@surfinguard/core-engine 0.1.0 → 1.0.0

package/dist/analyzers/git.js

@@ -0,0 +1,126 @@
+/**
+ * Git Analyzer — detects dangerous git operations.
+ *
+ * Detects 6 threat patterns (V01-V06) mapped to 4 risk primitives.
+ * Input: value = git command/operation description, metadata = { branch?, remote?, files? }
+ */
+export class GitAnalyzer {
+    actionType = 'git';
+    forcePushPatterns;
+    mergePatterns;
+    cicdPatterns;
+    releasePatterns;
+    branchDeletePatterns;
+    gitignorePatterns;
+    protectedBranches;
+    safePatterns;
+    constructor(patterns) {
+        this.forcePushPatterns = patterns.forcePushPatterns.map((p) => new RegExp(p, 'i'));
+        this.mergePatterns = patterns.mergePatterns.map((p) => new RegExp(p, 'i'));
+        this.cicdPatterns = patterns.cicdPatterns.map((p) => new RegExp(p, 'i'));
+        this.releasePatterns = patterns.releasePatterns.map((p) => new RegExp(p, 'i'));
+        this.branchDeletePatterns = patterns.branchDeletePatterns.map((p) => new RegExp(p, 'i'));
+        this.gitignorePatterns = patterns.gitignorePatterns.map((p) => new RegExp(p, 'i'));
+        this.protectedBranches = patterns.protectedBranches.map((b) => b.toLowerCase());
+        this.safePatterns = patterns.safePatterns.map((p) => new RegExp(p, 'i'));
+    }
+    analyze(value, metadata) {
+        const cmd = value.trim();
+        if (!cmd) {
+            return {
+                actionType: 'git',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty command' },
+            };
+        }
+        const lower = cmd.toLowerCase();
+        const branch = (metadata?.branch ?? '').toLowerCase();
+        // Safe short-circuit — also check files metadata for CI/CD paths
+        const files = metadata?.files;
+        const hasMetadataDanger = files?.some((f) => this.cicdPatterns.some((p) => p.test(f))) ?? false;
+        if (this.safePatterns.some((p) => p.test(lower)) &&
+            !this.hasDangerousPattern(lower) &&
+            !hasMetadataDanger) {
+            return {
+                actionType: 'git',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Safe git pattern' },
+            };
+        }
+        const findings = [];
+        const add = (primitive, score, reason, threatId) => {
+            findings.push({ primitive, score, reason, threatId });
+        };
+        const targetBranch = branch || this.extractBranchFromValue(lower);
+        const isProtected = this.isProtectedBranch(targetBranch);
+        // ── V01: Force push ──
+        if (this.forcePushPatterns.some((p) => p.test(lower))) {
+            const score = isProtected ? 10 : 8;
+            const reason = isProtected
+                ? `Force push to protected branch '${targetBranch}' — overwrites remote history`
+                : 'Force push — overwrites remote history';
+            add('DESTRUCTION', score, reason, 'V01');
+        }
+        // ── V02: Unreviewed merge to main ──
+        if (this.mergePatterns.some((p) => p.test(lower)) && isProtected) {
+            const score = 9;
+            add('DESTRUCTION', score, `Unreviewed merge to protected branch '${targetBranch}'`, 'V02');
+        }
+        // ── V03: CI/CD pipeline modification ──
+        if (this.cicdPatterns.some((p) => p.test(lower))) {
+            add('PERSISTENCE', 8, 'CI/CD pipeline modification — agent modifying build/deploy configuration', 'V03');
+        }
+        // Also check files metadata for CI/CD paths
+        if (files && !findings.some((f) => f.threatId === 'V03')) {
+            if (files.some((f) => this.cicdPatterns.some((p) => p.test(f)))) {
+                add('PERSISTENCE', 8, 'CI/CD pipeline modification — commit includes pipeline config files', 'V03');
+            }
+        }
+        // ── V04: Unauthorized release ──
+        if (this.releasePatterns.some((p) => p.test(lower))) {
+            add('MANIPULATION', 7, 'Unauthorized release — agent creating tags or publishing packages', 'V04');
+        }
+        // ── V05: Branch deletion ──
+        if (this.branchDeletePatterns.some((p) => p.test(lower))) {
+            const score = isProtected ? 10 : 7;
+            const reason = isProtected
+                ? `Deleting protected branch '${targetBranch}'`
+                : 'Branch deletion — agent deleting git branch';
+            add('DESTRUCTION', score, reason, 'V05');
+        }
+        // ── V06: Gitignore weakening ──
+        if (this.gitignorePatterns.some((p) => p.test(lower))) {
+            add('EXFILTRATION', 7, 'Gitignore weakening — removing or weakening .gitignore rules', 'V06');
+        }
+        return { actionType: 'git', findings };
+    }
+    hasDangerousPattern(text) {
+        return (this.forcePushPatterns.some((p) => p.test(text)) ||
+            this.mergePatterns.some((p) => p.test(text)) ||
+            this.cicdPatterns.some((p) => p.test(text)) ||
+            this.releasePatterns.some((p) => p.test(text)) ||
+            this.branchDeletePatterns.some((p) => p.test(text)) ||
+            this.gitignorePatterns.some((p) => p.test(text)));
+    }
+    isProtectedBranch(branch) {
+        if (!branch)
+            return false;
+        return this.protectedBranches.some((pb) => branch === pb || branch.endsWith(`/${pb}`));
+    }
+    extractBranchFromValue(text) {
+        // Try to extract branch name after push/merge keywords
+        for (const pb of this.protectedBranches) {
+            const patterns = [
+                new RegExp(`(?:push|merge|rebase).*\\b${pb}\\b`, 'i'),
+                new RegExp(`\\bto\\s+${pb}\\b`, 'i'),
+                new RegExp(`\\b${pb}\\b`, 'i'),
+            ];
+            for (const p of patterns) {
+                if (p.test(text))
+                    return pb;
+            }
+        }
+        return '';
+    }
+}
+//# sourceMappingURL=git.js.map

package/dist/analyzers/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/analyzers/git.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACb,UAAU,GAAG,KAAc,CAAC;IAEpB,iBAAiB,CAAW;IAC5B,aAAa,CAAW;IACxB,YAAY,CAAW;IACvB,eAAe,CAAW;IAC1B,oBAAoB,CAAW;IAC/B,iBAAiB,CAAW;IAC5B,iBAAiB,CAAW;IAC5B,YAAY,CAAW;IAExC,YAAY,QAA4B;QACtC,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,oBAAoB,GAAG,QAAQ,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,QAAkC;QACvD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE;aACtD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,CAAE,QAAQ,EAAE,MAAiB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAElE,iEAAiE;QACjE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAA6B,CAAC;QACtD,MAAM,iBAAiB,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;QAChG,IACE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5C,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAChC,CAAC,iBAAiB,EAClB,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACzD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,IAAI,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAEzD,wBAAwB;QACxB,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,WAAW;gBACxB,CAAC,CAAC,mCAAmC,YAAY,+BAA+B;gBAChF,CAAC,CAAC,wCAAwC,CAAC;YAC7C,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,sCAAsC;QACtC,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,yCAAyC,YAAY,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7F,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CACD,aAAa,EACb,CAAC,EACD,0EAA0E,EAC1E,KAAK,CACN,CAAC;QACJ,CAAC;QACD,4CAA4C;QAC5C,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,CAAC;YACzD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CACD,aAAa,EACb,CAAC,EACD,qEAAqE,EACrE,KAAK,CACN,CAAC;YACJ,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CACD,cAAc,EACd,CAAC,EACD,mEAAmE,EACnE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,6BAA6B;QAC7B,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,WAAW;gBACxB,CAAC,CAAC,8BAA8B,YAAY,GAAG;gBAC/C,CAAC,CAAC,6CAA6C,CAAC;YAClD,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,8DAA8D,EAAE,KAAK,CAAC,CAAC;QAChG,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAEO,mBAAmB,CAAC,IAAY;QACtC,OAAO,CACL,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC;IAEO,iBAAiB,CAAC,MAAc;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;IAEO,sBAAsB,CAAC,IAAY;QACzC,uDAAuD;QACvD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG;gBACf,IAAI,MAAM,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,CAAC;gBACrD,IAAI,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC;gBACpC,IAAI,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC;aAC/B,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;CACF"}

package/dist/analyzers/index.d.ts

@@ -4,4 +4,7 @@ export { CommandAnalyzer } from './command.js';
 export { TextAnalyzer } from './text.js';
 export { FileReadAnalyzer } from './file-read.js';
 export { FileWriteAnalyzer } from './file-write.js';
+export { ApiCallAnalyzer } from './api-call.js';
+export { QueryAnalyzer } from './query.js';
+export { CodeAnalyzer } from './code.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/analyzers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}

package/dist/analyzers/index.js

@@ -3,4 +3,7 @@ export { CommandAnalyzer } from './command.js';
 export { TextAnalyzer } from './text.js';
 export { FileReadAnalyzer } from './file-read.js';
 export { FileWriteAnalyzer } from './file-write.js';
+export { ApiCallAnalyzer } from './api-call.js';
+export { QueryAnalyzer } from './query.js';
+export { CodeAnalyzer } from './code.js';
 //# sourceMappingURL=index.js.map

package/dist/analyzers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC"}

package/dist/analyzers/infra.d.ts

@@ -0,0 +1,30 @@
+import type { InfraPatternDatabase } from '@surfinguard/types';
+import type { Analyzer, AnalyzerResult } from './base.js';
+/**
+ * Infrastructure Analyzer — detects dangerous cloud/container operations.
+ *
+ * Detects 12 threat patterns (I01-I06, CL01-CL06) mapped to 4 risk primitives.
+ * Input: value = infrastructure command/action, metadata = { provider?, environment?, resource? }
+ */
+export declare class InfraAnalyzer implements Analyzer {
+    readonly actionType: "infra";
+    private readonly containerEscapePatterns;
+    private readonly iacModificationPatterns;
+    private readonly firewallPatterns;
+    private readonly certificatePatterns;
+    private readonly dnsModificationPatterns;
+    private readonly secretStorePatterns;
+    private readonly resourceProvisioningPatterns;
+    private readonly iamPatterns;
+    private readonly securityGroupPatterns;
+    private readonly backupDeletionPatterns;
+    private readonly productionDeployPatterns;
+    private readonly cloudSecretPatterns;
+    private readonly productionEnvironments;
+    private readonly safePatterns;
+    constructor(patterns: InfraPatternDatabase);
+    analyze(value: string, metadata?: Record<string, unknown>): AnalyzerResult;
+    private hasDangerousPattern;
+    private isProductionEnvironment;
+}
+//# sourceMappingURL=infra.d.ts.map

package/dist/analyzers/infra.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra.d.ts","sourceRoot":"","sources":["../../src/analyzers/infra.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;;GAKG;AACH,qBAAa,aAAc,YAAW,QAAQ;IAC5C,QAAQ,CAAC,UAAU,EAAG,OAAO,CAAU;IAEvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAW;IACnD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAW;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;gBAE5B,QAAQ,EAAE,oBAAoB;IAqB1C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc;IAmK1E,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,uBAAuB;CAGhC"}

package/dist/analyzers/infra.js

@@ -0,0 +1,134 @@
+/**
+ * Infrastructure Analyzer — detects dangerous cloud/container operations.
+ *
+ * Detects 12 threat patterns (I01-I06, CL01-CL06) mapped to 4 risk primitives.
+ * Input: value = infrastructure command/action, metadata = { provider?, environment?, resource? }
+ */
+export class InfraAnalyzer {
+    actionType = 'infra';
+    containerEscapePatterns;
+    iacModificationPatterns;
+    firewallPatterns;
+    certificatePatterns;
+    dnsModificationPatterns;
+    secretStorePatterns;
+    resourceProvisioningPatterns;
+    iamPatterns;
+    securityGroupPatterns;
+    backupDeletionPatterns;
+    productionDeployPatterns;
+    cloudSecretPatterns;
+    productionEnvironments;
+    safePatterns;
+    constructor(patterns) {
+        this.containerEscapePatterns = patterns.containerEscapePatterns.map((p) => new RegExp(p, 'i'));
+        this.iacModificationPatterns = patterns.iacModificationPatterns.map((p) => new RegExp(p, 'i'));
+        this.firewallPatterns = patterns.firewallPatterns.map((p) => new RegExp(p, 'i'));
+        this.certificatePatterns = patterns.certificatePatterns.map((p) => new RegExp(p, 'i'));
+        this.dnsModificationPatterns = patterns.dnsModificationPatterns.map((p) => new RegExp(p, 'i'));
+        this.secretStorePatterns = patterns.secretStorePatterns.map((p) => new RegExp(p, 'i'));
+        this.resourceProvisioningPatterns = patterns.resourceProvisioningPatterns.map((p) => new RegExp(p, 'i'));
+        this.iamPatterns = patterns.iamPatterns.map((p) => new RegExp(p, 'i'));
+        this.securityGroupPatterns = patterns.securityGroupPatterns.map((p) => new RegExp(p, 'i'));
+        this.backupDeletionPatterns = patterns.backupDeletionPatterns.map((p) => new RegExp(p, 'i'));
+        this.productionDeployPatterns = patterns.productionDeployPatterns.map((p) => new RegExp(p, 'i'));
+        this.cloudSecretPatterns = patterns.cloudSecretPatterns.map((p) => new RegExp(p, 'i'));
+        this.productionEnvironments = patterns.productionEnvironments.map((e) => e.toLowerCase());
+        this.safePatterns = patterns.safePatterns.map((p) => new RegExp(p, 'i'));
+    }
+    analyze(value, metadata) {
+        const action = value.trim();
+        if (!action) {
+            return {
+                actionType: 'infra',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty action' },
+            };
+        }
+        const lower = action.toLowerCase();
+        const environment = (metadata?.environment ?? '').toLowerCase();
+        // Safe short-circuit — --dry-run and preview override dangerous patterns
+        const isDryRun = /--dry-run|preview/.test(lower);
+        if (isDryRun ||
+            (this.safePatterns.some((p) => p.test(lower)) && !this.hasDangerousPattern(lower))) {
+            return {
+                actionType: 'infra',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Safe infrastructure pattern' },
+            };
+        }
+        const findings = [];
+        const add = (primitive, score, reason, threatId) => {
+            findings.push({ primitive, score, reason, threatId });
+        };
+        const isProduction = this.isProductionEnvironment(environment) || this.isProductionEnvironment(lower);
+        const prodBoost = isProduction ? 2 : 0;
+        // ── I01: Docker escape ──
+        if (this.containerEscapePatterns.some((p) => p.test(lower))) {
+            add('ESCALATION', Math.min(10, 9 + prodBoost), 'Container escape — privileged mode, host mount, or nsenter detected', 'I01');
+        }
+        // ── I02: IaC modification ──
+        if (this.iacModificationPatterns.some((p) => p.test(lower))) {
+            add('DESTRUCTION', Math.min(10, 8 + prodBoost), 'IaC modification — Terraform/K8s/CloudFormation apply or destroy', 'I02');
+        }
+        // ── I03: Firewall rule changes ──
+        if (this.firewallPatterns.some((p) => p.test(lower))) {
+            add('ESCALATION', Math.min(10, 8 + prodBoost), 'Firewall rule changes — modifying network security rules', 'I03');
+        }
+        // ── I04: Certificate manipulation ──
+        if (this.certificatePatterns.some((p) => p.test(lower))) {
+            add('DESTRUCTION', Math.min(10, 8 + prodBoost), 'Certificate manipulation — deleting or replacing TLS certificates', 'I04');
+        }
+        // ── I05: DNS modification ──
+        if (this.dnsModificationPatterns.some((p) => p.test(lower))) {
+            add('MANIPULATION', Math.min(10, 8 + prodBoost), 'DNS modification — changing DNS records to redirect traffic', 'I05');
+        }
+        // ── I06: Secret store access ──
+        if (this.secretStorePatterns.some((p) => p.test(lower))) {
+            add('EXFILTRATION', Math.min(10, 7 + prodBoost), 'Secret store access — reading from Vault or secret managers', 'I06');
+        }
+        // ── CL01: Resource over-provisioning ──
+        if (this.resourceProvisioningPatterns.some((p) => p.test(lower))) {
+            add('DESTRUCTION', Math.min(10, 8 + prodBoost), 'Resource over-provisioning — creating excessive compute resources', 'CL01');
+        }
+        // ── CL02: IAM role modification ──
+        if (this.iamPatterns.some((p) => p.test(lower))) {
+            add('ESCALATION', Math.min(10, 9 + prodBoost), 'IAM role modification — escalating privileges via IAM changes', 'CL02');
+        }
+        // ── CL03: Security group opening ──
+        if (this.securityGroupPatterns.some((p) => p.test(lower))) {
+            add('ESCALATION', Math.min(10, 8 + prodBoost), 'Security group opening — exposing services to 0.0.0.0/0', 'CL03');
+        }
+        // ── CL04: Backup deletion ──
+        if (this.backupDeletionPatterns.some((p) => p.test(lower))) {
+            add('DESTRUCTION', Math.min(10, 9 + prodBoost), 'Backup deletion — removing snapshots or backups', 'CL04');
+        }
+        // ── CL05: Production deployment ──
+        if (this.productionDeployPatterns.some((p) => p.test(lower))) {
+            add('DESTRUCTION', Math.min(10, 7 + prodBoost), 'Production deployment — deploying to production environment', 'CL05');
+        }
+        // ── CL06: Cloud secret access ──
+        if (this.cloudSecretPatterns.some((p) => p.test(lower))) {
+            add('EXFILTRATION', Math.min(10, 7 + prodBoost), 'Cloud secret access — reading from cloud secret management services', 'CL06');
+        }
+        return { actionType: 'infra', findings };
+    }
+    hasDangerousPattern(text) {
+        return (this.containerEscapePatterns.some((p) => p.test(text)) ||
+            this.iacModificationPatterns.some((p) => p.test(text)) ||
+            this.firewallPatterns.some((p) => p.test(text)) ||
+            this.certificatePatterns.some((p) => p.test(text)) ||
+            this.dnsModificationPatterns.some((p) => p.test(text)) ||
+            this.secretStorePatterns.some((p) => p.test(text)) ||
+            this.resourceProvisioningPatterns.some((p) => p.test(text)) ||
+            this.iamPatterns.some((p) => p.test(text)) ||
+            this.securityGroupPatterns.some((p) => p.test(text)) ||
+            this.backupDeletionPatterns.some((p) => p.test(text)) ||
+            this.productionDeployPatterns.some((p) => p.test(text)) ||
+            this.cloudSecretPatterns.some((p) => p.test(text)));
+    }
+    isProductionEnvironment(text) {
+        return this.productionEnvironments.some((env) => text.includes(env));
+    }
+}
+//# sourceMappingURL=infra.js.map

package/dist/analyzers/infra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra.js","sourceRoot":"","sources":["../../src/analyzers/infra.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,aAAa;IACf,UAAU,GAAG,OAAgB,CAAC;IAEtB,uBAAuB,CAAW;IAClC,uBAAuB,CAAW;IAClC,gBAAgB,CAAW;IAC3B,mBAAmB,CAAW;IAC9B,uBAAuB,CAAW;IAClC,mBAAmB,CAAW;IAC9B,4BAA4B,CAAW;IACvC,WAAW,CAAW;IACtB,qBAAqB,CAAW;IAChC,sBAAsB,CAAW;IACjC,wBAAwB,CAAW;IACnC,mBAAmB,CAAW;IAC9B,sBAAsB,CAAW;IACjC,YAAY,CAAW;IAExC,YAAY,QAA8B;QACxC,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/F,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,4BAA4B,GAAG,QAAQ,CAAC,4BAA4B,CAAC,GAAG,CAC3E,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,QAAkC;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE;aACrD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,CAAE,QAAQ,EAAE,WAAsB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAE5E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,IACE,QAAQ;YACR,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,EAClF,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,OAAO;gBACnB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,EAAE;aACpE,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,MAAM,YAAY,GAChB,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEvC,2BAA2B;QAC3B,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CACD,YAAY,EACZ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,qEAAqE,EACrE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CACD,aAAa,EACb,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,kEAAkE,EAClE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CACD,YAAY,EACZ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,0DAA0D,EAC1D,KAAK,CACN,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CACD,aAAa,EACb,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,mEAAmE,EACnE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CACD,cAAc,EACd,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,6DAA6D,EAC7D,KAAK,CACN,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CACD,cAAc,EACd,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,6DAA6D,EAC7D,KAAK,CACN,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CACD,aAAa,EACb,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,mEAAmE,EACnE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CACD,YAAY,EACZ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,+DAA+D,EAC/D,MAAM,CACP,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CACD,YAAY,EACZ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,yDAAyD,EACzD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CACD,aAAa,EACb,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,iDAAiD,EACjD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CACD,aAAa,EACb,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,6DAA6D,EAC7D,MAAM,CACP,CAAC;QACJ,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CACD,cAAc,EACd,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAC3B,qEAAqE,EACrE,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAEO,mBAAmB,CAAC,IAAY;QACtC,OAAO,CACL,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACnD,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAAC,IAAY;QAC1C,OAAO,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/analyzers/iot.d.ts

@@ -0,0 +1,22 @@
+import type { IotPatternDatabase } from '@surfinguard/types';
+import type { Analyzer, AnalyzerResult } from './base.js';
+/**
+ * IoT Analyzer — detects dangerous physical device and IoT operations.
+ *
+ * Detects 4 threat patterns (IOT01-IOT04) mapped to ESCALATION, DESTRUCTION, and MANIPULATION primitives.
+ * Input: value = IoT/physical device command, metadata = { device_type?, device_id?, resource? }
+ */
+export declare class IotAnalyzer implements Analyzer {
+    readonly actionType: "iot";
+    private readonly smartLockPatterns;
+    private readonly industrialControlPatterns;
+    private readonly securityCameraPatterns;
+    private readonly vehicleCommandPatterns;
+    private readonly criticalDeviceTypes;
+    private readonly safePatterns;
+    constructor(patterns: IotPatternDatabase);
+    analyze(value: string, metadata?: Record<string, unknown>): AnalyzerResult;
+    private hasDangerousPattern;
+    private detectCriticalDevice;
+}
+//# sourceMappingURL=iot.d.ts.map

package/dist/analyzers/iot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iot.d.ts","sourceRoot":"","sources":["../../src/analyzers/iot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;;GAKG;AACH,qBAAa,WAAY,YAAW,QAAQ;IAC1C,QAAQ,CAAC,UAAU,EAAG,KAAK,CAAU;IAErC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAW;IAC7C,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAW;IACrD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAW;IAClD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;gBAE5B,QAAQ,EAAE,kBAAkB;IAWxC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc;IA6E1E,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,oBAAoB;CAK7B"}

package/dist/analyzers/iot.js

@@ -0,0 +1,78 @@
+/**
+ * IoT Analyzer — detects dangerous physical device and IoT operations.
+ *
+ * Detects 4 threat patterns (IOT01-IOT04) mapped to ESCALATION, DESTRUCTION, and MANIPULATION primitives.
+ * Input: value = IoT/physical device command, metadata = { device_type?, device_id?, resource? }
+ */
+export class IotAnalyzer {
+    actionType = 'iot';
+    smartLockPatterns;
+    industrialControlPatterns;
+    securityCameraPatterns;
+    vehicleCommandPatterns;
+    criticalDeviceTypes;
+    safePatterns;
+    constructor(patterns) {
+        this.smartLockPatterns = patterns.smartLockPatterns.map((p) => new RegExp(p, 'i'));
+        this.industrialControlPatterns = patterns.industrialControlPatterns.map((p) => new RegExp(p, 'i'));
+        this.securityCameraPatterns = patterns.securityCameraPatterns.map((p) => new RegExp(p, 'i'));
+        this.vehicleCommandPatterns = patterns.vehicleCommandPatterns.map((p) => new RegExp(p, 'i'));
+        this.criticalDeviceTypes = patterns.criticalDeviceTypes.map((t) => t.toLowerCase());
+        this.safePatterns = patterns.safePatterns.map((p) => new RegExp(p, 'i'));
+    }
+    analyze(value, metadata) {
+        const command = value.trim();
+        if (!command) {
+            return {
+                actionType: 'iot',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty command' },
+            };
+        }
+        const lower = command.toLowerCase();
+        // Safe short-circuit
+        if (this.safePatterns.some((p) => p.test(lower)) && !this.hasDangerousPattern(lower)) {
+            return {
+                actionType: 'iot',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Safe IoT pattern' },
+            };
+        }
+        const findings = [];
+        const add = (primitive, score, reason, threatId) => {
+            findings.push({ primitive, score, reason, threatId });
+        };
+        const isCriticalDevice = this.detectCriticalDevice(metadata);
+        const deviceBoost = isCriticalDevice ? 1 : 0;
+        // IOT01: Smart lock manipulation
+        if (this.smartLockPatterns.some((p) => p.test(lower))) {
+            add('ESCALATION', Math.min(10, 9 + deviceBoost), 'Smart lock manipulation — unlocking doors or disabling alarms', 'IOT01');
+        }
+        // IOT02: Industrial control modification
+        if (this.industrialControlPatterns.some((p) => p.test(lower))) {
+            add('DESTRUCTION', Math.min(10, 9 + deviceBoost), 'Industrial control modification — overriding safety or modifying PLC/SCADA', 'IOT02');
+        }
+        // IOT03: Security camera disabling
+        if (this.securityCameraPatterns.some((p) => p.test(lower))) {
+            add('MANIPULATION', Math.min(10, 9), 'Security camera disabling — disabling cameras or stopping surveillance', 'IOT03');
+        }
+        // IOT04: Vehicle command injection
+        if (this.vehicleCommandPatterns.some((p) => p.test(lower))) {
+            add('DESTRUCTION', 10, 'Vehicle command injection — sending CAN bus or OBD commands', 'IOT04');
+        }
+        return { actionType: 'iot', findings };
+    }
+    hasDangerousPattern(text) {
+        return (this.smartLockPatterns.some((p) => p.test(text)) ||
+            this.industrialControlPatterns.some((p) => p.test(text)) ||
+            this.securityCameraPatterns.some((p) => p.test(text)) ||
+            this.vehicleCommandPatterns.some((p) => p.test(text)));
+    }
+    detectCriticalDevice(metadata) {
+        const deviceType = (metadata?.device_type ?? '').toLowerCase();
+        if (!deviceType)
+            return false;
+        return this.criticalDeviceTypes.some((t) => deviceType.includes(t));
+    }
+}
+//# sourceMappingURL=iot.js.map

package/dist/analyzers/iot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iot.js","sourceRoot":"","sources":["../../src/analyzers/iot.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IACb,UAAU,GAAG,KAAc,CAAC;IAEpB,iBAAiB,CAAW;IAC5B,yBAAyB,CAAW;IACpC,sBAAsB,CAAW;IACjC,sBAAsB,CAAW;IACjC,mBAAmB,CAAW;IAC9B,YAAY,CAAW;IAExC,YAAY,QAA4B;QACtC,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC,GAAG,CACrE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,QAAkC;QACvD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE;aACtD,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAEpC,qBAAqB;QACrB,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrF,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACzD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7C,iCAAiC;QACjC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CACD,YAAY,EACZ,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,EAC7B,+DAA+D,EAC/D,OAAO,CACR,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CACD,aAAa,EACb,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,EAC7B,4EAA4E,EAC5E,OAAO,CACR,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CACD,cAAc,EACd,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EACf,wEAAwE,EACxE,OAAO,CACR,CAAC;QACJ,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CACD,aAAa,EACb,EAAE,EACF,6DAA6D,EAC7D,OAAO,CACR,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAEO,mBAAmB,CAAC,IAAY;QACtC,OAAO,CACL,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAEO,oBAAoB,CAAC,QAAkC;QAC7D,MAAM,UAAU,GAAG,CAAE,QAAQ,EAAE,WAAsB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3E,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;CACF"}

package/dist/analyzers/message.d.ts

@@ -0,0 +1,22 @@
+import type { MessagePatternDatabase } from '@surfinguard/types';
+import type { Analyzer, AnalyzerResult } from './base.js';
+/**
+ * Message Analyzer — detects dangerous messaging patterns.
+ *
+ * Detects 6 threat patterns (M01-M06) mapped to 2 risk primitives.
+ * Input: value = message body/content, metadata = { channel?, to?, subject? }
+ */
+export declare class MessageAnalyzer implements Analyzer {
+    readonly actionType: "message";
+    private readonly emailPatterns;
+    private readonly slackPatterns;
+    private readonly smsPatterns;
+    private readonly socialMediaPatterns;
+    private readonly sensitiveContentPatterns;
+    private readonly impersonationPatterns;
+    private readonly safePatterns;
+    constructor(patterns: MessagePatternDatabase);
+    analyze(value: string, metadata?: Record<string, unknown>): AnalyzerResult;
+    private hasSendingPattern;
+}
+//# sourceMappingURL=message.d.ts.map

package/dist/analyzers/message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/analyzers/message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,KAAK,EAAE,QAAQ,EAAmB,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3E;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,QAAQ;IAC9C,QAAQ,CAAC,UAAU,EAAG,SAAS,CAAU;IAEzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAW;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAW;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAW;IAC/C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAW;gBAE5B,QAAQ,EAAE,sBAAsB;IAY5C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc;IAoH1E,OAAO,CAAC,iBAAiB;CAQ1B"}

package/dist/analyzers/message.js

@@ -0,0 +1,106 @@
+/**
+ * Message Analyzer — detects dangerous messaging patterns.
+ *
+ * Detects 6 threat patterns (M01-M06) mapped to 2 risk primitives.
+ * Input: value = message body/content, metadata = { channel?, to?, subject? }
+ */
+export class MessageAnalyzer {
+    actionType = 'message';
+    emailPatterns;
+    slackPatterns;
+    smsPatterns;
+    socialMediaPatterns;
+    sensitiveContentPatterns;
+    impersonationPatterns;
+    safePatterns;
+    constructor(patterns) {
+        this.emailPatterns = patterns.emailPatterns.map((p) => new RegExp(p, 'i'));
+        this.slackPatterns = patterns.slackPatterns.map((p) => new RegExp(p, 'i'));
+        this.smsPatterns = patterns.smsPatterns.map((p) => new RegExp(p, 'i'));
+        this.socialMediaPatterns = patterns.socialMediaPatterns.map((p) => new RegExp(p, 'i'));
+        this.sensitiveContentPatterns = patterns.sensitiveContentPatterns.map((p) => new RegExp(p, 'i'));
+        this.impersonationPatterns = patterns.impersonationPatterns.map((p) => new RegExp(p, 'i'));
+        this.safePatterns = patterns.safePatterns.map((p) => new RegExp(p, 'i'));
+    }
+    analyze(value, metadata) {
+        const body = value.trim();
+        if (!body) {
+            return {
+                actionType: 'message',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Empty message' },
+            };
+        }
+        const channel = (metadata?.channel ?? '').toLowerCase();
+        const to = (metadata?.to ?? '').toLowerCase();
+        const subject = (metadata?.subject ?? '').toLowerCase();
+        const combined = `${body} ${to} ${subject}`.toLowerCase();
+        // Safe short-circuit
+        if (channel === 'log' || channel === 'debug') {
+            return {
+                actionType: 'message',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Log/debug channel' },
+            };
+        }
+        if (this.safePatterns.some((p) => p.test(body)) &&
+            !this.hasSendingPattern(combined) &&
+            !this.impersonationPatterns.some((p) => p.test(combined))) {
+            return {
+                actionType: 'message',
+                findings: [],
+                shortCircuit: { safe: true, reason: 'Safe message pattern' },
+            };
+        }
+        const findings = [];
+        const add = (primitive, score, reason, threatId) => {
+            findings.push({ primitive, score, reason, threatId });
+        };
+        const hasSensitiveContent = this.sensitiveContentPatterns.some((p) => p.test(combined));
+        // ── M01: Unauthorized email sending ──
+        const hasEmailPattern = this.emailPatterns.some((p) => p.test(combined));
+        if (hasEmailPattern || (channel === 'email' && hasSensitiveContent)) {
+            const score = hasSensitiveContent ? 8 : 6;
+            add('EXFILTRATION', score, 'Unauthorized email sending — agent attempting to send email' +
+                (hasSensitiveContent ? ' with sensitive content' : ''), 'M01');
+        }
+        // ── M02: Slack/Teams message leakage ──
+        const hasSlackPattern = this.slackPatterns.some((p) => p.test(combined));
+        if (hasSlackPattern || (channel === 'slack' && hasSensitiveContent)) {
+            const score = hasSensitiveContent ? 8 : 6;
+            add('EXFILTRATION', score, 'Slack/Teams message leakage — agent posting to chat platform' +
+                (hasSensitiveContent ? ' with sensitive content' : ''), 'M02');
+        }
+        // ── M03: SMS/notification abuse ──
+        const hasSmsPattern = this.smsPatterns.some((p) => p.test(combined));
+        if (hasSmsPattern || channel === 'sms') {
+            add('MANIPULATION', 6, 'SMS/notification abuse — agent sending SMS or notifications', 'M03');
+        }
+        // ── M04: Social media posting ──
+        const hasSocialPattern = this.socialMediaPatterns.some((p) => p.test(combined));
+        if (hasSocialPattern || channel === 'social') {
+            add('MANIPULATION', 7, 'Social media posting — agent posting to social media platform', 'M04');
+        }
+        // ── M05: GitHub issue/PR comments ──
+        const hasGithubPattern = /github\.com.*(?:issue|pull|comment)|create.*issue|post.*comment.*github/i.test(combined);
+        if (hasGithubPattern || channel === 'github') {
+            add('MANIPULATION', 5, 'GitHub issue/PR comment — agent posting on GitHub', 'M05');
+        }
+        // ── M06: Impersonation via messaging ──
+        if (this.impersonationPatterns.some((p) => p.test(combined))) {
+            add('MANIPULATION', 9, 'Impersonation via messaging — agent pretending to be another entity', 'M06');
+        }
+        // ── Bonus: sensitive content + any sending pattern ──
+        if (hasSensitiveContent && findings.length > 0 && !hasEmailPattern && !hasSlackPattern) {
+            add('EXFILTRATION', 2, 'Sensitive content detected in outgoing message', 'M01');
+        }
+        return { actionType: 'message', findings };
+    }
+    hasSendingPattern(text) {
+        return (this.emailPatterns.some((p) => p.test(text)) ||
+            this.slackPatterns.some((p) => p.test(text)) ||
+            this.smsPatterns.some((p) => p.test(text)) ||
+            this.socialMediaPatterns.some((p) => p.test(text)));
+    }
+}
+//# sourceMappingURL=message.js.map

package/dist/analyzers/message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.js","sourceRoot":"","sources":["../../src/analyzers/message.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IACjB,UAAU,GAAG,SAAkB,CAAC;IAExB,aAAa,CAAW;IACxB,aAAa,CAAW;IACxB,WAAW,CAAW;IACtB,mBAAmB,CAAW;IAC9B,wBAAwB,CAAW;IACnC,qBAAqB,CAAW;IAChC,YAAY,CAAW;IAExC,YAAY,QAAgC;QAC1C,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,wBAAwB,GAAG,QAAQ,CAAC,wBAAwB,CAAC,GAAG,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAC1B,CAAC;QACF,IAAI,CAAC,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,QAAkC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE;aACtD,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,CAAE,QAAQ,EAAE,OAAkB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,EAAE,GAAG,CAAE,QAAQ,EAAE,EAAa,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,CAAE,QAAQ,EAAE,OAAkB,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;QAE1D,qBAAqB;QACrB,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE;aAC1D,CAAC;QACJ,CAAC;QAED,IACE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACjC,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EACzD,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,EAAE;gBACZ,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAC7D,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,CACV,SAAuC,EACvC,KAAa,EACb,MAAc,EACd,QAAgB,EAChB,EAAE;YACF,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC;QAEF,MAAM,mBAAmB,GAAG,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExF,wCAAwC;QACxC,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,IAAI,eAAe,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,mBAAmB,CAAC,EAAE,CAAC;YACpE,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,GAAG,CACD,cAAc,EACd,KAAK,EACL,6DAA6D;gBAC3D,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC,EACxD,KAAK,CACN,CAAC;QACJ,CAAC;QAED,yCAAyC;QACzC,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,IAAI,eAAe,IAAI,CAAC,OAAO,KAAK,OAAO,IAAI,mBAAmB,CAAC,EAAE,CAAC;YACpE,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,GAAG,CACD,cAAc,EACd,KAAK,EACL,8DAA8D;gBAC5D,CAAC,mBAAmB,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC,EACxD,KAAK,CACN,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,IAAI,aAAa,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACvC,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,6DAA6D,EAAE,KAAK,CAAC,CAAC;QAC/F,CAAC;QAED,kCAAkC;QAClC,MAAM,gBAAgB,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChF,IAAI,gBAAgB,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7C,GAAG,CACD,cAAc,EACd,CAAC,EACD,+DAA+D,EAC/D,KAAK,CACN,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,MAAM,gBAAgB,GACpB,0EAA0E,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5F,IAAI,gBAAgB,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC7C,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,mDAAmD,EAAE,KAAK,CAAC,CAAC;QACrF,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CACD,cAAc,EACd,CAAC,EACD,qEAAqE,EACrE,KAAK,CACN,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IAAI,mBAAmB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,EAAE,CAAC;YACvF,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,gDAAgD,EAAE,KAAK,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAEO,iBAAiB,CAAC,IAAY;QACpC,OAAO,CACL,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACnD,CAAC;IACJ,CAAC;CACF"}