@weave_protocol/mund 0.1.0

package/dist/analyzers/code-analyzer.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Mund - The Guardian Protocol
+ * Code Analyzer - Detects dangerous code patterns
+ */
+import { type DetectionRule, type SecurityIssue, type IAnalyzer } from '../types.js';
+export declare class CodeAnalyzer implements IAnalyzer {
+    name: string;
+    type: string;
+    analyze(content: string, rules: DetectionRule[]): Promise<SecurityIssue[]>;
+    /**
+     * Calculate location within content
+     */
+    private getLocation;
+    /**
+     * Truncate match for display
+     */
+    private truncateMatch;
+    /**
+     * Get context-aware suggestion
+     */
+    private getSuggestion;
+}
+export default CodeAnalyzer;
+//# sourceMappingURL=code-analyzer.d.ts.map

package/dist/analyzers/code-analyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-analyzer.d.ts","sourceRoot":"","sources":["../../src/analyzers/code-analyzer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAErB,qBAAa,YAAa,YAAW,SAAS;IAC5C,IAAI,SAAkB;IACtB,IAAI,SAAkB;IAEhB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAkChF;;OAEG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,aAAa;IAKrB;;OAEG;IACH,OAAO,CAAC,aAAa;CAatB;AAED,eAAe,YAAY,CAAC"}

package/dist/analyzers/code-analyzer.js

@@ -0,0 +1,73 @@
+/**
+ * Mund - The Guardian Protocol
+ * Code Analyzer - Detects dangerous code patterns
+ */
+export class CodeAnalyzer {
+    name = 'CodeAnalyzer';
+    type = 'code_pattern';
+    async analyze(content, rules) {
+        const issues = [];
+        const codeRules = rules.filter(r => r.type === 'code_pattern' && r.enabled);
+        for (const rule of codeRules) {
+            if (!rule.pattern)
+                continue;
+            try {
+                const regex = new RegExp(rule.pattern, 'gm');
+                let match;
+                while ((match = regex.exec(content)) !== null) {
+                    const matchText = match[0];
+                    const location = this.getLocation(content, match.index, matchText.length);
+                    issues.push({
+                        rule_id: rule.id,
+                        rule_name: rule.name,
+                        type: rule.type,
+                        severity: rule.severity,
+                        action: rule.action,
+                        match: this.truncateMatch(matchText),
+                        location,
+                        suggestion: this.getSuggestion(rule.id, matchText)
+                    });
+                }
+            }
+            catch (error) {
+                console.error(`Invalid regex pattern in rule ${rule.id}:`, error);
+            }
+        }
+        return issues;
+    }
+    /**
+     * Calculate location within content
+     */
+    getLocation(content, start, length) {
+        const end = start + length;
+        const lines = content.substring(0, start).split('\n');
+        const line = lines.length;
+        const column = lines[lines.length - 1].length + 1;
+        return { start, end, line, column };
+    }
+    /**
+     * Truncate match for display
+     */
+    truncateMatch(match, maxLength = 100) {
+        if (match.length <= maxLength)
+            return match;
+        return match.substring(0, maxLength) + '...';
+    }
+    /**
+     * Get context-aware suggestion
+     */
+    getSuggestion(ruleId, _match) {
+        const suggestions = {
+            shell_injection: 'Avoid using string interpolation in shell commands. Use parameterized commands or escape inputs properly.',
+            sql_injection_pattern: 'Use parameterized queries or prepared statements instead of string concatenation for SQL.',
+            dangerous_chmod: 'Avoid overly permissive file permissions. Use the minimum required permissions (e.g., 644 for files, 755 for directories).',
+            rm_rf: 'Be extremely careful with recursive deletion. Consider using trash/recycle functionality instead.',
+            curl_bash: 'Piping curl to bash is dangerous. Download the script first, review it, then execute.',
+            base64_decode_exec: 'Decoding and executing arbitrary content is dangerous. Validate the source and content first.',
+            disable_ssl_verify: 'Disabling SSL verification exposes you to man-in-the-middle attacks. Fix certificate issues instead.',
+        };
+        return suggestions[ruleId] || 'Review this code pattern for potential security issues.';
+    }
+}
+export default CodeAnalyzer;
+//# sourceMappingURL=code-analyzer.js.map

package/dist/analyzers/code-analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-analyzer.js","sourceRoot":"","sources":["../../src/analyzers/code-analyzer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,OAAO,YAAY;IACvB,IAAI,GAAG,cAAc,CAAC;IACtB,IAAI,GAAG,cAAc,CAAC;IAEtB,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,KAAsB;QACnD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAE5E,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAE5B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC7C,IAAI,KAA6B,CAAC;gBAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;oBAE1E,MAAM,CAAC,IAAI,CAAC;wBACV,OAAO,EAAE,IAAI,CAAC,EAAE;wBAChB,SAAS,EAAE,IAAI,CAAC,IAAI;wBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;wBACpC,QAAQ;wBACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC;qBACnD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;QAClD,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC/C,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAc,EAAE,MAAc;QAClD,MAAM,WAAW,GAA2B;YAC1C,eAAe,EAAE,2GAA2G;YAC5H,qBAAqB,EAAE,2FAA2F;YAClH,eAAe,EAAE,4HAA4H;YAC7I,KAAK,EAAE,mGAAmG;YAC1G,SAAS,EAAE,uFAAuF;YAClG,kBAAkB,EAAE,+FAA+F;YACnH,kBAAkB,EAAE,sGAAsG;SAC3H,CAAC;QAEF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,yDAAyD,CAAC;IAC1F,CAAC;CACF;AAED,eAAe,YAAY,CAAC"}

package/dist/analyzers/exfiltration-detector.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Mund - The Guardian Protocol
+ * Exfiltration Detector - Detects data exfiltration attempts
+ */
+import { type DetectionRule, type SecurityIssue, type IAnalyzer } from '../types.js';
+export declare class ExfiltrationDetector implements IAnalyzer {
+    name: string;
+    type: string;
+    analyze(content: string, rules: DetectionRule[]): Promise<SecurityIssue[]>;
+    /**
+     * Extract and analyze URLs in content
+     */
+    private analyzeURLs;
+    /**
+     * Detect suspicious data encoding patterns
+     */
+    private detectSuspiciousEncoding;
+    /**
+     * Check if string is likely base64
+     */
+    private isLikelyBase64;
+    /**
+     * Calculate location within content
+     */
+    private getLocation;
+    /**
+     * Truncate match for display
+     */
+    private truncateMatch;
+    /**
+     * Truncate URL for display (hide potential sensitive parts)
+     */
+    private truncateURL;
+    /**
+     * Get remediation suggestion
+     */
+    private getSuggestion;
+}
+export default ExfiltrationDetector;
+//# sourceMappingURL=exfiltration-detector.d.ts.map

package/dist/analyzers/exfiltration-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exfiltration-detector.d.ts","sourceRoot":"","sources":["../../src/analyzers/exfiltration-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAGrB,qBAAa,oBAAqB,YAAW,SAAS;IACpD,IAAI,SAA0B;IAC9B,IAAI,SAAkB;IAEhB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IA2ChF;;OAEG;IACH,OAAO,CAAC,WAAW;IA4DnB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAgDhC;;OAEG;IACH,OAAO,CAAC,cAAc;IAqBtB;;OAEG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,aAAa;IAKrB;;OAEG;IACH,OAAO,CAAC,WAAW;IAsBnB;;OAEG;IACH,OAAO,CAAC,aAAa;CAStB;AAED,eAAe,oBAAoB,CAAC"}

package/dist/analyzers/exfiltration-detector.js

@@ -0,0 +1,220 @@
+/**
+ * Mund - The Guardian Protocol
+ * Exfiltration Detector - Detects data exfiltration attempts
+ */
+import { DANGEROUS_URL_PATTERNS } from '../constants.js';
+export class ExfiltrationDetector {
+    name = 'ExfiltrationDetector';
+    type = 'exfiltration';
+    async analyze(content, rules) {
+        const issues = [];
+        const exfilRules = rules.filter(r => r.type === 'exfiltration' && r.enabled);
+        // Pattern-based detection
+        for (const rule of exfilRules) {
+            if (!rule.pattern)
+                continue;
+            try {
+                const regex = new RegExp(rule.pattern, 'gi');
+                let match;
+                while ((match = regex.exec(content)) !== null) {
+                    const matchText = match[0];
+                    const location = this.getLocation(content, match.index, matchText.length);
+                    issues.push({
+                        rule_id: rule.id,
+                        rule_name: rule.name,
+                        type: rule.type,
+                        severity: rule.severity,
+                        action: rule.action,
+                        match: this.truncateMatch(matchText),
+                        location,
+                        suggestion: this.getSuggestion(rule.id)
+                    });
+                }
+            }
+            catch (error) {
+                console.error(`Invalid regex pattern in rule ${rule.id}:`, error);
+            }
+        }
+        // URL extraction and analysis
+        const urlIssues = this.analyzeURLs(content);
+        issues.push(...urlIssues);
+        // Data encoding detection
+        const encodingIssues = this.detectSuspiciousEncoding(content);
+        issues.push(...encodingIssues);
+        return issues;
+    }
+    /**
+     * Extract and analyze URLs in content
+     */
+    analyzeURLs(content) {
+        const issues = [];
+        // URL regex pattern
+        const urlRegex = /https?:\/\/[^\s"'<>)}\]]+/gi;
+        let match;
+        while ((match = urlRegex.exec(content)) !== null) {
+            const url = match[0];
+            const location = this.getLocation(content, match.index, url.length);
+            // Check against dangerous patterns
+            for (const pattern of DANGEROUS_URL_PATTERNS) {
+                if (pattern.test(url)) {
+                    issues.push({
+                        rule_id: 'dangerous_url',
+                        rule_name: 'Dangerous URL Detected',
+                        type: 'exfiltration',
+                        severity: 'high',
+                        action: 'alert',
+                        match: this.truncateURL(url),
+                        location,
+                        suggestion: 'This URL points to a service commonly used for data exfiltration. Verify the destination is legitimate.'
+                    });
+                    break;
+                }
+            }
+            // Check for IP-based URLs
+            if (/^https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/.test(url)) {
+                issues.push({
+                    rule_id: 'ip_based_url',
+                    rule_name: 'IP-Based URL',
+                    type: 'exfiltration',
+                    severity: 'medium',
+                    action: 'alert',
+                    match: this.truncateURL(url),
+                    location,
+                    suggestion: 'IP-based URLs can bypass domain-based security controls. Verify this is a legitimate destination.'
+                });
+            }
+            // Check for data URLs
+            if (/^data:/i.test(url)) {
+                issues.push({
+                    rule_id: 'data_url',
+                    rule_name: 'Data URL Detected',
+                    type: 'exfiltration',
+                    severity: 'medium',
+                    action: 'alert',
+                    match: this.truncateURL(url),
+                    location,
+                    suggestion: 'Data URLs can encode and transfer arbitrary content. Review the embedded data.'
+                });
+            }
+        }
+        return issues;
+    }
+    /**
+     * Detect suspicious data encoding patterns
+     */
+    detectSuspiciousEncoding(content) {
+        const issues = [];
+        // Large base64 blocks (potential data exfiltration)
+        const base64Regex = /[A-Za-z0-9+/]{100,}={0,2}/g;
+        let match;
+        while ((match = base64Regex.exec(content)) !== null) {
+            const encoded = match[0];
+            // Verify it's likely base64 (not just a long alphanumeric string)
+            if (this.isLikelyBase64(encoded)) {
+                const location = this.getLocation(content, match.index, encoded.length);
+                issues.push({
+                    rule_id: 'large_base64_block',
+                    rule_name: 'Large Base64 Block',
+                    type: 'exfiltration',
+                    severity: 'medium',
+                    action: 'log',
+                    match: `Base64 block (${encoded.length} chars)`,
+                    location,
+                    suggestion: 'Large base64 encoded blocks may contain exfiltrated data. Review the decoded content.'
+                });
+            }
+        }
+        // Hex-encoded data blocks
+        const hexRegex = /(?:0x)?[0-9a-fA-F]{200,}/g;
+        while ((match = hexRegex.exec(content)) !== null) {
+            const encoded = match[0];
+            const location = this.getLocation(content, match.index, encoded.length);
+            issues.push({
+                rule_id: 'large_hex_block',
+                rule_name: 'Large Hex-Encoded Block',
+                type: 'exfiltration',
+                severity: 'low',
+                action: 'log',
+                match: `Hex block (${encoded.length} chars)`,
+                location,
+                suggestion: 'Large hex-encoded blocks may contain encoded data. Review the decoded content.'
+            });
+        }
+        return issues;
+    }
+    /**
+     * Check if string is likely base64
+     */
+    isLikelyBase64(str) {
+        // Check character distribution
+        const chars = new Set(str.replace(/=/g, ''));
+        // Base64 uses a specific character set
+        const base64Chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+        for (const char of chars) {
+            if (!base64Chars.includes(char))
+                return false;
+        }
+        // Check if it decodes to valid content
+        try {
+            const decoded = Buffer.from(str, 'base64').toString('utf8');
+            // Check if decoded content has a reasonable ratio of printable characters
+            const printable = decoded.replace(/[^\x20-\x7E]/g, '').length;
+            return printable / decoded.length > 0.7;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Calculate location within content
+     */
+    getLocation(content, start, length) {
+        const end = start + length;
+        const lines = content.substring(0, start).split('\n');
+        const line = lines.length;
+        const column = lines[lines.length - 1].length + 1;
+        return { start, end, line, column };
+    }
+    /**
+     * Truncate match for display
+     */
+    truncateMatch(match, maxLength = 100) {
+        if (match.length <= maxLength)
+            return match;
+        return match.substring(0, maxLength) + '...';
+    }
+    /**
+     * Truncate URL for display (hide potential sensitive parts)
+     */
+    truncateURL(url, maxLength = 80) {
+        try {
+            const parsed = new URL(url);
+            const base = `${parsed.protocol}//${parsed.host}`;
+            if (base.length >= maxLength) {
+                return base.substring(0, maxLength) + '...';
+            }
+            const remainingLength = maxLength - base.length;
+            const path = parsed.pathname + parsed.search;
+            if (path.length > remainingLength) {
+                return base + path.substring(0, remainingLength) + '...';
+            }
+            return base + path;
+        }
+        catch {
+            return url.substring(0, maxLength) + (url.length > maxLength ? '...' : '');
+        }
+    }
+    /**
+     * Get remediation suggestion
+     */
+    getSuggestion(ruleId) {
+        const suggestions = {
+            suspicious_url_post: 'This code sends data to a service commonly used for data capture. Verify the destination.',
+            dns_exfiltration: 'DNS queries with encoded data can be used for exfiltration. Monitor and restrict DNS access.',
+            data_encoding_suspicious: 'Encoding sensitive data before transmission may indicate exfiltration. Review the purpose.',
+        };
+        return suggestions[ruleId] || 'Review this pattern for potential data exfiltration.';
+    }
+}
+export default ExfiltrationDetector;
+//# sourceMappingURL=exfiltration-detector.js.map

package/dist/analyzers/exfiltration-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exfiltration-detector.js","sourceRoot":"","sources":["../../src/analyzers/exfiltration-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,OAAO,oBAAoB;IAC/B,IAAI,GAAG,sBAAsB,CAAC;IAC9B,IAAI,GAAG,cAAc,CAAC;IAEtB,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,KAAsB;QACnD,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAE7E,0BAA0B;QAC1B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,SAAS;YAE5B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC7C,IAAI,KAA6B,CAAC;gBAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;oBAE1E,MAAM,CAAC,IAAI,CAAC;wBACV,OAAO,EAAE,IAAI,CAAC,EAAE;wBAChB,SAAS,EAAE,IAAI,CAAC,IAAI;wBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;wBACpC,QAAQ;wBACR,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,iCAAiC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAE1B,0BAA0B;QAC1B,MAAM,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;QAE/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAe;QACjC,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,oBAAoB;QACpB,MAAM,QAAQ,GAAG,6BAA6B,CAAC;QAC/C,IAAI,KAA6B,CAAC;QAElC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAEpE,mCAAmC;YACnC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;gBAC7C,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtB,MAAM,CAAC,IAAI,CAAC;wBACV,OAAO,EAAE,eAAe;wBACxB,SAAS,EAAE,wBAAwB;wBACnC,IAAI,EAAE,cAAc;wBACpB,QAAQ,EAAE,MAAM;wBAChB,MAAM,EAAE,OAAO;wBACf,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;wBAC5B,QAAQ;wBACR,UAAU,EAAE,yGAAyG;qBACtH,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;YAED,0BAA0B;YAC1B,IAAI,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/D,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,cAAc;oBACvB,SAAS,EAAE,cAAc;oBACzB,IAAI,EAAE,cAAc;oBACpB,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBAC5B,QAAQ;oBACR,UAAU,EAAE,mGAAmG;iBAChH,CAAC,CAAC;YACL,CAAC;YAED,sBAAsB;YACtB,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,UAAU;oBACnB,SAAS,EAAE,mBAAmB;oBAC9B,IAAI,EAAE,cAAc;oBACpB,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,OAAO;oBACf,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;oBAC5B,QAAQ;oBACR,UAAU,EAAE,gFAAgF;iBAC7F,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,OAAe;QAC9C,MAAM,MAAM,GAAoB,EAAE,CAAC;QAEnC,oDAAoD;QACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC;QACjD,IAAI,KAA6B,CAAC;QAElC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEzB,kEAAkE;YAClE,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAExE,MAAM,CAAC,IAAI,CAAC;oBACV,OAAO,EAAE,oBAAoB;oBAC7B,SAAS,EAAE,oBAAoB;oBAC/B,IAAI,EAAE,cAAc;oBACpB,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,KAAK;oBACb,KAAK,EAAE,iBAAiB,OAAO,CAAC,MAAM,SAAS;oBAC/C,QAAQ;oBACR,UAAU,EAAE,uFAAuF;iBACpG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,2BAA2B,CAAC;QAC7C,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAExE,MAAM,CAAC,IAAI,CAAC;gBACV,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,yBAAyB;gBACpC,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,cAAc,OAAO,CAAC,MAAM,SAAS;gBAC5C,QAAQ;gBACR,UAAU,EAAE,gFAAgF;aAC7F,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,GAAW;QAChC,+BAA+B;QAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QAE7C,uCAAuC;QACvC,MAAM,WAAW,GAAG,kEAAkE,CAAC;QACvF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QAChD,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5D,0EAA0E;YAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YAC9D,OAAO,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,KAAK,GAAG,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,KAAa,EAAE,SAAS,GAAG,GAAG;QAClD,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC/C,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAW,EAAE,SAAS,GAAG,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;YAElD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;YAC9C,CAAC;YAED,MAAM,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;YAE7C,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;gBAClC,OAAO,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,GAAG,KAAK,CAAC;YAC3D,CAAC;YAED,OAAO,IAAI,GAAG,IAAI,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,MAAc;QAClC,MAAM,WAAW,GAA2B;YAC1C,mBAAmB,EAAE,2FAA2F;YAChH,gBAAgB,EAAE,8FAA8F;YAChH,wBAAwB,EAAE,4FAA4F;SACvH,CAAC;QAEF,OAAO,WAAW,CAAC,MAAM,CAAC,IAAI,sDAAsD,CAAC;IACvF,CAAC;CACF;AAED,eAAe,oBAAoB,CAAC"}

package/dist/analyzers/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Mund - The Guardian Protocol
+ * Analyzers Index - Exports all analyzer modules
+ */
+export { SecretScanner } from './secret-scanner.js';
+export { PIIDetector } from './pii-detector.js';
+export { CodeAnalyzer } from './code-analyzer.js';
+export { InjectionDetector } from './injection-detector.js';
+export { ExfiltrationDetector } from './exfiltration-detector.js';
+import type { IAnalyzer } from '../types.js';
+/**
+ * Get all available analyzers
+ */
+export declare function getAnalyzers(): IAnalyzer[];
+/**
+ * Create analyzer engine that runs all analyzers
+ */
+export declare class AnalyzerEngine {
+    private analyzers;
+    constructor(analyzers?: IAnalyzer[]);
+    analyzeAll(content: string, rules: import('../types.js').DetectionRule[]): Promise<import('../types.js').SecurityIssue[]>;
+    addAnalyzer(analyzer: IAnalyzer): void;
+    removeAnalyzer(name: string): void;
+    getAnalyzerNames(): string[];
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/analyzers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAOlE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;GAEG;AACH,wBAAgB,YAAY,IAAI,SAAS,EAAE,CAQ1C;AAED;;GAEG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAc;gBAEnB,SAAS,CAAC,EAAE,SAAS,EAAE;IAI7B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,aAAa,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,OAAO,aAAa,EAAE,aAAa,EAAE,CAAC;IAqB/H,WAAW,CAAC,QAAQ,EAAE,SAAS,GAAG,IAAI;IAItC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIlC,gBAAgB,IAAI,MAAM,EAAE;CAG7B"}

package/dist/analyzers/index.js

@@ -0,0 +1,61 @@
+/**
+ * Mund - The Guardian Protocol
+ * Analyzers Index - Exports all analyzer modules
+ */
+export { SecretScanner } from './secret-scanner.js';
+export { PIIDetector } from './pii-detector.js';
+export { CodeAnalyzer } from './code-analyzer.js';
+export { InjectionDetector } from './injection-detector.js';
+export { ExfiltrationDetector } from './exfiltration-detector.js';
+import { SecretScanner } from './secret-scanner.js';
+import { PIIDetector } from './pii-detector.js';
+import { CodeAnalyzer } from './code-analyzer.js';
+import { InjectionDetector } from './injection-detector.js';
+import { ExfiltrationDetector } from './exfiltration-detector.js';
+/**
+ * Get all available analyzers
+ */
+export function getAnalyzers() {
+    return [
+        new SecretScanner(),
+        new PIIDetector(),
+        new CodeAnalyzer(),
+        new InjectionDetector(),
+        new ExfiltrationDetector()
+    ];
+}
+/**
+ * Create analyzer engine that runs all analyzers
+ */
+export class AnalyzerEngine {
+    analyzers;
+    constructor(analyzers) {
+        this.analyzers = analyzers || getAnalyzers();
+    }
+    async analyzeAll(content, rules) {
+        const allIssues = [];
+        for (const analyzer of this.analyzers) {
+            try {
+                const issues = await analyzer.analyze(content, rules);
+                allIssues.push(...issues);
+            }
+            catch (error) {
+                console.error(`Error in analyzer ${analyzer.name}:`, error);
+            }
+        }
+        // Sort by severity (critical first)
+        const severityOrder = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+        allIssues.sort((a, b) => (severityOrder[a.severity] || 4) - (severityOrder[b.severity] || 4));
+        return allIssues;
+    }
+    addAnalyzer(analyzer) {
+        this.analyzers.push(analyzer);
+    }
+    removeAnalyzer(name) {
+        this.analyzers = this.analyzers.filter(a => a.name !== name);
+    }
+    getAnalyzerNames() {
+        return this.analyzers.map(a => a.name);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/analyzers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analyzers/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAGlE;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,IAAI,aAAa,EAAE;QACnB,IAAI,WAAW,EAAE;QACjB,IAAI,YAAY,EAAE;QAClB,IAAI,iBAAiB,EAAE;QACvB,IAAI,oBAAoB,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,CAAc;IAE/B,YAAY,SAAuB;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,YAAY,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,KAA4C;QAC5E,MAAM,SAAS,GAA0C,EAAE,CAAC;QAE5D,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACtD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;YAC5B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACtB,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CACpE,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,WAAW,CAAC,QAAmB;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC/D,CAAC;IAED,gBAAgB;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;CACF"}

package/dist/analyzers/injection-detector.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Mund - The Guardian Protocol
+ * Injection Detector - Detects prompt injection attempts
+ */
+import { type DetectionRule, type SecurityIssue, type IAnalyzer } from '../types.js';
+export declare class InjectionDetector implements IAnalyzer {
+    name: string;
+    type: string;
+    analyze(content: string, rules: DetectionRule[]): Promise<SecurityIssue[]>;
+    /**
+     * Normalize content to detect obfuscated injection attempts
+     */
+    private normalizeContent;
+    /**
+     * Heuristic analysis for injection patterns
+     */
+    private heuristicAnalysis;
+    /**
+     * Calculate ratio of special characters
+     */
+    private calculateSpecialCharRatio;
+    /**
+     * Calculate location within content
+     */
+    private getLocation;
+    /**
+     * Sanitize match for safe display
+     */
+    private sanitizeMatch;
+    /**
+     * Get remediation suggestion
+     */
+    private getSuggestion;
+}
+export default InjectionDetector;
+//# sourceMappingURL=injection-detector.d.ts.map

package/dist/analyzers/injection-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection-detector.d.ts","sourceRoot":"","sources":["../../src/analyzers/injection-detector.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,EAEf,MAAM,aAAa,CAAC;AAErB,qBAAa,iBAAkB,YAAW,SAAS;IACjD,IAAI,SAAuB;IAC3B,IAAI,SAAe;IAEb,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAyChF;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAYxB;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAmEzB;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAMjC;;OAEG;IACH,OAAO,CAAC,WAAW;IAQnB;;OAEG;IACH,OAAO,CAAC,aAAa;IAUrB;;OAEG;IACH,OAAO,CAAC,aAAa;CAUtB;AAED,eAAe,iBAAiB,CAAC"}