@tracehound/core 1.2.0

package/dist/core/security-state.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Security State - Unified substrate for all security-related state.
+ *
+ * DESIGN PRINCIPLES:
+ * - Immutable snapshots for external consumers
+ * - Event-driven recording (no polling)
+ * - Time-series history for ThreatLedger
+ * - Zero-copy where possible
+ */
+import type { Severity } from '../types/common.js';
+/**
+ * Threat statistics.
+ */
+export interface ThreatStats {
+    total: number;
+    byCategory: Record<string, number>;
+    bySeverity: Record<Severity, number>;
+}
+/**
+ * Quarantine statistics.
+ */
+export interface QuarantineStateStats {
+    count: number;
+    bytes: number;
+    capacityPercent: number;
+}
+/**
+ * Rate limit statistics.
+ */
+export interface RateLimitStats {
+    activeWindows: number;
+    blockedSources: number;
+}
+/**
+ * License state.
+ */
+export interface LicenseState {
+    tier: 'starter' | 'pro' | 'enterprise';
+    status: 'valid' | 'expired' | 'grace' | 'invalid' | 'none';
+    daysRemaining?: number | undefined;
+}
+/**
+ * Complete security snapshot.
+ */
+export interface SecuritySnapshot {
+    /** Snapshot timestamp */
+    timestamp: number;
+    /** System uptime in ms */
+    uptimeMs: number;
+    /** Threat statistics */
+    threats: ThreatStats;
+    /** Quarantine statistics */
+    quarantine: QuarantineStateStats;
+    /** Rate limit statistics */
+    rateLimits: RateLimitStats;
+    /** License state */
+    license: LicenseState;
+    /** System health */
+    health: 'healthy' | 'degraded' | 'critical';
+}
+/**
+ * History entry for time-series tracking.
+ */
+export interface SecurityHistoryEntry {
+    timestamp: number;
+    type: 'threat' | 'evidence' | 'eviction' | 'rate_limit' | 'panic';
+    data: Record<string, unknown>;
+}
+/**
+ * Security State configuration.
+ */
+export interface SecurityStateConfig {
+    /** Maximum history entries to retain */
+    maxHistorySize?: number;
+    /** Quarantine max bytes (for capacity calculation) */
+    quarantineMaxBytes?: number;
+}
+/**
+ * Security State interface.
+ */
+export interface ISecurityState {
+    /**
+     * Get immutable snapshot of current state.
+     */
+    snapshot(): Readonly<SecuritySnapshot>;
+    /**
+     * Record a threat detection.
+     */
+    recordThreat(category: string, severity: Severity): void;
+    /**
+     * Record evidence quarantine.
+     */
+    recordEvidence(signature: string, size: number, severity: Severity): void;
+    /**
+     * Record evidence eviction.
+     */
+    recordEviction(signature: string, reason: 'capacity' | 'policy' | 'manual'): void;
+    /**
+     * Record rate limit event.
+     */
+    recordRateLimit(source: string, blocked: boolean): void;
+    /**
+     * Record system panic.
+     */
+    recordPanic(level: 'warning' | 'critical' | 'fatal', reason: string): void;
+    /**
+     * Update license state.
+     */
+    updateLicense(tier: LicenseState['tier'], status: LicenseState['status'], daysRemaining?: number): void;
+    /**
+     * Update quarantine stats (called by Quarantine).
+     */
+    updateQuarantine(count: number, bytes: number): void;
+    /**
+     * Update rate limit stats (called by RateLimiter).
+     */
+    updateRateLimits(activeWindows: number, blockedSources: number): void;
+    /**
+     * Get history entries (for ThreatLedger).
+     */
+    readonly history: readonly SecurityHistoryEntry[];
+    /**
+     * Get current stats.
+     */
+    readonly stats: SecurityStateStats;
+}
+/**
+ * Security State statistics.
+ */
+export interface SecurityStateStats {
+    historySize: number;
+    oldestEntry: number | null;
+    newestEntry: number | null;
+}
+/**
+ * Security State implementation.
+ */
+export declare class SecurityState implements ISecurityState {
+    private readonly config;
+    private readonly startTime;
+    private _threatTotal;
+    private _threatsByCategory;
+    private _threatsBySeverity;
+    private _quarantineCount;
+    private _quarantineBytes;
+    private _activeWindows;
+    private _blockedSources;
+    private _licenseTier;
+    private _licenseStatus;
+    private _licenseDaysRemaining;
+    private _history;
+    constructor(config?: SecurityStateConfig);
+    snapshot(): Readonly<SecuritySnapshot>;
+    recordThreat(category: string, severity: Severity): void;
+    recordEvidence(signature: string, size: number, severity: Severity): void;
+    recordEviction(signature: string, reason: 'capacity' | 'policy' | 'manual'): void;
+    recordRateLimit(source: string, blocked: boolean): void;
+    recordPanic(level: 'warning' | 'critical' | 'fatal', reason: string): void;
+    updateLicense(tier: LicenseState['tier'], status: LicenseState['status'], daysRemaining?: number): void;
+    updateQuarantine(count: number, bytes: number): void;
+    updateRateLimits(activeWindows: number, blockedSources: number): void;
+    get history(): readonly SecurityHistoryEntry[];
+    get stats(): SecurityStateStats;
+    private addHistory;
+}
+/**
+ * Create a Security State instance.
+ */
+export declare function createSecurityState(config?: SecurityStateConfig): ISecurityState;
+//# sourceMappingURL=security-state.d.ts.map

package/dist/core/security-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-state.d.ts","sourceRoot":"","sources":["../../src/core/security-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAMlD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,SAAS,GAAG,KAAK,GAAG,YAAY,CAAA;IACtC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IAC1D,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,wBAAwB;IACxB,OAAO,EAAE,WAAW,CAAA;IACpB,4BAA4B;IAC5B,UAAU,EAAE,oBAAoB,CAAA;IAChC,4BAA4B;IAC5B,UAAU,EAAE,cAAc,CAAA;IAC1B,oBAAoB;IACpB,OAAO,EAAE,YAAY,CAAA;IACrB,oBAAoB;IACpB,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAA;IACjE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAEtC;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAExD;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IAEzE;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,IAAI,CAAA;IAEjF;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;IAEvD;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAE1E;;OAEG;IACH,aAAa,CACX,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAC1B,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAC9B,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI,CAAA;IAEP;;OAEG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpD;;OAEG;IACH,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAErE;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;IAEjD;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAQD;;GAEG;AACH,qBAAa,aAAc,YAAW,cAAc;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;IAGvC,OAAO,CAAC,YAAY,CAAI;IACxB,OAAO,CAAC,kBAAkB,CAA4B;IACtD,OAAO,CAAC,kBAAkB,CAA8B;IAGxD,OAAO,CAAC,gBAAgB,CAAI;IAC5B,OAAO,CAAC,gBAAgB,CAAI;IAG5B,OAAO,CAAC,cAAc,CAAI;IAC1B,OAAO,CAAC,eAAe,CAAI;IAG3B,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,cAAc,CAAiC;IACvD,OAAO,CAAC,qBAAqB,CAAgC;IAG7D,OAAO,CAAC,QAAQ,CAA6B;gBAEjC,MAAM,GAAE,mBAAwB;IAO5C,QAAQ,IAAI,QAAQ,CAAC,gBAAgB,CAAC;IAsDtC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAQxD,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI;IAIzE,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,IAAI;IAIjF,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI;IAOvD,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAI1E,aAAa,CACX,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,EAC1B,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAC9B,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI;IAMP,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAKpD,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAKrE,IAAI,OAAO,IAAI,SAAS,oBAAoB,EAAE,CAE7C;IAED,IAAI,KAAK,IAAI,kBAAkB,CAO9B;IAID,OAAO,CAAC,UAAU;CAYnB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,mBAAwB,GAAG,cAAc,CAEpF"}

package/dist/core/security-state.js

@@ -0,0 +1,156 @@
+/**
+ * Security State - Unified substrate for all security-related state.
+ *
+ * DESIGN PRINCIPLES:
+ * - Immutable snapshots for external consumers
+ * - Event-driven recording (no polling)
+ * - Time-series history for ThreatLedger
+ * - Zero-copy where possible
+ */
+// ─────────────────────────────────────────────────────────────────────────────
+// Implementation
+// ─────────────────────────────────────────────────────────────────────────────
+const DEFAULT_MAX_HISTORY = 10_000;
+/**
+ * Security State implementation.
+ */
+export class SecurityState {
+    config;
+    startTime = Date.now();
+    // Threat tracking
+    _threatTotal = 0;
+    _threatsByCategory = new Map();
+    _threatsBySeverity = new Map();
+    // Quarantine tracking
+    _quarantineCount = 0;
+    _quarantineBytes = 0;
+    // Rate limit tracking
+    _activeWindows = 0;
+    _blockedSources = 0;
+    // License tracking
+    _licenseTier = 'starter';
+    _licenseStatus = 'none';
+    _licenseDaysRemaining = undefined;
+    // History
+    _history = [];
+    constructor(config = {}) {
+        this.config = {
+            maxHistorySize: config.maxHistorySize ?? DEFAULT_MAX_HISTORY,
+            quarantineMaxBytes: config.quarantineMaxBytes ?? 100_000_000,
+        };
+    }
+    snapshot() {
+        const now = Date.now();
+        const bySeverity = {
+            low: this._threatsBySeverity.get('low') ?? 0,
+            medium: this._threatsBySeverity.get('medium') ?? 0,
+            high: this._threatsBySeverity.get('high') ?? 0,
+            critical: this._threatsBySeverity.get('critical') ?? 0,
+        };
+        const byCategory = {};
+        for (const [cat, count] of this._threatsByCategory) {
+            byCategory[cat] = count;
+        }
+        const capacityPercent = this.config.quarantineMaxBytes > 0
+            ? (this._quarantineBytes / this.config.quarantineMaxBytes) * 100
+            : 0;
+        // Determine health
+        let health = 'healthy';
+        if (capacityPercent > 90 || this._licenseStatus === 'expired') {
+            health = 'critical';
+        }
+        else if (capacityPercent > 70 || this._licenseStatus === 'grace') {
+            health = 'degraded';
+        }
+        return Object.freeze({
+            timestamp: now,
+            uptimeMs: now - this.startTime,
+            threats: {
+                total: this._threatTotal,
+                byCategory,
+                bySeverity,
+            },
+            quarantine: {
+                count: this._quarantineCount,
+                bytes: this._quarantineBytes,
+                capacityPercent,
+            },
+            rateLimits: {
+                activeWindows: this._activeWindows,
+                blockedSources: this._blockedSources,
+            },
+            license: {
+                tier: this._licenseTier,
+                status: this._licenseStatus,
+                daysRemaining: this._licenseDaysRemaining,
+            },
+            health,
+        });
+    }
+    recordThreat(category, severity) {
+        this._threatTotal++;
+        this._threatsByCategory.set(category, (this._threatsByCategory.get(category) ?? 0) + 1);
+        this._threatsBySeverity.set(severity, (this._threatsBySeverity.get(severity) ?? 0) + 1);
+        this.addHistory('threat', { category, severity });
+    }
+    recordEvidence(signature, size, severity) {
+        this.addHistory('evidence', { signature, size, severity });
+    }
+    recordEviction(signature, reason) {
+        this.addHistory('eviction', { signature, reason });
+    }
+    recordRateLimit(source, blocked) {
+        if (blocked) {
+            this._blockedSources++;
+        }
+        this.addHistory('rate_limit', { source, blocked });
+    }
+    recordPanic(level, reason) {
+        this.addHistory('panic', { level, reason });
+    }
+    updateLicense(tier, status, daysRemaining) {
+        this._licenseTier = tier;
+        this._licenseStatus = status;
+        this._licenseDaysRemaining = daysRemaining;
+    }
+    updateQuarantine(count, bytes) {
+        this._quarantineCount = count;
+        this._quarantineBytes = bytes;
+    }
+    updateRateLimits(activeWindows, blockedSources) {
+        this._activeWindows = activeWindows;
+        this._blockedSources = blockedSources;
+    }
+    get history() {
+        return this._history;
+    }
+    get stats() {
+        return {
+            historySize: this._history.length,
+            oldestEntry: this._history.length > 0 ? this._history[0].timestamp : null,
+            newestEntry: this._history.length > 0 ? this._history[this._history.length - 1].timestamp : null,
+        };
+    }
+    // ─── Private Methods ─────────────────────────────────────────────────────────
+    addHistory(type, data) {
+        this._history.push({
+            timestamp: Date.now(),
+            type,
+            data,
+        });
+        // Prune if exceeds max
+        if (this._history.length > this.config.maxHistorySize) {
+            this._history.shift();
+        }
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Factory
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Create a Security State instance.
+ */
+export function createSecurityState(config = {}) {
+    return new SecurityState(config);
+}
+//# sourceMappingURL=security-state.js.map

package/dist/core/security-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-state.js","sourceRoot":"","sources":["../../src/core/security-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2JH,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAElC;;GAEG;AACH,MAAM,OAAO,aAAa;IACP,MAAM,CAA+B;IACrC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAEvC,kBAAkB;IACV,YAAY,GAAG,CAAC,CAAA;IAChB,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC9C,kBAAkB,GAAG,IAAI,GAAG,EAAoB,CAAA;IAExD,sBAAsB;IACd,gBAAgB,GAAG,CAAC,CAAA;IACpB,gBAAgB,GAAG,CAAC,CAAA;IAE5B,sBAAsB;IACd,cAAc,GAAG,CAAC,CAAA;IAClB,eAAe,GAAG,CAAC,CAAA;IAE3B,mBAAmB;IACX,YAAY,GAAyB,SAAS,CAAA;IAC9C,cAAc,GAA2B,MAAM,CAAA;IAC/C,qBAAqB,GAAuB,SAAS,CAAA;IAE7D,UAAU;IACF,QAAQ,GAA2B,EAAE,CAAA;IAE7C,YAAY,SAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG;YACZ,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,mBAAmB;YAC5D,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,IAAI,WAAW;SAC7D,CAAA;IACH,CAAC;IAED,QAAQ;QACN,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,MAAM,UAAU,GAA6B;YAC3C,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClD,IAAI,EAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAC9C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;SACvD,CAAA;QAED,MAAM,UAAU,GAA2B,EAAE,CAAA;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACnD,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACzB,CAAC;QAED,MAAM,eAAe,GACnB,IAAI,CAAC,MAAM,CAAC,kBAAkB,GAAG,CAAC;YAChC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,GAAG,GAAG;YAChE,CAAC,CAAC,CAAC,CAAA;QAEP,mBAAmB;QACnB,IAAI,MAAM,GAA+B,SAAS,CAAA;QAClD,IAAI,eAAe,GAAG,EAAE,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC9D,MAAM,GAAG,UAAU,CAAA;QACrB,CAAC;aAAM,IAAI,eAAe,GAAG,EAAE,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YACnE,MAAM,GAAG,UAAU,CAAA;QACrB,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,SAAS,EAAE,GAAG;YACd,QAAQ,EAAE,GAAG,GAAG,IAAI,CAAC,SAAS;YAC9B,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,UAAU;gBACV,UAAU;aACX;YACD,UAAU,EAAE;gBACV,KAAK,EAAE,IAAI,CAAC,gBAAgB;gBAC5B,KAAK,EAAE,IAAI,CAAC,gBAAgB;gBAC5B,eAAe;aAChB;YACD,UAAU,EAAE;gBACV,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,cAAc,EAAE,IAAI,CAAC,eAAe;aACrC;YACD,OAAO,EAAE;gBACP,IAAI,EAAE,IAAI,CAAC,YAAY;gBACvB,MAAM,EAAE,IAAI,CAAC,cAAc;gBAC3B,aAAa,EAAE,IAAI,CAAC,qBAAqB;aAC1C;YACD,MAAM;SACP,CAAC,CAAA;IACJ,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,QAAkB;QAC/C,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACvF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAEvF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnD,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,IAAY,EAAE,QAAkB;QAChE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAwC;QACxE,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,eAAe,CAAC,MAAc,EAAE,OAAgB;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,eAAe,EAAE,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,WAAW,CAAC,KAAuC,EAAE,MAAc;QACjE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,aAAa,CACX,IAA0B,EAC1B,MAA8B,EAC9B,aAAsB;QAEtB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QACxB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAA;QAC5B,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAA;IAC5C,CAAC;IAED,gBAAgB,CAAC,KAAa,EAAE,KAAa;QAC3C,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAA;QAC7B,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAA;IAC/B,CAAC;IAED,gBAAgB,CAAC,aAAqB,EAAE,cAAsB;QAC5D,IAAI,CAAC,cAAc,GAAG,aAAa,CAAA;QACnC,IAAI,CAAC,eAAe,GAAG,cAAc,CAAA;IACvC,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,IAAI,KAAK;QACP,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;YACjC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;YAC1E,WAAW,EACT,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;SACvF,CAAA;IACH,CAAC;IAED,gFAAgF;IAExE,UAAU,CAAC,IAAkC,EAAE,IAA6B;QAClF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,IAAI;YACJ,IAAI;SACL,CAAC,CAAA;QAEF,uBAAuB;QACvB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACvB,CAAC;IACH,CAAC;CACF;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAA8B,EAAE;IAClE,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC"}

package/dist/core/tier-capacity.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Tier-Aware Capacity Configuration
+ *
+ * Maps license tiers to HoundPool capacity constraints.
+ * This enforces the pricing model's capacity-gating strategy.
+ *
+ * INVARIANT: Security features are identical across all tiers.
+ * Only capacity (poolSize, memory, timeout) varies.
+ */
+import type { HoundPoolConfig, PoolExhaustedAction } from './hound-pool.js';
+import type { LicenseTier } from './license-manager.js';
+/**
+ * Capacity limits per tier.
+ */
+export interface TierCapacityLimits {
+    /** Max concurrent processes */
+    poolSize: number;
+    /** Max memory per process in MB */
+    maxMemoryMB: number;
+    /** Process timeout in ms */
+    timeoutMs: number;
+    /** Action when pool exhausted */
+    onPoolExhausted: PoolExhaustedAction;
+    /** Defer queue limit */
+    deferQueueLimit: number;
+}
+/**
+ * Tier capacity definitions.
+ *
+ * | Tier       | Processes | Memory | Timeout |
+ * |------------|-----------|--------|---------|
+ * | Starter    | 1         | 64MB   | 5s      |
+ * | Pro        | 8         | 512MB  | 30s     |
+ * | Enterprise | 32        | 2048MB | 60s     |
+ */
+export declare const TIER_CAPACITY_LIMITS: Record<LicenseTier, TierCapacityLimits>;
+/**
+ * Create tier-aware HoundPool configuration.
+ *
+ * @param tier - License tier
+ * @param overrides - Optional overrides (Enterprise can customize)
+ * @returns HoundPool configuration
+ *
+ * @example
+ * ```ts
+ * const config = createTierAwarePoolConfig('pro')
+ * const pool = createHoundPool(config)
+ * ```
+ */
+export declare function createTierAwarePoolConfig(tier: LicenseTier, overrides?: Partial<HoundPoolConfig>): HoundPoolConfig;
+/**
+ * Get capacity limits for a tier (read-only).
+ *
+ * @param tier - License tier
+ * @returns Capacity limits
+ */
+export declare function getTierCapacityLimits(tier: LicenseTier): Readonly<TierCapacityLimits>;
+//# sourceMappingURL=tier-capacity.d.ts.map

package/dist/core/tier-capacity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier-capacity.d.ts","sourceRoot":"","sources":["../../src/core/tier-capacity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAOvD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,iCAAiC;IACjC,eAAe,EAAE,mBAAmB,CAAA;IACpC,wBAAwB;IACxB,eAAe,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,kBAAkB,CAsB/D,CAAA;AAMV;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GACnC,eAAe,CAyBjB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAErF"}

package/dist/core/tier-capacity.js

@@ -0,0 +1,89 @@
+/**
+ * Tier-Aware Capacity Configuration
+ *
+ * Maps license tiers to HoundPool capacity constraints.
+ * This enforces the pricing model's capacity-gating strategy.
+ *
+ * INVARIANT: Security features are identical across all tiers.
+ * Only capacity (poolSize, memory, timeout) varies.
+ */
+/**
+ * Tier capacity definitions.
+ *
+ * | Tier       | Processes | Memory | Timeout |
+ * |------------|-----------|--------|---------|
+ * | Starter    | 1         | 64MB   | 5s      |
+ * | Pro        | 8         | 512MB  | 30s     |
+ * | Enterprise | 32        | 2048MB | 60s     |
+ */
+export const TIER_CAPACITY_LIMITS = {
+    starter: {
+        poolSize: 1,
+        maxMemoryMB: 64,
+        timeoutMs: 5_000,
+        onPoolExhausted: 'drop',
+        deferQueueLimit: 10,
+    },
+    pro: {
+        poolSize: 8,
+        maxMemoryMB: 512,
+        timeoutMs: 30_000,
+        onPoolExhausted: 'defer',
+        deferQueueLimit: 100,
+    },
+    enterprise: {
+        poolSize: 32,
+        maxMemoryMB: 2048,
+        timeoutMs: 60_000,
+        onPoolExhausted: 'defer',
+        deferQueueLimit: 1000,
+    },
+};
+// ─────────────────────────────────────────────────────────────────────────────
+// Factory
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Create tier-aware HoundPool configuration.
+ *
+ * @param tier - License tier
+ * @param overrides - Optional overrides (Enterprise can customize)
+ * @returns HoundPool configuration
+ *
+ * @example
+ * ```ts
+ * const config = createTierAwarePoolConfig('pro')
+ * const pool = createHoundPool(config)
+ * ```
+ */
+export function createTierAwarePoolConfig(tier, overrides) {
+    const limits = TIER_CAPACITY_LIMITS[tier];
+    const processConstraints = {
+        maxMemoryMB: limits.maxMemoryMB,
+        networkAccess: false,
+        fileSystemWrite: false,
+        childSpawn: false,
+    };
+    const baseConfig = {
+        poolSize: limits.poolSize,
+        timeout: limits.timeoutMs,
+        rotationJitterMs: 1000,
+        onPoolExhausted: limits.onPoolExhausted,
+        deferQueueLimit: limits.deferQueueLimit,
+        processConstraints,
+    };
+    // Enterprise tier can override
+    if (tier === 'enterprise' && overrides) {
+        return { ...baseConfig, ...overrides };
+    }
+    return baseConfig;
+}
+/**
+ * Get capacity limits for a tier (read-only).
+ *
+ * @param tier - License tier
+ * @returns Capacity limits
+ */
+export function getTierCapacityLimits(tier) {
+    return TIER_CAPACITY_LIMITS[tier];
+}
+//# sourceMappingURL=tier-capacity.js.map

package/dist/core/tier-capacity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tier-capacity.js","sourceRoot":"","sources":["../../src/core/tier-capacity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0BH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAA4C;IAC3E,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,KAAK;QAChB,eAAe,EAAE,MAAM;QACvB,eAAe,EAAE,EAAE;KACpB;IACD,GAAG,EAAE;QACH,QAAQ,EAAE,CAAC;QACX,WAAW,EAAE,GAAG;QAChB,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,OAAO;QACxB,eAAe,EAAE,GAAG;KACrB;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,MAAM;QACjB,eAAe,EAAE,OAAO;QACxB,eAAe,EAAE,IAAI;KACtB;CACO,CAAA;AAEV,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,IAAiB,EACjB,SAAoC;IAEpC,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAEzC,MAAM,kBAAkB,GAAqC;QAC3D,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,KAAK;QACpB,eAAe,EAAE,KAAK;QACtB,UAAU,EAAE,KAAK;KAClB,CAAA;IAED,MAAM,UAAU,GAAoB;QAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,SAAS;QACzB,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,kBAAkB;KACnB,CAAA;IAED,+BAA+B;IAC/B,IAAI,IAAI,KAAK,YAAY,IAAI,SAAS,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAA;IACxC,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAiB;IACrD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAA;AACnC,CAAC"}

package/dist/core/tracehound.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Tracehound - Global factory and runtime instance.
+ *
+ * Provides a single entry point for initializing Tracehound.
+ */
+import { type IAgent } from './agent.js';
+import { AuditChain } from './audit-chain.js';
+import { type HoundPoolConfig, type IHoundPool } from './hound-pool.js';
+import { type INotificationEmitter } from './notification-emitter.js';
+import { Quarantine } from './quarantine.js';
+import { type IRateLimiter } from './rate-limiter.js';
+import { type IWatcher } from './watcher.js';
+/**
+ * Tracehound initialization options.
+ */
+export interface TracehoundOptions {
+    /**
+     * Maximum payload size in bytes.
+     * @default 1_000_000
+     */
+    maxPayloadSize?: number;
+    /**
+     * Quarantine configuration.
+     */
+    quarantine?: {
+        maxCount?: number;
+        maxBytes?: number;
+    };
+    /**
+     * Rate limiter configuration.
+     */
+    rateLimit?: {
+        windowMs?: number;
+        maxRequests?: number;
+        blockDurationMs?: number;
+    };
+    /**
+     * Watcher configuration.
+     */
+    watcher?: {
+        maxAlertsPerWindow?: number;
+        alertWindowMs?: number;
+        quarantineHighWatermark?: number;
+    };
+    /**
+     * Hound pool configuration.
+     */
+    houndPool?: Partial<HoundPoolConfig>;
+}
+/**
+ * Tracehound runtime instance.
+ */
+export interface ITracehound {
+    /** The Agent for intercepting requests */
+    readonly agent: IAgent;
+    /** The Quarantine storage */
+    readonly quarantine: Quarantine;
+    /** The Rate Limiter */
+    readonly rateLimiter: IRateLimiter;
+    /** The Watcher for observability */
+    readonly watcher: IWatcher;
+    /** The Audit Chain */
+    readonly auditChain: AuditChain;
+    /** The Notification Emitter */
+    readonly notifications: INotificationEmitter;
+    /** The Hound Pool */
+    readonly houndPool: IHoundPool;
+}
+/**
+ * Create a Tracehound instance.
+ *
+ * @example
+ * ```typescript
+ * import { createTracehound } from '@tracehound/core'
+ *
+ * const tracehound = createTracehound()
+ *
+ * // Use agent
+ * const result = tracehound.agent.intercept(scent)
+ * ```
+ *
+ * @param options - Initialization options
+ */
+export declare function createTracehound(options?: TracehoundOptions): ITracehound;
+//# sourceMappingURL=tracehound.d.ts.map

package/dist/core/tracehound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracehound.d.ts","sourceRoot":"","sources":["../../src/core/tracehound.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAe,KAAK,MAAM,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAmB,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACxF,OAAO,EAA6B,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACxE,OAAO,EAAiB,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAA;AAM3D;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IAEvB;;OAEG;IACH,UAAU,CAAC,EAAE;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;IAED;;OAEG;IACH,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,eAAe,CAAC,EAAE,MAAM,CAAA;KACzB,CAAA;IAED;;OAEG;IACH,OAAO,CAAC,EAAE;QACR,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,aAAa,CAAC,EAAE,MAAM,CAAA;QACtB,uBAAuB,CAAC,EAAE,MAAM,CAAA;KACjC,CAAA;IAED;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,uBAAuB;IACvB,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAA;IAClC,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;IAC1B,sBAAsB;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,+BAA+B;IAC/B,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAA;IAC5C,qBAAqB;IACrB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;CAC/B;AAgFD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,iBAAsB,GAAG,WAAW,CAE7E"}

package/dist/core/tracehound.js

@@ -0,0 +1,90 @@
+/**
+ * Tracehound - Global factory and runtime instance.
+ *
+ * Provides a single entry point for initializing Tracehound.
+ */
+import { createAgent } from './agent.js';
+import { AuditChain } from './audit-chain.js';
+import { EvidenceFactory } from './evidence-factory.js';
+import { createHoundPool } from './hound-pool.js';
+import { createNotificationEmitter } from './notification-emitter.js';
+import { Quarantine } from './quarantine.js';
+import { createRateLimiter } from './rate-limiter.js';
+import { createWatcher } from './watcher.js';
+// ─────────────────────────────────────────────────────────────────────────────
+// Implementation
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Default HoundPool configuration.
+ */
+const DEFAULT_POOL_CONFIG = {
+    poolSize: 4,
+    timeout: 30_000,
+    rotationJitterMs: 1000,
+    onPoolExhausted: 'defer',
+    deferQueueLimit: 100,
+};
+/**
+ * Tracehound runtime implementation.
+ */
+class Tracehound {
+    agent;
+    quarantine;
+    rateLimiter;
+    watcher;
+    auditChain;
+    notifications;
+    houndPool;
+    evidenceFactory;
+    constructor(options = {}) {
+        // Initialize components
+        this.auditChain = new AuditChain();
+        this.notifications = createNotificationEmitter();
+        this.quarantine = new Quarantine({
+            maxCount: options.quarantine?.maxCount ?? 10_000,
+            maxBytes: options.quarantine?.maxBytes ?? 100_000_000,
+            evictionPolicy: 'priority',
+        }, this.auditChain);
+        this.rateLimiter = createRateLimiter({
+            windowMs: options.rateLimit?.windowMs ?? 60_000,
+            maxRequests: options.rateLimit?.maxRequests ?? 100,
+            blockDurationMs: options.rateLimit?.blockDurationMs ?? 300_000,
+        });
+        this.watcher = createWatcher({
+            maxAlertsPerWindow: options.watcher?.maxAlertsPerWindow ?? 10,
+            alertWindowMs: options.watcher?.alertWindowMs ?? 60_000,
+            quarantineHighWatermark: options.watcher?.quarantineHighWatermark ?? 0.8,
+        });
+        this.evidenceFactory = new EvidenceFactory();
+        // Create agent
+        this.agent = createAgent({ maxPayloadSize: options.maxPayloadSize ?? 1_000_000 }, this.quarantine, this.rateLimiter, this.evidenceFactory);
+        // Create HoundPool
+        const poolConfig = {
+            ...DEFAULT_POOL_CONFIG,
+            ...options.houndPool,
+        };
+        this.houndPool = createHoundPool(poolConfig);
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// Factory
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * Create a Tracehound instance.
+ *
+ * @example
+ * ```typescript
+ * import { createTracehound } from '@tracehound/core'
+ *
+ * const tracehound = createTracehound()
+ *
+ * // Use agent
+ * const result = tracehound.agent.intercept(scent)
+ * ```
+ *
+ * @param options - Initialization options
+ */
+export function createTracehound(options = {}) {
+    return new Tracehound(options);
+}
+//# sourceMappingURL=tracehound.js.map