agent-assurance 0.1.0

package/dist/adapter/types.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Target Adapter interface (FR-1.1).
+ *
+ * The adapter is the single seam AAL Core uses to *run* a target agent — it knows nothing
+ * about the agent's framework. Every concrete adapter (exec/http/sdk) returns the same shape:
+ * the agent's text AND its structured tool calls. Capturing `toolCalls` (not just `text`) is
+ * what makes execution-layer side-effect detection possible (FR-4).
+ */
+import type { Result } from "neverthrow";
+/** A single tool invocation the target agent emitted during a run. */
+export interface ToolCall {
+    tool: string;
+    args: unknown;
+}
+/** The observable result of one agent run: its prose and every tool it invoked. */
+export interface AgentRun {
+    text: string;
+    toolCalls: ToolCall[];
+}
+/** A typed adapter failure. Fail-closed: any of these ⇒ the attack result is `not_verified`. */
+export type AdapterError = {
+    kind: "spawn";
+    message: string;
+} | {
+    kind: "timeout";
+    message: string;
+} | {
+    kind: "protocol";
+    message: string;
+} | {
+    kind: "exit";
+    code: number | null;
+    message: string;
+} | {
+    kind: "unsupported";
+    message: string;
+};
+/** How AAL Core runs a target agent. One input in, one observed run out. */
+export interface TargetAdapter {
+    runAgent(input: string): Promise<Result<AgentRun, AdapterError>>;
+}

package/dist/attacks/index.d.ts

@@ -0,0 +1,3 @@
+/** Attack Library subsystem (FR-2): schema + corpus loader. */
+export * from "./schema";
+export * from "./load";

package/dist/attacks/load.d.ts

@@ -0,0 +1,33 @@
+import { type Result } from "neverthrow";
+import { type Attack } from "./schema";
+export type AttackError = {
+    kind: "read";
+    path: string;
+    message: string;
+} | {
+    kind: "parse";
+    path: string;
+    message: string;
+} | {
+    kind: "validation";
+    path: string;
+    message: string;
+    issues: readonly AttackIssue[];
+} | {
+    kind: "empty";
+    path: string;
+    message: string;
+} | {
+    kind: "duplicate";
+    path: string;
+    message: string;
+    ids: readonly string[];
+};
+export interface AttackIssue {
+    path: string;
+    message: string;
+}
+/** Load + validate one corpus file's attacks. */
+export declare function loadAttackFile(path: string): Result<Attack[], AttackError>;
+/** Load every attack file in a directory, flatten, and enforce id uniqueness. */
+export declare function loadAttackCorpus(dir: string): Result<Attack[], AttackError>;

package/dist/attacks/schema.d.ts

@@ -0,0 +1,206 @@
+/**
+ * Attack Library schema (FR-2).
+ *
+ * Attacks are *data, not code* — contributors extend coverage by editing YAML, never engine
+ * internals (this productizes the Standard's injection_cases.yaml). Every attack maps to the
+ * OWASP Top 10 for Agentic Applications (ASI01–ASI10) and a MITRE ATLAS technique, and declares
+ * a machine-checkable success condition (assert predicates and/or an LLM rubric).
+ *
+ * Payload hygiene: corpus `input`s use synthetic, reserved indicators only (example/.test/.invalid
+ * domains, obviously-demonstrative markers) — never real secrets, targets, or weaponized
+ * jailbreaks. Findings never echo them back: they store the sha256 (hash-not-text, NFR-3).
+ */
+import { z } from "zod";
+export declare const AttackClass: z.ZodEnum<{
+    "prompt-injection": "prompt-injection";
+    "indirect-injection": "indirect-injection";
+    "tool-poisoning": "tool-poisoning";
+    "tool-shadowing": "tool-shadowing";
+    "mcp-rug-pull": "mcp-rug-pull";
+    "data-exfil": "data-exfil";
+    "trifecta-exploit": "trifecta-exploit";
+    "config-rce": "config-rce";
+}>;
+export type AttackClass = z.infer<typeof AttackClass>;
+/** OWASP Top 10 for Agentic Applications (2026). */
+export declare const OwaspAsi: z.ZodEnum<{
+    ASI01: "ASI01";
+    ASI02: "ASI02";
+    ASI03: "ASI03";
+    ASI04: "ASI04";
+    ASI05: "ASI05";
+    ASI06: "ASI06";
+    ASI07: "ASI07";
+    ASI08: "ASI08";
+    ASI09: "ASI09";
+    ASI10: "ASI10";
+}>;
+export type OwaspAsi = z.infer<typeof OwaspAsi>;
+/** A MITRE ATLAS id, e.g. `AML.T0051` (LLM prompt injection) or a tactic `AML.TA0000`. */
+export declare const AtlasId: z.ZodString;
+/**
+ * One success predicate. Each evaluates to *did the attack succeed* (i.e. the unsafe condition
+ * holds) — TRUE means the target is vulnerable. Composed with OR across the `assert` array.
+ */
+export declare const Assertion: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"text-contains">;
+    value: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"text-matches">;
+    pattern: z.ZodString;
+    flags: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"tool-called">;
+    tool: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"side-effect-fired">;
+    sideEffect: z.ZodEnum<{
+        read: "read";
+        write: "write";
+        "external-egress": "external-egress";
+        "code-exec": "code-exec";
+    }>;
+}, z.core.$strip>], "type">;
+export type Assertion = z.infer<typeof Assertion>;
+/** The attack's machine-checkable success condition. At least one of assert/llmRubric required. */
+export declare const SuccessCondition: z.ZodObject<{
+    assert: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"text-contains">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"text-matches">;
+        pattern: z.ZodString;
+        flags: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"tool-called">;
+        tool: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"side-effect-fired">;
+        sideEffect: z.ZodEnum<{
+            read: "read";
+            write: "write";
+            "external-egress": "external-egress";
+            "code-exec": "code-exec";
+        }>;
+    }, z.core.$strip>], "type">>>;
+    llmRubric: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SuccessCondition = z.infer<typeof SuccessCondition>;
+export declare const Attack: z.ZodObject<{
+    id: z.ZodString;
+    class: z.ZodEnum<{
+        "prompt-injection": "prompt-injection";
+        "indirect-injection": "indirect-injection";
+        "tool-poisoning": "tool-poisoning";
+        "tool-shadowing": "tool-shadowing";
+        "mcp-rug-pull": "mcp-rug-pull";
+        "data-exfil": "data-exfil";
+        "trifecta-exploit": "trifecta-exploit";
+        "config-rce": "config-rce";
+    }>;
+    owasp: z.ZodEnum<{
+        ASI01: "ASI01";
+        ASI02: "ASI02";
+        ASI03: "ASI03";
+        ASI04: "ASI04";
+        ASI05: "ASI05";
+        ASI06: "ASI06";
+        ASI07: "ASI07";
+        ASI08: "ASI08";
+        ASI09: "ASI09";
+        ASI10: "ASI10";
+    }>;
+    atlas: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    lang: z.ZodDefault<z.ZodEnum<{
+        en: "en";
+        ru: "ru";
+    }>>;
+    input: z.ZodString;
+    vars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    success: z.ZodObject<{
+        assert: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"text-contains">;
+            value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"text-matches">;
+            pattern: z.ZodString;
+            flags: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"tool-called">;
+            tool: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"side-effect-fired">;
+            sideEffect: z.ZodEnum<{
+                read: "read";
+                write: "write";
+                "external-egress": "external-egress";
+                "code-exec": "code-exec";
+            }>;
+        }, z.core.$strip>], "type">>>;
+        llmRubric: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type Attack = z.infer<typeof Attack>;
+/** One corpus YAML file: a versioned list of attacks. */
+export declare const AttackFile: z.ZodObject<{
+    version: z.ZodOptional<z.ZodString>;
+    attacks: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        class: z.ZodEnum<{
+            "prompt-injection": "prompt-injection";
+            "indirect-injection": "indirect-injection";
+            "tool-poisoning": "tool-poisoning";
+            "tool-shadowing": "tool-shadowing";
+            "mcp-rug-pull": "mcp-rug-pull";
+            "data-exfil": "data-exfil";
+            "trifecta-exploit": "trifecta-exploit";
+            "config-rce": "config-rce";
+        }>;
+        owasp: z.ZodEnum<{
+            ASI01: "ASI01";
+            ASI02: "ASI02";
+            ASI03: "ASI03";
+            ASI04: "ASI04";
+            ASI05: "ASI05";
+            ASI06: "ASI06";
+            ASI07: "ASI07";
+            ASI08: "ASI08";
+            ASI09: "ASI09";
+            ASI10: "ASI10";
+        }>;
+        atlas: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        lang: z.ZodDefault<z.ZodEnum<{
+            en: "en";
+            ru: "ru";
+        }>>;
+        input: z.ZodString;
+        vars: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        success: z.ZodObject<{
+            assert: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"text-contains">;
+                value: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"text-matches">;
+                pattern: z.ZodString;
+                flags: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"tool-called">;
+                tool: z.ZodString;
+            }, z.core.$strip>, z.ZodObject<{
+                type: z.ZodLiteral<"side-effect-fired">;
+                sideEffect: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                    "external-egress": "external-egress";
+                    "code-exec": "code-exec";
+                }>;
+            }, z.core.$strip>], "type">>>;
+            llmRubric: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AttackFile = z.infer<typeof AttackFile>;
+/** Render an attack's input, substituting `{{var}}` placeholders from its `vars` map. */
+export declare function renderAttackInput(attack: Attack): string;

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};