@vauban-org/agent-sdk 0.16.0

package/dist/runs/subscribe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscribe.js","sourceRoot":"","sources":["../../src/runs/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAuBH,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,eAAe,GAAG,KAAK,CAAC;AAE9B;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,SAAS,GAA8B,IAAI,CAAC;IAChD,IAAI,OAA2B,CAAC;IAChC,IAAI,QAA4B,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAuB,CAAC;QACjE,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEtD,IAAI,IAA4B,CAAC;IACjC,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA2B,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAkB,EAClB,IAA2B,EAC3B,cAA6C,EAC7C,WAAwB;IAExB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,IAAI,CAAC;QACH,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YAC5B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,OAAO,WAAW,CAAC;YAE7B,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAElD,gDAAgD;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,2DAA2D;YAC3D,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAC5B,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBAErB,kCAAkC;gBAClC,IAAI,KAAK,CAAC,EAAE;oBAAE,cAAc,CAAC,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC;gBAE9C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,eAAe,CAAC;oBACrB,KAAK,UAAU,CAAC,CAAC,CAAC;wBAChB,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;4BACtF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;wBACjD,CAAC;wBACD,MAAM;oBACR,CAAC;oBACD,KAAK,cAAc,CAAC,CAAC,CAAC;wBACpB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;4BACpB,MAAM,CAAC,GAAG,KAAK,CAAC,IAA4D,CAAC;4BAC7E,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;wBAC9C,CAAC;wBACD,OAAO,UAAU,CAAC;oBACpB,CAAC;oBACD,KAAK,OAAO,CAAC,CAAC,CAAC;wBACb,MAAM,CAAC,GAAG,KAAK,CAAC,IAAqC,CAAC;wBACtD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;4BACjB,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,cAAc,CAAC,CAAC,CAAC;wBACtD,CAAC;wBACD,MAAM;oBACR,CAAC;oBACD,KAAK,MAAM;wBACT,gCAAgC;wBAChC,MAAM;oBACR;wBACE,yDAAyD;wBACzD,MAAM;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACzB,uDAAuD;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,IAA2B;IAE3B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,sDAAsD;IACtD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM;QAC9B,CAAC,CAAC,WAAW,CAAC,GAAG;YACf,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC,GAAG,EAAE;gBACJ,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzD,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC9D,OAAO,EAAE,CAAC,MAAM,CAAC;YACnB,CAAC,CAAC,EAAE;QACR,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;IAEtB,MAAM,cAAc,GAAkC;QACpD,KAAK,EAAE,IAAI,CAAC,WAAW;KACxB,CAAC;IAEF,2DAA2D;IAC3D,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,OAAO,GAAG,CAAC,CAAC;QAEhB,OAAO,CAAC,YAAY,CAAC,OAAO,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,KAAK,SAAS,CAAC;YAE1E,MAAM,OAAO,GAA2B;gBACtC,MAAM,EAAE,mBAAmB;gBAC3B,eAAe,EAAE,UAAU;aAC5B,CAAC;YAEF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;gBAC/C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBACpE,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,eAAe,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC;YAClD,CAAC;YAED,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBAC1B,MAAM,EAAE,KAAK;oBACb,OAAO;oBACP,MAAM,EAAE,YAAY;iBACrB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,YAAY,CAAC,OAAO;oBAAE,MAAM;gBAChC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpE,wBAAwB;gBACxB,OAAO,EAAE,CAAC;gBACV,IAAI,OAAO,GAAG,WAAW;oBAAE,MAAM;gBACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;oBACxE,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;wBAC1C,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpB,OAAO,EAAE,CAAC;oBACZ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC7E,MAAM;YACR,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;gBACnF,IAAI,OAAO,KAAK,UAAU,IAAI,YAAY,CAAC,OAAO;oBAAE,MAAM;gBAC1D,qCAAqC;gBACrC,OAAO,EAAE,CAAC;gBACV,IAAI,OAAO,GAAG,WAAW;oBAAE,MAAM;gBACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;oBACxE,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;wBAC1C,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpB,OAAO,EAAE,CAAC;oBACZ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,YAAY,CAAC,OAAO;oBAAE,MAAM;gBAChC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpE,OAAO,EAAE,CAAC;gBACV,IAAI,OAAO,GAAG,WAAW;oBAAE,MAAM;gBACjC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;oBACxE,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;wBAC1C,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpB,OAAO,EAAE,CAAC;oBACZ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO;QACL,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE;KAChC,CAAC;AACJ,CAAC"}

package/dist/runs/types.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Runs module types — @vauban-org/agent-sdk v0.5.3 (sprint-523 Bloc 3).
+ *
+ * Mirrors:
+ *   - src/routes/run-stream.ts  (RunStepStreamEventName, RunStepStreamEvent)
+ *   - src/routes/agent-health.ts (AgentHealth, Anomaly, CircuitBreakerSnapshot)
+ *
+ * Intentionally kept free of server-side dependencies.
+ */
+import type { RunStep } from "../proof/types.js";
+export type { RunStep };
+export type RunStreamEventName = "step_existing" | "step_new" | "run_complete" | "ping" | "error";
+export interface RunStreamEvent {
+    name: RunStreamEventName;
+    id?: string;
+    data: RunStep | {
+        status: string;
+        duration_ms?: number;
+    } | {
+        error: string;
+    } | undefined;
+}
+export interface AgentHealth {
+    agent_id: string;
+    window: "24h" | "7d" | "30d";
+    uptime_pct: number;
+    error_rate: number;
+    p50_latency_ms: number;
+    p99_latency_ms: number;
+    run_count: number;
+    last_run_at: string | null;
+    last_status: string | null;
+}
+export interface Anomaly {
+    agent_id: string;
+    cost_dimension: string;
+    run_id: string | null;
+    observed: number;
+    baseline_mean: number;
+    baseline_stddev: number;
+    z_score: number;
+    severity: "low" | "medium" | "high";
+    detected_at: string;
+}
+export interface CircuitBreakerSnapshot {
+    provider: string;
+    state: "closed" | "open" | "half-open";
+    failure_count: number;
+    last_failure: string | null;
+    last_success: string | null;
+    reset_after_ms: number | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/runs/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/runs/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEjD,YAAY,EAAE,OAAO,EAAE,CAAC;AAExB,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,UAAU,GACV,cAAc,GACd,MAAM,GACN,OAAO,CAAC;AAEZ,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EACA,OAAO,GACP;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GACxC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GACjB,SAAS,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACpC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B"}

package/dist/runs/types.js

@@ -0,0 +1,11 @@
+/**
+ * Runs module types — @vauban-org/agent-sdk v0.5.3 (sprint-523 Bloc 3).
+ *
+ * Mirrors:
+ *   - src/routes/run-stream.ts  (RunStepStreamEventName, RunStepStreamEvent)
+ *   - src/routes/agent-health.ts (AgentHealth, Anomaly, CircuitBreakerSnapshot)
+ *
+ * Intentionally kept free of server-side dependencies.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/runs/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/runs/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}

package/dist/safety/immune.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Immune detection — cosine similarity-based threat detection.
+ *
+ * Sprint-564: C3 — MAAG immune system (simplified: no voyage-4/pgvector in core).
+ *
+ * Cosine similarity engine for detecting known attack patterns.
+ * StressLedger is STORED ISOLATED — NEVER via BrainPort (P4 security).
+ * voyage-4 + pgvector integration deferred to external infra (Brain API).
+ *
+ * Golden fixtures: known attacker corpus with expected cosine thresholds.
+ */
+export interface ImmuneMemoryEntry {
+    /** Embedding vector of the detected pattern. */
+    embedding: number[];
+    /** Human-readable label. */
+    label: string;
+    /** Proof hash for L3 anchoring (Vauban Proof Stack). */
+    proofHash?: string;
+    /** When this entry was recorded. */
+    timestamp: number;
+}
+export interface ImmuneMatch {
+    entry: ImmuneMemoryEntry;
+    similarity: number;
+    threshold: number;
+}
+/**
+ * Cosine similarity between two vectors. Returns 0-1.
+ */
+export declare function cosineSimilarity(a: number[], b: number[]): number;
+/**
+ * StressLedger — ISOLATED store for immune memory entries.
+ * NEVER stored via BrainPort (P4 security: attack patterns must not
+ * be queryable or modifiable through the knowledge graph).
+ */
+export declare class StressLedger {
+    private entries;
+    /** Record an immune memory entry. Returns the entry with proof hash. */
+    record(embedding: number[], label: string): ImmuneMemoryEntry;
+    /** Find all entries above a cosine similarity threshold. */
+    search(embedding: number[], threshold?: number): ImmuneMatch[];
+    /** Number of stored entries. */
+    get size(): number;
+    /** Export all entries (for snapshot testing). */
+    export(): ImmuneMemoryEntry[];
+    /** Clear all entries. */
+    clear(): void;
+}
+export declare const GOLDEN_ATTACK_EMBEDDINGS: ReadonlyArray<{
+    label: string;
+    embedding: number[];
+}>;
+/** Run golden fixture validation. Returns false if any fixture fails detection. */
+export declare function validateGoldenFixtures(ledger: StressLedger): {
+    passed: boolean;
+    results: Array<{
+        label: string;
+        matched: boolean;
+        similarity: number;
+    }>;
+};
+//# sourceMappingURL=immune.d.ts.map

package/dist/safety/immune.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"immune.d.ts","sourceRoot":"","sources":["../../src/safety/immune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAgBjE;AAED;;;;GAIG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAA2B;IAE1C,wEAAwE;IACxE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,iBAAiB;IAU7D,4DAA4D;IAC5D,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,SAAO,GAAG,WAAW,EAAE;IAW5D,gCAAgC;IAChC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,iDAAiD;IACjD,MAAM,IAAI,iBAAiB,EAAE;IAI7B,yBAAyB;IACzB,KAAK,IAAI,IAAI;CAGd;AAID,eAAO,MAAM,wBAAwB,EAAE,aAAa,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAaA,CAAC;AAEF,mFAAmF;AACnF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG;IAC5D,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzE,CAuBA"}

package/dist/safety/immune.js

@@ -0,0 +1,109 @@
+/**
+ * Immune detection — cosine similarity-based threat detection.
+ *
+ * Sprint-564: C3 — MAAG immune system (simplified: no voyage-4/pgvector in core).
+ *
+ * Cosine similarity engine for detecting known attack patterns.
+ * StressLedger is STORED ISOLATED — NEVER via BrainPort (P4 security).
+ * voyage-4 + pgvector integration deferred to external infra (Brain API).
+ *
+ * Golden fixtures: known attacker corpus with expected cosine thresholds.
+ */
+/**
+ * Cosine similarity between two vectors. Returns 0-1.
+ */
+export function cosineSimilarity(a, b) {
+    if (a.length !== b.length)
+        return 0;
+    let dotProduct = 0;
+    let normA = 0;
+    let normB = 0;
+    for (let i = 0; i < a.length; i++) {
+        dotProduct += a[i] * b[i];
+        normA += a[i] * a[i];
+        normB += b[i] * b[i];
+    }
+    const denominator = Math.sqrt(normA) * Math.sqrt(normB);
+    if (denominator === 0)
+        return 0;
+    return dotProduct / denominator;
+}
+/**
+ * StressLedger — ISOLATED store for immune memory entries.
+ * NEVER stored via BrainPort (P4 security: attack patterns must not
+ * be queryable or modifiable through the knowledge graph).
+ */
+export class StressLedger {
+    entries = [];
+    /** Record an immune memory entry. Returns the entry with proof hash. */
+    record(embedding, label) {
+        const entry = {
+            embedding,
+            label,
+            timestamp: Date.now(),
+        };
+        this.entries.push(entry);
+        return entry;
+    }
+    /** Find all entries above a cosine similarity threshold. */
+    search(embedding, threshold = 0.92) {
+        const matches = [];
+        for (const entry of this.entries) {
+            const similarity = cosineSimilarity(embedding, entry.embedding);
+            if (similarity >= threshold) {
+                matches.push({ entry, similarity, threshold });
+            }
+        }
+        return matches.sort((a, b) => b.similarity - a.similarity);
+    }
+    /** Number of stored entries. */
+    get size() {
+        return this.entries.length;
+    }
+    /** Export all entries (for snapshot testing). */
+    export() {
+        return [...this.entries];
+    }
+    /** Clear all entries. */
+    clear() {
+        this.entries = [];
+    }
+}
+// ─── Golden fixtures — known attacker corpus ─────────────────────────────────
+export const GOLDEN_ATTACK_EMBEDDINGS = [
+    {
+        label: "prompt_injection_ignore",
+        embedding: [0.8, 0.6, 0.1, 0.2, 0.9, 0.1, 0.05, 0.3],
+    },
+    {
+        label: "data_exfiltration_attempt",
+        embedding: [0.1, 0.9, 0.8, 0.7, 0.1, 0.2, 0.9, 0.1],
+    },
+    {
+        label: "role_escalation",
+        embedding: [0.7, 0.1, 0.9, 0.1, 0.8, 0.6, 0.1, 0.2],
+    },
+];
+/** Run golden fixture validation. Returns false if any fixture fails detection. */
+export function validateGoldenFixtures(ledger) {
+    const results = [];
+    // Record golden fixtures
+    for (const fixture of GOLDEN_ATTACK_EMBEDDINGS) {
+        ledger.record(fixture.embedding, fixture.label);
+    }
+    // Test each fixture against the ledger
+    for (const fixture of GOLDEN_ATTACK_EMBEDDINGS) {
+        const matches = ledger.search(fixture.embedding, 0.92);
+        const selfMatch = matches.find((m) => m.entry.label === fixture.label);
+        results.push({
+            label: fixture.label,
+            matched: !!selfMatch,
+            similarity: selfMatch?.similarity ?? 0,
+        });
+    }
+    return {
+        passed: results.every((r) => r.matched),
+        results,
+    };
+}
+//# sourceMappingURL=immune.js.map

package/dist/safety/immune.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"immune.js","sourceRoot":"","sources":["../../src/safety/immune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAmBH;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAW,EAAE,CAAW;IACvD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAEpC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACvB,KAAK,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,WAAW,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAChC,OAAO,UAAU,GAAG,WAAW,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACf,OAAO,GAAwB,EAAE,CAAC;IAE1C,wEAAwE;IACxE,MAAM,CAAC,SAAmB,EAAE,KAAa;QACvC,MAAM,KAAK,GAAsB;YAC/B,SAAS;YACT,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,4DAA4D;IAC5D,MAAM,CAAC,SAAmB,EAAE,SAAS,GAAG,IAAI;QAC1C,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED,gCAAgC;IAChC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,CAAC;IAED,iDAAiD;IACjD,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,yBAAyB;IACzB,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACpB,CAAC;CACF;AAED,gFAAgF;AAEhF,MAAM,CAAC,MAAM,wBAAwB,GAGhC;IACH;QACE,KAAK,EAAE,yBAAyB;QAChC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC;KACrD;IACD;QACE,KAAK,EAAE,2BAA2B;QAClC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;KACpD;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;KACpD;CACF,CAAC;AAEF,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CAAC,MAAoB;IAIzD,MAAM,OAAO,GAAmE,EAAE,CAAC;IAEnF,yBAAyB;IACzB,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IAED,uCAAuC;IACvC,KAAK,MAAM,OAAO,IAAI,wBAAwB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC;YACX,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,CAAC,CAAC,SAAS;YACpB,UAAU,EAAE,SAAS,EAAE,UAAU,IAAI,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACvC,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/safety/index.d.ts

@@ -0,0 +1,3 @@
+export { sanitizeExternalInput, keepSafeOnly, DEFAULT_INSTRUCTION_PATTERNS, } from "./sanitize.js";
+export type { SanitizeConfig, SanitizedItem } from "./sanitize.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/safety/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/safety/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/safety/index.js

@@ -0,0 +1,2 @@
+export { sanitizeExternalInput, keepSafeOnly, DEFAULT_INSTRUCTION_PATTERNS, } from "./sanitize.js";
+//# sourceMappingURL=index.js.map

package/dist/safety/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/safety/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,YAAY,EACZ,4BAA4B,GAC7B,MAAM,eAAe,CAAC"}

package/dist/safety/sanitize.d.ts

@@ -0,0 +1,71 @@
+/**
+ * sanitize — Guards the LLM context against the Lethal Trifecta (Simon Willison).
+ * MUST be called before ANY externally-scraped content (Reddit post, tweet,
+ * Discord msg, web page, competitor blog) is injected into an LLM prompt or
+ * tool result.
+ *
+ * Defense layers:
+ *   Layer 1 — content length cap: 500 chars max per item (hard truncation
+ *             with "…" suffix). Protects context budget + limits injection surface.
+ *   Layer 2 — instruction marker regex: detects the most common jailbreak
+ *             patterns. If match → SKIP the item entirely (NOT sanitize; log
+ *             + discard). False positives are acceptable; missed injections are not.
+ *   Layer 3 (future) — embedding-based adversarial classifier.
+ *
+ * IMPORTANT: E2B sandbox protects execution; it does NOT protect LLM context.
+ * This sanitizer is the ONLY guard before content reaches the LLM prompt.
+ */
+export interface SanitizeConfig {
+    /** Maximum characters per item (Unicode code points, not bytes). Default: 500. */
+    maxContentChars?: number;
+    /** Regex list; a match on any pattern causes the item to be skipped. */
+    instructionMarkerPatterns?: RegExp[];
+    /** If true, log skipped items via console.warn with a structured payload. Default: true. */
+    logSkips?: boolean;
+}
+export interface SanitizedItem<T> {
+    /** True if the item survived sanitization (possibly truncated); false if discarded. */
+    kept: boolean;
+    /** Original item (with content possibly truncated in the `.content` field). */
+    item: T;
+    /** Reason the item was dropped (undefined if kept). */
+    reason?: string;
+}
+/**
+ * Default instruction marker patterns. These target the most common LLM
+ * jailbreak vectors observed in 2024-2026:
+ *   - Direct instruction overrides ("ignore previous instructions")
+ *   - Role impersonation ("SYSTEM:", "ASSISTANT:")
+ *   - Tool-call smuggling via fake XML/markdown tags
+ *   - ChatML control tokens ("<|system|>")
+ *   - Anthropic-style Human:/Assistant: markers smuggled via \n\n escapes
+ *   - DAN / jailbreak prompt injections
+ *
+ * Precision is deliberately tuned toward false-positives-acceptable. A
+ * false negative here means a prompt injection succeeds — catastrophic.
+ * A false positive means a benign Reddit post is dropped — recoverable.
+ */
+export declare const DEFAULT_INSTRUCTION_PATTERNS: RegExp[];
+/**
+ * Sanitize a batch of externally-scraped items before LLM ingestion.
+ *
+ * Contract:
+ *   - Throws TypeError if an item's `.content` field is not a string.
+ *   - Never mutates input items; returns new objects with truncated content.
+ *   - Returns one SanitizedItem per input (1:1 mapping, order preserved).
+ *
+ * @param items  Array of objects with a `.content: string` field.
+ * @param opts   Optional config override.
+ */
+export declare function sanitizeExternalInput<T extends {
+    content: string;
+}>(items: T[], opts?: SanitizeConfig): SanitizedItem<T>[];
+/**
+ * Convenience: run `sanitizeExternalInput` and return only the kept items,
+ * already content-truncated. Shape-preserving — the returned array contains
+ * the same T type as the input, with content possibly shortened.
+ */
+export declare function keepSafeOnly<T extends {
+    content: string;
+}>(items: T[], opts?: SanitizeConfig): T[];
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/safety/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/safety/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAC;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,uFAAuF;IACvF,IAAI,EAAE,OAAO,CAAC;IACd,+EAA+E;IAC/E,IAAI,EAAE,CAAC,CAAC;IACR,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,EAAE,MAAM,EAqBhD,CAAC;AA6CF;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EACjE,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,cAAc,GACpB,aAAa,CAAC,CAAC,CAAC,EAAE,CAsCpB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,EACxD,KAAK,EAAE,CAAC,EAAE,EACV,IAAI,CAAC,EAAE,cAAc,GACpB,CAAC,EAAE,CAIL"}

package/dist/safety/sanitize.js

@@ -0,0 +1,139 @@
+/**
+ * sanitize — Guards the LLM context against the Lethal Trifecta (Simon Willison).
+ * MUST be called before ANY externally-scraped content (Reddit post, tweet,
+ * Discord msg, web page, competitor blog) is injected into an LLM prompt or
+ * tool result.
+ *
+ * Defense layers:
+ *   Layer 1 — content length cap: 500 chars max per item (hard truncation
+ *             with "…" suffix). Protects context budget + limits injection surface.
+ *   Layer 2 — instruction marker regex: detects the most common jailbreak
+ *             patterns. If match → SKIP the item entirely (NOT sanitize; log
+ *             + discard). False positives are acceptable; missed injections are not.
+ *   Layer 3 (future) — embedding-based adversarial classifier.
+ *
+ * IMPORTANT: E2B sandbox protects execution; it does NOT protect LLM context.
+ * This sanitizer is the ONLY guard before content reaches the LLM prompt.
+ */
+/**
+ * Default instruction marker patterns. These target the most common LLM
+ * jailbreak vectors observed in 2024-2026:
+ *   - Direct instruction overrides ("ignore previous instructions")
+ *   - Role impersonation ("SYSTEM:", "ASSISTANT:")
+ *   - Tool-call smuggling via fake XML/markdown tags
+ *   - ChatML control tokens ("<|system|>")
+ *   - Anthropic-style Human:/Assistant: markers smuggled via \n\n escapes
+ *   - DAN / jailbreak prompt injections
+ *
+ * Precision is deliberately tuned toward false-positives-acceptable. A
+ * false negative here means a prompt injection succeeds — catastrophic.
+ * A false positive means a benign Reddit post is dropped — recoverable.
+ */
+export const DEFAULT_INSTRUCTION_PATTERNS = [
+    // Direct instruction override (requires both IGNORE + INSTRUCTIONS/PROMPTS)
+    /\b(IGNORE\s+(PREVIOUS|ALL|PRIOR)\s+(INSTRUCTIONS?|PROMPTS?))\b/i,
+    // Override + role verb (SYSTEM/ASSISTANT/INSTRUCTION)
+    /\bOVERRIDE\b.*\b(SYSTEM|ASSISTANT|INSTRUCTION)/i,
+    // Role marker injection at start-of-line or after punctuation
+    /\b(SYSTEM|ASSISTANT)\s*:/i,
+    // XML-style tool_call smuggling (open or close tag)
+    /<\/?\s*tool_call\s*>/i,
+    // <instructions> fake tag
+    /<\/?\s*instructions?\s*>/i,
+    // Explicit jailbreak terminology
+    /\bJAILBREAK\b/i,
+    // DAN prompt variants (DAN + mode/prompt)
+    /\bDAN\b.*\b(mode|prompt)/i,
+    // ChatML control tokens (<|user|>, <|system|>, <|im_start|>, …)
+    /<\|[a-zA-Z_]+\|>/,
+    // Anthropic-style marker injection via explicit \n\n (or doubly-escaped
+    // \\n\\n when smuggled inside a JSON string). Covers both serialization
+    // layers — attackers may inject at either.
+    /(?:\\\\|\\)n(?:\\\\|\\)n\s*(?:Human|Assistant)\s*:/,
+];
+const DEFAULT_MAX_CONTENT_CHARS = 500;
+function logSkip(payload) {
+    // Structured warn: downstream observers (pino, OTel) can scrape this.
+    // We intentionally avoid dynamic imports of pino here — the sanitizer
+    // must be importable from any context (worker, edge, test).
+    console.warn(JSON.stringify(payload));
+}
+/**
+ * Truncate a string to `maxChars` Unicode code points, appending "…" when
+ * truncation occurs. Uses `Array.from` to split on code points so
+ * surrogate pairs (emoji, CJK extended) are never cut mid-pair.
+ */
+function truncateByCodePoints(content, maxChars) {
+    if (maxChars <= 0)
+        return "";
+    const codePoints = Array.from(content);
+    if (codePoints.length <= maxChars)
+        return content;
+    return `${codePoints.slice(0, maxChars).join("")}…`;
+}
+/**
+ * First pattern that matches the content (or null). Returned for logging
+ * so ops can tune regex sensitivity.
+ */
+function findMatchingPattern(content, patterns) {
+    for (const pattern of patterns) {
+        if (pattern.test(content))
+            return pattern;
+    }
+    return null;
+}
+/**
+ * Sanitize a batch of externally-scraped items before LLM ingestion.
+ *
+ * Contract:
+ *   - Throws TypeError if an item's `.content` field is not a string.
+ *   - Never mutates input items; returns new objects with truncated content.
+ *   - Returns one SanitizedItem per input (1:1 mapping, order preserved).
+ *
+ * @param items  Array of objects with a `.content: string` field.
+ * @param opts   Optional config override.
+ */
+export function sanitizeExternalInput(items, opts) {
+    const maxChars = opts?.maxContentChars ?? DEFAULT_MAX_CONTENT_CHARS;
+    const patterns = opts?.instructionMarkerPatterns ?? DEFAULT_INSTRUCTION_PATTERNS;
+    const shouldLog = opts?.logSkips ?? true;
+    return items.map((item) => {
+        if (typeof item.content !== "string") {
+            // Fail loud: a non-string content field is a contract violation by the
+            // caller. Silently coercing would hide a bug.
+            throw new TypeError(`sanitizeExternalInput: item.content must be a string, got ${typeof item.content}`);
+        }
+        // Layer 2 first — if an injection marker is found, we DROP the item
+        // rather than truncate-and-hope. A truncated jailbreak is still a
+        // jailbreak.
+        const hit = findMatchingPattern(item.content, patterns);
+        if (hit !== null) {
+            const reason = `instruction_marker_match:${hit.source}`;
+            if (shouldLog) {
+                logSkip({
+                    event: "sanitize.skip",
+                    reason,
+                    pattern: hit.source,
+                    preview: item.content.slice(0, 80),
+                });
+            }
+            return { kept: false, item, reason };
+        }
+        // Layer 1 — truncate by code points (not bytes) to avoid mangling
+        // UTF-8 multi-byte sequences.
+        const truncated = truncateByCodePoints(item.content, maxChars);
+        const sanitizedItem = { ...item, content: truncated };
+        return { kept: true, item: sanitizedItem };
+    });
+}
+/**
+ * Convenience: run `sanitizeExternalInput` and return only the kept items,
+ * already content-truncated. Shape-preserving — the returned array contains
+ * the same T type as the input, with content possibly shortened.
+ */
+export function keepSafeOnly(items, opts) {
+    return sanitizeExternalInput(items, opts)
+        .filter((r) => r.kept)
+        .map((r) => r.item);
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/safety/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/safety/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAoBH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAa;IACpD,4EAA4E;IAC5E,iEAAiE;IACjE,sDAAsD;IACtD,iDAAiD;IACjD,8DAA8D;IAC9D,2BAA2B;IAC3B,oDAAoD;IACpD,uBAAuB;IACvB,0BAA0B;IAC1B,2BAA2B;IAC3B,iCAAiC;IACjC,gBAAgB;IAChB,0CAA0C;IAC1C,2BAA2B;IAC3B,gEAAgE;IAChE,kBAAkB;IAClB,wEAAwE;IACxE,wEAAwE;IACxE,2CAA2C;IAC3C,oDAAoD;CACrD,CAAC;AAEF,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAUtC,SAAS,OAAO,CAAC,OAAuB;IACtC,sEAAsE;IACtE,sEAAsE;IACtE,4DAA4D;IAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAe,EAAE,QAAgB;IAC7D,IAAI,QAAQ,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,OAAe,EACf,QAAkB;IAElB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAU,EACV,IAAqB;IAErB,MAAM,QAAQ,GAAG,IAAI,EAAE,eAAe,IAAI,yBAAyB,CAAC;IACpE,MAAM,QAAQ,GACZ,IAAI,EAAE,yBAAyB,IAAI,4BAA4B,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;IAEzC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACrC,uEAAuE;YACvE,8CAA8C;YAC9C,MAAM,IAAI,SAAS,CACjB,6DAA6D,OAAO,IAAI,CAAC,OAAO,EAAE,CACnF,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,aAAa;QACb,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,GAAG,CAAC,MAAM,EAAE,CAAC;YACxD,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC;oBACN,KAAK,EAAE,eAAe;oBACtB,MAAM;oBACN,OAAO,EAAE,GAAG,CAAC,MAAM;oBACnB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;QAED,kEAAkE;QAClE,8BAA8B;QAC9B,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACzD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAU,EACV,IAAqB;IAErB,OAAO,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/sdk-permission-mapping.d.ts

@@ -0,0 +1,41 @@
+/**
+ * sdk-permission-mapping — pure projections from `cc:*` scope + Biscuit
+ * tool list onto the SDK's runtime permission envelope.
+ *
+ * Two surfaces:
+ *  - `scopeToSdkPermissions(scope)` mirrors the JWT-only path used in
+ *    `mapScopesToSdkPermissions` but takes a SINGLE scope value (handier
+ *    for code paths that already know the resolved scope).
+ *  - `capabilityToSdkPermissions(scope, tools)` returns the INTERSECTION
+ *    of the static scope projection and the agent's dynamic Biscuit tool
+ *    allowlist. Tools that don't grant MCP capability remove `mcp:*`
+ *    permissions; an empty tool list strips MCP entirely regardless of
+ *    scope.
+ *
+ * Both functions are PURE (no IO, no globals). The empty-tools case is
+ * called out explicitly so a misconfigured agent token cannot quietly
+ * inherit the scope's full surface.
+ */
+export type CcScope = "cc:read" | "cc:execute" | "cc:admin";
+export type FileIoMode = "off" | "read-only" | "sandboxed-tmp";
+export type BashMode = "off" | "restricted";
+/**
+ * Permission envelope produced by this module. Distinct from the
+ * `SdkPermissions` shape in `permissions/sdk-permissions.ts`: that one is
+ * tightly coupled to the SDK loop, this one is a stable shape for hosts
+ * computing intersections (no readonly arrays — caller may freeze).
+ */
+export interface SdkPermissions {
+    bash: BashMode;
+    fileIo: FileIoMode;
+    mcp: string[];
+}
+/** Project a single `cc:*` scope onto SdkPermissions. Pure. */
+export declare function scopeToSdkPermissions(scope: CcScope): SdkPermissions;
+/**
+ * Compute the INTERSECTION of `scopeToSdkPermissions(scope)` and the
+ * agent's tool allowlist. Tools that don't unlock MCP scopes do not
+ * grant MCP. An empty tool list strips MCP entirely.
+ */
+export declare function capabilityToSdkPermissions(scope: CcScope, tools: readonly string[]): SdkPermissions;
+//# sourceMappingURL=sdk-permission-mapping.d.ts.map

package/dist/sdk-permission-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-permission-mapping.d.ts","sourceRoot":"","sources":["../src/sdk-permission-mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,UAAU,CAAC;AAE5D,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,WAAW,GAAG,eAAe,CAAC;AAC/D,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAoBD,+DAA+D;AAC/D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CASpE;AAwBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,cAAc,CAsBhB"}

package/dist/sdk-permission-mapping.js

@@ -0,0 +1,96 @@
+/**
+ * sdk-permission-mapping — pure projections from `cc:*` scope + Biscuit
+ * tool list onto the SDK's runtime permission envelope.
+ *
+ * Two surfaces:
+ *  - `scopeToSdkPermissions(scope)` mirrors the JWT-only path used in
+ *    `mapScopesToSdkPermissions` but takes a SINGLE scope value (handier
+ *    for code paths that already know the resolved scope).
+ *  - `capabilityToSdkPermissions(scope, tools)` returns the INTERSECTION
+ *    of the static scope projection and the agent's dynamic Biscuit tool
+ *    allowlist. Tools that don't grant MCP capability remove `mcp:*`
+ *    permissions; an empty tool list strips MCP entirely regardless of
+ *    scope.
+ *
+ * Both functions are PURE (no IO, no globals). The empty-tools case is
+ * called out explicitly so a misconfigured agent token cannot quietly
+ * inherit the scope's full surface.
+ */
+const READ_PERMS = {
+    bash: "off",
+    fileIo: "read-only",
+    mcp: ["brain:read", "citadel:read"],
+};
+const EXECUTE_PERMS = {
+    bash: "restricted",
+    fileIo: "sandboxed-tmp",
+    mcp: ["brain:write", "citadel:write"],
+};
+const ADMIN_PERMS = {
+    bash: "restricted",
+    fileIo: "sandboxed-tmp",
+    mcp: ["brain:write", "citadel:write", "brain:admin", "citadel:admin"],
+};
+/** Project a single `cc:*` scope onto SdkPermissions. Pure. */
+export function scopeToSdkPermissions(scope) {
+    switch (scope) {
+        case "cc:read":
+            return clone(READ_PERMS);
+        case "cc:execute":
+            return clone(EXECUTE_PERMS);
+        case "cc:admin":
+            return clone(ADMIN_PERMS);
+    }
+}
+/**
+ * Map a Biscuit tool name to an MCP sub-scope. The mapping is conservative:
+ * unknown tools grant NO MCP scope. Hosts may extend this map by
+ * passing tools that match a known prefix (e.g. `brain:*`, `citadel:*`).
+ */
+function toolToMcpScope(tool) {
+    if (tool === "brainQuery" || tool === "queryKnowledge")
+        return "brain:read";
+    if (tool === "brainArchive" || tool === "archiveKnowledge")
+        return "brain:write";
+    if (tool === "citadelRead")
+        return "citadel:read";
+    if (tool === "citadelWrite" || tool === "createTask")
+        return "citadel:write";
+    // Pre-namespaced (e.g. "brain:read") → identity if the prefix is known.
+    if (tool.startsWith("brain:") ||
+        tool.startsWith("citadel:") ||
+        tool.startsWith("starknet:")) {
+        return tool;
+    }
+    return null;
+}
+/**
+ * Compute the INTERSECTION of `scopeToSdkPermissions(scope)` and the
+ * agent's tool allowlist. Tools that don't unlock MCP scopes do not
+ * grant MCP. An empty tool list strips MCP entirely.
+ */
+export function capabilityToSdkPermissions(scope, tools) {
+    const base = scopeToSdkPermissions(scope);
+    // Empty tools → no MCP, regardless of scope.
+    if (tools.length === 0) {
+        return { ...base, mcp: [] };
+    }
+    // Map each tool to an MCP sub-scope; intersect with the scope's grant.
+    const requested = new Set();
+    for (const t of tools) {
+        const sub = toolToMcpScope(t);
+        if (sub)
+            requested.add(sub);
+    }
+    const granted = new Set(base.mcp);
+    const intersection = [...requested].filter((s) => granted.has(s)).sort();
+    return {
+        bash: base.bash,
+        fileIo: base.fileIo,
+        mcp: intersection,
+    };
+}
+function clone(p) {
+    return { bash: p.bash, fileIo: p.fileIo, mcp: [...p.mcp] };
+}
+//# sourceMappingURL=sdk-permission-mapping.js.map