@vorionsys/security 1.0.0

package/dist/cognigate/lua-scripts.js

@@ -0,0 +1,264 @@
+/**
+ * Cognigate Lua Scripts - Atomic Redis Operations
+ *
+ * Lua scripts for atomic resource tracking operations in Redis.
+ * These ensure consistency under concurrent access across multiple instances.
+ *
+ * @packageDocumentation
+ * @module @vorion/cognigate/lua-scripts
+ */
+/**
+ * Atomic increment with limit check.
+ *
+ * KEYS[1] - The hash key for execution state
+ * ARGV[1] - Field name to increment (e.g., 'networkRequests', 'fileSystemOps')
+ * ARGV[2] - Increment amount
+ * ARGV[3] - Maximum allowed value (limit)
+ *
+ * Returns: [allowed (0 or 1), newValue]
+ */
+export const INCREMENT_AND_CHECK_LUA = `
+local key = KEYS[1]
+local field = ARGV[1]
+local increment = tonumber(ARGV[2])
+local limit = tonumber(ARGV[3])
+
+-- Get current value or default to 0
+local current = tonumber(redis.call('HGET', key, field) or '0')
+local newValue = current + increment
+
+-- Check if within limit
+if newValue <= limit then
+  redis.call('HSET', key, field, tostring(newValue))
+  return {1, newValue}
+else
+  return {0, current}
+end
+`;
+/**
+ * Update peak memory (only if higher than current peak).
+ *
+ * KEYS[1] - The hash key for execution state
+ * ARGV[1] - New memory value in MB
+ *
+ * Returns: Current peak memory value
+ */
+export const UPDATE_MEMORY_PEAK_LUA = `
+local key = KEYS[1]
+local newMemory = tonumber(ARGV[1])
+
+-- Get current peak or default to 0
+local currentPeak = tonumber(redis.call('HGET', key, 'memoryPeakMb') or '0')
+
+-- Update only if new value is higher
+if newMemory > currentPeak then
+  redis.call('HSET', key, 'memoryPeakMb', tostring(newMemory))
+  return newMemory
+else
+  return currentPeak
+end
+`;
+/**
+ * Get all resource metrics atomically.
+ *
+ * KEYS[1] - The hash key for execution state
+ *
+ * Returns: [memoryPeakMb, cpuTimeMs, networkRequests, fileSystemOps, startTime]
+ */
+export const GET_RESOURCE_SNAPSHOT_LUA = `
+local key = KEYS[1]
+
+local memoryPeakMb = tonumber(redis.call('HGET', key, 'memoryPeakMb') or '0')
+local cpuTimeMs = tonumber(redis.call('HGET', key, 'cpuTimeMs') or '0')
+local networkRequests = tonumber(redis.call('HGET', key, 'networkRequests') or '0')
+local fileSystemOps = tonumber(redis.call('HGET', key, 'fileSystemOps') or '0')
+local startTime = tonumber(redis.call('HGET', key, 'startTime') or '0')
+
+return {memoryPeakMb, cpuTimeMs, networkRequests, fileSystemOps, startTime}
+`;
+/**
+ * Check all resource limits atomically and return violation if any.
+ *
+ * KEYS[1] - The hash key for execution state
+ * ARGV[1] - Memory limit in MB
+ * ARGV[2] - CPU time limit in milliseconds (calculated from percent and elapsed time)
+ * ARGV[3] - Network requests limit
+ * ARGV[4] - File system operations limit
+ * ARGV[5] - Current timestamp for wall time calculation
+ * ARGV[6] - Timeout in milliseconds
+ *
+ * Returns: [shouldTerminate (0 or 1), violationType, currentValue, limit]
+ * violationType: 0=none, 1=memory, 2=cpu, 3=timeout, 4=network, 5=filesystem
+ */
+export const CHECK_LIMITS_LUA = `
+local key = KEYS[1]
+local memoryLimit = tonumber(ARGV[1])
+local cpuTimeLimit = tonumber(ARGV[2])
+local networkLimit = tonumber(ARGV[3])
+local fsLimit = tonumber(ARGV[4])
+local currentTime = tonumber(ARGV[5])
+local timeoutMs = tonumber(ARGV[6])
+
+-- Get all current values
+local memoryPeakMb = tonumber(redis.call('HGET', key, 'memoryPeakMb') or '0')
+local cpuTimeMs = tonumber(redis.call('HGET', key, 'cpuTimeMs') or '0')
+local networkRequests = tonumber(redis.call('HGET', key, 'networkRequests') or '0')
+local fileSystemOps = tonumber(redis.call('HGET', key, 'fileSystemOps') or '0')
+local startTime = tonumber(redis.call('HGET', key, 'startTime') or '0')
+
+-- Calculate wall time
+local wallTimeMs = 0
+if startTime > 0 then
+  wallTimeMs = currentTime - startTime
+end
+
+-- Check memory limit
+if memoryLimit > 0 and memoryPeakMb > memoryLimit then
+  return {1, 1, memoryPeakMb, memoryLimit}
+end
+
+-- Check CPU time limit
+if cpuTimeLimit > 0 and cpuTimeMs > cpuTimeLimit then
+  return {1, 2, cpuTimeMs, cpuTimeLimit}
+end
+
+-- Check timeout
+if timeoutMs > 0 and wallTimeMs > timeoutMs then
+  return {1, 3, wallTimeMs, timeoutMs}
+end
+
+-- Check network requests limit
+if networkLimit > 0 and networkRequests > networkLimit then
+  return {1, 4, networkRequests, networkLimit}
+end
+
+-- Check file system operations limit
+if fsLimit > 0 and fileSystemOps > fsLimit then
+  return {1, 5, fileSystemOps, fsLimit}
+end
+
+-- No violations
+return {0, 0, 0, 0}
+`;
+/**
+ * Initialize execution state atomically.
+ *
+ * KEYS[1] - The hash key for execution state
+ * ARGV[1] - Start time timestamp
+ * ARGV[2] - TTL in seconds
+ * ARGV[3] - Memory limit in MB
+ * ARGV[4] - CPU percent limit
+ * ARGV[5] - Timeout in milliseconds
+ * ARGV[6] - Network requests limit (or -1 for unlimited)
+ * ARGV[7] - File system ops limit (or -1 for unlimited)
+ *
+ * Returns: 1 on success
+ */
+export const INIT_EXECUTION_LUA = `
+local key = KEYS[1]
+local startTime = ARGV[1]
+local ttl = tonumber(ARGV[2])
+local memoryLimit = ARGV[3]
+local cpuLimit = ARGV[4]
+local timeoutMs = ARGV[5]
+local networkLimit = ARGV[6]
+local fsLimit = ARGV[7]
+
+-- Set all initial values
+redis.call('HMSET', key,
+  'startTime', startTime,
+  'memoryPeakMb', '0',
+  'cpuTimeMs', '0',
+  'networkRequests', '0',
+  'fileSystemOps', '0',
+  'memoryLimit', memoryLimit,
+  'cpuLimit', cpuLimit,
+  'timeoutMs', timeoutMs,
+  'networkLimit', networkLimit,
+  'fsLimit', fsLimit,
+  'terminated', '0'
+)
+
+-- Set expiry
+redis.call('EXPIRE', key, ttl)
+
+return 1
+`;
+/**
+ * Increment CPU time atomically.
+ *
+ * KEYS[1] - The hash key for execution state
+ * ARGV[1] - Delta CPU time in milliseconds
+ *
+ * Returns: New total CPU time
+ */
+export const INCREMENT_CPU_TIME_LUA = `
+local key = KEYS[1]
+local delta = tonumber(ARGV[1])
+
+local current = tonumber(redis.call('HGET', key, 'cpuTimeMs') or '0')
+local newValue = current + delta
+redis.call('HSET', key, 'cpuTimeMs', tostring(newValue))
+
+return newValue
+`;
+/**
+ * Mark execution as terminated.
+ *
+ * KEYS[1] - The hash key for execution state
+ * ARGV[1] - Termination reason
+ * ARGV[2] - Violation type
+ *
+ * Returns: 1 if marked, 0 if already terminated
+ */
+export const MARK_TERMINATED_LUA = `
+local key = KEYS[1]
+local reason = ARGV[1]
+local violation = ARGV[2]
+
+local terminated = redis.call('HGET', key, 'terminated')
+if terminated == '1' then
+  return 0
+end
+
+redis.call('HMSET', key,
+  'terminated', '1',
+  'terminationReason', reason,
+  'terminationViolation', violation,
+  'terminatedAt', tostring(redis.call('TIME')[1] * 1000)
+)
+
+return 1
+`;
+/**
+ * Cleanup and get final metrics.
+ *
+ * KEYS[1] - The hash key for execution state
+ *
+ * Returns: [memoryPeakMb, cpuTimeMs, wallTimeMs, networkRequests, fileSystemOps]
+ * (also deletes the key)
+ */
+export const CLEANUP_EXECUTION_LUA = `
+local key = KEYS[1]
+
+-- Get all values before deletion
+local memoryPeakMb = tonumber(redis.call('HGET', key, 'memoryPeakMb') or '0')
+local cpuTimeMs = tonumber(redis.call('HGET', key, 'cpuTimeMs') or '0')
+local networkRequests = tonumber(redis.call('HGET', key, 'networkRequests') or '0')
+local fileSystemOps = tonumber(redis.call('HGET', key, 'fileSystemOps') or '0')
+local startTime = tonumber(redis.call('HGET', key, 'startTime') or '0')
+
+-- Calculate wall time
+local currentTime = redis.call('TIME')
+local currentMs = tonumber(currentTime[1]) * 1000 + math.floor(tonumber(currentTime[2]) / 1000)
+local wallTimeMs = 0
+if startTime > 0 then
+  wallTimeMs = currentMs - startTime
+end
+
+-- Delete the key
+redis.call('DEL', key)
+
+return {memoryPeakMb, cpuTimeMs, wallTimeMs, networkRequests, fileSystemOps}
+`;
+//# sourceMappingURL=lua-scripts.js.map

package/dist/cognigate/lua-scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lua-scripts.js","sourceRoot":"","sources":["../../src/cognigate/lua-scripts.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;CAiBtC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;CAcrC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;CAUxC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiD/B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;CASrC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;CAkBlC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsBpC,CAAC"}

package/dist/cognigate/metrics.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Cognigate Metrics - Prometheus-compatible observability
+ *
+ * Provides comprehensive metrics for monitoring Cognigate execution gateway,
+ * including resource usage, violations, terminations, and output validation.
+ *
+ * @packageDocumentation
+ * @module @vorion/cognigate/metrics
+ */
+import { Counter, Histogram, Gauge } from 'prom-client';
+/**
+ * Total executions started
+ */
+export declare const executionsStartedTotal: Counter<"tenant_id" | "intent_type">;
+/**
+ * Total executions completed (success or failure)
+ */
+export declare const executionsCompletedTotal: Counter<"result" | "tenant_id" | "intent_type">;
+/**
+ * Execution duration histogram
+ */
+export declare const executionDuration: Histogram<"result" | "tenant_id" | "intent_type">;
+/**
+ * Currently active executions
+ */
+export declare const activeExecutions: Gauge<"tenant_id">;
+/**
+ * Peak memory usage histogram (MB)
+ */
+export declare const memoryPeakMb: Histogram<"tenant_id" | "intent_type">;
+/**
+ * CPU time usage histogram (milliseconds)
+ */
+export declare const cpuTimeMs: Histogram<"tenant_id" | "intent_type">;
+/**
+ * Network requests per execution histogram
+ */
+export declare const networkRequestsPerExecution: Histogram<"tenant_id" | "intent_type">;
+/**
+ * File system operations per execution histogram
+ */
+export declare const fileSystemOpsPerExecution: Histogram<"tenant_id" | "intent_type">;
+/**
+ * Resource limit violations total
+ */
+export declare const resourceViolationsTotal: Counter<"tenant_id" | "violation_type">;
+/**
+ * Executions terminated due to resource limits
+ */
+export declare const terminationsTotal: Counter<"tenant_id" | "reason">;
+/**
+ * Output validations total
+ */
+export declare const outputValidationsTotal: Counter<"result" | "tenant_id" | "mode">;
+/**
+ * Output validation duration histogram
+ */
+export declare const outputValidationDuration: Histogram<"tenant_id">;
+/**
+ * PII detections total
+ */
+export declare const piiDetectionsTotal: Counter<"tenant_id" | "pii_type">;
+/**
+ * Output sanitizations total
+ */
+export declare const outputSanitizationsTotal: Counter<"tenant_id">;
+/**
+ * Prohibited patterns detected total
+ */
+export declare const prohibitedPatternsTotal: Counter<"tenant_id" | "severity" | "pattern_type">;
+/**
+ * Record execution start
+ */
+export declare function recordExecutionStart(tenantId: string, intentType: string): void;
+/**
+ * Record execution completion
+ */
+export declare function recordExecutionComplete(tenantId: string, intentType: string, result: 'success' | 'failure' | 'terminated', durationSeconds: number): void;
+/**
+ * Record resource usage
+ */
+export declare function recordResourceUsage(tenantId: string, intentType: string, usage: {
+    memoryPeakMb: number;
+    cpuTimeMs: number;
+    networkRequests: number;
+    fileSystemOps: number;
+}): void;
+/**
+ * Record resource violation
+ */
+export declare function recordResourceViolation(tenantId: string, violationType: 'memory_exceeded' | 'cpu_exceeded' | 'timeout_exceeded' | 'network_limit_exceeded' | 'filesystem_limit_exceeded'): void;
+/**
+ * Record execution termination
+ */
+export declare function recordTermination(tenantId: string, reason: string): void;
+/**
+ * Record output validation
+ */
+export declare function recordOutputValidation(tenantId: string, result: 'valid' | 'invalid', mode: 'strict' | 'permissive', durationMs: number): void;
+/**
+ * Record PII detection
+ */
+export declare function recordPIIDetection(tenantId: string, piiType: string): void;
+/**
+ * Record output sanitization
+ */
+export declare function recordOutputSanitization(tenantId: string): void;
+/**
+ * Record prohibited pattern detection
+ */
+export declare function recordProhibitedPattern(tenantId: string, patternType: string, severity: 'low' | 'medium' | 'high' | 'critical'): void;
+//# sourceMappingURL=metrics.d.ts.map

package/dist/cognigate/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/cognigate/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAOxD;;GAEG;AACH,eAAO,MAAM,sBAAsB,sCAKjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,wBAAwB,iDAKnC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB,mDAM5B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB,oBAK3B,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,YAAY,wCAMvB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,SAAS,wCAMpB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,2BAA2B,wCAMtC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,yBAAyB,wCAMpC,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,uBAAuB,yCAKlC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB,iCAK5B,CAAC;AAMH;;GAEG;AACH,eAAO,MAAM,sBAAsB,0CAKjC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,wBAAwB,wBAMnC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB,mCAK7B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,wBAAwB,sBAKnC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,uBAAuB,oDAKlC,CAAC;AAMH;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAG/E;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,EAC5C,eAAe,EAAE,MAAM,GACtB,IAAI,CAIN;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;IACL,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB,GACA,IAAI,CAKN;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,iBAAiB,GAAG,cAAc,GAAG,kBAAkB,GAAG,wBAAwB,GAAG,2BAA2B,GAC9H,IAAI,CAEN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAExE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,IAAI,EAAE,QAAQ,GAAG,YAAY,EAC7B,UAAU,EAAE,MAAM,GACjB,IAAI,CAGN;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAE1E;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE/D;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAC/C,IAAI,CAEN"}

package/dist/cognigate/metrics.js

@@ -0,0 +1,229 @@
+/**
+ * Cognigate Metrics - Prometheus-compatible observability
+ *
+ * Provides comprehensive metrics for monitoring Cognigate execution gateway,
+ * including resource usage, violations, terminations, and output validation.
+ *
+ * @packageDocumentation
+ * @module @vorion/cognigate/metrics
+ */
+import { Counter, Histogram, Gauge } from 'prom-client';
+import { vorionRegistry } from '../common/metrics-registry.js';
+// =============================================================================
+// Execution Metrics
+// =============================================================================
+/**
+ * Total executions started
+ */
+export const executionsStartedTotal = new Counter({
+    name: 'vorion_cognigate_executions_started_total',
+    help: 'Total number of executions started',
+    labelNames: ['tenant_id', 'intent_type'],
+    registers: [vorionRegistry],
+});
+/**
+ * Total executions completed (success or failure)
+ */
+export const executionsCompletedTotal = new Counter({
+    name: 'vorion_cognigate_executions_completed_total',
+    help: 'Total number of executions completed',
+    labelNames: ['tenant_id', 'intent_type', 'result'], // result: success, failure, terminated
+    registers: [vorionRegistry],
+});
+/**
+ * Execution duration histogram
+ */
+export const executionDuration = new Histogram({
+    name: 'vorion_cognigate_execution_duration_seconds',
+    help: 'Execution duration in seconds',
+    labelNames: ['tenant_id', 'intent_type', 'result'],
+    buckets: [0.1, 0.5, 1, 2, 5, 10, 30, 60, 120, 300],
+    registers: [vorionRegistry],
+});
+/**
+ * Currently active executions
+ */
+export const activeExecutions = new Gauge({
+    name: 'vorion_cognigate_active_executions',
+    help: 'Number of currently active executions',
+    labelNames: ['tenant_id'],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// Resource Usage Metrics
+// =============================================================================
+/**
+ * Peak memory usage histogram (MB)
+ */
+export const memoryPeakMb = new Histogram({
+    name: 'vorion_cognigate_memory_peak_mb',
+    help: 'Peak memory usage in MB',
+    labelNames: ['tenant_id', 'intent_type'],
+    buckets: [16, 32, 64, 128, 256, 512, 1024, 2048, 4096],
+    registers: [vorionRegistry],
+});
+/**
+ * CPU time usage histogram (milliseconds)
+ */
+export const cpuTimeMs = new Histogram({
+    name: 'vorion_cognigate_cpu_time_ms',
+    help: 'CPU time usage in milliseconds',
+    labelNames: ['tenant_id', 'intent_type'],
+    buckets: [10, 50, 100, 500, 1000, 5000, 10000, 30000, 60000],
+    registers: [vorionRegistry],
+});
+/**
+ * Network requests per execution histogram
+ */
+export const networkRequestsPerExecution = new Histogram({
+    name: 'vorion_cognigate_network_requests',
+    help: 'Number of network requests per execution',
+    labelNames: ['tenant_id', 'intent_type'],
+    buckets: [0, 1, 5, 10, 25, 50, 100, 250, 500],
+    registers: [vorionRegistry],
+});
+/**
+ * File system operations per execution histogram
+ */
+export const fileSystemOpsPerExecution = new Histogram({
+    name: 'vorion_cognigate_filesystem_ops',
+    help: 'Number of file system operations per execution',
+    labelNames: ['tenant_id', 'intent_type'],
+    buckets: [0, 1, 5, 10, 25, 50, 100, 500, 1000],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// Resource Violation Metrics
+// =============================================================================
+/**
+ * Resource limit violations total
+ */
+export const resourceViolationsTotal = new Counter({
+    name: 'vorion_cognigate_resource_violations_total',
+    help: 'Total number of resource limit violations',
+    labelNames: ['tenant_id', 'violation_type'], // memory_exceeded, cpu_exceeded, timeout_exceeded, network_limit_exceeded, filesystem_limit_exceeded
+    registers: [vorionRegistry],
+});
+/**
+ * Executions terminated due to resource limits
+ */
+export const terminationsTotal = new Counter({
+    name: 'vorion_cognigate_terminations_total',
+    help: 'Total number of executions terminated due to resource limits',
+    labelNames: ['tenant_id', 'reason'],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// Output Validation Metrics
+// =============================================================================
+/**
+ * Output validations total
+ */
+export const outputValidationsTotal = new Counter({
+    name: 'vorion_cognigate_output_validations_total',
+    help: 'Total number of output validations',
+    labelNames: ['tenant_id', 'result', 'mode'], // result: valid, invalid; mode: strict, permissive
+    registers: [vorionRegistry],
+});
+/**
+ * Output validation duration histogram
+ */
+export const outputValidationDuration = new Histogram({
+    name: 'vorion_cognigate_output_validation_duration_ms',
+    help: 'Output validation duration in milliseconds',
+    labelNames: ['tenant_id'],
+    buckets: [1, 5, 10, 25, 50, 100, 250, 500],
+    registers: [vorionRegistry],
+});
+/**
+ * PII detections total
+ */
+export const piiDetectionsTotal = new Counter({
+    name: 'vorion_cognigate_pii_detections_total',
+    help: 'Total number of PII detections in output',
+    labelNames: ['tenant_id', 'pii_type'],
+    registers: [vorionRegistry],
+});
+/**
+ * Output sanitizations total
+ */
+export const outputSanitizationsTotal = new Counter({
+    name: 'vorion_cognigate_output_sanitizations_total',
+    help: 'Total number of outputs sanitized',
+    labelNames: ['tenant_id'],
+    registers: [vorionRegistry],
+});
+/**
+ * Prohibited patterns detected total
+ */
+export const prohibitedPatternsTotal = new Counter({
+    name: 'vorion_cognigate_prohibited_patterns_total',
+    help: 'Total number of prohibited patterns detected',
+    labelNames: ['tenant_id', 'pattern_type', 'severity'],
+    registers: [vorionRegistry],
+});
+// =============================================================================
+// Helper Functions
+// =============================================================================
+/**
+ * Record execution start
+ */
+export function recordExecutionStart(tenantId, intentType) {
+    executionsStartedTotal.inc({ tenant_id: tenantId, intent_type: intentType });
+    activeExecutions.inc({ tenant_id: tenantId });
+}
+/**
+ * Record execution completion
+ */
+export function recordExecutionComplete(tenantId, intentType, result, durationSeconds) {
+    executionsCompletedTotal.inc({ tenant_id: tenantId, intent_type: intentType, result });
+    executionDuration.observe({ tenant_id: tenantId, intent_type: intentType, result }, durationSeconds);
+    activeExecutions.dec({ tenant_id: tenantId });
+}
+/**
+ * Record resource usage
+ */
+export function recordResourceUsage(tenantId, intentType, usage) {
+    memoryPeakMb.observe({ tenant_id: tenantId, intent_type: intentType }, usage.memoryPeakMb);
+    cpuTimeMs.observe({ tenant_id: tenantId, intent_type: intentType }, usage.cpuTimeMs);
+    networkRequestsPerExecution.observe({ tenant_id: tenantId, intent_type: intentType }, usage.networkRequests);
+    fileSystemOpsPerExecution.observe({ tenant_id: tenantId, intent_type: intentType }, usage.fileSystemOps);
+}
+/**
+ * Record resource violation
+ */
+export function recordResourceViolation(tenantId, violationType) {
+    resourceViolationsTotal.inc({ tenant_id: tenantId, violation_type: violationType });
+}
+/**
+ * Record execution termination
+ */
+export function recordTermination(tenantId, reason) {
+    terminationsTotal.inc({ tenant_id: tenantId, reason });
+}
+/**
+ * Record output validation
+ */
+export function recordOutputValidation(tenantId, result, mode, durationMs) {
+    outputValidationsTotal.inc({ tenant_id: tenantId, result, mode });
+    outputValidationDuration.observe({ tenant_id: tenantId }, durationMs);
+}
+/**
+ * Record PII detection
+ */
+export function recordPIIDetection(tenantId, piiType) {
+    piiDetectionsTotal.inc({ tenant_id: tenantId, pii_type: piiType });
+}
+/**
+ * Record output sanitization
+ */
+export function recordOutputSanitization(tenantId) {
+    outputSanitizationsTotal.inc({ tenant_id: tenantId });
+}
+/**
+ * Record prohibited pattern detection
+ */
+export function recordProhibitedPattern(tenantId, patternType, severity) {
+    prohibitedPatternsTotal.inc({ tenant_id: tenantId, pattern_type: patternType, severity });
+}
+//# sourceMappingURL=metrics.js.map

package/dist/cognigate/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/cognigate/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,OAAO,CAAC;IAChD,IAAI,EAAE,2CAA2C;IACjD,IAAI,EAAE,oCAAoC;IAC1C,UAAU,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU;IACjD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,OAAO,CAAC;IAClD,IAAI,EAAE,6CAA6C;IACnD,IAAI,EAAE,sCAAsC;IAC5C,UAAU,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAU,EAAE,uCAAuC;IACpG,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,SAAS,CAAC;IAC7C,IAAI,EAAE,6CAA6C;IACnD,IAAI,EAAE,+BAA+B;IACrC,UAAU,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAU;IAC3D,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC;IAClD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,KAAK,CAAC;IACxC,IAAI,EAAE,oCAAoC;IAC1C,IAAI,EAAE,uCAAuC;IAC7C,UAAU,EAAE,CAAC,WAAW,CAAU;IAClC,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC;IACxC,IAAI,EAAE,iCAAiC;IACvC,IAAI,EAAE,yBAAyB;IAC/B,UAAU,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU;IACjD,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;IACtD,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC;IACrC,IAAI,EAAE,8BAA8B;IACpC,IAAI,EAAE,gCAAgC;IACtC,UAAU,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU;IACjD,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;IAC5D,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,SAAS,CAAC;IACvD,IAAI,EAAE,mCAAmC;IACzC,IAAI,EAAE,0CAA0C;IAChD,UAAU,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU;IACjD,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC7C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,SAAS,CAAC;IACrD,IAAI,EAAE,iCAAiC;IACvC,IAAI,EAAE,gDAAgD;IACtD,UAAU,EAAE,CAAC,WAAW,EAAE,aAAa,CAAU;IACjD,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;IAC9C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,gFAAgF;AAChF,6BAA6B;AAC7B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,OAAO,CAAC;IACjD,IAAI,EAAE,4CAA4C;IAClD,IAAI,EAAE,2CAA2C;IACjD,UAAU,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAU,EAAE,qGAAqG;IAC3J,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,OAAO,CAAC;IAC3C,IAAI,EAAE,qCAAqC;IAC3C,IAAI,EAAE,8DAA8D;IACpE,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAU;IAC5C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,OAAO,CAAC;IAChD,IAAI,EAAE,2CAA2C;IACjD,IAAI,EAAE,oCAAoC;IAC1C,UAAU,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAU,EAAE,mDAAmD;IACzG,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,SAAS,CAAC;IACpD,IAAI,EAAE,gDAAgD;IACtD,IAAI,EAAE,4CAA4C;IAClD,UAAU,EAAE,CAAC,WAAW,CAAU;IAClC,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;IAC1C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,OAAO,CAAC;IAC5C,IAAI,EAAE,uCAAuC;IAC7C,IAAI,EAAE,0CAA0C;IAChD,UAAU,EAAE,CAAC,WAAW,EAAE,UAAU,CAAU;IAC9C,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,OAAO,CAAC;IAClD,IAAI,EAAE,6CAA6C;IACnD,IAAI,EAAE,mCAAmC;IACzC,UAAU,EAAE,CAAC,WAAW,CAAU;IAClC,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,OAAO,CAAC;IACjD,IAAI,EAAE,4CAA4C;IAClD,IAAI,EAAE,8CAA8C;IACpD,UAAU,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,CAAU;IAC9D,SAAS,EAAE,CAAC,cAAc,CAAC;CAC5B,CAAC,CAAC;AAEH,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,UAAkB;IACvE,sBAAsB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7E,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,UAAkB,EAClB,MAA4C,EAC5C,eAAuB;IAEvB,wBAAwB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IACvF,iBAAiB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;IACrG,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAgB,EAChB,UAAkB,EAClB,KAKC;IAED,YAAY,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3F,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACrF,2BAA2B,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7G,yBAAyB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;AAC3G,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,aAA+H;IAE/H,uBAAuB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC;AACtF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,MAAc;IAChE,iBAAiB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,MAA2B,EAC3B,IAA6B,EAC7B,UAAkB;IAElB,sBAAsB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,wBAAwB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,CAAC;AACxE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,OAAe;IAClE,kBAAkB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,wBAAwB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAgB,EAChB,WAAmB,EACnB,QAAgD;IAEhD,uBAAuB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC5F,CAAC"}