agent-assurance 0.1.0

package/dist/manifest/index.d.ts

@@ -0,0 +1,3 @@
+/** Capability Manifest subsystem (FR-1): schema + loader. */
+export * from "./schema";
+export * from "./load";

package/dist/manifest/load.d.ts

@@ -0,0 +1,25 @@
+import { type Result } from "neverthrow";
+import { CapabilityManifest } from "./schema";
+/** A typed manifest-loading failure. `issues` carries zod's per-field detail when relevant. */
+export type ManifestError = {
+    kind: "read";
+    path: string;
+    message: string;
+} | {
+    kind: "parse";
+    path: string;
+    message: string;
+} | {
+    kind: "validation";
+    path: string;
+    message: string;
+    issues: readonly ManifestIssue[];
+};
+export interface ManifestIssue {
+    path: string;
+    message: string;
+}
+/** Parse + validate an already-in-memory manifest value (source-agnostic). */
+export declare function parseManifest(raw: unknown, path?: string): Result<CapabilityManifest, ManifestError>;
+/** Load, parse (JSON or YAML by extension), and validate a manifest file. */
+export declare function loadManifest(path: string): Result<CapabilityManifest, ManifestError>;

package/dist/manifest/schema.d.ts

@@ -0,0 +1,136 @@
+/**
+ * Capability Manifest schema (FR-1.2).
+ *
+ * The manifest is the single framework-neutral input to AAL Core. It describes *what an
+ * agent can touch* — its tools and their side-effect class, the data it can read, where
+ * untrusted content enters, its identity model, and any mitigations the author declares —
+ * without AAL knowing anything about the agent's framework. It extends the Agentic Product
+ * Standard's `agent-capabilities.json` shape (private-data / untrusted-content / external-comms
+ * legs) with the structure the toxic-flow graph (FR-3) and the runner (FR-4/5) need.
+ */
+import { z } from "zod";
+/** Side-effect class of a declared tool. Drives severity and the toxic-flow graph. */
+export declare const SideEffectClass: z.ZodEnum<{
+    read: "read";
+    write: "write";
+    "external-egress": "external-egress";
+    "code-exec": "code-exec";
+}>;
+export type SideEffectClass = z.infer<typeof SideEffectClass>;
+/** A data scope a tool can reach. `private` reads are the private-data leg of the trifecta. */
+export declare const DataScope: z.ZodObject<{
+    id: z.ZodString;
+    sensitivity: z.ZodEnum<{
+        public: "public";
+        private: "private";
+    }>;
+}, z.core.$strip>;
+export type DataScope = z.infer<typeof DataScope>;
+/** A declared tool the agent can invoke. */
+export declare const Tool: z.ZodObject<{
+    name: z.ZodString;
+    sideEffect: z.ZodEnum<{
+        read: "read";
+        write: "write";
+        "external-egress": "external-egress";
+        "code-exec": "code-exec";
+    }>;
+    dataScopes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        sensitivity: z.ZodEnum<{
+            public: "public";
+            private: "private";
+        }>;
+    }, z.core.$strip>>>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type Tool = z.infer<typeof Tool>;
+/** A point where untrusted content enters the agent — the injection surface. */
+export declare const UntrustedIngress: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        retrieval: "retrieval";
+        web: "web";
+        email: "email";
+        "tool-output": "tool-output";
+        "user-upload": "user-upload";
+    }>;
+}, z.core.$strip>;
+export type UntrustedIngress = z.infer<typeof UntrustedIngress>;
+/** The trifecta/RCE legs a declared mitigation can break. Mirrors the APS gate's `leg`. */
+export declare const MitigationLeg: z.ZodEnum<{
+    "external-egress": "external-egress";
+    "code-exec": "code-exec";
+    "private-data": "private-data";
+    "untrusted-ingress": "untrusted-ingress";
+}>;
+export type MitigationLeg = z.infer<typeof MitigationLeg>;
+/**
+ * A mitigation the author declares as breaking one leg of a dangerous composition.
+ * A mitigation only counts if it names a non-empty `control` (mirrors the APS gate: a leg is
+ * broken only by a declared control, never by assertion alone).
+ */
+export declare const DeclaredMitigation: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    breaks: z.ZodEnum<{
+        "external-egress": "external-egress";
+        "code-exec": "code-exec";
+        "private-data": "private-data";
+        "untrusted-ingress": "untrusted-ingress";
+    }>;
+    control: z.ZodString;
+}, z.core.$strip>;
+export type DeclaredMitigation = z.infer<typeof DeclaredMitigation>;
+/** The agent's identity posture. Evidence for least-privilege controls in AAL Evidence. */
+export declare const Identity: z.ZodObject<{
+    delegated: z.ZodBoolean;
+    scoped: z.ZodBoolean;
+}, z.core.$strip>;
+export type Identity = z.infer<typeof Identity>;
+/** The Capability Manifest. Versioned so the schema can evolve without silent breakage. */
+export declare const CapabilityManifest: z.ZodObject<{
+    manifestVersion: z.ZodLiteral<"0.1">;
+    name: z.ZodString;
+    identity: z.ZodObject<{
+        delegated: z.ZodBoolean;
+        scoped: z.ZodBoolean;
+    }, z.core.$strip>;
+    tools: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        sideEffect: z.ZodEnum<{
+            read: "read";
+            write: "write";
+            "external-egress": "external-egress";
+            "code-exec": "code-exec";
+        }>;
+        dataScopes: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            sensitivity: z.ZodEnum<{
+                public: "public";
+                private: "private";
+            }>;
+        }, z.core.$strip>>>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    untrustedIngress: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodEnum<{
+            retrieval: "retrieval";
+            web: "web";
+            email: "email";
+            "tool-output": "tool-output";
+            "user-upload": "user-upload";
+        }>;
+    }, z.core.$strip>>>;
+    declaredMitigations: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        breaks: z.ZodEnum<{
+            "external-egress": "external-egress";
+            "code-exec": "code-exec";
+            "private-data": "private-data";
+            "untrusted-ingress": "untrusted-ingress";
+        }>;
+        control: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type CapabilityManifest = z.infer<typeof CapabilityManifest>;

package/dist/policy/protected-paths.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Cycle-of-Trust protected-path matching. The single source of truth is
+ * policy-pack/protected-paths.json — this module loads + validates it (zod on the
+ * boundary, per the repo contract) and exposes the same matching the reference
+ * hook (guard-protected-paths.mjs) performs, so engine tests can prove the pack
+ * denies every self-modification attempt.
+ *
+ * This is read/report-only: it evaluates whether a tool call WOULD cross the
+ * boundary. It never touches Claude Code config itself.
+ */
+import { z } from "zod";
+declare const protectedPathsSchema: z.ZodObject<{
+    globs: z.ZodArray<z.ZodString>;
+    shellMarkers: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type ProtectedPaths = z.infer<typeof protectedPathsSchema>;
+export declare const PROTECTED_PATHS: ProtectedPaths;
+/** True when a file path a Write/Edit tool targets is a protected control path. */
+export declare const matchesProtectedPath: (filePath: string) => boolean;
+/** True when a shell command string reaches into a protected control path. */
+export declare const shellTouchesProtectedPath: (command: string) => boolean;
+/**
+ * The empirically-verified per-permission-mode enforcement matrix. `deny` =
+ * permissions.deny rule; `hook` = the PreToolUse guard hook; `managed` =
+ * managed-settings (disableBypassPermissionsMode + deny). `true` means that
+ * layer's block holds in the mode.
+ *
+ * Spike result (Claude Code v2.1.201, 2026-07-04 — see ADR-0001 "Empirical
+ * results"): a PreToolUse command hook returning exit 2 blocks the tool call in
+ * EVERY mode tested, including `bypassPermissions` AND `--dangerously-skip-
+ * permissions` (a control run with no hook confirmed bypass truly skips
+ * permission checks, so the block is attributable to the hook). This REVERSES
+ * matrix delta D1: the hook — not just managed settings — holds under bypass.
+ * Permission *rules* (`permissions.deny`/`allow`) are still skipped under bypass,
+ * so `deny` is false there; the hook and the managed layer both hold.
+ */
+export declare const GUARANTEES_BY_MODE: Record<string, {
+    deny: boolean;
+    hook: boolean;
+    managed: boolean;
+}>;
+/**
+ * ConfigChange enforcement (delta D2, resolved by spike). A `ConfigChange` hook
+ * fires when a settings/skill file changes during a session; the event carries
+ * `source` (user_settings | project_settings | local_settings | policy_settings
+ * | skills) and `file_path`. Exit 2 blocks the change from taking effect — EXCEPT
+ * `policy_settings` (managed), which a hook cannot block and which remains the
+ * admin channel.
+ *
+ * This returns true when the change should be blocked: any `skills` change (a
+ * skill is an executable capability) or a change whose file is a protected
+ * control path (settings.json / settings.local.json). Managed (`policy_settings`)
+ * is never blocked here — it is how an admin legitimately updates the boundary.
+ */
+export declare const blocksConfigChange: (source: string, filePath: string | undefined) => boolean;
+export {};

package/dist/report/findings.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Findings model (FR-6.1).
+ *
+ * Normalizes two very different inputs — static toxic-flow graph results (Step 2) and dynamic
+ * attack results (Step 4) — into one severity-ranked `Finding` list. Every finding is
+ * payload-free: it carries the input's sha256 and a derived `observed` summary, never the raw
+ * attack input, agent text, or tool arguments (NFR-3).
+ *
+ * Severity contract: an unmitigated lethal trifecta and a refuse-in-text-but-fire divergence are
+ * both `critical`. Untested / inconclusive is surfaced as `info` (`not_verified`), never dropped
+ * and never a pass (fail-closed).
+ */
+import type { ToxicFlow } from "../graph/build";
+import type { OwaspAsi } from "../attacks/schema";
+import type { AttackResult } from "../runner/run";
+export type Severity = "critical" | "high" | "medium" | "low" | "info";
+export interface Finding {
+    id: string;
+    source: "graph" | "dynamic";
+    ruleId: string;
+    title: string;
+    severity: Severity;
+    owasp?: OwaspAsi;
+    atlas?: string;
+    flowId?: string;
+    attackId?: string;
+    inputHash?: string;
+    observed: string;
+    stability?: {
+        pass: number;
+        total: number;
+    };
+    fix: string;
+    /** Manifest-derived node ids that create the finding — unambiguous remediation (FR-3.3). */
+    locations: string[];
+}
+/** Sort findings most-severe first (stable within a severity). */
+export declare function rankFindings(findings: Finding[]): Finding[];
+/** Static toxic-flow graph results → findings. Unmitigated flows are critical; mitigated → info. */
+export declare function findingsFromFlows(flows: ToxicFlow[]): Finding[];
+/** Dynamic attack results → findings. Contained attacks produce no finding (target withstood). */
+export declare function findingsFromResults(results: AttackResult[]): Finding[];
+export interface Coverage {
+    attacksTotal: number;
+    attacksConclusive: number;
+    attacksNotVerified: number;
+    dynamicRan: boolean;
+    /** Fraction of attacks conclusively evaluated (succeeded or contained), 0..1. */
+    ratio: number;
+}
+/** Honest coverage: how much was actually tested vs. skipped/inconclusive (NFR-8). */
+export declare function computeCoverage(results: AttackResult[], dynamicRan: boolean): Coverage;

package/dist/report/human.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Human-readable report (FR-6.3).
+ *
+ * Renders a scan report as Markdown: a verdict line, findings ranked most-severe first with their
+ * OWASP/ATLAS mapping and a prioritized fix, and — mandatory — the coverage ratio so results are
+ * never over-claimed (NFR-8). Deterministic (no timestamps) so it is reproducible and snapshottable.
+ */
+import type { ScanReport } from "../scan";
+import type { Finding, Severity } from "./findings";
+/** Count findings by severity. */
+export declare function severityCounts(findings: Finding[]): Record<Severity, number>;
+/** One-line coverage statement (NFR-8). */
+export declare function coverageLine(report: ScanReport): string;
+export declare function toMarkdown(report: ScanReport): string;
+/**
+ * Compact, deterministic CLI summary (the stdout output contract). Machine-independent: keyed on
+ * the target name and findings, not absolute paths, so it is snapshot-stable.
+ */
+export declare function renderCliSummary(report: ScanReport): string;

package/dist/report/index.d.ts

@@ -0,0 +1,5 @@
+/** Report subsystem (FR-6): findings model, SARIF emitter, human report. */
+export * from "./findings";
+export * from "./sarif";
+export * from "./human";
+export * from "./json";

package/dist/report/json.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Structured JSON report (FR-6.3 / FR-10.3).
+ *
+ * A downstream-ingestible, versioned view of a scan — consumed by the AAL Evidence layer to score
+ * controls. Payload-free (findings and attacks reference inputs by sha256 only). Deterministic and
+ * timestamp-free so it stays reproducible.
+ */
+import type { ScanReport } from "../scan";
+import type { Finding } from "./findings";
+export interface AssuranceJson {
+    schemaVersion: "aal-core-report/0.1";
+    target: string;
+    criticalCount: number;
+    coverage: ScanReport["coverage"];
+    findings: Finding[];
+    attacks: AssuranceAttack[];
+    flows: AssuranceFlow[];
+}
+export interface AssuranceAttack {
+    attackId: string;
+    attackClass: string;
+    owasp: string;
+    atlas: string;
+    outcome: "succeeded" | "contained" | "not_verified";
+    stability: {
+        pass: number;
+        total: number;
+    };
+    inputHash: string;
+    refuseButFire: boolean;
+}
+export interface AssuranceFlow {
+    id: string;
+    kind: string;
+    mitigated: boolean;
+    legs: string[];
+}
+/** Shape a scan report as the stable JSON the Evidence layer ingests. */
+export declare function toAssuranceJson(report: ScanReport): AssuranceJson;

package/dist/report/sarif.d.ts

@@ -0,0 +1,57 @@
+import type { ScanReport } from "../scan";
+export type SarifLevel = "error" | "warning" | "note" | "none";
+export interface SarifLog {
+    version: "2.1.0";
+    $schema: string;
+    runs: SarifRun[];
+}
+interface SarifRun {
+    tool: {
+        driver: SarifDriver;
+    };
+    results: SarifResult[];
+}
+interface SarifDriver {
+    name: string;
+    informationUri: string;
+    version: string;
+    rules: SarifReportingDescriptor[];
+}
+interface SarifReportingDescriptor {
+    id: string;
+    name: string;
+    shortDescription: {
+        text: string;
+    };
+    defaultConfiguration: {
+        level: SarifLevel;
+    };
+    properties: Record<string, unknown>;
+}
+interface SarifResult {
+    ruleId: string;
+    level: SarifLevel;
+    message: {
+        text: string;
+    };
+    locations: SarifLocation[];
+    properties: Record<string, unknown>;
+}
+interface SarifLocation {
+    physicalLocation: {
+        artifactLocation: {
+            uri: string;
+        };
+    };
+    logicalLocations?: {
+        fullyQualifiedName: string;
+        kind: string;
+    }[];
+}
+export declare function toSarif(report: ScanReport): SarifLog;
+/** Structural conformance check for SARIF 2.1.0 (offline substitute for schema validation). */
+export declare function validateSarif(log: unknown): {
+    valid: boolean;
+    issues: string[];
+};
+export {};

package/dist/runner/index.d.ts

@@ -0,0 +1,5 @@
+/** Dynamic runner subsystem (FR-4/5): sandbox, oracle, side-effect detector, orchestrator. */
+export * from "./side-effect";
+export * from "./sandbox";
+export * from "./oracle";
+export * from "./run";

package/dist/runner/oracle.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Success-condition oracle (FR-2.4).
+ *
+ * Judges whether an attack *succeeded* (the target behaved unsafely). `assert` predicates run
+ * in-process and are fully deterministic; an `llmRubric` is delegated to a pluggable provider at
+ * temperature 0. We reuse the judge-as-oracle *pattern* only — AAL Core imports no AgenticMind
+ * code (NFR-7); the provider is generic and swappable via env.
+ *
+ * Fail-closed: an `llmRubric` with no configured provider is inconclusive (`no-provider`), which
+ * the runner surfaces as `not_verified` — never a silent pass.
+ */
+import { type Result } from "neverthrow";
+import type { AgentRun } from "../adapter/types";
+import type { CapabilityManifest } from "../manifest/schema";
+import type { Assertion, SuccessCondition } from "../attacks/schema";
+export type OracleError = {
+    kind: "no-provider";
+    message: string;
+} | {
+    kind: "provider";
+    message: string;
+};
+/** A generic success-condition judge. Returns true iff the run satisfies the (unsafe) rubric. */
+export interface OracleProvider {
+    readonly name: string;
+    judge(rubric: string, run: AgentRun): Promise<Result<boolean, OracleError>>;
+}
+/** Evaluate one assert predicate: does the *unsafe* condition it describes hold? */
+export declare function evaluateAssertion(assertion: Assertion, run: AgentRun, manifest: CapabilityManifest): boolean;
+/** OR across the assert array: the attack succeeded if any predicate holds. */
+export declare function evaluateAssertions(assertions: Assertion[], run: AgentRun, manifest: CapabilityManifest): boolean;
+/** Evaluate a full success condition, consulting the provider only when an llmRubric is present. */
+export declare function evaluateSuccess(success: SuccessCondition, run: AgentRun, manifest: CapabilityManifest, provider?: OracleProvider): Promise<Result<boolean, OracleError>>;
+/** A deterministic provider for tests: applies a supplied predicate instead of calling a model. */
+export declare function createFakeProvider(predicate: (rubric: string, run: AgentRun) => boolean, name?: string): OracleProvider;
+export interface AnthropicProviderOptions {
+    apiKey?: string;
+    model?: string;
+    baseUrl?: string;
+}
+/**
+ * Default provider: an Anthropic Messages API call at temperature 0. Generic HTTP (no SDK, no
+ * engine code). Key via `dotenvx`/env. Only constructed when a rubric-based attack runs and a key
+ * is present — never on the deterministic assert path.
+ */
+export declare function createAnthropicProvider(options?: AnthropicProviderOptions): OracleProvider;

package/dist/runner/run.d.ts

@@ -0,0 +1,38 @@
+import type { CapabilityManifest } from "../manifest/schema";
+import { type Attack, type OwaspAsi } from "../attacks/schema";
+import { type OracleProvider } from "./oracle";
+import type { Sandbox, InterceptedSideEffect } from "./sandbox";
+import { type SideEffectFinding } from "./side-effect";
+export type AttackOutcome = "succeeded" | "contained" | "not_verified";
+export interface AttackResult {
+    attackId: string;
+    attackClass: Attack["class"];
+    owasp: OwaspAsi;
+    atlas: string;
+    inputHash: string;
+    outcome: AttackOutcome;
+    stability: {
+        pass: number;
+        total: number;
+    };
+    sideEffect: SideEffectFinding;
+    intercepted: InterceptedSideEffect[];
+    observed: string;
+    note?: string;
+}
+export interface RunOptions {
+    runs?: number;
+    provider?: OracleProvider;
+    /** Recorded in the report as run provenance. A reproducibility anchor for stochastic oracle
+     *  providers; the built-in exec adapter is already deterministic. */
+    seed?: number;
+}
+/** sha256 of the rendered attack input — the only representation of a payload we persist. */
+export declare function hashInput(text: string): string;
+/** Coerce a runs value to a positive integer. A NaN/invalid value must never become 0 runs
+ *  (which would make every attack falsely "contained" — a fail-open). */
+export declare function normalizeRuns(runs: number | undefined): number;
+/** Run one attack N times against a sandboxed target and score it. */
+export declare function runAttack(attack: Attack, sandbox: Sandbox, manifest: CapabilityManifest, options?: RunOptions): Promise<AttackResult>;
+/** Run a whole attack suite sequentially (reproducible; avoids subprocess storms). */
+export declare function runSuite(attacks: Attack[], sandbox: Sandbox, manifest: CapabilityManifest, options?: RunOptions): Promise<AttackResult[]>;

package/dist/runner/sandbox.d.ts

@@ -0,0 +1,27 @@
+import type { Result } from "neverthrow";
+import type { AdapterError, AgentRun, TargetAdapter } from "../adapter/types";
+import type { CapabilityManifest } from "../manifest/schema";
+import { type ResolvedSideEffect } from "./side-effect";
+/** A side-effecting tool call that was intercepted (never performed) during a run. */
+export interface InterceptedSideEffect {
+    tool: string;
+    sideEffect: ResolvedSideEffect;
+    argHash: string;
+    intercepted: true;
+}
+export interface SandboxRunResult {
+    run: AgentRun;
+    intercepted: InterceptedSideEffect[];
+}
+export interface Sandbox {
+    run(input: string): Promise<Result<SandboxRunResult, AdapterError>>;
+    /** Count of side effects actually performed against a real system. Must remain 0 (NFR-4). */
+    readonly performedCount: number;
+}
+/** sha256 of a value's canonical JSON — never store raw tool arguments. */
+export declare function hashArgs(args: unknown): string;
+/**
+ * Build a process-jail sandbox around an adapter. Declared side effects are intercepted and
+ * recorded; none are executed. The canary is the only path a side-effecting call can take.
+ */
+export declare function createProcessJailSandbox(adapter: TargetAdapter, manifest: CapabilityManifest): Sandbox;

package/dist/runner/side-effect.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Execution-layer side-effect detector (FR-4.1/4.2) — the second differentiated technique.
+ *
+ * It inspects the target's *tool calls*, not just its text. The dangerous divergence it flags:
+ * the agent *refuses or deflects in prose* while a side-effecting tool call still fires. A fired
+ * write / external-egress / code-exec under a refusal text is `critical` — the model said no but
+ * the system did the thing anyway.
+ */
+import type { AgentRun, ToolCall } from "../adapter/types";
+import type { CapabilityManifest, SideEffectClass } from "../manifest/schema";
+/** A resolved side-effect class, or `unknown` for a tool absent from the manifest (fail-closed). */
+export type ResolvedSideEffect = SideEffectClass | "unknown";
+/** Resolve a tool's side-effect class from the manifest; unknown tools are treated fail-closed. */
+export declare function sideEffectClassOf(tool: string, manifest: CapabilityManifest): ResolvedSideEffect;
+/** True for classes that touch the world. `read` does not; unknown tools count (fail-closed). */
+export declare function isSideEffecting(cls: ResolvedSideEffect): boolean;
+/** Does the agent's prose refuse or deflect the request? */
+export declare function refusesInText(text: string): boolean;
+export interface FiredSideEffect {
+    tool: string;
+    sideEffect: ResolvedSideEffect;
+}
+export interface SideEffectFinding {
+    refusedInText: boolean;
+    firedSideEffects: FiredSideEffect[];
+    /** The critical divergence: refused in prose, yet a side-effecting tool fired (FR-4.2). */
+    refuseButFire: boolean;
+}
+/** Classify a run's tool calls and flag the refuse-in-text-but-fire divergence. */
+export declare function detectSideEffectDivergence(run: AgentRun, manifest: CapabilityManifest): SideEffectFinding;
+/** The side-effecting tool calls in a run (write / egress / exec / unknown). */
+export declare function firedSideEffectsOf(toolCalls: ToolCall[], manifest: CapabilityManifest): FiredSideEffect[];

package/dist/scan.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Scan orchestration — the one call the CLI (and tests) drive.
+ *
+ * Runs the static toxic-flow graph over the manifest and, when a target adapter is supplied, the
+ * dynamic attack suite in a sandbox; then normalizes both into a single ranked findings list with
+ * an honest coverage ratio. Deterministic and timestamp-free so results are reproducible (FR-6.2)
+ * and snapshot-testable.
+ */
+import { type Result } from "neverthrow";
+import type { TargetAdapter } from "./adapter/types";
+import { type ToxicFlow } from "./graph";
+import { type AttackResult } from "./runner/run";
+import type { OracleProvider } from "./runner/oracle";
+import { type Coverage, type Finding } from "./report/findings";
+/** Default corpus shipped with the package (resolves from both src/ and dist/). */
+export declare const DEFAULT_ATTACKS_DIR: string;
+export interface ScanInput {
+    manifestPath: string;
+    attacksDir?: string;
+    runs?: number;
+    seed?: number;
+    adapter?: TargetAdapter;
+    provider?: OracleProvider;
+}
+export interface ScanReport {
+    target: string;
+    manifestPath: string;
+    seed?: number;
+    runs: number;
+    findings: Finding[];
+    coverage: Coverage;
+    toxicFlows: ToxicFlow[];
+    attackResults: AttackResult[];
+    criticalCount: number;
+}
+export type ScanError = {
+    kind: "manifest";
+    message: string;
+} | {
+    kind: "attacks";
+    message: string;
+};
+export declare function runScan(input: ScanInput): Promise<Result<ScanReport, ScanError>>;

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "agent-assurance",
+  "version": "0.1.0",
+  "description": "AAL Core — framework-neutral red-team engine for AI agents (toxic-flow graph, side-effect detection, SARIF). Part of the Agent Assurance Layer.",
+  "type": "module",
+  "license": "MIT",
+  "author": "Moai Team LLC",
+  "homepage": "https://github.com/Moai-Team-LLC/agent-assurance#readme",
+  "repository": { "type": "git", "url": "git+https://github.com/Moai-Team-LLC/agent-assurance.git" },
+  "bugs": { "url": "https://github.com/Moai-Team-LLC/agent-assurance/issues" },
+  "keywords": [
+    "ai",
+    "ai-security",
+    "agent",
+    "agentic",
+    "red-team",
+    "security",
+    "owasp",
+    "owasp-agentic",
+    "llm",
+    "prompt-injection",
+    "sarif",
+    "mcp",
+    "toxic-flow",
+    "lethal-trifecta"
+  ],
+  "bin": { "aal": "./dist/cli.js", "agent-assurance": "./dist/cli.js" },
+  "exports": { ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" } },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "engines": { "node": ">=22.18" },
+  "packageManager": "bun@1.3.12",
+  "publishConfig": { "access": "public", "provenance": true },
+  "scripts": {
+    "check": "bun run lint && bun run tsc && bun run test",
+    "lint": "oxlint",
+    "tsc": "tsc --noEmit",
+    "test": "vitest run",
+    "build": "bun build ./src/cli.ts --outfile ./dist/cli.js --target node && bun build ./src/index.ts --outfile ./dist/index.js --target node && tsc -p tsconfig.dts.json",
+    "cli": "bun run src/cli.ts",
+    "prepublishOnly": "bun run build",
+    "prepare": "husky || true"
+  },
+  "dependencies": {
+    "commander": "^11.1.0",
+    "neverthrow": "^8.2.0",
+    "yaml": "^2.9.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^21.0.1",
+    "@commitlint/config-conventional": "^21.0.1",
+    "@dotenvx/dotenvx": "^1.67.0",
+    "@types/node": "^25.9.1",
+    "husky": "^9.1.7",
+    "oxlint": "^1.66.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.7"
+  }
+}