anantham-v2 2.0.0-alpha.1

package/dist/compaction/compaction-types.js

@@ -0,0 +1,40 @@
+import { z } from "zod";
+import { ContextPlanSchema } from "../domain/context.js";
+export const CompactionArtifactRefSchema = z.object({
+    artifactId: z.string().min(1),
+    uri: z.string().optional(),
+    description: z.string().optional(),
+});
+export const CompactionSummarySchema = z.object({
+    objective: z.string().min(1),
+    facts: z.array(z.string()),
+    decisions: z.array(z.string()),
+    constraints: z.array(z.string()),
+    currentState: z.string().min(1),
+    unresolved: z.array(z.string()),
+    artifactReferences: z.array(CompactionArtifactRefSchema),
+    provenance: z.object({
+        sourceEventIds: z.array(z.string()),
+        compactedAt: z.string().min(1),
+    }),
+    pendingActions: z.array(z.string()),
+});
+export const CompactionPreviewSchema = z.object({
+    currentTokens: z.number().int().nonnegative(),
+    projectedTokens: z.number().int().nonnegative(),
+    estimatedSavings: z.number().int(),
+    preservedItemCount: z.number().int().nonnegative(),
+    summarizedItemCount: z.number().int().nonnegative(),
+    omittedItemCount: z.number().int().nonnegative(),
+    warnings: z.array(z.string()),
+});
+export const CompactionResultSchema = z.object({
+    compactionId: z.string().min(1),
+    sessionId: z.string().min(1),
+    compactedPlan: ContextPlanSchema,
+    summary: CompactionSummarySchema,
+    tokensBefore: z.number().int().nonnegative(),
+    tokensAfter: z.number().int().nonnegative(),
+    eventId: z.string().min(1),
+});
+//# sourceMappingURL=compaction-types.js.map

package/dist/compaction/compaction-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compaction-types.js","sourceRoot":"","sources":["../../src/compaction/compaction-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACpC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC7C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAClC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,aAAa,EAAE,iBAAiB;IAChC,OAAO,EAAE,uBAAuB;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC3C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC"}

package/dist/compaction/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./compaction-types.js";
+export * from "./compaction-engine.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/compaction/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/compaction/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC"}

package/dist/compaction/index.js

@@ -0,0 +1,3 @@
+export * from "./compaction-types.js";
+export * from "./compaction-engine.js";
+//# sourceMappingURL=index.js.map

package/dist/compaction/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/compaction/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC"}

package/dist/content/content-access-validator.d.ts

@@ -0,0 +1,32 @@
+import type { ContentObject } from "../domain/content.js";
+import type { TrustLevel, SensitivityLevel } from "../domain/security.js";
+export interface AccessRequestContext {
+    projectId?: string;
+    sessionId?: string;
+    actorTrust?: TrustLevel;
+    actorSensitivityClearance?: SensitivityLevel;
+}
+export interface AccessValidationResult {
+    allowed: boolean;
+    reason?: string;
+}
+export declare class ContentAccessValidator {
+    private static readonly SENSITIVITY_HIERARCHY;
+    /**
+     * Validates whether a request context is permitted to access a ContentObject.
+     * PRD Part 1 Section 14 & PRD Part 3 Security Architecture.
+     */
+    static verifyAccess(content: ContentObject, context: AccessRequestContext): AccessValidationResult;
+    /**
+     * Enforces that sensitivity downgrades (e.g. secret -> public) cannot be performed
+     * by untrusted actors or without explicit elevated permissions.
+     * PRD Part 3 Section 139.
+     */
+    static validateClassificationTransition(currentSensitivity: SensitivityLevel, newSensitivity: SensitivityLevel, actorTrust?: TrustLevel): AccessValidationResult;
+    /**
+     * Verifies strict cross-project boundary isolation.
+     * Content originating in Project A cannot be accessed in Project B unless explicitly public.
+     */
+    static verifyProjectIsolation(content: ContentObject, contextProjectId: string, contentProjectId?: string): AccessValidationResult;
+}
+//# sourceMappingURL=content-access-validator.d.ts.map

package/dist/content/content-access-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-access-validator.d.ts","sourceRoot":"","sources":["../../src/content/content-access-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAE1E,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,yBAAyB,CAAC,EAAE,gBAAgB,CAAC;CAC9C;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAK3C;IAEF;;;OAGG;WACW,YAAY,CACxB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,oBAAoB,GAC5B,sBAAsB;IAuBzB;;;;OAIG;WACW,gCAAgC,CAC5C,kBAAkB,EAAE,gBAAgB,EACpC,cAAc,EAAE,gBAAgB,EAChC,UAAU,GAAE,UAA2B,GACtC,sBAAsB;IAoBzB;;;OAGG;WACW,sBAAsB,CAClC,OAAO,EAAE,aAAa,EACtB,gBAAgB,EAAE,MAAM,EACxB,gBAAgB,CAAC,EAAE,MAAM,GACxB,sBAAsB;CAgB1B"}

package/dist/content/content-access-validator.js

@@ -0,0 +1,71 @@
+export class ContentAccessValidator {
+    static SENSITIVITY_HIERARCHY = {
+        public: 0,
+        normal: 1,
+        sensitive: 2,
+        secret: 3,
+    };
+    /**
+     * Validates whether a request context is permitted to access a ContentObject.
+     * PRD Part 1 Section 14 & PRD Part 3 Security Architecture.
+     */
+    static verifyAccess(content, context) {
+        // 1. Secret / Restricted Content requires matching clearance
+        const requiredLevel = ContentAccessValidator.SENSITIVITY_HIERARCHY[content.security.sensitivity];
+        const actorLevel = ContentAccessValidator.SENSITIVITY_HIERARCHY[context.actorSensitivityClearance || "normal"];
+        if (actorLevel < requiredLevel) {
+            return {
+                allowed: false,
+                reason: `Access denied: content sensitivity '${content.security.sensitivity}' exceeds actor clearance '${context.actorSensitivityClearance || "normal"}'.`,
+            };
+        }
+        // 2. Untrusted actors cannot access internal / sensitive / secret content
+        if (context.actorTrust === "untrusted" && content.security.sensitivity !== "public") {
+            return {
+                allowed: false,
+                reason: "Access denied: untrusted actors are restricted to public content only.",
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Enforces that sensitivity downgrades (e.g. secret -> public) cannot be performed
+     * by untrusted actors or without explicit elevated permissions.
+     * PRD Part 3 Section 139.
+     */
+    static validateClassificationTransition(currentSensitivity, newSensitivity, actorTrust = "user-content") {
+        const currentLevel = ContentAccessValidator.SENSITIVITY_HIERARCHY[currentSensitivity];
+        const newLevel = ContentAccessValidator.SENSITIVITY_HIERARCHY[newSensitivity];
+        // Sensitivity Escalation (e.g. normal -> sensitive) is always permitted for security hardening
+        if (newLevel >= currentLevel) {
+            return { allowed: true };
+        }
+        // Sensitivity Downgrade (e.g. secret -> public) is strictly forbidden for untrusted / normal user actors
+        if (actorTrust === "untrusted" || actorTrust === "user-content" || actorTrust === "web-content") {
+            return {
+                allowed: false,
+                reason: `Unauthorized sensitivity downgrade: untrusted actor with trust '${actorTrust}' cannot downgrade sensitivity from '${currentSensitivity}' to '${newSensitivity}'.`,
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Verifies strict cross-project boundary isolation.
+     * Content originating in Project A cannot be accessed in Project B unless explicitly public.
+     */
+    static verifyProjectIsolation(content, contextProjectId, contentProjectId) {
+        if (!contentProjectId || !contextProjectId) {
+            return { allowed: true };
+        }
+        if (contentProjectId !== contextProjectId) {
+            if (content.security.sensitivity !== "public") {
+                return {
+                    allowed: false,
+                    reason: `Cross-project access violation: content owned by project '${contentProjectId}' cannot be accessed from project '${contextProjectId}'.`,
+                };
+            }
+        }
+        return { allowed: true };
+    }
+}
+//# sourceMappingURL=content-access-validator.js.map

package/dist/content/content-access-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-access-validator.js","sourceRoot":"","sources":["../../src/content/content-access-validator.ts"],"names":[],"mappings":"AAeA,MAAM,OAAO,sBAAsB;IACzB,MAAM,CAAU,qBAAqB,GAAqC;QAChF,MAAM,EAAE,CAAC;QACT,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,CAAC;QACZ,MAAM,EAAE,CAAC;KACV,CAAC;IAEF;;;OAGG;IACI,MAAM,CAAC,YAAY,CACxB,OAAsB,EACtB,OAA6B;QAE7B,6DAA6D;QAC7D,MAAM,aAAa,GAAG,sBAAsB,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACjG,MAAM,UAAU,GAAG,sBAAsB,CAAC,qBAAqB,CAAC,OAAO,CAAC,yBAAyB,IAAI,QAAQ,CAAC,CAAC;QAE/G,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,uCAAuC,OAAO,CAAC,QAAQ,CAAC,WAAW,8BAA8B,OAAO,CAAC,yBAAyB,IAAI,QAAQ,IAAI;aAC3J,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,IAAI,OAAO,CAAC,UAAU,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpF,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,wEAAwE;aACjF,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,gCAAgC,CAC5C,kBAAoC,EACpC,cAAgC,EAChC,aAAyB,cAAc;QAEvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAE9E,+FAA+F;QAC/F,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,yGAAyG;QACzG,IAAI,UAAU,KAAK,WAAW,IAAI,UAAU,KAAK,cAAc,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;YAChG,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,mEAAmE,UAAU,wCAAwC,kBAAkB,SAAS,cAAc,IAAI;aAC3K,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,sBAAsB,CAClC,OAAsB,EACtB,gBAAwB,EACxB,gBAAyB;QAEzB,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAC9C,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,6DAA6D,gBAAgB,sCAAsC,gBAAgB,IAAI;iBAChJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC"}

package/dist/content/content-guards.d.ts

@@ -0,0 +1,64 @@
+export interface MimeSniffResult {
+    mimeType: string;
+    detectedBy: "magic" | "extension" | "text-heuristic" | "binary-fallback";
+    confidence: number;
+    isExecutable?: boolean;
+}
+export interface ArchiveEntryMeta {
+    name: string;
+    compressedSize: number;
+    uncompressedSize: number;
+}
+export interface ArchiveBombOptions {
+    maxDecompressionRatio?: number;
+    maxTotalExpandedBytes?: number;
+    maxEntryCount?: number;
+}
+export interface MimeSpoofCheckResult {
+    isSpoofed: boolean;
+    declaredMime?: string;
+    detectedMime: string;
+    risk: string | null;
+}
+export declare class ContentGuards {
+    static readonly DEFAULT_MAX_FILE_BYTES: number;
+    static readonly DEFAULT_MAX_TEXT_BYTES: number;
+    static readonly DEFAULT_MAX_DECOMPRESSION_RATIO = 100;
+    static readonly DEFAULT_MAX_EXPANDED_ARCHIVE_BYTES: number;
+    static readonly DEFAULT_MAX_ARCHIVE_ENTRIES = 1000;
+    /**
+     * Sniffs MIME type using magic byte signatures, file extension fallback, and text heuristics.
+     * PRD Part 1 Section 10 & PRD Part 3 Section 136.
+     */
+    static sniffMimeType(buffer: Buffer, filename?: string): MimeSniffResult;
+    /**
+     * Detects MIME spoofing where a declared MIME or filename extension contradicts actual magic bytes.
+     * PRD Part 3 Section 136.
+     */
+    static detectMimeSpoofing(buffer: Buffer, declaredMime?: string, filename?: string): MimeSpoofCheckResult;
+    /**
+     * Enforces file size boundaries.
+     */
+    static validateSize(sizeBytes: number, maxBytes?: number): void;
+    /**
+     * Checks archive entry paths for Zip Slip path traversal and dangerous files.
+     * PRD Part 1 Section 13 & PRD Part 3 Section 138.
+     */
+    static checkArchiveSafety(entryNames: string[]): {
+        isSafe: boolean;
+        violations: string[];
+    };
+    /**
+     * Evaluates archive entries against zip bomb / decompression amplification attacks.
+     * PRD Part 3 Section 138.
+     */
+    static checkArchiveBomb(entries: ArchiveEntryMeta[], options?: ArchiveBombOptions): {
+        isBomb: boolean;
+        violations: string[];
+    };
+    /**
+     * Heuristically estimates tokens for a string payload (~4 chars per token).
+     */
+    static estimateTokens(text: string): number;
+}
+//# sourceMappingURL=content-guards.d.ts.map

package/dist/content/content-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-guards.d.ts","sourceRoot":"","sources":["../../src/content/content-guards.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,GAAG,WAAW,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,qBAAa,aAAa;IACxB,gBAAuB,sBAAsB,SAAoB;IACjE,gBAAuB,sBAAsB,SAAoB;IACjE,gBAAuB,+BAA+B,OAAO;IAC7D,gBAAuB,kCAAkC,SAAqB;IAC9E,gBAAuB,2BAA2B,QAAQ;IAE1D;;;OAGG;WACW,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,eAAe;IAsJ/E;;;OAGG;WACW,kBAAkB,CAC9B,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,oBAAoB;IA6DvB;;OAEG;WACW,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAuC,GAAG,IAAI;IAMpG;;;OAGG;WACW,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;IAiCjG;;;OAGG;WACW,gBAAgB,CAC5B,OAAO,EAAE,gBAAgB,EAAE,EAC3B,OAAO,CAAC,EAAE,kBAAkB,GAC3B;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAA;KAAE;IAiD5C;;OAEG;WACW,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;CAInD"}

package/dist/content/content-guards.js

@@ -0,0 +1,290 @@
+import { extname } from "node:path";
+export class ContentGuards {
+    static DEFAULT_MAX_FILE_BYTES = 50 * 1024 * 1024; // 50MB
+    static DEFAULT_MAX_TEXT_BYTES = 10 * 1024 * 1024; // 10MB
+    static DEFAULT_MAX_DECOMPRESSION_RATIO = 100; // 100:1 ratio
+    static DEFAULT_MAX_EXPANDED_ARCHIVE_BYTES = 100 * 1024 * 1024; // 100MB
+    static DEFAULT_MAX_ARCHIVE_ENTRIES = 1000;
+    /**
+     * Sniffs MIME type using magic byte signatures, file extension fallback, and text heuristics.
+     * PRD Part 1 Section 10 & PRD Part 3 Section 136.
+     */
+    static sniffMimeType(buffer, filename) {
+        // 1. Check Magic Byte Signatures
+        if (buffer.length >= 4) {
+            // Windows Executable / DLL: MZ (0x4D 0x5A)
+            if (buffer[0] === 0x4d && buffer[1] === 0x5a) {
+                return { mimeType: "application/x-dosexec", detectedBy: "magic", confidence: 1.0, isExecutable: true };
+            }
+            // Unix ELF: 0x7F 'E' 'L' 'F' (0x7F 0x45 0x4C 0x46)
+            if (buffer[0] === 0x7f && buffer[1] === 0x45 && buffer[2] === 0x4c && buffer[3] === 0x46) {
+                return { mimeType: "application/x-executable", detectedBy: "magic", confidence: 1.0, isExecutable: true };
+            }
+            // Mach-O Executable / Universal Binary
+            const magic32 = buffer.readUInt32BE(0);
+            if (magic32 === 0xfeedface ||
+                magic32 === 0xfeedfacf ||
+                magic32 === 0xcafebabe ||
+                magic32 === 0xbebafeca) {
+                return { mimeType: "application/x-mach-binary", detectedBy: "magic", confidence: 1.0, isExecutable: true };
+            }
+            // PDF: %PDF- (0x25 0x50 0x44 0x46)
+            if (buffer[0] === 0x25 && buffer[1] === 0x50 && buffer[2] === 0x44 && buffer[3] === 0x46) {
+                return { mimeType: "application/pdf", detectedBy: "magic", confidence: 1.0 };
+            }
+            // PNG: 0x89 0x50 0x4E 0x47
+            if (buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4e && buffer[3] === 0x47) {
+                return { mimeType: "image/png", detectedBy: "magic", confidence: 1.0 };
+            }
+            // JPEG: 0xFF 0xD8 0xFF
+            if (buffer[0] === 0xff && buffer[1] === 0xd8 && buffer[2] === 0xff) {
+                return { mimeType: "image/jpeg", detectedBy: "magic", confidence: 1.0 };
+            }
+            // GIF: GIF87a or GIF89a
+            if (buffer[0] === 0x47 &&
+                buffer[1] === 0x49 &&
+                buffer[2] === 0x46 &&
+                buffer[3] === 0x38) {
+                return { mimeType: "image/gif", detectedBy: "magic", confidence: 1.0 };
+            }
+            // ZIP / DOCX / XLSX / JAR: PK\x03\x04
+            if (buffer[0] === 0x50 && buffer[1] === 0x4b && buffer[2] === 0x03 && buffer[3] === 0x04) {
+                if (filename) {
+                    const ext = extname(filename).toLowerCase();
+                    if (ext === ".docx")
+                        return { mimeType: "application/vnd.openxmlformats-officedocument.wordprocessingml.document", detectedBy: "magic", confidence: 0.95 };
+                    if (ext === ".xlsx")
+                        return { mimeType: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", detectedBy: "magic", confidence: 0.95 };
+                }
+                return { mimeType: "application/zip", detectedBy: "magic", confidence: 1.0 };
+            }
+            // GZIP: 0x1F 0x8B
+            if (buffer[0] === 0x1f && buffer[1] === 0x8b) {
+                return { mimeType: "application/gzip", detectedBy: "magic", confidence: 1.0 };
+            }
+            // WebP / RIFF: 0x52 0x49 0x46 0x46
+            if (buffer[0] === 0x52 && buffer[1] === 0x49 && buffer[2] === 0x46 && buffer[3] === 0x46) {
+                if (buffer.length >= 12 && buffer.toString("ascii", 8, 12) === "WEBP") {
+                    return { mimeType: "image/webp", detectedBy: "magic", confidence: 1.0 };
+                }
+                if (buffer.length >= 12 && buffer.toString("ascii", 8, 12) === "WAVE") {
+                    return { mimeType: "audio/wav", detectedBy: "magic", confidence: 1.0 };
+                }
+            }
+        }
+        // 2. Extension based detection
+        if (filename) {
+            const ext = extname(filename).toLowerCase();
+            const extMimes = {
+                ".txt": "text/plain",
+                ".md": "text/markdown",
+                ".markdown": "text/markdown",
+                ".json": "application/json",
+                ".csv": "text/csv",
+                ".tsv": "text/tab-separated-values",
+                ".ts": "text/typescript",
+                ".tsx": "text/typescript-jsx",
+                ".js": "text/javascript",
+                ".jsx": "text/javascript-jsx",
+                ".html": "text/html",
+                ".css": "text/css",
+                ".xml": "application/xml",
+                ".yaml": "application/x-yaml",
+                ".yml": "application/x-yaml",
+                ".sql": "application/sql",
+                ".sh": "application/x-sh",
+                ".ps1": "application/x-powershell",
+                ".py": "text/x-python",
+                ".rs": "text/x-rust",
+                ".go": "text/x-go",
+                ".java": "text/x-java-source",
+                ".c": "text/x-c",
+                ".cpp": "text/x-c++",
+                ".h": "text/x-c-header",
+                ".mp3": "audio/mpeg",
+                ".mp4": "video/mp4",
+                ".webm": "video/webm",
+                ".svg": "image/svg+xml",
+            };
+            if (extMimes[ext]) {
+                return { mimeType: extMimes[ext], detectedBy: "extension", confidence: 0.9 };
+            }
+        }
+        // 3. Text Heuristic Check (Printable ASCII / standard whitespace without null or control bytes)
+        const checkLength = Math.min(buffer.length, 1024);
+        let nonPrintableCount = 0;
+        let hasNull = false;
+        for (let i = 0; i < checkLength; i++) {
+            const byte = buffer[i];
+            if (byte === 0x00) {
+                hasNull = true;
+                break;
+            }
+            if (byte < 0x09 || (byte > 0x0d && byte < 0x20) || byte > 0x7e) {
+                nonPrintableCount++;
+            }
+        }
+        const isText = !hasNull && checkLength > 0 && nonPrintableCount / checkLength < 0.1;
+        if (isText) {
+            // Check if it starts with { or [ for JSON
+            const sample = buffer.toString("utf8", 0, Math.min(buffer.length, 256)).trim();
+            if (sample.startsWith("{") || sample.startsWith("[")) {
+                try {
+                    JSON.parse(buffer.toString("utf8"));
+                    return { mimeType: "application/json", detectedBy: "text-heuristic", confidence: 0.95 };
+                }
+                catch {
+                    // not valid json, treat as plain text
+                }
+            }
+            return { mimeType: "text/plain", detectedBy: "text-heuristic", confidence: 0.75 };
+        }
+        // 4. Binary Fallback
+        return { mimeType: "application/octet-stream", detectedBy: "binary-fallback", confidence: 0.5 };
+    }
+    /**
+     * Detects MIME spoofing where a declared MIME or filename extension contradicts actual magic bytes.
+     * PRD Part 3 Section 136.
+     */
+    static detectMimeSpoofing(buffer, declaredMime, filename) {
+        const sniffResult = ContentGuards.sniffMimeType(buffer, filename);
+        const detectedMime = sniffResult.mimeType;
+        // Check if detected as executable disguised as non-executable
+        if (sniffResult.isExecutable) {
+            if (declaredMime && !declaredMime.includes("executable") && !declaredMime.includes("dosexec")) {
+                return {
+                    isSpoofed: true,
+                    declaredMime,
+                    detectedMime,
+                    risk: `CRITICAL: Binary executable payload disguised as declared MIME '${declaredMime}'.`,
+                };
+            }
+            if (filename) {
+                const ext = extname(filename).toLowerCase();
+                if (ext === ".png" || ext === ".jpg" || ext === ".jpeg" || ext === ".pdf" || ext === ".txt") {
+                    return {
+                        isSpoofed: true,
+                        declaredMime,
+                        detectedMime,
+                        risk: `CRITICAL: Binary executable payload disguised as safe extension '${ext}'.`,
+                    };
+                }
+            }
+        }
+        // Check media / document spoofing
+        if (declaredMime) {
+            const isDeclaredImage = declaredMime.startsWith("image/");
+            const isDetectedImage = detectedMime.startsWith("image/");
+            const isDeclaredPdf = declaredMime === "application/pdf";
+            const isDetectedPdf = detectedMime === "application/pdf";
+            if (isDeclaredImage && !isDetectedImage && detectedMime !== "application/octet-stream") {
+                return {
+                    isSpoofed: true,
+                    declaredMime,
+                    detectedMime,
+                    risk: `MIME mismatch: declared image MIME '${declaredMime}' but detected '${detectedMime}'.`,
+                };
+            }
+            if (isDeclaredPdf && !isDetectedPdf) {
+                return {
+                    isSpoofed: true,
+                    declaredMime,
+                    detectedMime,
+                    risk: `MIME mismatch: declared PDF but detected '${detectedMime}'.`,
+                };
+            }
+        }
+        return {
+            isSpoofed: false,
+            declaredMime,
+            detectedMime,
+            risk: null,
+        };
+    }
+    /**
+     * Enforces file size boundaries.
+     */
+    static validateSize(sizeBytes, maxBytes = ContentGuards.DEFAULT_MAX_FILE_BYTES) {
+        if (sizeBytes > maxBytes) {
+            throw new Error(`Content size of ${sizeBytes} bytes exceeds maximum allowed limit of ${maxBytes} bytes.`);
+        }
+    }
+    /**
+     * Checks archive entry paths for Zip Slip path traversal and dangerous files.
+     * PRD Part 1 Section 13 & PRD Part 3 Section 138.
+     */
+    static checkArchiveSafety(entryNames) {
+        const violations = [];
+        for (const name of entryNames) {
+            // Normalize slashes
+            const normalized = name.replace(/\\/g, "/");
+            // Check for path traversal (Zip Slip)
+            if (normalized.includes("../") ||
+                normalized.startsWith("/") ||
+                normalized.includes("/..") ||
+                /^[a-zA-Z]:\//.test(normalized)) {
+                violations.push(`Zip Slip path traversal risk detected in entry: '${name}'`);
+            }
+            // Check for hidden malicious control scripts or executables in archives
+            const lower = normalized.toLowerCase();
+            const dangerousExtensions = [
+                ".exe", ".bat", ".cmd", ".vbs", ".ps1", ".sh", ".dll", ".so", ".dylib", ".scr", ".com", ".pif"
+            ];
+            if (dangerousExtensions.some(ext => lower.endsWith(ext))) {
+                violations.push(`Restricted executable entry detected in archive: '${name}'`);
+            }
+        }
+        return {
+            isSafe: violations.length === 0,
+            violations,
+        };
+    }
+    /**
+     * Evaluates archive entries against zip bomb / decompression amplification attacks.
+     * PRD Part 3 Section 138.
+     */
+    static checkArchiveBomb(entries, options) {
+        const violations = [];
+        const maxRatio = options?.maxDecompressionRatio ?? ContentGuards.DEFAULT_MAX_DECOMPRESSION_RATIO;
+        const maxTotalBytes = options?.maxTotalExpandedBytes ?? ContentGuards.DEFAULT_MAX_EXPANDED_ARCHIVE_BYTES;
+        const maxEntries = options?.maxEntryCount ?? ContentGuards.DEFAULT_MAX_ARCHIVE_ENTRIES;
+        if (entries.length > maxEntries) {
+            violations.push(`Archive entry count (${entries.length}) exceeds safety limit of ${maxEntries} entries.`);
+        }
+        let totalCompressed = 0;
+        let totalUncompressed = 0;
+        for (const entry of entries) {
+            totalCompressed += entry.compressedSize;
+            totalUncompressed += entry.uncompressedSize;
+            // Check individual entry compression ratio
+            if (entry.compressedSize > 0) {
+                const ratio = entry.uncompressedSize / entry.compressedSize;
+                if (ratio > maxRatio && entry.uncompressedSize > 1024 * 1024) { // Only flag if uncompressed > 1MB
+                    violations.push(`Archive entry '${entry.name}' has anomalous compression ratio of ${ratio.toFixed(1)}:1 (limit: ${maxRatio}:1).`);
+                }
+            }
+        }
+        if (totalUncompressed > maxTotalBytes) {
+            violations.push(`Total uncompressed archive size of ${totalUncompressed} bytes exceeds safety limit of ${maxTotalBytes} bytes.`);
+        }
+        if (totalCompressed > 0) {
+            const overallRatio = totalUncompressed / totalCompressed;
+            if (overallRatio > maxRatio && totalUncompressed > 10 * 1024 * 1024) {
+                violations.push(`Overall archive decompression ratio of ${overallRatio.toFixed(1)}:1 exceeds safety limit of ${maxRatio}:1.`);
+            }
+        }
+        return {
+            isBomb: violations.length > 0,
+            violations,
+        };
+    }
+    /**
+     * Heuristically estimates tokens for a string payload (~4 chars per token).
+     */
+    static estimateTokens(text) {
+        if (!text)
+            return 0;
+        return Math.ceil(text.length / 4);
+    }
+}
+//# sourceMappingURL=content-guards.js.map

package/dist/content/content-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-guards.js","sourceRoot":"","sources":["../../src/content/content-guards.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4BpC,MAAM,OAAO,aAAa;IACjB,MAAM,CAAU,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;IAClE,MAAM,CAAU,sBAAsB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;IAClE,MAAM,CAAU,+BAA+B,GAAG,GAAG,CAAC,CAAM,cAAc;IAC1E,MAAM,CAAU,kCAAkC,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,QAAQ;IAChF,MAAM,CAAU,2BAA2B,GAAG,IAAI,CAAC;IAE1D;;;OAGG;IACI,MAAM,CAAC,aAAa,CAAC,MAAc,EAAE,QAAiB;QAC3D,iCAAiC;QACjC,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,2CAA2C;YAC3C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,OAAO,EAAE,QAAQ,EAAE,uBAAuB,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACzG,CAAC;YAED,mDAAmD;YACnD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzF,OAAO,EAAE,QAAQ,EAAE,0BAA0B,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC5G,CAAC;YAED,uCAAuC;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACvC,IACE,OAAO,KAAK,UAAU;gBACtB,OAAO,KAAK,UAAU;gBACtB,OAAO,KAAK,UAAU;gBACtB,OAAO,KAAK,UAAU,EACtB,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,2BAA2B,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YAC7G,CAAC;YAED,mCAAmC;YACnC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzF,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAC/E,CAAC;YAED,2BAA2B;YAC3B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YACzE,CAAC;YAED,uBAAuB;YACvB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACnE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAC1E,CAAC;YAED,wBAAwB;YACxB,IACE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;gBAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;gBAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;gBAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YACzE,CAAC;YAED,sCAAsC;YACtC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzF,IAAI,QAAQ,EAAE,CAAC;oBACb,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;oBAC5C,IAAI,GAAG,KAAK,OAAO;wBAAE,OAAO,EAAE,QAAQ,EAAE,yEAAyE,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;oBAC3J,IAAI,GAAG,KAAK,OAAO;wBAAE,OAAO,EAAE,QAAQ,EAAE,mEAAmE,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;gBACvJ,CAAC;gBACD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAC/E,CAAC;YAED,kBAAkB;YAClB,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAChF,CAAC;YAED,mCAAmC;YACnC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzF,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;oBACtE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;gBAC1E,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;oBACtE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAA2B;gBACvC,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,eAAe;gBAC5B,OAAO,EAAE,kBAAkB;gBAC3B,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,2BAA2B;gBACnC,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,qBAAqB;gBAC7B,KAAK,EAAE,iBAAiB;gBACxB,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,WAAW;gBACpB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,iBAAiB;gBACzB,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,oBAAoB;gBAC5B,MAAM,EAAE,iBAAiB;gBACzB,KAAK,EAAE,kBAAkB;gBACzB,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,eAAe;gBACtB,KAAK,EAAE,aAAa;gBACpB,KAAK,EAAE,WAAW;gBAClB,OAAO,EAAE,oBAAoB;gBAC7B,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,YAAY;gBACpB,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,eAAe;aACxB,CAAC;YAEF,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClB,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAC/E,CAAC;QACH,CAAC;QAED,gGAAgG;QAChG,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;YACxB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM;YACR,CAAC;YACD,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;gBAC/D,iBAAiB,EAAE,CAAC;YACtB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,WAAW,GAAG,CAAC,IAAI,iBAAiB,GAAG,WAAW,GAAG,GAAG,CAAC;QAEpF,IAAI,MAAM,EAAE,CAAC;YACX,0CAA0C;YAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/E,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC;oBACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;oBACpC,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;gBAC1F,CAAC;gBAAC,MAAM,CAAC;oBACP,sCAAsC;gBACxC,CAAC;YACH,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACpF,CAAC;QAED,qBAAqB;QACrB,OAAO,EAAE,QAAQ,EAAE,0BAA0B,EAAE,UAAU,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAClG,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,kBAAkB,CAC9B,MAAc,EACd,YAAqB,EACrB,QAAiB;QAEjB,MAAM,WAAW,GAAG,aAAa,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE1C,8DAA8D;QAC9D,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;YAC7B,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9F,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,YAAY;oBACZ,YAAY;oBACZ,IAAI,EAAE,mEAAmE,YAAY,IAAI;iBAC1F,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5C,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;oBAC5F,OAAO;wBACL,SAAS,EAAE,IAAI;wBACf,YAAY;wBACZ,YAAY;wBACZ,IAAI,EAAE,oEAAoE,GAAG,IAAI;qBAClF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,eAAe,GAAG,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,eAAe,GAAG,YAAY,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,aAAa,GAAG,YAAY,KAAK,iBAAiB,CAAC;YACzD,MAAM,aAAa,GAAG,YAAY,KAAK,iBAAiB,CAAC;YAEzD,IAAI,eAAe,IAAI,CAAC,eAAe,IAAI,YAAY,KAAK,0BAA0B,EAAE,CAAC;gBACvF,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,YAAY;oBACZ,YAAY;oBACZ,IAAI,EAAE,uCAAuC,YAAY,mBAAmB,YAAY,IAAI;iBAC7F,CAAC;YACJ,CAAC;YAED,IAAI,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpC,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,YAAY;oBACZ,YAAY;oBACZ,IAAI,EAAE,6CAA6C,YAAY,IAAI;iBACpE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,YAAY;YACZ,YAAY;YACZ,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,YAAY,CAAC,SAAiB,EAAE,QAAQ,GAAG,aAAa,CAAC,sBAAsB;QAC3F,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,2CAA2C,QAAQ,SAAS,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,kBAAkB,CAAC,UAAoB;QACnD,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,oBAAoB;YACpB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAE5C,sCAAsC;YACtC,IACE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC1B,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAC/B,CAAC;gBACD,UAAU,CAAC,IAAI,CAAC,oDAAoD,IAAI,GAAG,CAAC,CAAC;YAC/E,CAAC;YAED,wEAAwE;YACxE,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,mBAAmB,GAAG;gBAC1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;aAC/F,CAAC;YACF,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACzD,UAAU,CAAC,IAAI,CAAC,qDAAqD,IAAI,GAAG,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;YAC/B,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,gBAAgB,CAC5B,OAA2B,EAC3B,OAA4B;QAE5B,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,EAAE,qBAAqB,IAAI,aAAa,CAAC,+BAA+B,CAAC;QACjG,MAAM,aAAa,GAAG,OAAO,EAAE,qBAAqB,IAAI,aAAa,CAAC,kCAAkC,CAAC;QACzG,MAAM,UAAU,GAAG,OAAO,EAAE,aAAa,IAAI,aAAa,CAAC,2BAA2B,CAAC;QAEvF,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,MAAM,6BAA6B,UAAU,WAAW,CAAC,CAAC;QAC5G,CAAC;QAED,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAE1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,eAAe,IAAI,KAAK,CAAC,cAAc,CAAC;YACxC,iBAAiB,IAAI,KAAK,CAAC,gBAAgB,CAAC;YAE5C,2CAA2C;YAC3C,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,cAAc,CAAC;gBAC5D,IAAI,KAAK,GAAG,QAAQ,IAAI,KAAK,CAAC,gBAAgB,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,kCAAkC;oBAChG,UAAU,CAAC,IAAI,CACb,kBAAkB,KAAK,CAAC,IAAI,wCAAwC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,QAAQ,MAAM,CACjH,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,iBAAiB,GAAG,aAAa,EAAE,CAAC;YACtC,UAAU,CAAC,IAAI,CACb,sCAAsC,iBAAiB,kCAAkC,aAAa,SAAS,CAChH,CAAC;QACJ,CAAC;QAED,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,YAAY,GAAG,iBAAiB,GAAG,eAAe,CAAC;YACzD,IAAI,YAAY,GAAG,QAAQ,IAAI,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;gBACpE,UAAU,CAAC,IAAI,CACb,0CAA0C,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,QAAQ,KAAK,CAC7G,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC;YAC7B,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,cAAc,CAAC,IAAY;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC"}

package/dist/content/content-ingestion-engine.d.ts

@@ -0,0 +1,23 @@
+import { type ContentObject, type ContentSource } from "../domain/content.js";
+import type { SensitivityLevel, TrustLevel } from "../domain/security.js";
+export interface ContentIngestRequest {
+    data: Buffer | string;
+    name: string;
+    source: ContentSource;
+    projectId?: string;
+    sessionId?: string;
+    taskId?: string;
+    actor?: string;
+    sensitivity?: SensitivityLevel;
+    trust?: TrustLevel;
+    maxSizeBytes?: number;
+}
+export declare class ContentIngestionEngine {
+    /**
+     * Ingests multimodal content, performs security validation, extracts structured representations,
+     * binds provenance, and produces a validated, immutable ContentObject.
+     * PRD Part 1 Section 10-13 & PRD Part 3 Section 135-140.
+     */
+    static ingest(request: ContentIngestRequest): Promise<ContentObject>;
+}
+//# sourceMappingURL=content-ingestion-engine.d.ts.map

package/dist/content/content-ingestion-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-ingestion-engine.d.ts","sourceRoot":"","sources":["../../src/content/content-ingestion-engine.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,aAAa,EAEnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAU1E,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,sBAAsB;IACjC;;;;OAIG;WACiB,MAAM,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;CAoKlF"}