@ninelives/agent-governance-sdk 5.0.1

package/dist/context-poisoning.js

@@ -0,0 +1,410 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContextPoisoningDetector = void 0;
+const crypto_1 = require("crypto");
+const DEFAULT_PATTERNS = [
+    {
+        id: 'prompt-injection-ignore',
+        name: 'Prompt injection: ignore previous instructions',
+        description: 'Detects attempts to override system instructions via "ignore" directives',
+        detector: 'regex',
+        pattern: '(?:ignore|disregard|forget|override)\\s+(?:all\\s+)?(?:previous|prior|above|earlier|system)\\s+(?:instructions|rules|prompts|context)',
+        severity: 'critical',
+    },
+    {
+        id: 'prompt-injection-roleplay',
+        name: 'Prompt injection: role assumption',
+        description: 'Detects attempts to make the agent assume a different role or persona',
+        detector: 'regex',
+        pattern: '(?:you\\s+are\\s+now|act\\s+as|pretend\\s+(?:to\\s+be|you\\s+are)|from\\s+now\\s+on\\s+you\\s+are|new\\s+instructions?:)',
+        severity: 'high',
+    },
+    {
+        id: 'prompt-injection-system-override',
+        name: 'Prompt injection: system prompt extraction',
+        description: 'Detects attempts to extract or modify system prompts',
+        detector: 'regex',
+        pattern: '(?:show|reveal|display|output|print|repeat)\\s+(?:your|the)?\\s*(?:system\\s+(?:prompt|message|instructions)|initial\\s+(?:prompt|instructions))',
+        severity: 'high',
+    },
+    {
+        id: 'context-stuffing',
+        name: 'Context window stuffing',
+        description: 'Detects abnormally large entries that may attempt to push important context out of the window',
+        detector: 'size',
+        severity: 'medium',
+    },
+    {
+        id: 'high-entropy-payload',
+        name: 'High entropy payload',
+        description: 'Detects entries with abnormally high entropy that may contain encoded/obfuscated payloads',
+        detector: 'entropy',
+        severity: 'medium',
+    },
+    {
+        id: 'repetition-attack',
+        name: 'Repetition flooding',
+        description: 'Detects repeated identical or near-identical entries that may attempt to bias agent behavior',
+        detector: 'repetition',
+        severity: 'medium',
+    },
+    {
+        id: 'injection-delimiter',
+        name: 'Delimiter injection',
+        description: 'Detects use of common prompt delimiters to break context boundaries',
+        detector: 'injection',
+        pattern: '(?:```\\s*system|<\\|(?:im_start|system|end)\\|>|\\[INST\\]|<<SYS>>|###\\s*(?:System|Instruction|Human|Assistant):)',
+        severity: 'critical',
+    },
+];
+const DEFAULT_CONFIG = {
+    maxContextSizeBytes: 100_000,
+    maxEntriesPerSession: 200,
+    entropyThreshold: 5.5,
+    similarityThreshold: 0.9,
+    enableIsolation: true,
+};
+/**
+ * Detects context poisoning attacks in agent memory stores (OWASP ASI-06).
+ *
+ * Scans context entries for known attack patterns including prompt injection,
+ * context window stuffing, high-entropy payloads, and repetition flooding.
+ * Also validates memory isolation between agent sessions.
+ */
+class ContextPoisoningDetector {
+    config;
+    patterns;
+    compiledRegex = new Map();
+    contextStore = new Map();
+    integrityHashes = new Map();
+    static MAX_CONTEXT_KEYS = 10_000;
+    static MAX_ENTRIES_PER_KEY = 1_000;
+    constructor(config) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.patterns = [...DEFAULT_PATTERNS, ...(config?.knownPatterns ?? [])];
+        for (const p of this.patterns) {
+            if (p.detector === 'regex' && p.pattern) {
+                try {
+                    this.compiledRegex.set(p.id, new RegExp(p.pattern, 'i'));
+                }
+                catch {
+                    // Skip patterns that fail to compile
+                }
+            }
+            else if (p.detector === 'injection' && p.pattern) {
+                try {
+                    this.compiledRegex.set(p.id, new RegExp(p.pattern, 'i'));
+                }
+                catch {
+                    // Skip patterns that fail to compile
+                }
+            }
+        }
+    }
+    /**
+     * Add a context entry to the store and compute its integrity hash.
+     */
+    addEntry(entry) {
+        const key = `${entry.agentId}:${entry.sessionId}`;
+        const entries = this.contextStore.get(key) ?? [];
+        if (entries.length >= ContextPoisoningDetector.MAX_ENTRIES_PER_KEY) {
+            entries.shift();
+        }
+        entries.push(entry);
+        if (!this.contextStore.has(key) && this.contextStore.size >= ContextPoisoningDetector.MAX_CONTEXT_KEYS) {
+            // Evict oldest key (first inserted).
+            const oldest = this.contextStore.keys().next().value;
+            if (oldest !== undefined) {
+                this.contextStore.delete(oldest);
+            }
+        }
+        this.contextStore.set(key, entries);
+        const hash = this.computeHash(entry);
+        this.integrityHashes.set(entry.entryId, hash);
+    }
+    /**
+     * Scan all stored context entries for poisoning indicators.
+     */
+    scan() {
+        const findings = [];
+        let entriesScanned = 0;
+        for (const entries of this.contextStore.values()) {
+            for (const entry of entries) {
+                entriesScanned++;
+                const entryFindings = this.scanEntry(entry);
+                findings.push(...entryFindings);
+            }
+            // Check repetition across entries in the same session
+            const repetitionFindings = this.checkRepetition(entries);
+            findings.push(...repetitionFindings);
+        }
+        const isolationViolations = this.config.enableIsolation
+            ? this.checkIsolation()
+            : [];
+        const integrityValid = this.verifyIntegrity();
+        const riskLevel = this.assessRisk(findings, isolationViolations);
+        return {
+            scannedAt: new Date().toISOString(),
+            entriesScanned,
+            findings,
+            integrityValid,
+            isolationViolations,
+            riskLevel,
+        };
+    }
+    /**
+     * Scan a single context entry for poisoning patterns.
+     */
+    scanEntry(entry) {
+        const findings = [];
+        for (const pattern of this.patterns) {
+            const finding = this.checkPattern(entry, pattern);
+            if (finding) {
+                findings.push(finding);
+            }
+        }
+        return findings;
+    }
+    /**
+     * Verify integrity of all stored entries.
+     * Returns false if any entry has been tampered with.
+     */
+    verifyIntegrity() {
+        for (const entries of this.contextStore.values()) {
+            for (const entry of entries) {
+                const storedHash = this.integrityHashes.get(entry.entryId);
+                if (!storedHash)
+                    continue;
+                const currentHash = this.computeHash(entry);
+                if (currentHash !== storedHash)
+                    return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Check memory isolation between sessions for the same agent.
+     */
+    checkIsolation() {
+        const violations = [];
+        // Group by agentId
+        const agentSessions = new Map();
+        for (const [key, entries] of this.contextStore) {
+            const [agentId] = key.split(':');
+            if (!agentSessions.has(agentId)) {
+                agentSessions.set(agentId, new Map());
+            }
+            const sessions = agentSessions.get(agentId);
+            const sessionId = entries[0]?.sessionId;
+            if (sessionId) {
+                sessions.set(sessionId, entries);
+            }
+        }
+        // Check for content leaking between sessions
+        for (const [agentId, sessions] of agentSessions) {
+            const sessionIds = [...sessions.keys()];
+            for (let i = 0; i < sessionIds.length; i++) {
+                for (let j = i + 1; j < sessionIds.length; j++) {
+                    const entriesA = sessions.get(sessionIds[i]);
+                    const entriesB = sessions.get(sessionIds[j]);
+                    const shared = this.findSharedContent(entriesA, entriesB);
+                    if (shared.length > 0) {
+                        violations.push({
+                            sourceSessionId: sessionIds[i],
+                            targetSessionId: sessionIds[j],
+                            agentId,
+                            sharedEntryIds: shared,
+                            description: `${shared.length} context entries shared between sessions, violating memory isolation`,
+                        });
+                    }
+                }
+            }
+        }
+        return violations;
+    }
+    /**
+     * Get all stored entries for a specific agent/session.
+     */
+    getEntries(agentId, sessionId) {
+        return [...(this.contextStore.get(`${agentId}:${sessionId}`) ?? [])];
+    }
+    /**
+     * Clear all entries for a specific agent/session.
+     */
+    clearSession(agentId, sessionId) {
+        const key = `${agentId}:${sessionId}`;
+        const entries = this.contextStore.get(key);
+        if (entries) {
+            for (const entry of entries) {
+                this.integrityHashes.delete(entry.entryId);
+            }
+        }
+        this.contextStore.delete(key);
+    }
+    // ── Internal helpers ──
+    checkPattern(entry, pattern) {
+        switch (pattern.detector) {
+            case 'regex':
+            case 'injection':
+                return this.checkRegex(entry, pattern);
+            case 'entropy':
+                return this.checkEntropy(entry, pattern);
+            case 'size':
+                return this.checkSize(entry, pattern);
+            case 'repetition':
+                return null; // Handled separately across entries
+            default:
+                return null;
+        }
+    }
+    checkRegex(entry, pattern) {
+        const regex = this.compiledRegex.get(pattern.id);
+        if (!regex)
+            return null;
+        const match = regex.exec(entry.content);
+        if (!match)
+            return null;
+        return {
+            findingId: (0, crypto_1.randomUUID)(),
+            patternId: pattern.id,
+            patternName: pattern.name,
+            severity: pattern.severity,
+            entryId: entry.entryId,
+            sessionId: entry.sessionId,
+            agentId: entry.agentId,
+            description: pattern.description,
+            evidence: match[0].substring(0, 200),
+            recommendation: this.getRecommendation(pattern),
+        };
+    }
+    checkEntropy(entry, pattern) {
+        if (entry.content.length < 50)
+            return null;
+        const entropy = this.shannonEntropy(entry.content);
+        if (entropy < this.config.entropyThreshold)
+            return null;
+        return {
+            findingId: (0, crypto_1.randomUUID)(),
+            patternId: pattern.id,
+            patternName: pattern.name,
+            severity: pattern.severity,
+            entryId: entry.entryId,
+            sessionId: entry.sessionId,
+            agentId: entry.agentId,
+            description: `Entry has abnormally high entropy (${entropy.toFixed(2)} bits/char, threshold: ${this.config.entropyThreshold})`,
+            evidence: `First 100 chars: ${entry.content.substring(0, 100)}`,
+            recommendation: 'Review entry for encoded or obfuscated payloads. Consider rejecting high-entropy inputs.',
+        };
+    }
+    checkSize(entry, pattern) {
+        const sizeBytes = Buffer.byteLength(entry.content, 'utf-8');
+        if (sizeBytes <= this.config.maxContextSizeBytes)
+            return null;
+        return {
+            findingId: (0, crypto_1.randomUUID)(),
+            patternId: pattern.id,
+            patternName: pattern.name,
+            severity: pattern.severity,
+            entryId: entry.entryId,
+            sessionId: entry.sessionId,
+            agentId: entry.agentId,
+            description: `Entry size (${sizeBytes} bytes) exceeds maximum (${this.config.maxContextSizeBytes} bytes)`,
+            evidence: `Size: ${sizeBytes} bytes, limit: ${this.config.maxContextSizeBytes} bytes`,
+            recommendation: 'Truncate or reject oversized context entries to prevent context window stuffing.',
+        };
+    }
+    checkRepetition(entries) {
+        const findings = [];
+        const contentCounts = new Map();
+        for (const entry of entries) {
+            const normalized = entry.content.trim().toLowerCase();
+            const existing = contentCounts.get(normalized) ?? [];
+            existing.push(entry);
+            contentCounts.set(normalized, existing);
+        }
+        const repetitionPattern = this.patterns.find((p) => p.id === 'repetition-attack');
+        if (!repetitionPattern)
+            return findings;
+        for (const [, duplicates] of contentCounts) {
+            if (duplicates.length >= 3) {
+                findings.push({
+                    findingId: (0, crypto_1.randomUUID)(),
+                    patternId: repetitionPattern.id,
+                    patternName: repetitionPattern.name,
+                    severity: repetitionPattern.severity,
+                    entryId: duplicates[0].entryId,
+                    sessionId: duplicates[0].sessionId,
+                    agentId: duplicates[0].agentId,
+                    description: `Content repeated ${duplicates.length} times in session, possible repetition flooding`,
+                    evidence: `Repeated content (first 100 chars): ${duplicates[0].content.substring(0, 100)}`,
+                    recommendation: 'Deduplicate repeated context entries. Rate-limit identical submissions.',
+                });
+            }
+        }
+        return findings;
+    }
+    findSharedContent(entriesA, entriesB) {
+        const shared = [];
+        const contentMapA = new Map();
+        for (const entry of entriesA) {
+            contentMapA.set(entry.content.trim(), entry.entryId);
+        }
+        for (const entry of entriesB) {
+            const normalizedContent = entry.content.trim();
+            if (contentMapA.has(normalizedContent) && normalizedContent.length > 20) {
+                shared.push(contentMapA.get(normalizedContent), entry.entryId);
+            }
+        }
+        return shared;
+    }
+    shannonEntropy(text) {
+        const freq = new Map();
+        for (const char of text) {
+            freq.set(char, (freq.get(char) ?? 0) + 1);
+        }
+        let entropy = 0;
+        const len = text.length;
+        for (const count of freq.values()) {
+            const p = count / len;
+            if (p > 0) {
+                entropy -= p * Math.log2(p);
+            }
+        }
+        return entropy;
+    }
+    computeHash(entry) {
+        return (0, crypto_1.createHash)('sha256')
+            .update(`${entry.entryId}:${entry.sessionId}:${entry.agentId}:${entry.role}:${entry.content}:${entry.timestamp}`)
+            .digest('hex');
+    }
+    getRecommendation(pattern) {
+        switch (pattern.severity) {
+            case 'critical':
+                return 'Block this input immediately. Log the attempt and quarantine the session.';
+            case 'high':
+                return 'Flag for review and consider blocking. Monitor the source for repeated attempts.';
+            case 'medium':
+                return 'Log the anomaly and apply additional validation before processing.';
+            default:
+                return 'Monitor for repeated occurrences and consider adding to block list.';
+        }
+    }
+    assessRisk(findings, violations) {
+        if (findings.length === 0 && violations.length === 0)
+            return 'none';
+        const hasCritical = findings.some((f) => f.severity === 'critical');
+        const hasHigh = findings.some((f) => f.severity === 'high');
+        const hasMedium = findings.some((f) => f.severity === 'medium');
+        if (hasCritical || violations.length > 0)
+            return 'critical';
+        if (hasHigh)
+            return 'high';
+        if (hasMedium)
+            return 'medium';
+        return 'low';
+    }
+}
+exports.ContextPoisoningDetector = ContextPoisoningDetector;
+//# sourceMappingURL=context-poisoning.js.map

package/dist/context-poisoning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-poisoning.js","sourceRoot":"","sources":["../src/context-poisoning.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC,mCAAgD;AAUhD,MAAM,gBAAgB,GAAuB;IAC3C;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,gDAAgD;QACtD,WAAW,EAAE,0EAA0E;QACvF,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,uIAAuI;QAChJ,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,mCAAmC;QACzC,WAAW,EAAE,uEAAuE;QACpF,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,0HAA0H;QACnI,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE,4CAA4C;QAClD,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,kJAAkJ;QAC3J,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,+FAA+F;QAC5G,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,2FAA2F;QACxG,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,8FAA8F;QAC3G,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,qEAAqE;QAClF,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,qHAAqH;QAC9H,QAAQ,EAAE,UAAU;KACrB;CACF,CAAC;AAEF,MAAM,cAAc,GAA4D;IAC9E,mBAAmB,EAAE,OAAO;IAC5B,oBAAoB,EAAE,GAAG;IACzB,gBAAgB,EAAE,GAAG;IACrB,mBAAmB,EAAE,GAAG;IACxB,eAAe,EAAE,IAAI;CACtB,CAAC;AAEF;;;;;;GAMG;AACH,MAAa,wBAAwB;IAClB,MAAM,CAA0D;IAChE,QAAQ,CAAqB;IAC7B,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,YAAY,GAAG,IAAI,GAAG,EAA0B,CAAC;IACjD,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAErD,MAAM,CAAU,gBAAgB,GAAG,MAAM,CAAC;IAC1C,MAAM,CAAU,mBAAmB,GAAG,KAAK,CAAC;IAEpD,YAAY,MAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QAExE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACxC,IAAI,CAAC;oBACH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBACP,qCAAqC;gBACvC,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACnD,IAAI,CAAC;oBACH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBACP,qCAAqC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,KAAmB;QAC1B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,EAAE,CAAC;YACnE,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEpB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,wBAAwB,CAAC,gBAAgB,EAAE,CAAC;YACvG,qCAAqC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI;QACF,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,IAAI,cAAc,GAAG,CAAC,CAAC;QAEvB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,cAAc,EAAE,CAAC;gBACjB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC5C,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC;YAClC,CAAC;YAED,sDAAsD;YACtD,MAAM,kBAAkB,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe;YACrD,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;YACvB,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QAEjE,OAAO;YACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,cAAc;YACd,QAAQ;YACR,cAAc;YACd,mBAAmB;YACnB,SAAS;SACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAmB;QAC3B,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAClD,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3D,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC5C,IAAI,WAAW,KAAK,UAAU;oBAAE,OAAO,KAAK,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,UAAU,GAAgC,EAAE,CAAC;QAEnD,mBAAmB;QACnB,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;QACrE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;YACxC,CAAC;YACD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;YACxC,IAAI,SAAS,EAAE,CAAC;gBACd,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC;YAChD,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;oBAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,CAAC;oBAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBAE1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtB,UAAU,CAAC,IAAI,CAAC;4BACd,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;4BAC9B,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC;4BAC9B,OAAO;4BACP,cAAc,EAAE,MAAM;4BACtB,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,sEAAsE;yBACpG,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe,EAAE,SAAiB;QAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,OAAe,EAAE,SAAiB;QAC7C,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,yBAAyB;IAEjB,YAAY,CAAC,KAAmB,EAAE,OAAyB;QACjE,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,OAAO,CAAC;YACb,KAAK,WAAW;gBACd,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACzC,KAAK,SAAS;gBACZ,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3C,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YACxC,KAAK,YAAY;gBACf,OAAO,IAAI,CAAC,CAAC,oCAAoC;YACnD;gBACE,OAAO,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,KAAmB,EAAE,OAAyB;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,OAAO;YACL,SAAS,EAAE,IAAA,mBAAU,GAAE;YACvB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;YACpC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;SAChD,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,KAAmB,EAAE,OAAyB;QACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QAExD,OAAO;YACL,SAAS,EAAE,IAAA,mBAAU,GAAE;YACvB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,sCAAsC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,IAAI,CAAC,MAAM,CAAC,gBAAgB,GAAG;YAC9H,QAAQ,EAAE,oBAAoB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC/D,cAAc,EAAE,0FAA0F;SAC3G,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,KAAmB,EAAE,OAAyB;QAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAE9D,OAAO;YACL,SAAS,EAAE,IAAA,mBAAU,GAAE;YACvB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,eAAe,SAAS,4BAA4B,IAAI,CAAC,MAAM,CAAC,mBAAmB,SAAS;YACzG,QAAQ,EAAE,SAAS,SAAS,kBAAkB,IAAI,CAAC,MAAM,CAAC,mBAAmB,QAAQ;YACrF,cAAc,EAAE,kFAAkF;SACnG,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,OAAuB;QAC7C,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA0B,CAAC;QAExD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,mBAAmB,CAAC,CAAC;QAClF,IAAI,CAAC,iBAAiB;YAAE,OAAO,QAAQ,CAAC;QAExC,KAAK,MAAM,CAAC,EAAE,UAAU,CAAC,IAAI,aAAa,EAAE,CAAC;YAC3C,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC;oBACZ,SAAS,EAAE,IAAA,mBAAU,GAAE;oBACvB,SAAS,EAAE,iBAAiB,CAAC,EAAE;oBAC/B,WAAW,EAAE,iBAAiB,CAAC,IAAI;oBACnC,QAAQ,EAAE,iBAAiB,CAAC,QAAQ;oBACpC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO;oBAC9B,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;oBAClC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO;oBAC9B,WAAW,EAAE,oBAAoB,UAAU,CAAC,MAAM,iDAAiD;oBACnG,QAAQ,EAAE,uCAAuC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBAC1F,cAAc,EAAE,yEAAyE;iBAC1F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,iBAAiB,CAAC,QAAwB,EAAE,QAAwB;QAC1E,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAE9C,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACxE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,KAAK,GAAG,GAAG,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,WAAW,CAAC,KAAmB;QACrC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;aAChH,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEO,iBAAiB,CAAC,OAAyB;QACjD,QAAQ,OAAO,CAAC,QAAQ,EAAE,CAAC;YACzB,KAAK,UAAU;gBACb,OAAO,2EAA2E,CAAC;YACrF,KAAK,MAAM;gBACT,OAAO,kFAAkF,CAAC;YAC5F,KAAK,QAAQ;gBACX,OAAO,oEAAoE,CAAC;YAC9E;gBACE,OAAO,qEAAqE,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,UAAU,CAChB,QAA4B,EAC5B,UAAuC;QAEvC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEpE,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QAEhE,IAAI,WAAW,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,UAAU,CAAC;QAC5D,IAAI,OAAO;YAAE,OAAO,MAAM,CAAC;QAC3B,IAAI,SAAS;YAAE,OAAO,QAAQ,CAAC;QAC/B,OAAO,KAAK,CAAC;IACf,CAAC;;AAjXH,4DAkXC"}

package/dist/credential-vault.d.ts

@@ -0,0 +1,213 @@
+/**
+ * Credential vault, scoping, and injection for agent tool calls.
+ *
+ * TypeScript port of the Python `agent_os.credential_vault` primitive
+ * (issue #2481, PR #2534). Tracking issue: #2535.
+ *
+ * Design goals (identical to the Python reference):
+ *
+ * 1. **Value boundary** — agents never receive resolved secret values. They
+ *    reference credentials by opaque handle names; only the injector ever
+ *    holds the resolved value, and only long enough to render a payload.
+ * 2. **Authority boundary** — every resolution is gated by a per-agent
+ *    {@link CredentialProfile} that binds an *action capability* (not just
+ *    an agent identity) to a specific credential handle.
+ * 3. **Policy-first** — placeholder substitution happens *after* the
+ *    workflow policy callback returns `allow=true`.
+ * 4. **Deterministic deny** — denied resolutions emit the same opaque
+ *    {@link DenyReceipt} regardless of whether the handle is missing,
+ *    bound to a different agent, or denied by policy.
+ * 5. **Untrusted server metadata** — only placeholders whose names appear
+ *    in the caller-supplied `allowedHandles` set are eligible for
+ *    substitution. Anything else is treated as injection.
+ * 6. **Rotation without rebinding** — credential values rotate in place;
+ *    the handle name is stable so prompts, MCP descriptions, and saved
+ *    plans never need to change.
+ *
+ * Encrypted-at-rest persistence uses AES-256-GCM (`@noble/ciphers`) with
+ * a 12-byte random nonce prefixed to the ciphertext. If no persistence
+ * path is configured the vault is memory-only.
+ *
+ * Wire-format note: this SDK uses AES-256-GCM; the Python SDK uses Fernet.
+ * A cross-language interop spec is tracked in issue #2535 and the two
+ * formats are not currently interchangeable.
+ */
+/** Regex matching the credential placeholder syntax `{{cred:NAME}}`. */
+export declare const PLACEHOLDER_RE: RegExp;
+/** Stable string returned in audit/deny records when a request is refused. */
+export declare const DENY_REASON = "credential_denied";
+/** Outcome of a credential resolution attempt. */
+export type CredentialDecision = 'allow' | 'deny';
+export declare class CredentialError extends Error {
+    constructor(message: string);
+}
+export interface CredentialRecord {
+    readonly name: string;
+    readonly value: string;
+    readonly credType: string;
+    readonly version: number;
+    readonly createdAt: number;
+    readonly rotatedAt: number | null;
+}
+/**
+ * Opaque handle an agent may reference. Holding a handle does **not** grant
+ * access to the underlying value; resolution requires the vault, the
+ * agent's DID, and an action capability binding.
+ */
+export declare class CredentialHandle {
+    readonly name: string;
+    constructor(name: string);
+    /** Return the `{{cred:NAME}}` placeholder for this handle. */
+    placeholder(): string;
+    toString(): string;
+}
+/**
+ * Per-agent capability binding.
+ *
+ * A profile maps action capabilities (e.g. `github:read_issues`,
+ * `github:push_code`) to the credential handle name that may be used to
+ * fulfil that capability. Two capabilities that share an underlying
+ * credential are still modelled as separate bindings so revoking one does
+ * not implicitly revoke the other.
+ */
+export declare class CredentialProfile {
+    readonly agentDid: string;
+    private readonly _bindings;
+    constructor(agentDid: string, bindings: Record<string, string> | Map<string, string>);
+    /** Return the handle name bound to `actionClass`, or undefined. */
+    capabilityFor(actionClass: string): string | undefined;
+    /** Snapshot of bindings (read-only). */
+    get bindings(): ReadonlyMap<string, string>;
+}
+export interface VaultAuditEvent {
+    readonly timestamp: number;
+    readonly agentDid: string;
+    readonly handleName: string;
+    readonly targetService: string;
+    readonly actionClass: string;
+    readonly decision: CredentialDecision;
+    readonly policyVersion: string;
+    readonly reason: string;
+}
+/** Deterministic deny output returned in place of a rendered payload. */
+export declare class DenyReceipt {
+    readonly reason: string;
+    readonly actionClass: string;
+    readonly targetService: string;
+    constructor(opts?: {
+        actionClass?: string;
+        targetService?: string;
+        reason?: string;
+    });
+    toJSON(): Record<string, string>;
+    equals(other: DenyReceipt): boolean;
+}
+export interface CredentialVaultOptions {
+    /** Optional filesystem path for encrypted persistence. */
+    persistPath?: string;
+    /** AES-256-GCM key (exactly 32 bytes). Required when `persistPath` is set. */
+    encryptionKey?: Uint8Array;
+}
+/**
+ * Encrypted-at-rest credential store and scoped resolver.
+ *
+ * Exposes two surfaces:
+ *
+ * - **Admin** (`put`, `rotate`, `delete`, `listHandles`, `registerProfile`)
+ *   — for operators provisioning credentials.
+ * - **Resolver** (`checkAccess`, `_resolveInternal`) — for the injector.
+ *   Agents are never expected to call these directly.
+ */
+export declare class CredentialVault {
+    private readonly records;
+    private readonly profiles;
+    private readonly _audit;
+    private readonly persistPath;
+    private readonly key;
+    private loaded;
+    constructor(options?: CredentialVaultOptions);
+    /** Generate a fresh AES-256-GCM key (32 random bytes). */
+    static generateKey(): Uint8Array;
+    /** Load persisted records from disk. Idempotent. */
+    load(): Promise<void>;
+    put(name: string, value: string, credType?: string): Promise<CredentialHandle>;
+    rotate(name: string, newValue: string): Promise<CredentialHandle>;
+    delete(name: string): Promise<boolean>;
+    listHandles(): Promise<string[]>;
+    getMetadata(name: string): Promise<Omit<CredentialRecord, 'value'> | null>;
+    registerProfile(profile: CredentialProfile): void;
+    revokeProfile(agentDid: string): boolean;
+    /** True iff `agentDid` may use `handleName` for `actionClass`. */
+    checkAccess(agentDid: string, handleName: string, actionClass: string): boolean;
+    /**
+     * Internal: resolve a credential value and emit an audit event.
+     * Returns `[value, event]`; on deny `value` is null.
+     *
+     * Callers must ensure `value` never crosses the agent trust boundary.
+     * Use {@link CredentialInjector} rather than calling this directly.
+     */
+    _resolveInternal(agentDid: string, handleName: string, actionClass: string, targetService: string, policyVersion: string): [string | null, VaultAuditEvent];
+    /** Immutable snapshot of audit events. */
+    auditLog(): readonly VaultAuditEvent[];
+    clearAudit(): void;
+    _recordReject(event: VaultAuditEvent): void;
+    private flush;
+    private encrypt;
+    private decrypt;
+}
+export interface InjectionContext {
+    readonly agentDid: string;
+    readonly actionClass: string;
+    readonly targetService: string;
+    readonly requestedHandles: readonly string[];
+    readonly policyVersion: string;
+}
+export interface PolicyOutcome {
+    readonly allow: boolean;
+    readonly reason?: string;
+}
+export type PolicyCheck = (ctx: InjectionContext) => PolicyOutcome | Promise<PolicyOutcome>;
+export interface InjectionResult<T> {
+    readonly allowed: boolean;
+    readonly payload: T | DenyReceipt;
+    readonly denyReceipt: DenyReceipt | null;
+    readonly auditEvents: readonly VaultAuditEvent[];
+}
+export interface InjectionOptions {
+    actionClass: string;
+    targetService: string;
+    allowedHandles: Iterable<string>;
+    policyVersion?: string;
+    policyCheck?: PolicyCheck;
+}
+/**
+ * Render `{{cred:NAME}}` placeholders into HTTP, MCP, and env payloads.
+ *
+ * The injector is the *only* component that ever holds resolved credential
+ * values, and only long enough to render an outbound payload.
+ *
+ * For every injection call:
+ *
+ * - `allowedHandles` is the workflow-policy allowlist of handle names
+ *   eligible for substitution on this call. A placeholder whose name is
+ *   not in this set causes the entire call to be denied — this is the
+ *   "MCP server metadata is untrusted" boundary.
+ * - `policyCheck` is invoked *before* any value is read from the vault.
+ * - On any deny, `payload` is a {@link DenyReceipt} (deterministic shape).
+ */
+export declare class CredentialInjector {
+    private readonly vault;
+    constructor(vault: CredentialVault);
+    injectHeaders(agentDid: string, headers: Record<string, string>, opts: InjectionOptions): Promise<InjectionResult<Record<string, string>>>;
+    injectToolArgs<T>(agentDid: string, args: T, opts: InjectionOptions): Promise<InjectionResult<T>>;
+    injectEnv(agentDid: string, env: Record<string, string>, opts: InjectionOptions): Promise<InjectionResult<Record<string, string>>>;
+    private _inject;
+}
+/**
+ * Stable HMAC-SHA256 digest of an audit-event sequence.
+ *
+ * The digest covers handle names and decisions but never resolved
+ * credential values (the vault never stores them in events).
+ */
+export declare function auditDigest(events: readonly VaultAuditEvent[], key: Uint8Array): string;
+//# sourceMappingURL=credential-vault.d.ts.map

package/dist/credential-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-vault.d.ts","sourceRoot":"","sources":["../src/credential-vault.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAcH,wEAAwE;AACxE,eAAO,MAAM,cAAc,QAAiD,CAAC;AAE7E,8EAA8E;AAC9E,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAE/C,kDAAkD;AAClD,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;AAWlD,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM;IAGxB,8DAA8D;IAC9D,WAAW,IAAI,MAAM;IAGrB,QAAQ,IAAI,MAAM;CAGnB;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;gBAE5C,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IASpF,mEAAmE;IACnE,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAItD,wCAAwC;IACxC,IAAI,QAAQ,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAE1C;CACF;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,yEAAyE;AACzE,qBAAa,WAAW;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAKxF,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAOhC,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO;CAOpC;AAQD,MAAM,WAAW,sBAAsB;IACrC,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,UAAU,CAAC;CAC5B;AAED;;;;;;;;;GASG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgB;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,MAAM,CAAS;gBAEX,OAAO,GAAE,sBAA2B;IAchD,0DAA0D;IAC1D,MAAM,CAAC,WAAW,IAAI,UAAU;IAIhC,oDAAoD;IAC9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BrB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,SAAW,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAoBhF,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAiBjE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAStC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKhC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAQhF,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IAIjD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMxC,kEAAkE;IAClE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAQ/E;;;;;;OAMG;IACH,gBAAgB,CACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,MAAM,GACpB,CAAC,MAAM,GAAG,IAAI,EAAE,eAAe,CAAC;IA+BnC,0CAA0C;IAC1C,QAAQ,IAAI,SAAS,eAAe,EAAE;IAItC,UAAU,IAAI,IAAI;IAOlB,aAAa,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;YAM7B,KAAK;IAUnB,OAAO,CAAC,OAAO;IAUf,OAAO,CAAC,OAAO;CAShB;AAMD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,gBAAgB,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5F,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,eAAe;IAE7C,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAI7C,cAAc,CAAC,CAAC,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAIxB,SAAS,CACb,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAIrC,OAAO;CAqFtB;AAsDD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAiBvF"}