agent-assurance 0.1.0

package/dist/graph/build.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Toxic-flow graph builder (FR-3.1).
+ *
+ * Turns a Capability Manifest into a directed graph over which we detect *transitive* attack
+ * paths that single-prompt scanners miss. Nodes are the agent core, its tools, its untrusted
+ * ingress points, and the data scopes it can reach; edges are the data-flow reachability the
+ * manifest implies. Every dangerous edge is tagged with the trifecta/RCE *leg* it belongs to,
+ * so a declared mitigation can cut exactly that leg.
+ *
+ * Pure and in-memory — no agent execution — so it is fast (NFR-6, < 60s) and CI-safe (FR-3.4).
+ */
+import type { CapabilityManifest, MitigationLeg, SideEffectClass } from "../manifest/schema";
+export type NodeKind = "agent" | "untrusted-ingress" | "data-scope" | "tool";
+export interface GraphNode {
+    id: string;
+    kind: NodeKind;
+    label: string;
+    sideEffect?: SideEffectClass;
+    sensitivity?: "public" | "private";
+}
+/** A directed data-flow edge. `leg` names the trifecta/RCE leg a mitigation can cut here. */
+export interface GraphEdge {
+    from: string;
+    to: string;
+    leg?: MitigationLeg;
+}
+export interface CapabilityGraph {
+    nodes: Map<string, GraphNode>;
+    edges: GraphEdge[];
+}
+/**
+ * A detected composition risk over the manifest. `mitigated` is true when a declared mitigation
+ * breaks at least one leg (the flow is structurally present but claimed-controlled → YELLOW);
+ * an unmitigated flow is a critical finding (FR-3.2). `nodes` are the exact manifest-derived
+ * node ids that form the flow, so remediation is unambiguous (FR-3.3).
+ */
+export interface ToxicFlow {
+    id: string;
+    kind: "lethal-trifecta" | "untrusted-to-code-exec";
+    legs: MitigationLeg[];
+    nodes: string[];
+    mitigated: boolean;
+    brokenLegs: MitigationLeg[];
+    rationale: string;
+}
+export declare const AGENT_ID = "agent";
+/** Build the capability graph from a validated manifest. */
+export declare function buildCapabilityGraph(manifest: CapabilityManifest): CapabilityGraph;
+/** The legs a manifest's declared mitigations break (a mitigation counts only with a control). */
+export declare function brokenLegs(manifest: CapabilityManifest): Set<MitigationLeg>;
+/**
+ * The source node of a surviving edge into the agent carrying `leg` (undefined if the leg is cut
+ * or absent). Robust to data-scope node dedup: a leg is determined by the edge, not by a node's
+ * stored sensitivity, so the trifecta verdict never depends on tool declaration order.
+ */
+export declare function sourceViaLeg(graph: CapabilityGraph, leg: MitigationLeg, cut: ReadonlySet<MitigationLeg>): GraphNode | undefined;
+/** Direct predecessors of a node, skipping edges whose leg is in `cut`. */
+export declare function predecessors(graph: CapabilityGraph, target: string, cut: ReadonlySet<MitigationLeg>): GraphNode[];
+/** Node ids reachable forward from `start` (BFS), skipping edges whose leg is in `cut`. */
+export declare function reachableFrom(graph: CapabilityGraph, start: string, cut: ReadonlySet<MitigationLeg>): Set<string>;

package/dist/graph/flows.d.ts

@@ -0,0 +1,14 @@
+/**
+ * General transitive-composition detection (FR-3.1).
+ *
+ * The lethal trifecta is the flagship (trifecta.ts). This adds the other canonical composition
+ * risk — `read_untrusted -> code_exec` — where untrusted content reaching the agent can drive a
+ * code-execution tool (config-injection RCE). Returns every detected flow, mitigated or not, so
+ * the report can show controlled flows as YELLOW and unmitigated ones as critical.
+ */
+import type { CapabilityManifest } from "../manifest/schema";
+import { type ToxicFlow } from "./build";
+/** Detect the untrusted-content -> code-execution path, or null when absent. */
+export declare function findUntrustedToCodeExec(manifest: CapabilityManifest): ToxicFlow | null;
+/** All toxic flows on a manifest: the lethal trifecta plus transitive RCE paths (FR-3.1/3.2). */
+export declare function analyzeToxicFlows(manifest: CapabilityManifest): ToxicFlow[];

package/dist/graph/index.d.ts

@@ -0,0 +1,4 @@
+/** Toxic-flow graph subsystem (FR-3): static composition-risk analysis over a manifest. */
+export * from "./build";
+export * from "./trifecta";
+export * from "./flows";

package/dist/graph/trifecta.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Lethal-trifecta query (FR-3.2) — the flagship toxic-flow rule.
+ *
+ * Flags any composition where private data reaches the agent AND untrusted content reaches the
+ * agent (the injection enabler) AND the agent can reach an external-egress sink — with no
+ * declared mitigation breaking a leg. This is the runtime, graph-discoverable equivalent of the
+ * Agentic Product Standard's `lethal_trifecta_check.py`, and returns the same verdict on the
+ * same inputs (see graph.test.ts for the parity assertion).
+ */
+import type { CapabilityManifest } from "../manifest/schema";
+import { type ToxicFlow } from "./build";
+/** Detect the lethal trifecta on a manifest. Null when fewer than three legs are present. */
+export declare function findLethalTrifecta(manifest: CapabilityManifest): ToxicFlow | null;

package/dist/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * AAL Core — public entry point.
+ *
+ * Framework-neutral offensive red-team engine for AI agents. This file re-exports the
+ * stable public API as subsystems land (manifest, adapter, graph, attacks, runner, report).
+ *
+ * INVARIANT: this package imports no AgenticMind code. Keep it that way.
+ */
+export declare const AAL_CORE_VERSION: "0.1.0";
+/** Verdict vocabulary. Fail-closed: unknown/inconclusive is `not_verified`, never `safe`. */
+export type Verdict = "pass" | "fail" | "not_verified";
+export * from "./manifest";
+export * from "./adapter";
+export * from "./graph";
+export * from "./attacks";
+export * from "./runner";
+export * from "./report";
+export * from "./scan";