@ninelives/agent-governance-sdk 5.0.1

package/dist/cascade-containment.js

@@ -0,0 +1,387 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CascadeContainmentManager = void 0;
+const crypto_1 = require("crypto");
+const metrics_1 = require("./metrics");
+const DEFAULT_BLAST_RADIUS_POLICY = {
+    maxDependencyDepth: 5,
+    maxFanout: 10,
+    circuitBreakerThreshold: 5,
+    circuitBreakerResetMs: 30_000,
+    autoQuarantine: true,
+    autoRollback: false,
+};
+const TIER_DEFAULTS = {
+    Untrusted: {
+        maxDependencyDepth: 2,
+        maxFanout: 3,
+        circuitBreakerThreshold: 3,
+        autoQuarantine: true,
+        autoRollback: true,
+    },
+    Provisional: {
+        maxDependencyDepth: 3,
+        maxFanout: 5,
+        circuitBreakerThreshold: 4,
+        autoQuarantine: true,
+        autoRollback: false,
+    },
+    Trusted: {
+        maxDependencyDepth: 5,
+        maxFanout: 10,
+        circuitBreakerThreshold: 5,
+        autoQuarantine: false,
+        autoRollback: false,
+    },
+    Verified: {
+        maxDependencyDepth: 8,
+        maxFanout: 20,
+        circuitBreakerThreshold: 8,
+        autoQuarantine: false,
+        autoRollback: false,
+    },
+};
+/**
+ * Manages cascading failure containment for multi-agent systems (OWASP ASI-08).
+ *
+ * Tracks agent dependency graphs, maintains per-link circuit breakers,
+ * and applies blast radius policies based on trust tier to contain
+ * failures before they propagate through the system.
+ */
+class CascadeContainmentManager {
+    nodes = new Map();
+    breakers = new Map();
+    events = [];
+    config;
+    constructor(config) {
+        this.config = {
+            defaultPolicy: { ...DEFAULT_BLAST_RADIUS_POLICY, ...config?.defaultPolicy },
+            tierPolicies: config?.tierPolicies,
+            cascadeThreshold: config?.cascadeThreshold ?? 3,
+        };
+    }
+    /**
+     * Register an agent in the dependency graph.
+     */
+    registerAgent(agentId, trustTier = 'Provisional') {
+        if (this.nodes.has(agentId)) {
+            return this.nodes.get(agentId);
+        }
+        const node = {
+            agentId,
+            trustTier,
+            healthStatus: 'healthy',
+            dependencies: [],
+            dependents: [],
+            lastHealthCheck: new Date().toISOString(),
+        };
+        this.nodes.set(agentId, node);
+        return node;
+    }
+    /**
+     * Declare a dependency: `fromAgent` depends on `toAgent`.
+     * Creates a circuit breaker for this link.
+     */
+    addDependency(fromAgent, toAgent) {
+        this.ensureAgent(fromAgent);
+        this.ensureAgent(toAgent);
+        const from = this.nodes.get(fromAgent);
+        const to = this.nodes.get(toAgent);
+        if (!from.dependencies.includes(toAgent)) {
+            const policy = this.getPolicyForAgent(fromAgent);
+            if (from.dependencies.length >= policy.maxFanout) {
+                throw new Error(`Agent "${fromAgent}" exceeds max fanout (${policy.maxFanout}) for tier ${from.trustTier}`);
+            }
+            const depth = this.getDepthTo(toAgent) + 1;
+            if (depth > policy.maxDependencyDepth) {
+                throw new Error(`Dependency depth ${depth} exceeds max (${policy.maxDependencyDepth}) for tier ${from.trustTier}`);
+            }
+            from.dependencies.push(toAgent);
+            to.dependents.push(fromAgent);
+            const linkKey = this.linkKey(fromAgent, toAgent);
+            if (!this.breakers.has(linkKey)) {
+                this.breakers.set(linkKey, new metrics_1.CircuitBreaker(policy.circuitBreakerThreshold, policy.circuitBreakerResetMs));
+            }
+        }
+    }
+    /**
+     * Check if an agent can call its dependency (circuit breaker is not open).
+     */
+    canCall(fromAgent, toAgent) {
+        const breaker = this.breakers.get(this.linkKey(fromAgent, toAgent));
+        if (!breaker)
+            return true;
+        return breaker.canExecute();
+    }
+    /**
+     * Record a successful call between agents.
+     */
+    recordSuccess(fromAgent, toAgent) {
+        const breaker = this.breakers.get(this.linkKey(fromAgent, toAgent));
+        if (breaker) {
+            breaker.onSuccess();
+        }
+        const target = this.nodes.get(toAgent);
+        if (target && target.healthStatus !== 'healthy') {
+            target.healthStatus = 'healthy';
+            target.lastHealthCheck = new Date().toISOString();
+        }
+    }
+    /**
+     * Record a failed call between agents. May trigger containment actions.
+     */
+    recordFailure(fromAgent, toAgent, reason = 'call failed') {
+        const triggered = [];
+        const breaker = this.breakers.get(this.linkKey(fromAgent, toAgent));
+        if (breaker) {
+            breaker.onFailure();
+            if (breaker.state === 'open') {
+                const evt = this.emitEvent(toAgent, [fromAgent], 'circuit_opened', reason);
+                triggered.push(evt);
+            }
+        }
+        // Update health status of target agent
+        const target = this.nodes.get(toAgent);
+        if (target) {
+            const openBreakersToTarget = this.countOpenBreakersTo(toAgent);
+            if (openBreakersToTarget >= (this.config.cascadeThreshold ?? 3)) {
+                target.healthStatus = 'failing';
+            }
+            else if (openBreakersToTarget > 0) {
+                target.healthStatus = 'degraded';
+            }
+            target.lastHealthCheck = new Date().toISOString();
+        }
+        // Apply containment based on policy
+        const containmentEvents = this.applyContainment(toAgent, reason);
+        triggered.push(...containmentEvents);
+        return triggered;
+    }
+    /**
+     * Propagate health status through dependency graph.
+     * When a node fails, its dependents are notified and may degrade.
+     */
+    propagateHealth(agentId) {
+        const triggered = [];
+        const node = this.nodes.get(agentId);
+        if (!node)
+            return triggered;
+        if (node.healthStatus !== 'failing' && node.healthStatus !== 'unreachable') {
+            return triggered;
+        }
+        const affected = [];
+        for (const dependentId of node.dependents) {
+            const dependent = this.nodes.get(dependentId);
+            if (dependent && dependent.healthStatus === 'healthy') {
+                dependent.healthStatus = 'degraded';
+                dependent.lastHealthCheck = new Date().toISOString();
+                affected.push(dependentId);
+            }
+        }
+        if (affected.length > 0) {
+            const evt = this.emitEvent(agentId, affected, 'health_propagated', `Health degradation propagated from ${agentId}`);
+            triggered.push(evt);
+            // Recursive propagation for transitive dependents
+            for (const affectedId of affected) {
+                const deeper = this.propagateHealth(affectedId);
+                triggered.push(...deeper);
+            }
+        }
+        return triggered;
+    }
+    /**
+     * Compute the blast radius for a given agent: how many agents would
+     * be affected if this agent fails completely.
+     */
+    computeBlastRadius(agentId) {
+        const visited = new Set();
+        this.collectDependents(agentId, visited);
+        visited.delete(agentId);
+        return visited.size;
+    }
+    /**
+     * Analyze the current state of the agent graph for cascade risk.
+     */
+    analyze() {
+        let healthyAgents = 0;
+        let degradedAgents = 0;
+        let failingAgents = 0;
+        for (const node of this.nodes.values()) {
+            switch (node.healthStatus) {
+                case 'healthy':
+                    healthyAgents++;
+                    break;
+                case 'degraded':
+                    degradedAgents++;
+                    break;
+                case 'failing':
+                case 'unreachable':
+                    failingAgents++;
+                    break;
+            }
+        }
+        let openCircuitBreakers = 0;
+        for (const breaker of this.breakers.values()) {
+            if (breaker.state === 'open') {
+                openCircuitBreakers++;
+            }
+        }
+        const blastRadiusMap = {};
+        for (const agentId of this.nodes.keys()) {
+            blastRadiusMap[agentId] = this.computeBlastRadius(agentId);
+        }
+        const totalAgents = this.nodes.size;
+        const cascadeRisk = this.assessCascadeRisk(failingAgents, degradedAgents, totalAgents, openCircuitBreakers);
+        return {
+            totalAgents,
+            healthyAgents,
+            degradedAgents,
+            failingAgents,
+            openCircuitBreakers,
+            cascadeRisk,
+            blastRadiusMap,
+            events: [...this.events],
+        };
+    }
+    /**
+     * Get the dependency graph as a list of agent nodes.
+     */
+    getGraph() {
+        return [...this.nodes.values()].map((n) => ({ ...n }));
+    }
+    /**
+     * Get the circuit breaker state for a specific link.
+     */
+    getBreakerState(fromAgent, toAgent) {
+        return this.breakers.get(this.linkKey(fromAgent, toAgent))?.state;
+    }
+    /**
+     * Get all containment events.
+     */
+    getEvents() {
+        return [...this.events];
+    }
+    /**
+     * Get the effective blast radius policy for an agent.
+     */
+    getPolicyForAgent(agentId) {
+        const node = this.nodes.get(agentId);
+        const tier = node?.trustTier ?? 'Provisional';
+        return this.getPolicyForTier(tier);
+    }
+    /**
+     * Get the effective blast radius policy for a trust tier.
+     */
+    getPolicyForTier(tier) {
+        const tierOverrides = this.config.tierPolicies?.[tier] ?? TIER_DEFAULTS[tier];
+        return { ...this.config.defaultPolicy, ...tierOverrides };
+    }
+    /**
+     * Reset a specific agent back to healthy status.
+     */
+    resetAgent(agentId) {
+        const node = this.nodes.get(agentId);
+        if (node) {
+            node.healthStatus = 'healthy';
+            node.lastHealthCheck = new Date().toISOString();
+        }
+    }
+    // ── Internal helpers ──
+    ensureAgent(agentId) {
+        if (!this.nodes.has(agentId)) {
+            this.registerAgent(agentId);
+        }
+    }
+    linkKey(from, to) {
+        return `${from}->${to}`;
+    }
+    countOpenBreakersTo(agentId) {
+        const node = this.nodes.get(agentId);
+        if (!node)
+            return 0;
+        let count = 0;
+        for (const depId of node.dependents) {
+            const breaker = this.breakers.get(this.linkKey(depId, agentId));
+            if (breaker && breaker.state === 'open') {
+                count++;
+            }
+        }
+        return count;
+    }
+    getDepthTo(agentId, visited = new Set()) {
+        if (visited.has(agentId))
+            return 0;
+        visited.add(agentId);
+        const node = this.nodes.get(agentId);
+        if (!node || node.dependencies.length === 0)
+            return 0;
+        let maxDepth = 0;
+        for (const dep of node.dependencies) {
+            maxDepth = Math.max(maxDepth, 1 + this.getDepthTo(dep, visited));
+        }
+        return maxDepth;
+    }
+    collectDependents(agentId, visited) {
+        if (visited.has(agentId))
+            return;
+        visited.add(agentId);
+        const node = this.nodes.get(agentId);
+        if (!node)
+            return;
+        for (const depId of node.dependents) {
+            this.collectDependents(depId, visited);
+        }
+    }
+    applyContainment(agentId, reason) {
+        const triggered = [];
+        const node = this.nodes.get(agentId);
+        if (!node)
+            return triggered;
+        const policy = this.getPolicyForAgent(agentId);
+        if (node.healthStatus === 'failing' && policy.autoQuarantine) {
+            node.healthStatus = 'unreachable';
+            const evt = this.emitEvent(agentId, [agentId], 'agent_quarantined', `Auto-quarantined: ${reason}`);
+            triggered.push(evt);
+            // Propagate health to dependents
+            const propagated = this.propagateHealth(agentId);
+            triggered.push(...propagated);
+        }
+        if (node.healthStatus === 'unreachable' && policy.autoRollback) {
+            const evt = this.emitEvent(agentId, [agentId], 'rollback_triggered', `Auto-rollback triggered: ${reason}`);
+            triggered.push(evt);
+        }
+        return triggered;
+    }
+    assessCascadeRisk(failing, degraded, total, openBreakers) {
+        if (total === 0)
+            return 'low';
+        const failRatio = failing / total;
+        const degradeRatio = degraded / total;
+        if (failRatio >= 0.3 || openBreakers >= 5)
+            return 'critical';
+        if (failRatio >= 0.15 || degradeRatio >= 0.3)
+            return 'high';
+        if (failRatio > 0 || degradeRatio >= 0.15)
+            return 'medium';
+        return 'low';
+    }
+    emitEvent(sourceAgentId, affectedAgentIds, action, reason) {
+        const blastRadius = this.computeBlastRadius(sourceAgentId);
+        const event = {
+            eventId: (0, crypto_1.randomUUID)(),
+            timestamp: new Date().toISOString(),
+            sourceAgentId,
+            affectedAgentIds,
+            action,
+            reason,
+            blastRadius,
+            containedAt: this.events.length,
+        };
+        this.events.push(event);
+        return event;
+    }
+}
+exports.CascadeContainmentManager = CascadeContainmentManager;
+//# sourceMappingURL=cascade-containment.js.map

package/dist/cascade-containment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade-containment.js","sourceRoot":"","sources":["../src/cascade-containment.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC,mCAAoC;AACpC,uCAAqE;AAYrE,MAAM,2BAA2B,GAAsB;IACrD,kBAAkB,EAAE,CAAC;IACrB,SAAS,EAAE,EAAE;IACb,uBAAuB,EAAE,CAAC;IAC1B,qBAAqB,EAAE,MAAM;IAC7B,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,KAAK;CACpB,CAAC;AAEF,MAAM,aAAa,GAAkD;IACnE,SAAS,EAAE;QACT,kBAAkB,EAAE,CAAC;QACrB,SAAS,EAAE,CAAC;QACZ,uBAAuB,EAAE,CAAC;QAC1B,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,IAAI;KACnB;IACD,WAAW,EAAE;QACX,kBAAkB,EAAE,CAAC;QACrB,SAAS,EAAE,CAAC;QACZ,uBAAuB,EAAE,CAAC;QAC1B,cAAc,EAAE,IAAI;QACpB,YAAY,EAAE,KAAK;KACpB;IACD,OAAO,EAAE;QACP,kBAAkB,EAAE,CAAC;QACrB,SAAS,EAAE,EAAE;QACb,uBAAuB,EAAE,CAAC;QAC1B,cAAc,EAAE,KAAK;QACrB,YAAY,EAAE,KAAK;KACpB;IACD,QAAQ,EAAE;QACR,kBAAkB,EAAE,CAAC;QACrB,SAAS,EAAE,EAAE;QACb,uBAAuB,EAAE,CAAC;QAC1B,cAAc,EAAE,KAAK;QACrB,YAAY,EAAE,KAAK;KACpB;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAa,yBAAyB;IACnB,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IACrC,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7C,MAAM,GAAmB,EAAE,CAAC;IAC5B,MAAM,CAA2B;IAElD,YAAY,MAA0C;QACpD,IAAI,CAAC,MAAM,GAAG;YACZ,aAAa,EAAE,EAAE,GAAG,2BAA2B,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE;YAC3E,YAAY,EAAE,MAAM,EAAE,YAAY;YAClC,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,CAAC;SAChD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe,EAAE,YAAuB,aAAa;QACjE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAClC,CAAC;QAED,MAAM,IAAI,GAAc;YACtB,OAAO;YACP,SAAS;YACT,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,EAAE;YACd,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC1C,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,SAAiB,EAAE,OAAe;QAC9C,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE1B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAEpC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAEjD,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,UAAU,SAAS,yBAAyB,MAAM,CAAC,SAAS,cAAc,IAAI,CAAC,SAAS,EAAE,CAC3F,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,KAAK,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,oBAAoB,KAAK,iBAAiB,MAAM,CAAC,kBAAkB,cAAc,IAAI,CAAC,SAAS,EAAE,CAClG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,OAAO,EACP,IAAI,wBAAc,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAAiB,EAAE,OAAe;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB,EAAE,OAAe;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;YAChC,MAAM,CAAC,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB,EAAE,OAAe,EAAE,SAAiB,aAAa;QAC9E,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QAEpE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,SAAS,EAAE,CAAC;YAEpB,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;gBAC3E,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,oBAAoB,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,oBAAoB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;YAClC,CAAC;iBAAM,IAAI,oBAAoB,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC;YACnC,CAAC;YACD,MAAM,CAAC,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpD,CAAC;QAED,oCAAoC;QACpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjE,SAAS,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,CAAC;QAErC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,OAAe;QAC7B,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,aAAa,EAAE,CAAC;YAC3E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,SAAS,IAAI,SAAS,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACtD,SAAS,CAAC,YAAY,GAAG,UAAU,CAAC;gBACpC,SAAS,CAAC,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBACrD,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CACxB,OAAO,EACP,QAAQ,EACR,mBAAmB,EACnB,sCAAsC,OAAO,EAAE,CAChD,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,kDAAkD;YAClD,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,OAAe;QAChC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,OAAO,CAAC,IAAI,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1B,KAAK,SAAS;oBACZ,aAAa,EAAE,CAAC;oBAChB,MAAM;gBACR,KAAK,UAAU;oBACb,cAAc,EAAE,CAAC;oBACjB,MAAM;gBACR,KAAK,SAAS,CAAC;gBACf,KAAK,aAAa;oBAChB,aAAa,EAAE,CAAC;oBAChB,MAAM;YACV,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,GAAG,CAAC,CAAC;QAC5B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC7B,mBAAmB,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CACxC,aAAa,EACb,cAAc,EACd,WAAW,EACX,mBAAmB,CACpB,CAAC;QAEF,OAAO;YACL,WAAW;YACX,aAAa;YACb,cAAc;YACd,aAAa;YACb,mBAAmB;YACnB,WAAW;YACX,cAAc;YACd,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAAiB,EAAE,OAAe;QAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC;IACpE,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,OAAe;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,EAAE,SAAS,IAAI,aAAa,CAAC;QAC9C,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,IAAe;QAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,aAAa,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,IAAI,CAAC,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,CAAC;IACH,CAAC;IAED,yBAAyB;IAEjB,WAAW,CAAC,OAAe;QACjC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,IAAY,EAAE,EAAU;QACtC,OAAO,GAAG,IAAI,KAAK,EAAE,EAAE,CAAC;IAC1B,CAAC;IAEO,mBAAmB,CAAC,OAAe;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QAEpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YAChE,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;gBACxC,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,UAAU,CAAC,OAAe,EAAE,UAAU,IAAI,GAAG,EAAU;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAErB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAEtD,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,iBAAiB,CAAC,OAAe,EAAE,OAAoB;QAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAErB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,OAAe,EAAE,MAAc;QACtD,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAE/C,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC7D,IAAI,CAAC,YAAY,GAAG,aAAa,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CACxB,OAAO,EACP,CAAC,OAAO,CAAC,EACT,mBAAmB,EACnB,qBAAqB,MAAM,EAAE,CAC9B,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEpB,iCAAiC;YACjC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACjD,SAAS,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,aAAa,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CACxB,OAAO,EACP,CAAC,OAAO,CAAC,EACT,oBAAoB,EACpB,4BAA4B,MAAM,EAAE,CACrC,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,iBAAiB,CACvB,OAAe,EACf,QAAgB,EAChB,KAAa,EACb,YAAoB;QAEpB,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAE9B,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,CAAC;QAClC,MAAM,YAAY,GAAG,QAAQ,GAAG,KAAK,CAAC;QAEtC,IAAI,SAAS,IAAI,GAAG,IAAI,YAAY,IAAI,CAAC;YAAE,OAAO,UAAU,CAAC;QAC7D,IAAI,SAAS,IAAI,IAAI,IAAI,YAAY,IAAI,GAAG;YAAE,OAAO,MAAM,CAAC;QAC5D,IAAI,SAAS,GAAG,CAAC,IAAI,YAAY,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAC;QAC3D,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS,CACf,aAAqB,EACrB,gBAA0B,EAC1B,MAAqB,EACrB,MAAc;QAEd,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAiB;YAC1B,OAAO,EAAE,IAAA,mBAAU,GAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,aAAa;YACb,gBAAgB;YAChB,MAAM;YACN,MAAM;YACN,WAAW;YACX,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;SAChC,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAhaD,8DAgaC"}

package/dist/client.d.ts

@@ -0,0 +1,34 @@
+import { AgentIdentity } from './identity';
+import { TrustManager } from './trust';
+import { PolicyEngine } from './policy';
+import { AuditLogger } from './audit';
+import { AgentMeshConfig, GovernanceResult, SkillAuditMetadata } from './types';
+import { KillSwitch } from './kill-switch';
+import { LifecycleManager } from './lifecycle';
+import { RingEnforcer } from './rings';
+/**
+ * Unified client that ties identity, trust, policy, and audit together
+ * into a single governance-aware entry point.
+ */
+export declare class AgentMeshClient {
+    readonly identity: AgentIdentity;
+    readonly trust: TrustManager;
+    readonly policy: PolicyEngine;
+    readonly audit: AuditLogger;
+    readonly lifecycle: LifecycleManager;
+    readonly ringEnforcer: RingEnforcer;
+    readonly killSwitch?: KillSwitch;
+    private readonly quarantineOnBreach;
+    private readonly killOnBreach;
+    constructor(config: AgentMeshConfig);
+    /** Convenience factory. */
+    static create(agentId: string, options?: Partial<AgentMeshConfig>): AgentMeshClient;
+    /**
+     * Execute an action through the full governance pipeline:
+     * 1. Evaluate policy
+     * 2. Check trust score
+     * 3. Log to audit trail
+     */
+    executeWithGovernance(action: string, params?: Record<string, unknown>, skillAuditMetadata?: SkillAuditMetadata): Promise<GovernanceResult>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAkB,MAAM,aAAa,CAAC;AAC/D,OAAO,EAAmB,YAAY,EAAE,MAAM,SAAS,CAAC;AAExD;;;GAGG;AACH,qBAAa,eAAe;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAU;gBAE3B,MAAM,EAAE,eAAe;IAYnC,2BAA2B;IAC3B,MAAM,CAAC,MAAM,CACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GACjC,eAAe;IAIlB;;;;;OAKG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,MAAM,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACpC,kBAAkB,CAAC,EAAE,kBAAkB,GACtC,OAAO,CAAC,gBAAgB,CAAC;CAwE7B"}

package/dist/client.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentMeshClient = void 0;
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+const identity_1 = require("./identity");
+const trust_1 = require("./trust");
+const policy_1 = require("./policy");
+const audit_1 = require("./audit");
+const kill_switch_1 = require("./kill-switch");
+const lifecycle_1 = require("./lifecycle");
+const rings_1 = require("./rings");
+/**
+ * Unified client that ties identity, trust, policy, and audit together
+ * into a single governance-aware entry point.
+ */
+class AgentMeshClient {
+    identity;
+    trust;
+    policy;
+    audit;
+    lifecycle;
+    ringEnforcer;
+    killSwitch;
+    quarantineOnBreach;
+    killOnBreach;
+    constructor(config) {
+        this.identity = identity_1.AgentIdentity.generate(config.agentId, config.capabilities);
+        this.trust = new trust_1.TrustManager(config.trust);
+        this.policy = new policy_1.PolicyEngine(config.policyRules);
+        this.audit = new audit_1.AuditLogger(config.audit);
+        this.lifecycle = new lifecycle_1.LifecycleManager(this.identity.did);
+        this.ringEnforcer = new rings_1.RingEnforcer(config.execution);
+        this.quarantineOnBreach = config.execution?.quarantineOnBreach ?? true;
+        this.killOnBreach = config.execution?.killOnBreach ?? false;
+        this.killSwitch = config.killSwitch?.enabled === false ? undefined : new kill_switch_1.KillSwitch(config.killSwitch);
+    }
+    /** Convenience factory. */
+    static create(agentId, options) {
+        return new AgentMeshClient({ agentId, ...options });
+    }
+    /**
+     * Execute an action through the full governance pipeline:
+     * 1. Evaluate policy
+     * 2. Check trust score
+     * 3. Log to audit trail
+     */
+    async executeWithGovernance(action, params = {}, skillAuditMetadata) {
+        const start = performance.now();
+        if (this.lifecycle.state === lifecycle_1.LifecycleState.Provisioning) {
+            this.lifecycle.activate('Governance pipeline initialized');
+        }
+        try {
+            this.ringEnforcer.enforce(action);
+        }
+        catch (error) {
+            if (error instanceof rings_1.RingBreachError) {
+                let lifecycleReason = error.message;
+                if (this.quarantineOnBreach && this.lifecycle.canTransition(lifecycle_1.LifecycleState.Quarantined)) {
+                    this.lifecycle.quarantine(error.message);
+                }
+                const killSwitchResult = this.killOnBreach && this.killSwitch
+                    ? await this.killSwitch.kill(this.identity.did, {
+                        action,
+                        reason: error.message,
+                    })
+                    : undefined;
+                const auditEntry = this.audit.log({
+                    agentId: this.identity.did,
+                    action,
+                    decision: 'deny',
+                });
+                this.trust.recordFailure(this.identity.did);
+                return {
+                    decision: 'deny',
+                    trustScore: this.trust.getTrustScore(this.identity.did),
+                    auditEntry,
+                    executionTime: Math.round((performance.now() - start) * 1000) / 1000,
+                    ringViolation: error.violation,
+                    killSwitchResult,
+                    lifecycleState: this.lifecycle.state,
+                    lifecycleReason,
+                };
+            }
+            throw error;
+        }
+        const decision = this.policy.evaluate(action, params);
+        const trustScore = this.trust.getTrustScore(this.identity.did);
+        const auditEntry = this.audit.log({
+            agentId: this.identity.did,
+            action,
+            decision,
+            skillAuditMetadata,
+        });
+        if (decision === 'allow') {
+            this.trust.recordSuccess(this.identity.did);
+        }
+        else if (decision === 'deny') {
+            this.trust.recordFailure(this.identity.did);
+        }
+        const executionTime = Math.round((performance.now() - start) * 1000) / 1000;
+        return {
+            decision,
+            trustScore,
+            auditEntry,
+            executionTime,
+            lifecycleState: this.lifecycle.state,
+        };
+    }
+}
+exports.AgentMeshClient = AgentMeshClient;
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAAA,uCAAuC;AACvC,kCAAkC;AAClC,yCAA2C;AAC3C,mCAAuC;AACvC,qCAAwC;AACxC,mCAAsC;AAEtC,+CAA2C;AAC3C,2CAA+D;AAC/D,mCAAwD;AAExD;;;GAGG;AACH,MAAa,eAAe;IACjB,QAAQ,CAAgB;IACxB,KAAK,CAAe;IACpB,MAAM,CAAe;IACrB,KAAK,CAAc;IACnB,SAAS,CAAmB;IAC5B,YAAY,CAAe;IAC3B,UAAU,CAAc;IAChB,kBAAkB,CAAU;IAC5B,YAAY,CAAU;IAEvC,YAAY,MAAuB;QACjC,IAAI,CAAC,QAAQ,GAAG,wBAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,qBAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,mBAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,4BAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,SAAS,EAAE,kBAAkB,IAAI,IAAI,CAAC;QACvE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,SAAS,EAAE,YAAY,IAAI,KAAK,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,wBAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACzG,CAAC;IAED,2BAA2B;IAC3B,MAAM,CAAC,MAAM,CACX,OAAe,EACf,OAAkC;QAElC,OAAO,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,SAAkC,EAAE,EACpC,kBAAuC;QAEvC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,0BAAc,CAAC,YAAY,EAAE,CAAC;YACzD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,iCAAiC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAe,EAAE,CAAC;gBACrC,IAAI,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC;gBACpC,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,0BAAc,CAAC,WAAW,CAAC,EAAE,CAAC;oBACxF,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3C,CAAC;gBAED,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU;oBAC3D,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;wBAC5C,MAAM;wBACN,MAAM,EAAE,KAAK,CAAC,OAAO;qBACtB,CAAC;oBACJ,CAAC,CAAC,SAAS,CAAC;gBAEd,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;oBAChC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;oBAC1B,MAAM;oBACN,QAAQ,EAAE,MAAM;iBACjB,CAAC,CAAC;gBAEH,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAE5C,OAAO;oBACL,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;oBACvD,UAAU;oBACV,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI;oBACpE,aAAa,EAAE,KAAK,CAAC,SAAS;oBAC9B,gBAAgB;oBAChB,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;oBACpC,eAAe;iBAChB,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG;YAC1B,MAAM;YACN,QAAQ;YACR,kBAAkB;SACnB,CAAC,CAAC;QAEH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;QAE5E,OAAO;YACL,QAAQ;YACR,UAAU;YACV,UAAU;YACV,aAAa;YACb,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK;SACrC,CAAC;IACJ,CAAC;CACF;AAjHD,0CAiHC"}

package/dist/context-poisoning.d.ts

@@ -0,0 +1,58 @@
+import type { ContextEntry, ContextIsolationViolation, ContextPoisoningConfig, ContextPoisoningScanResult, PoisoningFinding } from './types';
+/**
+ * Detects context poisoning attacks in agent memory stores (OWASP ASI-06).
+ *
+ * Scans context entries for known attack patterns including prompt injection,
+ * context window stuffing, high-entropy payloads, and repetition flooding.
+ * Also validates memory isolation between agent sessions.
+ */
+export declare class ContextPoisoningDetector {
+    private readonly config;
+    private readonly patterns;
+    private readonly compiledRegex;
+    private readonly contextStore;
+    private readonly integrityHashes;
+    private static readonly MAX_CONTEXT_KEYS;
+    private static readonly MAX_ENTRIES_PER_KEY;
+    constructor(config?: ContextPoisoningConfig);
+    /**
+     * Add a context entry to the store and compute its integrity hash.
+     */
+    addEntry(entry: ContextEntry): void;
+    /**
+     * Scan all stored context entries for poisoning indicators.
+     */
+    scan(): ContextPoisoningScanResult;
+    /**
+     * Scan a single context entry for poisoning patterns.
+     */
+    scanEntry(entry: ContextEntry): PoisoningFinding[];
+    /**
+     * Verify integrity of all stored entries.
+     * Returns false if any entry has been tampered with.
+     */
+    verifyIntegrity(): boolean;
+    /**
+     * Check memory isolation between sessions for the same agent.
+     */
+    checkIsolation(): ContextIsolationViolation[];
+    /**
+     * Get all stored entries for a specific agent/session.
+     */
+    getEntries(agentId: string, sessionId: string): ContextEntry[];
+    /**
+     * Clear all entries for a specific agent/session.
+     */
+    clearSession(agentId: string, sessionId: string): void;
+    private checkPattern;
+    private checkRegex;
+    private checkEntropy;
+    private checkSize;
+    private checkRepetition;
+    private findSharedContent;
+    private shannonEntropy;
+    private computeHash;
+    private getRecommendation;
+    private assessRisk;
+}
+//# sourceMappingURL=context-poisoning.d.ts.map

package/dist/context-poisoning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-poisoning.d.ts","sourceRoot":"","sources":["../src/context-poisoning.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,YAAY,EACZ,yBAAyB,EACzB,sBAAsB,EACtB,0BAA0B,EAC1B,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AAkEjB;;;;;;GAMG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0D;IACjF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqC;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA6B;IAE7D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAS;gBAExC,MAAM,CAAC,EAAE,sBAAsB;IAqB3C;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI;IAqBnC;;OAEG;IACH,IAAI,IAAI,0BAA0B;IAiClC;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,gBAAgB,EAAE;IAalD;;;OAGG;IACH,eAAe,IAAI,OAAO;IAY1B;;OAEG;IACH,cAAc,IAAI,yBAAyB,EAAE;IA0C7C;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,EAAE;IAI9D;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAatD,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,UAAU;IAqBlB,OAAO,CAAC,YAAY;IAoBpB,OAAO,CAAC,SAAS;IAkBjB,OAAO,CAAC,eAAe;IAkCvB,OAAO,CAAC,iBAAiB;IAkBzB,OAAO,CAAC,cAAc;IAkBtB,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,UAAU;CAenB"}