@vibesdotdev/security 0.0.0-stage → 1.0.0-rc.4

package/dist/tools/index.d.ts

@@ -0,0 +1,10 @@
+export { default as scanInputDescriptor } from './scan-input/index.ts';
+export { default as redactOutputDescriptor } from './redact-output/index.ts';
+export { default as checkPolicyDescriptor } from './check-policy/index.ts';
+export { default as reportEventDescriptor } from './report-event/index.ts';
+export { SECURITY_TOOL_IDS, decisionTone, isSecurityToolId, securityToolCardModel, securityToolCardRows, securityToolIcon, type PolicyDecision, type SecurityToolCardModel, type SecurityToolCardRow, type SecurityToolCardTone, type SecurityToolId, type SecurityToolThreat, } from './security-tool-card.ts';
+export type { ScanInputInput, ScanInputOutput, } from './scan-input/schemas.ts';
+export type { RedactOutputInput, RedactOutputOutput, } from './redact-output/schemas.ts';
+export type { CheckPolicyInput, CheckPolicyOutput, } from './check-policy/schemas.ts';
+export type { ReportEventInput, ReportEventOutput, } from './report-event/schemas.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAE3E,OAAO,EACN,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACX,cAAc,EACd,eAAe,GACf,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACX,iBAAiB,EACjB,kBAAkB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,YAAY,EACX,gBAAgB,EAChB,iBAAiB,GACjB,MAAM,2BAA2B,CAAC;AAEnC,YAAY,EACX,gBAAgB,EAChB,iBAAiB,GACjB,MAAM,2BAA2B,CAAC"}

package/dist/tools/index.js

@@ -0,0 +1,6 @@
+export { default as scanInputDescriptor } from "./scan-input/index.js";
+export { default as redactOutputDescriptor } from "./redact-output/index.js";
+export { default as checkPolicyDescriptor } from "./check-policy/index.js";
+export { default as reportEventDescriptor } from "./report-event/index.js";
+export { SECURITY_TOOL_IDS, decisionTone, isSecurityToolId, securityToolCardModel, securityToolCardRows, securityToolIcon, } from "./security-tool-card.js";
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,IAAI,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAE3E,OAAO,EACN,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,GAOhB,MAAM,yBAAyB,CAAC"}

package/dist/tools/redact-output/index.d.ts

@@ -0,0 +1,3 @@
+export { default } from './redact-output.descriptor.ts';
+export type { RedactOutputInput, RedactOutputOutput } from './schemas.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/redact-output/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/redact-output/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC;AACxD,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/tools/redact-output/index.js

@@ -0,0 +1,2 @@
+export { default } from "./redact-output.descriptor.js";
+//# sourceMappingURL=index.js.map

package/dist/tools/redact-output/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/redact-output/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/tools/redact-output/redact-output.descriptor.d.ts

@@ -0,0 +1,42 @@
+declare const _default: {
+    kind: "tools/tool";
+    id: string;
+    name: string;
+    description: string;
+    mcpDescription: string;
+    category: string;
+    subcategory: string;
+    hardware: string[];
+    purpose: string[];
+    tags: string[];
+    safety: string;
+    requiresApproval: boolean;
+    schemas: {
+        input: import("zod/v4").ZodObject<{
+            content: import("zod/v4").ZodString;
+            rules: import("zod/v4").ZodOptional<import("zod/v4").ZodArray<import("zod/v4").ZodObject<{
+                pattern: import("zod/v4").ZodString;
+                id: import("zod/v4").ZodString;
+                replacement: import("zod/v4").ZodString;
+                target: import("zod/v4").ZodOptional<import("zod/v4").ZodEnum<{
+                    metadata: "metadata";
+                    content: "content";
+                    header: "header";
+                }>>;
+                enabled: import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>;
+            }, import("zod/v4/core").$strip>>>;
+        }, import("zod/v4/core").$strip>;
+        output: import("zod/v4").ZodObject<{
+            redacted: import("zod/v4").ZodString;
+            matches: import("zod/v4").ZodArray<import("zod/v4").ZodObject<{
+                pattern: import("zod/v4").ZodString;
+                index: import("zod/v4").ZodNumber;
+                length: import("zod/v4").ZodNumber;
+                replacement: import("zod/v4").ZodString;
+            }, import("zod/v4/core").$strip>>;
+            redactorAvailable: import("zod/v4").ZodDefault<import("zod/v4").ZodBoolean>;
+        }, import("zod/v4/core").$strip>;
+    };
+};
+export default _default;
+//# sourceMappingURL=redact-output.descriptor.d.ts.map

package/dist/tools/redact-output/redact-output.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-output.descriptor.d.ts","sourceRoot":"","sources":["../../../src/tools/redact-output/redact-output.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,wBAkBG"}

package/dist/tools/redact-output/redact-output.descriptor.js

@@ -0,0 +1,21 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+import { RedactOutputInputSchema, RedactOutputOutputSchema } from "./schemas.js";
+export default createRuntimeAsset({
+    kind: 'tools/tool',
+    id: 'security.redact-output',
+    name: 'Redact Output Content',
+    description: 'Redact PII, secrets, and configured deny-list patterns from output content.',
+    mcpDescription: 'Redact sensitive output. Ex: {content,rules}; returns redacted text and matches.',
+    category: 'security',
+    subcategory: 'redactor',
+    hardware: ['consumer', 'cloud'],
+    purpose: ['direct', 'worker', 'agent'],
+    tags: ['security', 'redact', 'pii', 'secrets'],
+    safety: 'write',
+    requiresApproval: false,
+    schemas: {
+        input: RedactOutputInputSchema,
+        output: RedactOutputOutputSchema,
+    },
+});
+//# sourceMappingURL=redact-output.descriptor.js.map

package/dist/tools/redact-output/redact-output.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-output.descriptor.js","sourceRoot":"","sources":["../../../src/tools/redact-output/redact-output.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAEjF,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,wBAAwB;IAC5B,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,6EAA6E;IAC1F,cAAc,EACb,kFAAkF;IACnF,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,UAAU;IACvB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;IACtC,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;IAC9C,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,KAAK;IACvB,OAAO,EAAE;QACR,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,wBAAwB;KAChC;CACD,CAAC,CAAC"}

package/dist/tools/redact-output/redact-output.impl.consumer.d.ts

@@ -0,0 +1,7 @@
+import type { ToolCallContext, VibesRuntime } from '@vibesdotdev/kernel';
+import { type RedactOutputInput, type RedactOutputOutput } from './schemas.ts';
+declare const _default: {
+    execute(input: RedactOutputInput, runtime: VibesRuntime, _ctx: ToolCallContext): Promise<RedactOutputOutput>;
+};
+export default _default;
+//# sourceMappingURL=redact-output.impl.consumer.d.ts.map

package/dist/tools/redact-output/redact-output.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-output.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/tools/redact-output/redact-output.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAA2B,KAAK,iBAAiB,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;;mBAGlF,iBAAiB,WAAW,YAAY,QAAQ,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;;AADnH,wBAaE"}

package/dist/tools/redact-output/redact-output.impl.consumer.js

@@ -0,0 +1,18 @@
+import { SecurityRedactorResultSchema } from "../../schemas/contracts/redactor.js";
+import { RedactOutputInputSchema } from "./schemas.js";
+export default {
+    async execute(input, runtime, _ctx) {
+        const parsed = RedactOutputInputSchema.parse(input);
+        if (!runtime.hasKind('security/redactor'))
+            return { redacted: parsed.content, matches: [], redactorAvailable: false };
+        const query = runtime.query('security/redactor').enabled();
+        if (query.descriptors().length === 0)
+            return { redacted: parsed.content, matches: [], redactorAvailable: false };
+        const redactor = await query.resolve();
+        const rules = parsed.rules?.map(rule => ({
+            ...rule, name: rule.id, target: rule.target ?? 'content', enabled: rule.enabled ?? true
+        }));
+        return SecurityRedactorResultSchema.parse(await redactor.redact(parsed.content, rules));
+    }
+};
+//# sourceMappingURL=redact-output.impl.consumer.js.map

package/dist/tools/redact-output/redact-output.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-output.impl.consumer.js","sourceRoot":"","sources":["../../../src/tools/redact-output/redact-output.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAGnF,OAAO,EAAE,uBAAuB,EAAmD,MAAM,cAAc,CAAC;AAExG,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAwB,EAAE,OAAqB,EAAE,IAAqB;QACnF,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;QAEtH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAsD,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC;QAChH,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;QACjH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACxC,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;SACvF,CAAC,CAAC,CAAC;QACJ,OAAO,4BAA4B,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzF,CAAC;CACD,CAAC"}

package/dist/tools/redact-output/schemas.d.ts

@@ -0,0 +1,28 @@
+import * as z from 'zod/v4';
+export declare const RedactOutputInputSchema: z.ZodObject<{
+    content: z.ZodString;
+    rules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        pattern: z.ZodString;
+        id: z.ZodString;
+        replacement: z.ZodString;
+        target: z.ZodOptional<z.ZodEnum<{
+            metadata: "metadata";
+            content: "content";
+            header: "header";
+        }>>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type RedactOutputInput = z.infer<typeof RedactOutputInputSchema>;
+export declare const RedactOutputOutputSchema: z.ZodObject<{
+    redacted: z.ZodString;
+    matches: z.ZodArray<z.ZodObject<{
+        pattern: z.ZodString;
+        index: z.ZodNumber;
+        length: z.ZodNumber;
+        replacement: z.ZodString;
+    }, z.core.$strip>>;
+    redactorAvailable: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+export type RedactOutputOutput = z.infer<typeof RedactOutputOutputSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/tools/redact-output/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/tools/redact-output/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAK5B,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;iBAMlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,eAAO,MAAM,wBAAwB;;;;;;;;;iBAA+B,CAAC;AACrE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}

package/dist/tools/redact-output/schemas.js

@@ -0,0 +1,13 @@
+import * as z from 'zod/v4';
+import { RedactionRuleSchema } from "../../schemas/RedactionRule.js";
+import { SecurityRedactorResultSchema } from "../../schemas/redactor.js";
+import { SecurityContentSchema } from "../../schemas/contracts/scanner.js";
+export const RedactOutputInputSchema = z.object({
+    content: SecurityContentSchema.describe('Content to redact'),
+    rules: z.array(RedactionRuleSchema.omit({ name: true }).extend({
+        target: RedactionRuleSchema.shape.target.optional(),
+        enabled: z.boolean().optional()
+    })).max(64).optional()
+});
+export const RedactOutputOutputSchema = SecurityRedactorResultSchema;
+//# sourceMappingURL=schemas.js.map

package/dist/tools/redact-output/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/tools/redact-output/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,qBAAqB,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9D,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;QACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC"}

package/dist/tools/report-event/index.d.ts

@@ -0,0 +1,3 @@
+export { default } from './report-event.descriptor.ts';
+export type { ReportEventInput, ReportEventOutput } from './schemas.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/report-event/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/report-event/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/tools/report-event/index.js

@@ -0,0 +1,2 @@
+export { default } from "./report-event.descriptor.js";
+//# sourceMappingURL=index.js.map

package/dist/tools/report-event/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/report-event/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/tools/report-event/report-event.descriptor.d.ts

@@ -0,0 +1,43 @@
+declare const _default: {
+    kind: "tools/tool";
+    id: string;
+    name: string;
+    description: string;
+    mcpDescription: string;
+    category: string;
+    subcategory: string;
+    hardware: string[];
+    purpose: string[];
+    tags: string[];
+    safety: string;
+    requiresApproval: boolean;
+    schemas: {
+        input: import("zod/v4").ZodObject<{
+            event: import("zod/v4").ZodObject<{
+                id: import("zod/v4").ZodString;
+                timestamp: import("zod/v4").ZodString;
+                actor: import("zod/v4").ZodString;
+                action: import("zod/v4").ZodString;
+                resource: import("zod/v4").ZodString;
+                outcome: import("zod/v4").ZodEnum<{
+                    allow: "allow";
+                    deny: "deny";
+                    review: "review";
+                }>;
+                metadata: import("zod/v4").ZodOptional<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodUnknown>>;
+            }, import("zod/v4/core").$strip>;
+        }, import("zod/v4/core").$strip>;
+        output: import("zod/v4").ZodObject<{
+            recorded: import("zod/v4").ZodBoolean;
+            eventId: import("zod/v4").ZodString;
+            error: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            failure: import("zod/v4").ZodOptional<import("zod/v4").ZodObject<{
+                name: import("zod/v4").ZodString;
+                code: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+                reason: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+            }, import("zod/v4/core").$strip>>;
+        }, import("zod/v4/core").$strip>;
+    };
+};
+export default _default;
+//# sourceMappingURL=report-event.descriptor.d.ts.map

package/dist/tools/report-event/report-event.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-event.descriptor.d.ts","sourceRoot":"","sources":["../../../src/tools/report-event/report-event.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,wBAkBG"}

package/dist/tools/report-event/report-event.descriptor.js

@@ -0,0 +1,21 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+import { ReportEventInputSchema, ReportEventOutputSchema } from "../../schemas/report-event.js";
+export default createRuntimeAsset({
+    kind: 'tools/tool',
+    id: 'security.report-event',
+    name: 'Report Audit Event',
+    description: 'Record an audit event for security and compliance tracking.',
+    mcpDescription: 'Record a security audit event. Ex: {event}; returns recorded status and eventId.',
+    category: 'security',
+    subcategory: 'audit',
+    hardware: ['consumer', 'cloud'],
+    purpose: ['direct', 'worker', 'agent'],
+    tags: ['security', 'audit', 'compliance', 'events'],
+    safety: 'write',
+    requiresApproval: false,
+    schemas: {
+        input: ReportEventInputSchema,
+        output: ReportEventOutputSchema,
+    },
+});
+//# sourceMappingURL=report-event.descriptor.js.map

package/dist/tools/report-event/report-event.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-event.descriptor.js","sourceRoot":"","sources":["../../../src/tools/report-event/report-event.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAEhG,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,6DAA6D;IAC1E,cAAc,EACb,kFAAkF;IACnF,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,OAAO;IACpB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;IACtC,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC;IACnD,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,KAAK;IACvB,OAAO,EAAE;QACR,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EAAE,uBAAuB;KAC/B;CACD,CAAC,CAAC"}

package/dist/tools/report-event/report-event.impl.consumer.d.ts

@@ -0,0 +1,24 @@
+import { type ToolCallContext, type VibesRuntime } from '@vibesdotdev/kernel';
+import { type ReportEventInput, type ReportEventOutput } from '../../schemas/report-event.ts';
+/**
+ * Records one audit event with the registered `security/auditor`.
+ *
+ * The input is admitted through the owning ReportEventInputSchema before any
+ * runtime resolution: a malformed envelope or event rejects with the canonical
+ * ZodError, before an auditor is resolved, invoked or logged. That rejection is
+ * a validation outcome, not an operational failure — no recorded:false result
+ * and no failure logging is produced for it. After admission, only the parsed
+ * event is used; the raw caller input is never accessed again (so a malformed
+ * `input.event` cannot throw a TypeError inside the failure handler either).
+ *
+ * A failure to resolve the auditor or to emit — after admission — is answered
+ * `recorded: false` with the failure's value-free facts (class name, errno
+ * code, CapabilityError reason) and a fixed message naming them. The raw error
+ * (its message may carry event data or a credential) never crosses the tool
+ * boundary: only value-free facts also go to the runtime's logger, once.
+ */
+declare const _default: {
+    execute(input: ReportEventInput, runtime: VibesRuntime, _ctx: ToolCallContext): Promise<ReportEventOutput>;
+};
+export default _default;
+//# sourceMappingURL=report-event.impl.consumer.d.ts.map

package/dist/tools/report-event/report-event.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-event.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/tools/report-event/report-event.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,EAGN,KAAK,eAAe,EAEpB,KAAK,YAAY,EACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAA0B,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAUtH;;;;;;;;;;;;;;;;GAgBG;;mBAGM,gBAAgB,WACd,YAAY,QACf,eAAe,GACnB,OAAO,CAAC,iBAAiB,CAAC;;AAL9B,wBAsCE"}

package/dist/tools/report-event/report-event.impl.consumer.js

@@ -0,0 +1,61 @@
+import { getLogger } from '@vibesdotdev/logging';
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { ReportEventInputSchema } from "../../schemas/report-event.js";
+const LOGGER_ID = 'security:tools:report-event';
+/** The output's message: fixed text naming only the failure's value-free facts. */
+function failureMessage(facts) {
+    const named = [facts.name, facts.code, facts.reason].filter((fact) => fact !== undefined).join(' ');
+    return `The security auditor could not record the event (${named}).`;
+}
+/**
+ * Records one audit event with the registered `security/auditor`.
+ *
+ * The input is admitted through the owning ReportEventInputSchema before any
+ * runtime resolution: a malformed envelope or event rejects with the canonical
+ * ZodError, before an auditor is resolved, invoked or logged. That rejection is
+ * a validation outcome, not an operational failure — no recorded:false result
+ * and no failure logging is produced for it. After admission, only the parsed
+ * event is used; the raw caller input is never accessed again (so a malformed
+ * `input.event` cannot throw a TypeError inside the failure handler either).
+ *
+ * A failure to resolve the auditor or to emit — after admission — is answered
+ * `recorded: false` with the failure's value-free facts (class name, errno
+ * code, CapabilityError reason) and a fixed message naming them. The raw error
+ * (its message may carry event data or a credential) never crosses the tool
+ * boundary: only value-free facts also go to the runtime's logger, once.
+ */
+export default {
+    async execute(input, runtime, _ctx) {
+        const { event } = ReportEventInputSchema.parse(input);
+        try {
+            const query = runtime
+                .query('security/auditor').enabled();
+            if (query.descriptors().length === 0) {
+                return {
+                    recorded: false,
+                    eventId: event.id,
+                    error: 'No security auditor registered'
+                };
+            }
+            const auditor = await query.resolve();
+            await auditor.emit(event);
+            return {
+                recorded: true,
+                eventId: event.id
+            };
+        }
+        catch (err) {
+            const failure = CaughtFailureSchema.parse(err);
+            const facts = valueFreeFailure(failure);
+            const logger = getLogger(LOGGER_ID, runtime);
+            logger.error('The security auditor could not record the event', { eventId: event.id, error: facts });
+            return {
+                recorded: false,
+                eventId: event.id,
+                error: failureMessage(facts),
+                failure: facts
+            };
+        }
+    },
+};
+//# sourceMappingURL=report-event.impl.consumer.js.map

package/dist/tools/report-event/report-event.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-event.impl.consumer.js","sourceRoot":"","sources":["../../../src/tools/report-event/report-event.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAIhB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAAiD,MAAM,+BAA+B,CAAC;AAEtH,MAAM,SAAS,GAAG,6BAA6B,CAAC;AAEhD,mFAAmF;AACnF,SAAS,cAAc,CAAC,KAAuB;IAC9C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpG,OAAO,oDAAoD,KAAK,IAAI,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAuB,EACvB,OAAqB,EACrB,IAAqB;QAErB,MAAM,EAAE,KAAK,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,OAAO;iBACnB,KAAK,CAAoD,kBAAkB,CAAC,CAAC,OAAO,EAAE,CAAC;YAEzF,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,OAAO;oBACN,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,KAAK,EAAE,gCAAgC;iBACvC,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO;gBACN,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,KAAK,CAAC,EAAE;aACjB,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,iDAAiD,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YACrG,OAAO;gBACN,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;gBAC5B,OAAO,EAAE,KAAK;aACd,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/tools/report-event/schemas.d.ts

@@ -0,0 +1,2 @@
+export { ReportEventInputSchema, ReportEventOutputSchema, type ReportEventInput, type ReportEventOutput, } from '../../schemas/report-event.ts';
+//# sourceMappingURL=schemas.d.ts.map

package/dist/tools/report-event/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/tools/report-event/schemas.ts"],"names":[],"mappings":"AACA,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,GACtB,MAAM,+BAA+B,CAAC"}

package/dist/tools/report-event/schemas.js

@@ -0,0 +1,3 @@
+// Compatibility entrypoint; the canonical tool contract belongs to schemas/.
+export { ReportEventInputSchema, ReportEventOutputSchema, } from "../../schemas/report-event.js";
+//# sourceMappingURL=schemas.js.map

package/dist/tools/report-event/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/tools/report-event/schemas.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,OAAO,EACN,sBAAsB,EACtB,uBAAuB,GAGvB,MAAM,+BAA+B,CAAC"}

package/dist/tools/scan-input/index.d.ts

@@ -0,0 +1,3 @@
+export { default } from './scan-input.descriptor.ts';
+export type { ScanInputInput, ScanInputOutput } from './schemas.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/scan-input/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/scan-input/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/tools/scan-input/index.js

@@ -0,0 +1,2 @@
+export { default } from "./scan-input.descriptor.js";
+//# sourceMappingURL=index.js.map

package/dist/tools/scan-input/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/scan-input/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/tools/scan-input/scan-input.descriptor.d.ts

@@ -0,0 +1,49 @@
+declare const _default: {
+    kind: "tools/tool";
+    id: string;
+    name: string;
+    description: string;
+    mcpDescription: string;
+    category: string;
+    subcategory: string;
+    hardware: string[];
+    purpose: string[];
+    tags: string[];
+    safety: string;
+    requiresApproval: boolean;
+    schemas: {
+        input: import("zod/v4").ZodObject<{
+            content: import("zod/v4").ZodString;
+            options: import("zod/v4").ZodOptional<import("zod/v4").ZodObject<{
+                detectSecrets: import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>;
+                detectPII: import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>;
+                detectPromptInjection: import("zod/v4").ZodOptional<import("zod/v4").ZodBoolean>;
+            }, import("zod/v4/core").$strip>>;
+        }, import("zod/v4/core").$strip>;
+        output: import("zod/v4").ZodObject<{
+            threats: import("zod/v4").ZodArray<import("zod/v4").ZodObject<{
+                severity: import("zod/v4").ZodEnum<{
+                    low: "low";
+                    medium: "medium";
+                    high: "high";
+                    critical: "critical";
+                }>;
+                kind: import("zod/v4").ZodEnum<{
+                    prompt_injection: "prompt_injection";
+                    secret_leak: "secret_leak";
+                    pii: "pii";
+                    suspicious_payload: "suspicious_payload";
+                }>;
+                description: import("zod/v4").ZodString;
+                matches: import("zod/v4").ZodArray<import("zod/v4").ZodObject<{
+                    length: import("zod/v4").ZodNumber;
+                    index: import("zod/v4").ZodNumber;
+                    rule: import("zod/v4").ZodString;
+                }, import("zod/v4/core").$strip>>;
+            }, import("zod/v4/core").$strip>>;
+            scannerAvailable: import("zod/v4").ZodBoolean;
+        }, import("zod/v4/core").$strip>;
+    };
+};
+export default _default;
+//# sourceMappingURL=scan-input.descriptor.d.ts.map

package/dist/tools/scan-input/scan-input.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-input.descriptor.d.ts","sourceRoot":"","sources":["../../../src/tools/scan-input/scan-input.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,wBAkBG"}

package/dist/tools/scan-input/scan-input.descriptor.js

@@ -0,0 +1,21 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
+import { ScanInputInputSchema, ScanInputOutputSchema } from "./schemas.js";
+export default createRuntimeAsset({
+    kind: 'tools/tool',
+    id: 'security.scan-input',
+    name: 'Scan Input Content',
+    description: 'Scan input content for threats, secrets, PII, and prompt injection patterns.',
+    mcpDescription: 'Scan input for threats. Ex: {content,options}; returns threats and scanner status.',
+    category: 'security',
+    subcategory: 'scanner',
+    hardware: ['consumer', 'cloud'],
+    purpose: ['direct', 'worker', 'agent'],
+    tags: ['security', 'scan', 'threats', 'secrets', 'pii'],
+    safety: 'read',
+    requiresApproval: false,
+    schemas: {
+        input: ScanInputInputSchema,
+        output: ScanInputOutputSchema,
+    },
+});
+//# sourceMappingURL=scan-input.descriptor.js.map

package/dist/tools/scan-input/scan-input.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-input.descriptor.js","sourceRoot":"","sources":["../../../src/tools/scan-input/scan-input.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE3E,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,qBAAqB;IACzB,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,8EAA8E;IAC3F,cAAc,EACb,oFAAoF;IACrF,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,SAAS;IACtB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;IACtC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC;IACvD,MAAM,EAAE,MAAM;IACd,gBAAgB,EAAE,KAAK;IACvB,OAAO,EAAE;QACR,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,qBAAqB;KAC7B;CACD,CAAC,CAAC"}

package/dist/tools/scan-input/scan-input.impl.consumer.d.ts

@@ -0,0 +1,7 @@
+import type { ToolCallContext, VibesRuntime } from '@vibesdotdev/kernel';
+import { type ScanInputInput, type ScanInputOutput } from './schemas.ts';
+declare const _default: {
+    execute(input: ScanInputInput, runtime: VibesRuntime, _ctx: ToolCallContext): Promise<ScanInputOutput>;
+};
+export default _default;
+//# sourceMappingURL=scan-input.impl.consumer.d.ts.map

package/dist/tools/scan-input/scan-input.impl.consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-input.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/tools/scan-input/scan-input.impl.consumer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAAwB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;;mBAGzE,cAAc,WAAW,YAAY,QAAQ,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;;AAD7G,wBAkBE"}

package/dist/tools/scan-input/scan-input.impl.consumer.js

@@ -0,0 +1,22 @@
+import { SecurityScannerResultSchema } from "../../schemas/contracts/scanner.js";
+import { ScanInputInputSchema } from "./schemas.js";
+export default {
+    async execute(input, runtime, _ctx) {
+        const parsed = ScanInputInputSchema.parse(input);
+        if (!runtime.hasKind('security/scanner'))
+            return { threats: [], scannerAvailable: false };
+        const scanners = await runtime
+            .query('security/scanner')
+            .enabled()
+            .resolveAll();
+        const results = await Promise.all(scanners.map(async (scanner) => SecurityScannerResultSchema.parse(await scanner.scan(parsed.content, parsed.options))));
+        return {
+            threats: results.flatMap(result => result.threats.map(threat => ({
+                ...threat,
+                matches: threat.matches.map(match => ({ rule: match.pattern, index: match.index, length: match.length }))
+            }))),
+            scannerAvailable: results.some(result => result.scanAvailable)
+        };
+    }
+};
+//# sourceMappingURL=scan-input.impl.consumer.js.map

package/dist/tools/scan-input/scan-input.impl.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-input.impl.consumer.js","sourceRoot":"","sources":["../../../src/tools/scan-input/scan-input.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AAGjF,OAAO,EAAE,oBAAoB,EAA6C,MAAM,cAAc,CAAC;AAE/F,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAqB,EAAE,OAAqB,EAAE,IAAqB;QAChF,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAE1F,MAAM,QAAQ,GAAG,MAAM,OAAO;aAC5B,KAAK,CAAoD,kBAAkB,CAAC;aAC5E,OAAO,EAAE;aACT,UAAU,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE,CAAC,2BAA2B,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxJ,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAChE,GAAG,MAAM;gBACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;aACzG,CAAC,CAAC,CAAC;YACJ,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC;SAC9D,CAAC;IACH,CAAC;CACD,CAAC"}

package/dist/tools/scan-input/schemas.d.ts

@@ -0,0 +1,36 @@
+import * as z from 'zod/v4';
+export { MAX_SCANNABLE_CONTENT_LENGTH } from '../../schemas/contracts/scanner.ts';
+export declare const ScanInputInputSchema: z.ZodObject<{
+    content: z.ZodString;
+    options: z.ZodOptional<z.ZodObject<{
+        detectSecrets: z.ZodOptional<z.ZodBoolean>;
+        detectPII: z.ZodOptional<z.ZodBoolean>;
+        detectPromptInjection: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ScanInputInput = z.infer<typeof ScanInputInputSchema>;
+export declare const ScanInputOutputSchema: z.ZodObject<{
+    threats: z.ZodArray<z.ZodObject<{
+        severity: z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            critical: "critical";
+        }>;
+        kind: z.ZodEnum<{
+            prompt_injection: "prompt_injection";
+            secret_leak: "secret_leak";
+            pii: "pii";
+            suspicious_payload: "suspicious_payload";
+        }>;
+        description: z.ZodString;
+        matches: z.ZodArray<z.ZodObject<{
+            length: z.ZodNumber;
+            index: z.ZodNumber;
+            rule: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    scannerAvailable: z.ZodBoolean;
+}, z.core.$strip>;
+export type ScanInputOutput = z.infer<typeof ScanInputOutputSchema>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/tools/scan-input/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/tools/scan-input/schemas.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,4BAA4B,EAAE,MAAM,oCAAoC,CAAC;AAClF,eAAO,MAAM,oBAAoB;;;;;;;iBAI/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;iBAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/tools/scan-input/schemas.js

@@ -0,0 +1,15 @@
+import { SecurityContentSchema, SecurityScannerOverridesSchema, SecurityScannerResultSchema, ThreatMatchSchema } from "../../schemas/scanner.js";
+import * as z from 'zod/v4';
+export { MAX_SCANNABLE_CONTENT_LENGTH } from "../../schemas/contracts/scanner.js";
+export const ScanInputInputSchema = z.object({
+    content: SecurityContentSchema
+        .describe('Content to scan for threats'),
+    options: SecurityScannerOverridesSchema.optional(),
+});
+export const ScanInputOutputSchema = SecurityScannerResultSchema.omit({ scanAvailable: true }).extend({
+    threats: z.array(SecurityScannerResultSchema.shape.threats.element.extend({
+        matches: z.array(ThreatMatchSchema.omit({ pattern: true }).extend({ rule: z.string() }))
+    })),
+    scannerAvailable: z.boolean()
+});
+//# sourceMappingURL=schemas.js.map