Array(256).fill(0);
-        for (let i = 0; i < bytes.length; i++) {
-            counts[bytes[i]]++;
-        }
-        let entropy = 0.0;
-        const len = bytes.length;
-        for (let i = 0; i < 256; i++) {
-            if (counts[i] > 0) {
-                const p = counts[i] / len;
-                entropy -= p * Math.log2(p);
-            }
-        }
-        // High entropy threshold > 7.2 indicates packed/encrypted payload
-        const isSuspicious = entropy > 7.2 && bytes.length > 64;
-        return {
-            entropyScore: Math.round(entropy * 1000) / 1000,
-            isSuspicious,
-            byteLength: bytes.length,
-        };
-    }
-}
-exports.ShannonEntropyEngine = ShannonEntropyEngine;

package/dist/index.d.ts

@@ -1,14 +0,0 @@
-/**
- * # Ferrox-Node Sentinel (`@nest-yalc-2/sentinel` / `@ferrox/node-sentinel`)
- * Enterprise AI/ML Security Analytics & 35 SOTA Innovations for NestJS
- */
-export * from './algorithms/ai-guardrails';
-export * from './algorithms/rag-groundedness';
-export * from './algorithms/shannon-entropy';
-export * from './algorithms/polymorphic-routes';
-export * from './algorithms/markov-sequence';
-export * from './algorithms/lsass-guard';
-export * from './algorithms/sbom-verifier';
-export * from './sentinel.guard';
-export * from './sentinel.interceptor';
-export * from './sentinel.module';

package/dist/index.js

@@ -1,30 +0,0 @@
-"use strict";
-/**
- * # Ferrox-Node Sentinel (`@nest-yalc-2/sentinel` / `@ferrox/node-sentinel`)
- * Enterprise AI/ML Security Analytics & 35 SOTA Innovations for NestJS
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./algorithms/ai-guardrails"), exports);
-__exportStar(require("./algorithms/rag-groundedness"), exports);
-__exportStar(require("./algorithms/shannon-entropy"), exports);
-__exportStar(require("./algorithms/polymorphic-routes"), exports);
-__exportStar(require("./algorithms/markov-sequence"), exports);
-__exportStar(require("./algorithms/lsass-guard"), exports);
-__exportStar(require("./algorithms/sbom-verifier"), exports);
-__exportStar(require("./sentinel.guard"), exports);
-__exportStar(require("./sentinel.interceptor"), exports);
-__exportStar(require("./sentinel.module"), exports);

package/dist/sentinel.guard.d.ts

@@ -1,8 +0,0 @@
-/**
- * # NestJS Ferrox-Node Sentinel Guard (`sentinel.guard.ts`)
- * CanActivate Guard evaluating entropy, prompt injection, and velocity anomalies
- */
-import { CanActivate, ExecutionContext } from '@nestjs/common';
-export declare class FerroxSentinelGuard implements CanActivate {
-    canActivate(context: ExecutionContext): boolean;
-}

package/dist/sentinel.guard.js

@@ -1,38 +0,0 @@
-"use strict";
-/**
- * # NestJS Ferrox-Node Sentinel Guard (`sentinel.guard.ts`)
- * CanActivate Guard evaluating entropy, prompt injection, and velocity anomalies
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FerroxSentinelGuard = void 0;
-const common_1 = require("@nestjs/common");
-const ai_guardrails_js_1 = require("./algorithms/ai-guardrails.js");
-const shannon_entropy_js_1 = require("./algorithms/shannon-entropy.js");
-let FerroxSentinelGuard = class FerroxSentinelGuard {
-    canActivate(context) {
-        const request = context.switchToHttp().getRequest();
-        const bodyStr = request.body ? JSON.stringify(request.body) : '';
-        // 1. Evaluate Payload Shannon Entropy
-        const entropyResult = shannon_entropy_js_1.ShannonEntropyEngine.calculateEntropy(bodyStr);
-        if (entropyResult.isSuspicious) {
-            throw new common_1.ForbiddenException(`[FerroxSentinel] Blocked high-entropy payload (Score: ${entropyResult.entropyScore})`);
-        }
-        // 2. Evaluate Prompt Injection Patterns if string present in query or body
-        const promptSample = `${request.url} ${bodyStr}`;
-        const aiAssessment = ai_guardrails_js_1.AiPromptGuardrailEngine.evaluatePrompt(promptSample);
-        if (aiAssessment.isThreatDetected && aiAssessment.threatScore >= 0.7) {
-            throw new common_1.ForbiddenException(`[FerroxSentinel] Blocked Prompt Injection / DAN Jailbreak attempt. Matched: ${aiAssessment.matchedKeywords.join(', ')}`);
-        }
-        return true;
-    }
-};
-exports.FerroxSentinelGuard = FerroxSentinelGuard;
-exports.FerroxSentinelGuard = FerroxSentinelGuard = __decorate([
-    (0, common_1.Injectable)()
-], FerroxSentinelGuard);

package/dist/sentinel.interceptor.d.ts

@@ -1,11 +0,0 @@
-/**
- * # NestJS Ferrox-Node RAG Groundedness & Response Interceptor (`sentinel.interceptor.ts`)
- * Evaluates LLM generated response groundedness against retrieved context
- */
-import { NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
-import { Observable } from 'rxjs';
-export declare class RagGroundednessInterceptor implements NestInterceptor {
-    private readonly minGroundednessScore;
-    constructor(minGroundednessScore?: number);
-    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
-}

package/dist/sentinel.interceptor.js

@@ -1,43 +0,0 @@
-"use strict";
-/**
- * # NestJS Ferrox-Node RAG Groundedness & Response Interceptor (`sentinel.interceptor.ts`)
- * Evaluates LLM generated response groundedness against retrieved context
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RagGroundednessInterceptor = void 0;
-const common_1 = require("@nestjs/common");
-const operators_1 = require("rxjs/operators");
-const rag_groundedness_js_1 = require("./algorithms/rag-groundedness.js");
-let RagGroundednessInterceptor = class RagGroundednessInterceptor {
-    minGroundednessScore;
-    constructor(minGroundednessScore = 0.70) {
-        this.minGroundednessScore = minGroundednessScore;
-    }
-    intercept(context, next) {
-        const request = context.switchToHttp().getRequest();
-        const retrievedContexts = request.ragContexts || [];
-        return next.handle().pipe((0, operators_1.map)((response) => {
-            if (typeof response === 'string' && retrievedContexts.length > 0) {
-                const assessment = rag_groundedness_js_1.RagHallucinationGroundednessEngine.evaluateGroundedness(response, retrievedContexts, this.minGroundednessScore);
-                if (!assessment.isGrounded) {
-                    throw new common_1.BadGatewayException(`[FerroxSentinel] LLM response failed groundedness check (Score: ${assessment.groundednessScore.toFixed(2)} < ${this.minGroundednessScore})`);
-                }
-            }
-            return response;
-        }));
-    }
-};
-exports.RagGroundednessInterceptor = RagGroundednessInterceptor;
-exports.RagGroundednessInterceptor = RagGroundednessInterceptor = __decorate([
-    (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [Number])
-], RagGroundednessInterceptor);

package/dist/sentinel.module.d.ts

@@ -1,12 +0,0 @@
-/**
- * # NestJS Ferrox-Node Sentinel Module (`sentinel.module.ts`)
- */
-import { DynamicModule } from '@nestjs/common';
-export interface SentinelModuleOptions {
-    enablePromptSanitizer?: boolean;
-    enableEntropyCheck?: boolean;
-    minGroundednessScore?: number;
-}
-export declare class FerroxSentinelModule {
-    static register(options?: SentinelModuleOptions): DynamicModule;
-}

package/dist/sentinel.module.js

@@ -1,35 +0,0 @@
-"use strict";
-/**
- * # NestJS Ferrox-Node Sentinel Module (`sentinel.module.ts`)
- */
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var FerroxSentinelModule_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FerroxSentinelModule = void 0;
-const common_1 = require("@nestjs/common");
-const sentinel_guard_js_1 = require("./sentinel.guard.js");
-const sentinel_interceptor_js_1 = require("./sentinel.interceptor.js");
-let FerroxSentinelModule = FerroxSentinelModule_1 = class FerroxSentinelModule {
-    static register(options = {}) {
-        return {
-            module: FerroxSentinelModule_1,
-            providers: [
-                sentinel_guard_js_1.FerroxSentinelGuard,
-                {
-                    provide: sentinel_interceptor_js_1.RagGroundednessInterceptor,
-                    useValue: new sentinel_interceptor_js_1.RagGroundednessInterceptor(options.minGroundednessScore ?? 0.70),
-                },
-            ],
-            exports: [sentinel_guard_js_1.FerroxSentinelGuard, sentinel_interceptor_js_1.RagGroundednessInterceptor],
-        };
-    }
-};
-exports.FerroxSentinelModule = FerroxSentinelModule;
-exports.FerroxSentinelModule = FerroxSentinelModule = FerroxSentinelModule_1 = __decorate([
-    (0, common_1.Module)({})
-], FerroxSentinelModule);

package/tsconfig.json

@@ -1,18 +0,0 @@
-{
-  "compilerOptions": {
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "target": "ES2022",
-    "declaration": true,
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "strict": true,
-    "experimentalDecorators": true,
-    "emitDecoratorMetadata": true,
-    "skipLibCheck": true,
-    "esModuleInterop": true,
-    "types": ["node", "jest"]
-  },
-  "include": ["src/**/*"],
-  "exclude": ["src/__tests__"]
-}