agent-threat-rules 2.1.5 → 3.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (172) hide show
  1. package/README.md +365 -327
  2. package/dist/engine.d.ts +46 -1
  3. package/dist/engine.d.ts.map +1 -1
  4. package/dist/engine.js +242 -1
  5. package/dist/engine.js.map +1 -1
  6. package/dist/eval/eval-harness.d.ts.map +1 -1
  7. package/dist/eval/eval-harness.js +9 -0
  8. package/dist/eval/eval-harness.js.map +1 -1
  9. package/dist/eval/run-hackaprompt-benchmark.js +9 -0
  10. package/dist/eval/run-hackaprompt-benchmark.js.map +1 -1
  11. package/dist/eval/run-pint-benchmark.js +9 -0
  12. package/dist/eval/run-pint-benchmark.js.map +1 -1
  13. package/dist/eval/skill-benchmark.d.ts +11 -0
  14. package/dist/eval/skill-benchmark.d.ts.map +1 -1
  15. package/dist/eval/skill-benchmark.js +57 -0
  16. package/dist/eval/skill-benchmark.js.map +1 -1
  17. package/dist/measurement/from-eval-harness.d.ts +70 -0
  18. package/dist/measurement/from-eval-harness.d.ts.map +1 -0
  19. package/dist/measurement/from-eval-harness.js +49 -0
  20. package/dist/measurement/from-eval-harness.js.map +1 -0
  21. package/dist/measurement/schema.d.ts +152 -0
  22. package/dist/measurement/schema.d.ts.map +1 -0
  23. package/dist/measurement/schema.js +178 -0
  24. package/dist/measurement/schema.js.map +1 -0
  25. package/dist/measurement/write.d.ts +64 -0
  26. package/dist/measurement/write.d.ts.map +1 -0
  27. package/dist/measurement/write.js +163 -0
  28. package/dist/measurement/write.js.map +1 -0
  29. package/dist/semantic-evaluator.d.ts +48 -0
  30. package/dist/semantic-evaluator.d.ts.map +1 -0
  31. package/dist/semantic-evaluator.js +107 -0
  32. package/dist/semantic-evaluator.js.map +1 -0
  33. package/dist/trace-evaluator.d.ts +22 -0
  34. package/dist/trace-evaluator.d.ts.map +1 -0
  35. package/dist/trace-evaluator.js +249 -0
  36. package/dist/trace-evaluator.js.map +1 -0
  37. package/dist/types.d.ts +143 -0
  38. package/dist/types.d.ts.map +1 -1
  39. package/package.json +5 -3
  40. package/rules/agent-manipulation/ATR-2026-00552-goal-drift-after-pressure-injection.yaml +216 -0
  41. package/rules/context-exfiltration/ATR-2026-00471-garak-sysprompt-extraction-mixedunassigned.yaml +126 -0
  42. package/rules/context-exfiltration/ATR-2026-00501-data-exfiltration-via-markdown-image-and-link-url-injection.yaml +173 -0
  43. package/rules/context-exfiltration/ATR-2026-00504-tool-and-function-capability-enumeration.yaml +164 -0
  44. package/rules/context-exfiltration/ATR-2026-00505-system-prompt-extraction-instruction-dump-request.yaml +178 -0
  45. package/rules/context-exfiltration/ATR-2026-00514-system-prompt-extraction.yaml +202 -0
  46. package/rules/context-exfiltration/ATR-2026-00516-output-xss-via-llm.yaml +180 -0
  47. package/rules/context-exfiltration/ATR-2026-00524-claude-code-anthropic-base-url-credential-exfil.yaml +257 -0
  48. package/rules/context-exfiltration/ATR-2026-00548-cross-agent-session-context-leak.yaml +177 -0
  49. package/rules/excessive-autonomy/ATR-2026-00491-garak-agent-breaker-markdown-just-raw-json.yaml +152 -0
  50. package/rules/excessive-autonomy/ATR-2026-00500-ssrf-via-agent-url-fetch-instruction.yaml +168 -0
  51. package/rules/excessive-autonomy/ATR-2026-00553-runaway-tool-loop-behavioral.yaml +174 -0
  52. package/rules/model-abuse/ATR-2026-00502-training-data-extraction-via-divergent-repetition-attack.yaml +158 -0
  53. package/rules/model-abuse/ATR-2026-00517-model-extraction-distillation.yaml +187 -0
  54. package/rules/privilege-escalation/ATR-2026-00528-praisonai-auth-disabled-default.yaml +192 -0
  55. package/rules/privilege-escalation/ATR-2026-00539-crewai-codeinterpreter-sandbox-escape-rce.yaml +292 -0
  56. package/rules/privilege-escalation/ATR-2026-00546-crewai-json-loader-local-file-read.yaml +162 -0
  57. package/rules/privilege-escalation/ATR-2026-00547-crewai-rag-url-ssrf-bypass.yaml +167 -0
  58. package/rules/privilege-escalation/ATR-2026-00549-destructive-tool-without-human-approval.yaml +193 -0
  59. package/rules/privilege-escalation/ATR-2026-00551-cross-conversation-memory-write.yaml +198 -0
  60. package/rules/prompt-injection/ATR-2026-00452-direct-pwned-payload-injection.yaml +172 -0
  61. package/rules/prompt-injection/ATR-2026-00453-secret-key-reveal-demand.yaml +165 -0
  62. package/rules/prompt-injection/ATR-2026-00454-backslash-per-character-encoding.yaml +162 -0
  63. package/rules/prompt-injection/ATR-2026-00455-no-period-output-override.yaml +153 -0
  64. package/rules/prompt-injection/ATR-2026-00456-conditional-empty-input-injection.yaml +168 -0
  65. package/rules/prompt-injection/ATR-2026-00457-garak-dan-to-every-prompt.yaml +160 -0
  66. package/rules/prompt-injection/ATR-2026-00458-garak-dra-step-by-step.yaml +143 -0
  67. package/rules/prompt-injection/ATR-2026-00459-garak-dan-an-ai-language.yaml +136 -0
  68. package/rules/prompt-injection/ATR-2026-00460-garak-dan-no-matter-how.yaml +162 -0
  69. package/rules/prompt-injection/ATR-2026-00461-garak-goodside-mixedunassigned.yaml +140 -0
  70. package/rules/prompt-injection/ATR-2026-00462-garak-gcg-mixedunassigned.yaml +141 -0
  71. package/rules/prompt-injection/ATR-2026-00463-garak-lmrc-mixedunassigned.yaml +142 -0
  72. package/rules/prompt-injection/ATR-2026-00464-garak-dan-i-would-like.yaml +139 -0
  73. package/rules/prompt-injection/ATR-2026-00465-garak-dan-your-prompt-here.yaml +145 -0
  74. package/rules/prompt-injection/ATR-2026-00466-garak-latentinjection-following-text-from.yaml +141 -0
  75. package/rules/prompt-injection/ATR-2026-00467-garak-dan-act-as-a.yaml +140 -0
  76. package/rules/prompt-injection/ATR-2026-00468-garak-goat-the-target-llm.yaml +141 -0
  77. package/rules/prompt-injection/ATR-2026-00469-garak-dan-at-the-end.yaml +140 -0
  78. package/rules/prompt-injection/ATR-2026-00470-garak-dan-as-an-ai.yaml +155 -0
  79. package/rules/prompt-injection/ATR-2026-00472-garak-dan-are-going-to.yaml +150 -0
  80. package/rules/prompt-injection/ATR-2026-00473-garak-lmrc-how-can-i.yaml +140 -0
  81. package/rules/prompt-injection/ATR-2026-00474-garak-dan-that-chatgpt-has.yaml +133 -0
  82. package/rules/prompt-injection/ATR-2026-00475-garak-web-injection-alert-1-script.yaml +136 -0
  83. package/rules/prompt-injection/ATR-2026-00476-garak-web-injection-javascript-alert-1.yaml +157 -0
  84. package/rules/prompt-injection/ATR-2026-00477-garak-latentinjection-translate-the-following-text.yaml +143 -0
  85. package/rules/prompt-injection/ATR-2026-00478-garak-latentinjection-abuse-contact-email.yaml +136 -0
  86. package/rules/prompt-injection/ATR-2026-00479-garak-latentinjection-mixedunassigned.yaml +146 -0
  87. package/rules/prompt-injection/ATR-2026-00480-garak-dan-the-role-of.yaml +137 -0
  88. package/rules/prompt-injection/ATR-2026-00481-garak-dan-mixedunassigned.yaml +153 -0
  89. package/rules/prompt-injection/ATR-2026-00482-garak-lmrc-what-s-an.yaml +128 -0
  90. package/rules/prompt-injection/ATR-2026-00483-garak-dan-the-user-s.yaml +141 -0
  91. package/rules/prompt-injection/ATR-2026-00484-garak-dan-and-you-will.yaml +138 -0
  92. package/rules/prompt-injection/ATR-2026-00485-garak-dan-and-does-not.yaml +141 -0
  93. package/rules/prompt-injection/ATR-2026-00486-garak-dan-t-care-about.yaml +125 -0
  94. package/rules/prompt-injection/ATR-2026-00487-garak-dan-and-nothing-else.yaml +134 -0
  95. package/rules/prompt-injection/ATR-2026-00488-garak-encoding-alert-1-script.yaml +137 -0
  96. package/rules/prompt-injection/ATR-2026-00489-garak-encoding-javascript-alert-1.yaml +158 -0
  97. package/rules/prompt-injection/ATR-2026-00490-garak-dan-in-order-to.yaml +158 -0
  98. package/rules/prompt-injection/ATR-2026-00492-garak-dan-want-you-to.yaml +156 -0
  99. package/rules/prompt-injection/ATR-2026-00493-garak-latentinjection-registrar-iana-id.yaml +158 -0
  100. package/rules/prompt-injection/ATR-2026-00495-garak-dan-insert-prompt-here.yaml +177 -0
  101. package/rules/prompt-injection/ATR-2026-00496-garak-dan-no-matter-what.yaml +148 -0
  102. package/rules/prompt-injection/ATR-2026-00497-garak-encoding-mixedunassigned.yaml +179 -0
  103. package/rules/prompt-injection/ATR-2026-00498-garak-web-injection-mixedunassigned.yaml +169 -0
  104. package/rules/prompt-injection/ATR-2026-00499-garak-dan-from-now-on.yaml +150 -0
  105. package/rules/prompt-injection/ATR-2026-00503-fake-error-state-takeover-unrestricted-replacement-bot.yaml +160 -0
  106. package/rules/prompt-injection/ATR-2026-00506-nevermind-override-goal-hijacking-in-user-input-promptinject.yaml +149 -0
  107. package/rules/prompt-injection/ATR-2026-00507-screaming-stop-goal-hijacking-in-user-input-promptinject.yaml +154 -0
  108. package/rules/prompt-injection/ATR-2026-00508-escape-delimiter-wrapped-goal-hijacking-in-user-input-prompt.yaml +154 -0
  109. package/rules/prompt-injection/ATR-2026-00509-prompt-leaking-via-ignore-previous-instructions-in-user-inpu.yaml +168 -0
  110. package/rules/prompt-injection/ATR-2026-00510-delayed-tool-invocation-injection.yaml +189 -0
  111. package/rules/prompt-injection/ATR-2026-00511-mcp-web-context-poisoning.yaml +185 -0
  112. package/rules/prompt-injection/ATR-2026-00512-rules-file-backdoor-injection.yaml +181 -0
  113. package/rules/prompt-injection/ATR-2026-00515-hidden-text-prompt-injection.yaml +194 -0
  114. package/rules/prompt-injection/ATR-2026-00518-ignore-previous-and-following-instructions-output-command-promptinject.yaml +154 -0
  115. package/rules/prompt-injection/ATR-2026-00519-tautology-logic-noise-injection-promptbench.yaml +151 -0
  116. package/rules/prompt-injection/ATR-2026-00520-nlp-task-random-token-suffix-injection-promptbench.yaml +153 -0
  117. package/rules/prompt-injection/ATR-2026-00535-windsurf-ide-zero-click-prompt-injection.yaml +199 -0
  118. package/rules/prompt-injection/ATR-2026-00550-untrusted-retrieval-to-privileged-tool.yaml +199 -0
  119. package/rules/skill-compromise/ATR-2026-00123-skill-overreach-permissions.yaml +5 -2
  120. package/rules/skill-compromise/ATR-2026-00523-claude-code-hooks-session-start-pre-trust-rce.yaml +221 -0
  121. package/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml +220 -0
  122. package/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml +201 -0
  123. package/rules/tool-poisoning/ATR-2026-00494-garak-exploitation-mixedunassigned.yaml +179 -0
  124. package/rules/tool-poisoning/ATR-2026-00513-package-hallucination-exploitation.yaml +167 -0
  125. package/rules/tool-poisoning/ATR-2026-00521-shell-command-injection-agent-tool-context.yaml +176 -0
  126. package/rules/tool-poisoning/ATR-2026-00522-sql-injection-natural-language-agent-interface.yaml +219 -0
  127. package/rules/tool-poisoning/ATR-2026-00526-claude-code-shell-metachar-in-double-quoted-path.yaml +167 -0
  128. package/rules/tool-poisoning/ATR-2026-00529-litellm-proxy-sqli-cisa-kev.yaml +158 -0
  129. package/rules/tool-poisoning/ATR-2026-00530-ms-agent-shell-tool-unsanitized-argv-rce.yaml +184 -0
  130. package/rules/tool-poisoning/ATR-2026-00531-praisonai-unauthenticated-agent-api.yaml +174 -0
  131. package/rules/tool-poisoning/ATR-2026-00532-apache-doris-mcp-sql-injection.yaml +155 -0
  132. package/rules/tool-poisoning/ATR-2026-00533-apache-pinot-mcp-unauthenticated-takeover.yaml +151 -0
  133. package/rules/tool-poisoning/ATR-2026-00534-alibaba-rds-mcp-unauthenticated-metadata-exfil.yaml +155 -0
  134. package/rules/tool-poisoning/ATR-2026-00536-nginx-ui-mcp-unauthenticated-command-execution.yaml +199 -0
  135. package/rules/tool-poisoning/ATR-2026-00537-fastmcp-server-name-cmd-injection-windows.yaml +226 -0
  136. package/rules/tool-poisoning/ATR-2026-00538-langchain-chatchat-mcp-stdio-unauthenticated-rce.yaml +244 -0
  137. package/rules/tool-poisoning/ATR-2026-00540-praisonai-parse-mcp-command-cli-injection.yaml +186 -0
  138. package/rules/tool-poisoning/ATR-2026-00541-agent-zero-mcp-config-command-injection.yaml +183 -0
  139. package/rules/tool-poisoning/ATR-2026-00542-upsonic-mcp-command-allowlist-bypass.yaml +166 -0
  140. package/rules/tool-poisoning/ATR-2026-00543-litellm-mcp-server-argv-injection.yaml +168 -0
  141. package/rules/tool-poisoning/ATR-2026-00544-praisonai-pth-file-path-traversal-rce.yaml +172 -0
  142. package/rules/tool-poisoning/ATR-2026-00545-praisonai-tool-override-unauth-rce.yaml +170 -0
  143. package/spec/README.md +279 -0
  144. package/spec/atr-correlation-v1.0.md +281 -0
  145. package/spec/atr-event-v1.0.md +294 -0
  146. package/spec/atr-language-detection-v1.0.md +218 -0
  147. package/spec/atr-method-v1.1.md +557 -0
  148. package/spec/atr-profile-v1.0.md +307 -0
  149. package/spec/atr-schema.yaml +279 -8
  150. package/spec/category-registry/v1.0.yaml +200 -0
  151. package/spec/conformance/README.md +244 -0
  152. package/spec/conformance/SIGNING.md +191 -0
  153. package/spec/conformance/baseline/fixtures/ATR-2026-00001-tp-001/expected.json +36 -0
  154. package/spec/conformance/baseline/fixtures/ATR-2026-00001-tp-001/input.json +16 -0
  155. package/spec/conformance/baseline/fixtures/README.md +120 -0
  156. package/spec/conformance/baseline/manifest.json +56 -0
  157. package/spec/conformance/expected-results.schema.json +121 -0
  158. package/spec/external-registries/cccs-yara.md +142 -0
  159. package/spec/internet-drafts/draft-lin-atr-core-00.html +1925 -0
  160. package/spec/internet-drafts/draft-lin-atr-core-00.md +288 -0
  161. package/spec/internet-drafts/draft-lin-atr-core-00.txt +560 -0
  162. package/spec/internet-drafts/draft-lin-atr-core-00.xml +424 -0
  163. package/spec/mappings/README.md +43 -0
  164. package/spec/mappings/atr-to-nist-csf-2.0.md +234 -0
  165. package/spec/schema/correlation.schema.json +144 -0
  166. package/spec/schema/event.schema.json +233 -0
  167. package/spec/schema/profile.schema.json +196 -0
  168. package/spec/schema/rule.schema.json +224 -0
  169. package/spec/stix-extension/README.md +76 -13
  170. package/spec/stix-extension/examples/atr-rule-trace-method-example.json +85 -0
  171. package/spec/stix-extension/extension-definition.json +23 -3
  172. package/spec/stix-extension/x-atr-rule-schema.json +107 -11
@@ -0,0 +1,249 @@
1
+ /**
2
+ * Trace-method rule evaluator.
3
+ *
4
+ * Implements the formal semantics in atr-method-v1.1.md §8 for the three
5
+ * trace primitives: forbid, require, invariant. Operates on a Trace (DAG
6
+ * of spans, OpenInference / OTel GenAI format).
7
+ *
8
+ * Capability: atr/method/trace (per atr-method-v1.1.md §9).
9
+ *
10
+ * Pure function; no I/O. Engine wires this in via evaluateRule dispatch
11
+ * when detection.method === 'trace'.
12
+ */
13
+ /** Normalize a span's "kind" — accept either span.kind (OpenInference) or kind (OTel) */
14
+ function getSpanKind(span) {
15
+ return span["span.kind"] ?? span.kind;
16
+ }
17
+ /** Resolve `${span.attributes.<path>}` placeholder against the candidate span */
18
+ function resolvePlaceholder(value, candidateSpan) {
19
+ if (typeof value !== "string")
20
+ return value;
21
+ const m = value.match(/^\$\{span\.attributes\.(.+)\}$/);
22
+ if (!m)
23
+ return value;
24
+ const path = m[1];
25
+ return readAttributePath(candidateSpan.attributes ?? {}, path);
26
+ }
27
+ /** Read dotted-path attribute, e.g., "tool.args.target_conversation_id" */
28
+ function readAttributePath(attrs, path) {
29
+ // Try literal-key first (covers cases like "session.id" stored as a literal key with a dot)
30
+ if (path in attrs)
31
+ return attrs[path];
32
+ // Then walk dotted path
33
+ const parts = path.split(".");
34
+ let cur = attrs;
35
+ for (const part of parts) {
36
+ if (cur === null || cur === undefined)
37
+ return undefined;
38
+ if (typeof cur !== "object")
39
+ return undefined;
40
+ cur = cur[part];
41
+ if (cur === undefined)
42
+ return undefined;
43
+ }
44
+ return cur;
45
+ }
46
+ /** Evaluate a single attribute predicate against a value. Returns boolean. */
47
+ function evaluatePredicate(predicate, value) {
48
+ if (predicate === null || predicate === undefined) {
49
+ return value === predicate;
50
+ }
51
+ // Literal equality
52
+ if (typeof predicate !== "object") {
53
+ return value === predicate;
54
+ }
55
+ const pred = predicate;
56
+ // Compound predicate object: { in: [...] } / { not_equals: X } / etc.
57
+ if (Array.isArray(pred["in"]) && pred["in"].includes(value))
58
+ return true;
59
+ if (Array.isArray(pred["in"]) && !pred["in"].includes(value))
60
+ return false;
61
+ if (Array.isArray(pred["not_in"])) {
62
+ return !pred["not_in"].includes(value);
63
+ }
64
+ if ("equals" in pred)
65
+ return value === pred["equals"];
66
+ if ("not_equals" in pred)
67
+ return value !== pred["not_equals"];
68
+ if ("exists" in pred) {
69
+ const requiredExists = Boolean(pred["exists"]);
70
+ return requiredExists ? value !== undefined : value === undefined;
71
+ }
72
+ if ("regex" in pred && typeof pred["regex"] === "string") {
73
+ try {
74
+ const re = new RegExp(pred["regex"]);
75
+ return typeof value === "string" && re.test(value);
76
+ }
77
+ catch {
78
+ return false;
79
+ }
80
+ }
81
+ if (Object.keys(pred).length === 0)
82
+ return true;
83
+ // Unknown predicate object — strict: return false rather than assume.
84
+ return false;
85
+ }
86
+ /** Check if a span matches a shape. Handles literal values + predicate maps + placeholders. */
87
+ function spanMatchesShape(span, shape) {
88
+ if (shape["span.kind"] !== undefined) {
89
+ const kind = getSpanKind(span);
90
+ if (kind !== shape["span.kind"])
91
+ return false;
92
+ }
93
+ const attrPredicates = shape.attributes ?? {};
94
+ for (const [path, predicate] of Object.entries(attrPredicates)) {
95
+ const actual = readAttributePath(span.attributes ?? {}, path);
96
+ const resolved = resolvePlaceholder(predicate, span);
97
+ // Compound predicate map?
98
+ if (resolved !== null &&
99
+ typeof resolved === "object" &&
100
+ !Array.isArray(resolved)) {
101
+ // Resolve ${...} inside compound predicates first
102
+ const resolvedPred = {};
103
+ for (const [k, v] of Object.entries(resolved)) {
104
+ resolvedPred[k] = resolvePlaceholder(v, span);
105
+ }
106
+ if (!evaluatePredicate(resolvedPred, actual))
107
+ return false;
108
+ }
109
+ else {
110
+ // Literal value (after placeholder resolution if any)
111
+ if (!evaluatePredicate(resolved, actual))
112
+ return false;
113
+ }
114
+ }
115
+ return true;
116
+ }
117
+ /** Check the preceded_by clause; accepts single shape OR one_of_shapes disjunction. */
118
+ function checkPrecededBy(trace, upToIndex, precededBy) {
119
+ const shapes = "one_of_shapes" in precededBy
120
+ ? precededBy.one_of_shapes
121
+ : [precededBy];
122
+ for (let i = 0; i < upToIndex; i++) {
123
+ const s = trace.spans[i];
124
+ for (const shape of shapes) {
125
+ if (spanMatchesShape(s, shape))
126
+ return true;
127
+ }
128
+ }
129
+ return false;
130
+ }
131
+ /** Evaluate a single forbid primitive. Returns array of violation descriptions. */
132
+ function evaluateForbid(trace, forbid) {
133
+ const violations = [];
134
+ for (let i = 0; i < trace.spans.length; i++) {
135
+ const span = trace.spans[i];
136
+ if (!spanMatchesShape(span, forbid.shape))
137
+ continue;
138
+ if (forbid.preceded_by) {
139
+ const hasPredecessor = checkPrecededBy(trace, i, forbid.preceded_by);
140
+ if (hasPredecessor) {
141
+ violations.push(`forbid: span ${span.id} matches shape AND predecessor present`);
142
+ }
143
+ }
144
+ else {
145
+ violations.push(`forbid: span ${span.id} matches forbidden shape`);
146
+ }
147
+ }
148
+ return violations;
149
+ }
150
+ /** Evaluate a single require primitive. Returns array of violation descriptions
151
+ * (NB: violation = expected predecessor MISSING, per §8.3.2 inverse polarity). */
152
+ function evaluateRequire(trace, req) {
153
+ const violations = [];
154
+ for (let i = 0; i < trace.spans.length; i++) {
155
+ const span = trace.spans[i];
156
+ if (!spanMatchesShape(span, req.target_shape))
157
+ continue;
158
+ const hasRequired = checkPrecededBy(trace, i, req.must_be_preceded_by);
159
+ if (!hasRequired) {
160
+ violations.push(`require: span ${span.id} matches target but predecessor missing`);
161
+ }
162
+ }
163
+ return violations;
164
+ }
165
+ /** Group spans by the across-key value (chain id / session / conversation). */
166
+ function groupByAcross(trace, across) {
167
+ const groups = new Map();
168
+ for (const span of trace.spans) {
169
+ let key;
170
+ if (across === "trace") {
171
+ key = trace.trace_id ?? "_trace_";
172
+ }
173
+ else if (across === "agent.delegation_chain") {
174
+ key = readAttributePath(span.attributes ?? {}, "agent.delegation_chain");
175
+ }
176
+ else if (across === "session") {
177
+ key = readAttributePath(span.attributes ?? {}, "session.id");
178
+ }
179
+ else if (across === "conversation") {
180
+ key =
181
+ readAttributePath(span.attributes ?? {}, "gen_ai.conversation.id") ??
182
+ readAttributePath(span.attributes ?? {}, "conversation.id");
183
+ }
184
+ if (key === undefined)
185
+ continue;
186
+ const list = groups.get(key) ?? [];
187
+ list.push(span);
188
+ groups.set(key, list);
189
+ }
190
+ return groups;
191
+ }
192
+ /** Evaluate a single invariant primitive. */
193
+ function evaluateInvariant(trace, inv) {
194
+ const violations = [];
195
+ const groups = groupByAcross(trace, inv.across);
196
+ for (const [key, spans] of groups.entries()) {
197
+ if (spans.length < 2)
198
+ continue;
199
+ const firstVal = readAttributePath(spans[0].attributes ?? {}, inv.attribute);
200
+ for (let i = 1; i < spans.length; i++) {
201
+ const v = readAttributePath(spans[i].attributes ?? {}, inv.attribute);
202
+ // If both undefined, no violation. If diverge, violation.
203
+ if (firstVal === undefined && v === undefined)
204
+ continue;
205
+ if (firstVal !== v) {
206
+ violations.push(`invariant: ${inv.attribute} drifts across ${inv.across}="${key}" (first=${JSON.stringify(firstVal)}, span ${spans[i].id}=${JSON.stringify(v)})`);
207
+ break; // one violation per group is sufficient
208
+ }
209
+ }
210
+ }
211
+ return violations;
212
+ }
213
+ /** Top-level trace rule evaluator. Returns matched=true if ANY declared
214
+ * primitive evaluates to violation. */
215
+ export function evaluateTraceRule(rule, trace) {
216
+ const t = rule.detection.trace;
217
+ if (!t) {
218
+ return { matched: false, violations: [], matchedPrimitives: [] };
219
+ }
220
+ const allViolations = [];
221
+ const matchedPrimitives = [];
222
+ for (const f of t.forbid ?? []) {
223
+ const v = evaluateForbid(trace, f);
224
+ if (v.length > 0) {
225
+ allViolations.push(...v);
226
+ matchedPrimitives.push("forbid");
227
+ }
228
+ }
229
+ for (const r of t.require ?? []) {
230
+ const v = evaluateRequire(trace, r);
231
+ if (v.length > 0) {
232
+ allViolations.push(...v);
233
+ matchedPrimitives.push("require");
234
+ }
235
+ }
236
+ for (const inv of t.invariant ?? []) {
237
+ const v = evaluateInvariant(trace, inv);
238
+ if (v.length > 0) {
239
+ allViolations.push(...v);
240
+ matchedPrimitives.push("invariant");
241
+ }
242
+ }
243
+ return {
244
+ matched: allViolations.length > 0,
245
+ violations: allViolations,
246
+ matchedPrimitives,
247
+ };
248
+ }
249
+ //# sourceMappingURL=trace-evaluator.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"trace-evaluator.js","sourceRoot":"","sources":["../src/trace-evaluator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,yFAAyF;AACzF,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,iFAAiF;AACjF,SAAS,kBAAkB,CAAC,KAAc,EAAE,aAAsB;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClB,OAAO,iBAAiB,CAAC,aAAa,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,KAA8B,EAAE,IAAY;IACrE,4FAA4F;IAC5F,IAAI,IAAI,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,wBAAwB;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAY,KAAK,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9C,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,SAAkB,EAAE,KAAc;IAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,KAAK,KAAK,SAAS,CAAC;IAC7B,CAAC;IACD,mBAAmB;IACnB,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,KAAK,KAAK,SAAS,CAAC;IAC7B,CAAC;IACD,MAAM,IAAI,GAAG,SAAoC,CAAC;IAClD,sEAAsE;IACtE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAK,IAAI,CAAC,IAAI,CAAe,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxF,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAE,IAAI,CAAC,IAAI,CAAe,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,CAAE,IAAI,CAAC,QAAQ,CAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,YAAY,IAAI,IAAI;QAAE,OAAO,KAAK,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/C,OAAO,cAAc,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAW,CAAC,CAAC;YAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,sEAAsE;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+FAA+F;AAC/F,SAAS,gBAAgB,CAAC,IAAa,EAAE,KAAmB;IAC1D,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,KAAK,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;IAChD,CAAC;IACD,MAAM,cAAc,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACrD,0BAA0B;QAC1B,IACE,QAAQ,KAAK,IAAI;YACjB,OAAO,QAAQ,KAAK,QAAQ;YAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACxB,CAAC;YACD,kDAAkD;YAClD,MAAM,YAAY,GAA4B,EAAE,CAAC;YACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;gBACzE,YAAY,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAChD,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,sDAAsD;YACtD,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,SAAS,eAAe,CACtB,KAAe,EACf,SAAiB,EACjB,UAA4D;IAE5D,MAAM,MAAM,GACV,eAAe,IAAI,UAAU;QAC3B,CAAC,CAAE,UAAgD,CAAC,aAAa;QACjE,CAAC,CAAC,CAAC,UAA0B,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,SAAS,cAAc,CAAC,KAAe,EAAE,MAAsB;IAC7D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,SAAS;QACpD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACrE,IAAI,cAAc,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,EAAE,wCAAwC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;mFACmF;AACnF,SAAS,eAAe,CAAC,KAAe,EAAE,GAAoB;IAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC;YAAE,SAAS;QACxD,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,UAAU,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,yCAAyC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,KAAe,EAAE,MAAmC;IACzE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,GAAuB,CAAC;QAC5B,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC;QACpC,CAAC;aAAM,IAAI,MAAM,KAAK,wBAAwB,EAAE,CAAC;YAC/C,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,wBAAwB,CAE1D,CAAC;QAChB,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,YAAY,CAAuB,CAAC;QACrF,CAAC;aAAM,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,GAAG;gBACA,iBAAiB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,wBAAwB,CAAY;oBAC7E,iBAAiB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,iBAAiB,CAAY,CAAC;QAC5E,CAAC;QACD,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6CAA6C;AAC7C,SAAS,iBAAiB,CAAC,KAAe,EAAE,GAAsB;IAChE,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;YACtE,0DAA0D;YAC1D,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS;gBAAE,SAAS;YACxD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,UAAU,CAAC,IAAI,CACb,cAAc,GAAG,CAAC,SAAS,kBAAkB,GAAG,CAAC,MAAM,KAAK,GAAG,YAAY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CACjJ,CAAC;gBACF,MAAM,CAAC,wCAAwC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAQD;wCACwC;AACxC,MAAM,UAAU,iBAAiB,CAAC,IAAa,EAAE,KAAe;IAC9D,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;IAC/B,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,iBAAiB,GAA2C,EAAE,CAAC;IAErE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,MAAM,GAAG,CAAC;QACjC,UAAU,EAAE,aAAa;QACzB,iBAAiB;KAClB,CAAC;AACJ,CAAC"}
package/dist/types.d.ts CHANGED
@@ -8,6 +8,19 @@ export type ATRCategory = "prompt-injection" | "tool-poisoning" | "context-exfil
8
8
  export type ATRConfidence = "high" | "medium" | "low";
9
9
  export type ATRSourceType = "llm_io" | "tool_call" | "mcp_exchange" | "agent_behavior" | "multi_agent_comm" | "context_window" | "memory_access" | "skill_lifecycle" | "skill_permission" | "skill_chain";
10
10
  export type ATRMatchType = "contains" | "regex" | "exact" | "starts_with";
11
+ /**
12
+ * BCP-47 language tag used by multilingual rules (v3.0+).
13
+ *
14
+ * When a condition declares `language: 'zh-Hant'`, the engine will only
15
+ * evaluate the condition against inputs whose dominant script matches.
16
+ * Rules without an explicit `language` field default to `'en'` and apply
17
+ * to all inputs (backwards-compatible with v2.x).
18
+ *
19
+ * Adding a new language: append the tag here and update
20
+ * `detectInputLanguage()` in engine.ts to recognise the relevant Unicode
21
+ * block.
22
+ */
23
+ export type ATRLanguage = "en" | "zh-Hant" | "zh-Hans" | "ja" | "es" | "ar";
11
24
  export type ATROperator = "gt" | "lt" | "eq" | "gte" | "lte" | "deviation_from_baseline";
12
25
  export type ATRAction = "block_input" | "block_output" | "block_tool" | "quarantine_session" | "reset_context" | "alert" | "shadow" | "snapshot" | "escalate" | "reduce_permissions" | "kill_agent";
13
26
  export interface ATRReferences {
@@ -34,6 +47,14 @@ export interface ATRPatternCondition {
34
47
  patterns: string[];
35
48
  match_type: ATRMatchType;
36
49
  case_sensitive?: boolean;
50
+ /**
51
+ * BCP-47 language tag. v3.0+ multilingual support.
52
+ *
53
+ * If set, this condition only fires when the engine's input language
54
+ * detection matches. Default behaviour (field absent) is "match all
55
+ * inputs", preserving v2.x compatibility.
56
+ */
57
+ language?: ATRLanguage;
37
58
  }
38
59
  export interface ATRBehavioralCondition {
39
60
  metric: string;
@@ -68,6 +89,112 @@ export interface ATRDetection {
68
89
  /** "any" = OR across all conditions, "all" = AND. For named format: boolean expression string. */
69
90
  condition: string;
70
91
  false_positives?: string[];
92
+ /** v1.1 detection method extension. Default "pattern" when absent. */
93
+ method?: "pattern" | "signature" | "semantic" | "behavioral" | "trace";
94
+ /** v1.1 signature method companion (atr-method-v1.1.md §5) */
95
+ signature?: ATRSignatureDetection;
96
+ /** v1.1 semantic method companion (atr-method-v1.1.md §6) */
97
+ semantic?: ATRSemanticDetection;
98
+ /** v1.1 behavioral method companion (atr-method-v1.1.md §7) */
99
+ behavioral?: ATRBehavioralDetection;
100
+ /** v1.1 trace method companion (atr-method-v1.1.md §8) */
101
+ trace?: ATRTraceDetection;
102
+ }
103
+ /** v1.1 signature method — exact-match indicators */
104
+ export interface ATRSignatureDetection {
105
+ indicators: ATRSignatureIndicator[];
106
+ match_logic?: "any" | "all";
107
+ }
108
+ export interface ATRSignatureIndicator {
109
+ type: "sha256" | "sha512" | "blake2b-256" | "package_name" | "registry_url" | "skill_id";
110
+ value: string;
111
+ target_field: string;
112
+ provenance?: {
113
+ first_observed?: string;
114
+ source?: string;
115
+ attribution?: string;
116
+ };
117
+ }
118
+ /** v1.1 semantic method — LLM-as-judge */
119
+ export interface ATRSemanticDetection {
120
+ judge_model_class: string;
121
+ prompt_template: string;
122
+ threshold: number;
123
+ output_schema?: Record<string, unknown>;
124
+ cache_ttl?: number;
125
+ judge_prompt_hash?: string;
126
+ fallback_method?: "pattern" | "none";
127
+ consensus?: {
128
+ n: number;
129
+ agreement: number;
130
+ };
131
+ }
132
+ /** v1.1 behavioral method — metric threshold over time window */
133
+ export interface ATRBehavioralDetection {
134
+ metric: string;
135
+ aggregation: "count" | "sum" | "avg" | "max" | "distinct_count" | "rate";
136
+ window: string;
137
+ operator: "gt" | "lt" | "gte" | "lte" | "eq" | "deviation_from_baseline";
138
+ threshold: number;
139
+ group_by?: string[];
140
+ filter?: Record<string, unknown>;
141
+ baseline?: {
142
+ source: "rolling_mean" | "historical_percentile" | "fixed";
143
+ lookback?: string;
144
+ percentile?: number;
145
+ value?: number;
146
+ deviation_unit?: "stddev" | "fraction";
147
+ };
148
+ min_events?: number;
149
+ cooldown?: string;
150
+ }
151
+ /** v1.1 trace method — declarative assertions over span DAG */
152
+ export interface ATRTraceDetection {
153
+ ingest_format?: "openinference" | "otel_gen_ai";
154
+ forbid?: ATRTraceForbid[];
155
+ require?: ATRTraceRequire[];
156
+ invariant?: ATRTraceInvariant[];
157
+ }
158
+ /** Span shape matcher: span.kind + attributes (literal or predicate) */
159
+ export type ATRSpanShape = {
160
+ ["span.kind"]?: string;
161
+ attributes?: Record<string, unknown>;
162
+ };
163
+ export interface ATRTraceForbid {
164
+ shape: ATRSpanShape;
165
+ preceded_by?: ATRSpanShape | {
166
+ one_of_shapes: ATRSpanShape[];
167
+ };
168
+ within_trace?: boolean;
169
+ description?: string;
170
+ }
171
+ export interface ATRTraceRequire {
172
+ target_shape: ATRSpanShape;
173
+ must_be_preceded_by: ATRSpanShape | {
174
+ one_of_shapes: ATRSpanShape[];
175
+ };
176
+ within_trace?: boolean;
177
+ description?: string;
178
+ }
179
+ export interface ATRTraceInvariant {
180
+ attribute: string;
181
+ across: "trace" | "agent.delegation_chain" | "session" | "conversation";
182
+ description?: string;
183
+ }
184
+ /** A single span in an OpenInference / OTel GenAI trace */
185
+ export interface ATRSpan {
186
+ id: string;
187
+ ["span.kind"]?: string;
188
+ kind?: string;
189
+ attributes?: Record<string, unknown>;
190
+ start_time?: string;
191
+ end_time?: string;
192
+ parent_id?: string;
193
+ }
194
+ /** An agent execution trace — a temporally ordered set of spans */
195
+ export interface ATRTrace {
196
+ trace_id?: string;
197
+ spans: ATRSpan[];
71
198
  }
72
199
  export interface ATRResponse {
73
200
  actions: ATRAction[];
@@ -147,7 +274,23 @@ export interface AgentEvent {
147
274
  /** Scan context: when 'skill', all rules fire regardless of agent_source.type,
148
275
  * with cross-context confidence downweighting for MCP-only rules. */
149
276
  scanContext?: "mcp" | "skill";
277
+ /** v1.1 trace payload — for trace-method rule evaluation */
278
+ trace?: ATRTrace;
150
279
  }
280
+ /** A semantic-judge invocation signature passed into the engine.
281
+ * Engines that implement method=semantic accept this via dependency
282
+ * injection. When absent, semantic rules with fallback_method='pattern'
283
+ * degrade to pattern evaluation; rules with fallback_method='none' or
284
+ * absent fallback skip silently. */
285
+ export type ATRSemanticJudge = (args: {
286
+ prompt: string;
287
+ input: string;
288
+ judge_model_class: string;
289
+ }) => Promise<{
290
+ category: string;
291
+ confidence: number;
292
+ evidence?: string;
293
+ }>;
151
294
  /** Result when an ATR rule matches an event */
152
295
  export type ScanContextType = "native" | "cross-context";
153
296
  export interface ATRMatch {
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE3E,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,MAAM,GACN,QAAQ,GACR,KAAK,GACL,eAAe,CAAC;AAEpB,MAAM,MAAM,WAAW,GACnB,kBAAkB,GAClB,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,GACpB,gBAAgB,GAChB,aAAa,GACb,kBAAkB,CAAC;AAEvB,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEtD,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,kBAAkB,GAClB,aAAa,CAAC;AAElB,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,CAAC;AAE1E,MAAM,MAAM,WAAW,GACnB,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,KAAK,GACL,KAAK,GACL,yBAAyB,CAAC;AAE9B,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,cAAc,GACd,YAAY,GACZ,oBAAoB,GACpB,eAAe,GACf,OAAO,GACP,QAAQ,GACR,UAAU,GACV,UAAU,GACV,oBAAoB,GACpB,YAAY,CAAC;AAEjB,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,YAAY,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,+CAA+C;AAC/C,MAAM,MAAM,aAAa,GACrB,iBAAiB,EAAE,GACnB,MAAM,CACJ,MAAM,EACN,mBAAmB,GAAG,sBAAsB,GAAG,oBAAoB,CACpE,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,aAAa,CAAC;IAC1B,kGAAkG;IAClG,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,eAAe,CAAC;CACpE;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,cAAc,EAAE,WAAW,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,cAAc,CAAC;IAC7B,SAAS,EAAE,YAAY,CAAC;IACxB,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,wDAAwD;IACxD,aAAa,CAAC,EAAE,cAAc,EAAE,CAAC;IACjC,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,WAAW,GAAG,eAAe,CAAC;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,gBAAgB,GAChB,qBAAqB,GACrB,cAAc,CAAC;AAEnB,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;0EACsE;IACtE,WAAW,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;CAC/B;AAED,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEzD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB;kFAC8E;IAC9E,YAAY,EAAE,eAAe,CAAC;CAC/B;AAED,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEtD,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,WAAW,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACzD;AAED,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,aAAa,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,8CAA8C;AAC9C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,qEAAqE;AACrE,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE3E,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,MAAM,GACN,QAAQ,GACR,KAAK,GACL,eAAe,CAAC;AAEpB,MAAM,MAAM,WAAW,GACnB,kBAAkB,GAClB,gBAAgB,GAChB,sBAAsB,GACtB,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,GACpB,gBAAgB,GAChB,aAAa,GACb,kBAAkB,CAAC;AAEvB,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEtD,MAAM,MAAM,aAAa,GACrB,QAAQ,GACR,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,kBAAkB,GAClB,aAAa,CAAC;AAElB,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,aAAa,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GACnB,IAAI,GACJ,SAAS,GACT,SAAS,GACT,IAAI,GACJ,IAAI,GACJ,IAAI,CAAC;AAET,MAAM,MAAM,WAAW,GACnB,IAAI,GACJ,IAAI,GACJ,IAAI,GACJ,KAAK,GACL,KAAK,GACL,yBAAyB,CAAC;AAE9B,MAAM,MAAM,SAAS,GACjB,aAAa,GACb,cAAc,GACd,YAAY,GACZ,oBAAoB,GACpB,eAAe,GACf,OAAO,GACP,QAAQ,GACR,UAAU,GACV,UAAU,GACV,oBAAoB,GACpB,YAAY,CAAC;AAEjB,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,OAAO;IACtB,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,YAAY,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,+CAA+C;AAC/C,MAAM,MAAM,aAAa,GACrB,iBAAiB,EAAE,GACnB,MAAM,CACJ,MAAM,EACN,mBAAmB,GAAG,sBAAsB,GAAG,oBAAoB,CACpE,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,aAAa,CAAC;IAC1B,kGAAkG;IAClG,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,sEAAsE;IACtE,MAAM,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC;IACvE,8DAA8D;IAC9D,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,+DAA+D;IAC/D,UAAU,CAAC,EAAE,sBAAsB,CAAC;IACpC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,qBAAqB,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,cAAc,GAAG,cAAc,GAAG,UAAU,CAAC;IACzF,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,0CAA0C;AAC1C,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IACrC,SAAS,CAAC,EAAE;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C;AAED,iEAAiE;AACjE,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,gBAAgB,GAAG,MAAM,CAAC;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,yBAAyB,CAAC;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE,cAAc,GAAG,uBAAuB,GAAG,OAAO,CAAC;QAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,cAAc,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KACxC,CAAC;IACF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,eAAe,GAAG,aAAa,CAAC;IAChD,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED,wEAAwE;AACxE,MAAM,MAAM,YAAY,GAAG;IACzB,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,YAAY,CAAC;IACpB,WAAW,CAAC,EAAE,YAAY,GAAG;QAAE,aAAa,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IAC/D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,YAAY,CAAC;IAC3B,mBAAmB,EAAE,YAAY,GAAG;QAAE,aAAa,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IACtE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,GAAG,wBAAwB,GAAG,SAAS,GAAG,cAAc,CAAC;IACxE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,2DAA2D;AAC3D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,eAAe,CAAC;CACpE;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,WAAW,EAAE,CAAC;IAC9B,cAAc,EAAE,WAAW,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,cAAc,CAAC;IAC7B,SAAS,EAAE,YAAY,CAAC;IACxB,QAAQ,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,wDAAwD;IACxD,aAAa,CAAC,EAAE,cAAc,EAAE,CAAC;IACjC,iGAAiG;IACjG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,WAAW,GAAG,eAAe,CAAC;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,MAAM,cAAc,GACtB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,eAAe,GACf,gBAAgB,GAChB,qBAAqB,GACrB,cAAc,CAAC;AAEnB,mDAAmD;AACnD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC;0EACsE;IACtE,WAAW,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC;IAC9B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED;;;;qCAIqC;AACrC,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;CAC3B,KAAK,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3E,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,eAAe,CAAC;AAEzD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB;kFAC8E;IAC9E,YAAY,EAAE,eAAe,CAAC;CAC/B;AAED,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEtD,mEAAmE;AACnE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,WAAW,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,mEAAmE;AACnE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACzD,WAAW,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,YAAY,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3D,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD;;;;;OAKG;IACH,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrD,QAAQ,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,QAAQ,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvD,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACzD;AAED,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,aAAa,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,8CAA8C;AAC9C,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED,qEAAqE;AACrE,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,OAAO,CAAC;AAEvC,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,QAAQ,EAAE,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}
package/package.json CHANGED
@@ -1,8 +1,8 @@
1
1
  {
2
2
  "name": "agent-threat-rules",
3
- "version": "2.1.5",
3
+ "version": "3.0.5",
4
4
  "type": "module",
5
- "description": "Open detection standard -- like Sigma, but for AI agents. 311 rules for prompt injection, tool poisoning, context exfiltration, and MCP attacks. Shipped in Cisco AI Defense. 97.1% recall on NVIDIA garak.",
5
+ "description": "Open detection standard -- like Sigma, but for AI agents. 450 rules for prompt injection, tool poisoning, context exfiltration, and MCP attacks. Shipped in Cisco AI Defense. 97.1% recall on NVIDIA garak.",
6
6
  "main": "./dist/index.js",
7
7
  "types": "./dist/index.d.ts",
8
8
  "bin": {
@@ -74,7 +74,9 @@
74
74
  "validate": "tsx tests/validate-rules.ts",
75
75
  "eval": "tsx src/eval/run-eval.ts",
76
76
  "eval:pint": "tsx src/eval/run-pint-benchmark.ts",
77
- "prepublishOnly": "npm run build"
77
+ "compile:yara": "tsx scripts/compile-yara.ts --all rules/",
78
+ "prepublishOnly": "npm run build",
79
+ "compile:pipelock": "tsx scripts/compile-pipelock.ts"
78
80
  },
79
81
  "dependencies": {
80
82
  "@modelcontextprotocol/sdk": "^1.12.0",