autotel-genai 0.4.2 → 0.6.1

package/README.md

@@ -210,6 +210,47 @@ governance attributes **and** canonical `gen_ai.*` when `ai` metadata is present
 It honours spec breaking change #242 (`gen_ai.agent.id` is dropped on internal
 `invoke_agent` spans via `genAiAgentAttributes(…, { internal: true })`).
 
+**Eval-sandbox incident replay.** When multiple eval agents share a writable
+registry (the OpenAI/HuggingFace pattern), use the agent IR helpers below.
+See the standalone demo at `agent-eval-sandbox-demo` (sibling to ai-sdk-guardrails).
+
+```ts
+import {
+  CrossAgentMonitor,
+  createHoneyTokenTool,
+  crossAgentDetectionsToSecurityEvents,
+  detectCrossAgentPattern,
+  EVAL_IDENTITY_ATTR,
+  querySpansForEvalIncident,
+  recordEvalRunIdentity,
+} from 'autotel-genai/agent';
+
+// Tag every run so its spans stay separable downstream
+// (eval.run_id / eval.task_id / eval.sandbox_id).
+recordEvalRunIdentity({ runId, taskId, sandboxId });
+
+// Live: emit agent.shared_channel.detected as tools run
+const monitor = new CrossAgentMonitor({ minAgents: 2, ctx });
+monitor.record({ agentId: 'eval-a', resource: 'artifactory:/notes' });
+
+// Offline: the same detection over events you collected yourself
+const alerts = crossAgentDetectionsToSecurityEvents(
+  detectCrossAgentPattern(collectedEvents, { minAgents: 2 }),
+);
+
+// Batch IR over an exported span array
+const ir = querySpansForEvalIncident(finishedSpans);
+ir.crossAgentEvents; // shared-channel alerts
+ir.evalRuns; // every EVAL_IDENTITY_ATTR.runId seen
+
+// Honey-token tool: a decoy credential that reports when an agent touches it
+const honeyToken = createHoneyTokenTool({
+  name: 'readLeakedCredential',
+  bait: 'AKIA_HONEY_TOKEN_DO_NOT_USE',
+  ctx,
+});
+```
+
 ### Vercel AI SDK
 
 Register `autotelTelemetry()` once and every `generateText` / `streamText` /
@@ -364,6 +405,7 @@ call exactly once.
 import {
   createGenAiObserver,
   createLangChainObserver, // LangChain / LangGraph callback handler
+  createMastraObserver, // Mastra ObservabilityExporter
   observeAiSdkResult, // Vercel AI SDK result walker
 } from 'autotel-genai/observer';
 
@@ -372,6 +414,19 @@ const observe = createGenAiObserver();
 // LangChain / LangGraph — one handler, runId/parentRunId → span tree:
 await graph.invoke(input, { callbacks: [createLangChainObserver(observe)] });
 
+// Mastra — one exporter on the observability pipeline:
+new Mastra({
+  agents,
+  observability: new Observability({
+    configs: {
+      autotel: {
+        serviceName: 'support-agent',
+        exporters: [createMastraObserver(observe)],
+      },
+    },
+  }),
+});
+
 // Vercel AI SDK — walk a generateText/streamText result:
 observeAiSdkResult(observe, await generateText({ model, prompt }), {
   id: 'gen-1',
@@ -382,6 +437,22 @@ observeAiSdkResult(observe, await generateText({ model, prompt }), {
 
 See `apps/example-langchain-observer` for a runnable LangGraph + Ollama demo.
 
+Mastra maps `agent_run` → `invoke_agent`, `model_generation` → `chat`,
+`rag_embedding` → `embeddings`, every tool-call type → `execute_tool`, and
+`workflow_run`/`workflow_step` → `invoke_workflow`. Plumbing (model steps and
+chunks, processors, scorers, mappings) is dropped and its children reparent to
+the nearest kept ancestor. Pass `skipSpan` to drop additional supported span
+types; unsupported plumbing always stays dropped. `model_step` /
+`model_inference` are dropped deliberately: their usage is already summed on the
+enclosing `model_generation`, so keeping both would double-count
+`gen_ai.usage.*`.
+
+`@mastra/otel-exporter` also emits canonical `gen_ai.*`. Prefer this adapter
+when you want Mastra's spans to be _autotel's_ spans — Mastra dispatches events
+synchronously, so they nest under the request span you already opened, reach
+every `init()` destination, pass through your `spanEnrichers` (including
+`langfuseCompatibility`), and get priced.
+
 ## Semantic conventions
 
 Aligned to the `semantic-conventions-genai` snapshot. Span names follow the

package/dist/agent/index.cjs

@@ -1,27 +1,34 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_agent_security = require('../agent-security-kfpXuwL4.cjs');
-const require_agent = require('../agent-CnXNAj9B.cjs');
+const require_agent = require('../agent-CpucMj6w.cjs');
 
 exports.AGENT_AUDIT_SCHEMA_VERSION = require_agent.AGENT_AUDIT_SCHEMA_VERSION;
 exports.AGENT_PLAN_RISK_ATTR = require_agent.AGENT_PLAN_RISK_ATTR;
 exports.AGENT_SECURITY_ATTR = require_agent_security.AGENT_SECURITY_ATTR;
+exports.CrossAgentMonitor = require_agent.CrossAgentMonitor;
+exports.EVAL_IDENTITY_ATTR = require_agent.EVAL_IDENTITY_ATTR;
 exports.agentContextFromSpan = require_agent_security.agentContextFromSpan;
 exports.canonicalizeForHash = require_agent.canonicalizeForHash;
 exports.createAgentAuditMetadata = require_agent.createAgentAuditMetadata;
 exports.createAgentIdentityRegistry = require_agent.createAgentIdentityRegistry;
+exports.createHoneyTokenTool = require_agent.createHoneyTokenTool;
 exports.createSignedEventEnvelope = require_agent.createSignedEventEnvelope;
+exports.crossAgentDetectionsToSecurityEvents = require_agent.crossAgentDetectionsToSecurityEvents;
 exports.defineAgentAction = require_agent.defineAgentAction;
 exports.defineAgentToolCall = require_agent.defineAgentToolCall;
 exports.delegateToAgent = require_agent.delegateToAgent;
 exports.deriveActionRiskClass = require_agent_security.deriveActionRiskClass;
+exports.detectCrossAgentPattern = require_agent.detectCrossAgentPattern;
 exports.flattenAgentAttributes = require_agent.flattenAgentAttributes;
 exports.hashPayload = require_agent.hashPayload;
 exports.heuristicPlanRiskClassifier = require_agent.heuristicPlanRiskClassifier;
+exports.querySpansForEvalIncident = require_agent.querySpansForEvalIncident;
 exports.recordActionRiskClass = require_agent_security.recordActionRiskClass;
 exports.recordActiveScopes = require_agent_security.recordActiveScopes;
 exports.recordAgentHandoff = require_agent.recordAgentHandoff;
 exports.recordControllerId = require_agent_security.recordControllerId;
 exports.recordDecisionBasis = require_agent.recordDecisionBasis;
+exports.recordEvalRunIdentity = require_agent.recordEvalRunIdentity;
 exports.recordHumanApproval = require_agent_security.recordHumanApproval;
 exports.recordInputProvenance = require_agent_security.recordInputProvenance;
 exports.recordMemoryAccess = require_agent_security.recordMemoryAccess;
@@ -33,6 +40,7 @@ exports.resolvePrivacyProfile = require_agent.resolvePrivacyProfile;
 exports.runAgentPlanClassifier = require_agent.runAgentPlanClassifier;
 exports.sanitizeAuditPayload = require_agent.sanitizeAuditPayload;
 exports.setAgentAttributes = require_agent.setAgentAttributes;
+exports.spansToCrossAgentEvents = require_agent.spansToCrossAgentEvents;
 exports.tryRecordHumanApproval = require_agent_security.tryRecordHumanApproval;
 exports.verifyEventEnvelopeHash = require_agent.verifyEventEnvelopeHash;
 exports.withAgentAction = require_agent.withAgentAction;

package/dist/agent/index.d.cts

@@ -1,4 +1,4 @@
-import { $ as AgentToolCallOptions, A as delegateToAgent, B as AgentDecisionMetadata, C as defineAgentToolCall, D as withAgentToolCall, E as withAgentAction, F as AgentActionFactory, G as AgentIdentityRegistry, H as AgentHandler, I as AgentActionMetadata, J as AgentOutcome, K as AgentIdentityStatus, L as AgentActionOptions, M as flattenAgentAttributes, N as setAgentAttributes, O as DelegateToAgentInput, P as createAgentAuditMetadata, Q as AgentToolCallActionMetadata, R as AgentAiMetadata, S as defineAgentAction, T as recordPolicyDecision, U as AgentIdentity, V as AgentEventKind, W as AgentIdentityRecord, X as AgentSessionMetadata, Y as AgentSessionActionMetadata, Z as AgentSessionStatus, _ as ProvisionAgentIdentityInput, a as AgentPlanRiskVerdict, at as PrivacyProfile, b as createAgentIdentityRegistry, c as recordPlanRiskAssessment, ct as ToolCallMetadata, d as CreateSignedEventEnvelopeOptions, dt as canonicalizeForHash, et as AiLifecycleStage, f as createSignedEventEnvelope, ft as hashPayload, g as sanitizeAuditPayload, h as resolvePrivacyProfile, i as AgentPlanClassifierResult, it as PolicyMetadata, j as recordAgentHandoff, k as RecordAgentHandoffMetadata, l as runAgentPlanClassifier, lt as ToolStatus, m as PrivacyProfileInput, n as AgentPlanClassifier, nt as GovernanceMetadata, o as RecordPlanRiskAssessmentOptions, ot as PrivacyProfileName, p as verifyEventEnvelopeHash, pt as AGENT_AUDIT_SCHEMA_VERSION, q as AgentMetadataInput, r as AgentPlanClassifierInput, rt as PolicyDecision, s as heuristicPlanRiskClassifier, st as ScopedToolDefinition, t as AGENT_PLAN_RISK_ATTR, tt as DelegationContext, u as withScopedTool, ut as HashPayloadOptions, v as RevokeAgentIdentityInput, w as recordDecisionBasis, x as withAgentSession, y as RotateAgentIdentityInput, z as AgentAuditEventEnvelope } from "../index-Dc450L-d.cjs";
+import { $ as canonicalizeForHash, A as verifyEventEnvelopeHash, B as defineAgentToolCall, C as CrossAgentSecurityEvent, D as withScopedTool, E as detectCrossAgentPattern, F as RevokeAgentIdentityInput, G as DelegateToAgentInput, H as recordPolicyDecision, I as RotateAgentIdentityInput, J as recordAgentHandoff, K as RecordAgentHandoffMetadata, L as createAgentIdentityRegistry, M as resolvePrivacyProfile, N as sanitizeAuditPayload, O as CreateSignedEventEnvelopeOptions, P as ProvisionAgentIdentityInput, Q as HashPayloadOptions, R as withAgentSession, S as CrossAgentEvent, T as crossAgentDetectionsToSecurityEvents, U as withAgentAction, V as recordDecisionBasis, W as withAgentToolCall, X as setAgentAttributes, Y as flattenAgentAttributes, Z as createAgentAuditMetadata, _ as RecordEvalRunIdentityInput, a as AgentPlanRiskVerdict, b as CrossAgentMonitorOptions, c as recordPlanRiskAssessment, d as querySpansForEvalIncident, et as hashPayload, f as spansToCrossAgentEvents, g as EVAL_IDENTITY_ATTR, h as createHoneyTokenTool, i as AgentPlanClassifierResult, j as PrivacyProfileInput, k as createSignedEventEnvelope, l as runAgentPlanClassifier, m as HoneyTokenToolOptions, n as AgentPlanClassifier, o as RecordPlanRiskAssessmentOptions, p as HoneyTokenToolDefinition, q as delegateToAgent, r as AgentPlanClassifierInput, s as heuristicPlanRiskClassifier, t as AGENT_PLAN_RISK_ATTR, tt as AGENT_AUDIT_SCHEMA_VERSION, u as EvalIncidentQueryResult, v as recordEvalRunIdentity, w as DetectCrossAgentPatternOptions, x as CrossAgentDetection, y as CrossAgentMonitor, z as defineAgentAction } from "../index-PH_ymlyO.cjs";
 import { a as TokenUsage, i as ModelPricing } from "../cost-C1FkUNG1.cjs";
-import { C as recordPlanStep, D as agentContextFromSpan, E as AgentContext, S as recordMemoryAccess, T as tryRecordHumanApproval, _ as recordActionRiskClass, a as AgentInputProvenance, b as recordHumanApproval, c as AgentSecurityRecordOptions, d as RecordHumanApprovalInput, f as RecordInputProvenanceInput, g as deriveActionRiskClass, h as RecordRenderOutputInput, i as AgentConsentOutcome, l as RecordActiveScopesInput, m as RecordPlanStepInput, n as ActionRiskHints, o as AgentMemoryOperation, p as RecordMemoryAccessInput, r as AgentActionRiskClass, s as AgentOutputFormat, t as AGENT_SECURITY_ATTR, u as RecordControllerInput, v as recordActiveScopes, w as recordRenderOutput, x as recordInputProvenance, y as recordControllerId } from "../agent-security-BHdP6ZPG.cjs";
-export { AGENT_AUDIT_SCHEMA_VERSION, AGENT_PLAN_RISK_ATTR, AGENT_SECURITY_ATTR, type ActionRiskHints, type AgentActionFactory, type AgentActionMetadata, type AgentActionOptions, type AgentActionRiskClass, type AgentAiMetadata, type AgentAuditEventEnvelope, type AgentConsentOutcome, type AgentContext, type AgentDecisionMetadata, type AgentEventKind, type AgentHandler, type AgentIdentity, type AgentIdentityRecord, type AgentIdentityRegistry, type AgentIdentityStatus, type AgentInputProvenance, type AgentMemoryOperation, type AgentMetadataInput, type AgentOutcome, type AgentOutputFormat, type AgentPlanClassifier, type AgentPlanClassifierInput, type AgentPlanClassifierResult, type AgentPlanRiskVerdict, type AgentSecurityRecordOptions, type AgentSessionActionMetadata, type AgentSessionMetadata, type AgentSessionStatus, type AgentToolCallActionMetadata, type AgentToolCallOptions, type AiLifecycleStage, type CreateSignedEventEnvelopeOptions, type DelegateToAgentInput, type DelegationContext, type GovernanceMetadata, type HashPayloadOptions, type ModelPricing, type PolicyDecision, type PolicyMetadata, type PrivacyProfile, type PrivacyProfileInput, type PrivacyProfileName, type ProvisionAgentIdentityInput, type RecordActiveScopesInput, type RecordAgentHandoffMetadata, type RecordControllerInput, type RecordHumanApprovalInput, type RecordInputProvenanceInput, type RecordMemoryAccessInput, type RecordPlanRiskAssessmentOptions, type RecordPlanStepInput, type RecordRenderOutputInput, type RevokeAgentIdentityInput, type RotateAgentIdentityInput, type ScopedToolDefinition, type TokenUsage, type ToolCallMetadata, type ToolStatus, agentContextFromSpan, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createSignedEventEnvelope, defineAgentAction, defineAgentToolCall, delegateToAgent, deriveActionRiskClass, flattenAgentAttributes, hashPayload, heuristicPlanRiskClassifier, recordActionRiskClass, recordActiveScopes, recordAgentHandoff, recordControllerId, recordDecisionBasis, recordHumanApproval, recordInputProvenance, recordMemoryAccess, recordPlanRiskAssessment, recordPlanStep, recordPolicyDecision, recordRenderOutput, resolvePrivacyProfile, runAgentPlanClassifier, sanitizeAuditPayload, setAgentAttributes, tryRecordHumanApproval, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };
+import { $ as ScopedToolDefinition, A as AgentAuditEventEnvelope, B as AgentSessionActionMetadata, C as recordPlanStep, D as AgentActionMetadata, E as AgentActionFactory, F as AgentIdentityRecord, G as AiLifecycleStage, H as AgentSessionStatus, I as AgentIdentityRegistry, J as GovernanceMetadata, K as DelegationContext, L as AgentIdentityStatus, M as AgentEventKind, N as AgentHandler, O as AgentActionOptions, P as AgentIdentity, Q as PrivacyProfileName, R as AgentMetadataInput, S as recordMemoryAccess, T as tryRecordHumanApproval, U as AgentToolCallActionMetadata, V as AgentSessionMetadata, W as AgentToolCallOptions, X as PolicyMetadata, Y as PolicyDecision, Z as PrivacyProfile, _ as recordActionRiskClass, a as AgentInputProvenance, b as recordHumanApproval, c as AgentSecurityRecordOptions, d as RecordHumanApprovalInput, et as ToolCallMetadata, f as RecordInputProvenanceInput, g as deriveActionRiskClass, h as RecordRenderOutputInput, i as AgentConsentOutcome, j as AgentDecisionMetadata, k as AgentAiMetadata, l as RecordActiveScopesInput, m as RecordPlanStepInput, n as ActionRiskHints, nt as AgentContext, o as AgentMemoryOperation, p as RecordMemoryAccessInput, r as AgentActionRiskClass, rt as agentContextFromSpan, s as AgentOutputFormat, t as AGENT_SECURITY_ATTR, tt as ToolStatus, u as RecordControllerInput, v as recordActiveScopes, w as recordRenderOutput, x as recordInputProvenance, y as recordControllerId, z as AgentOutcome } from "../agent-security-BFryrFbk.cjs";
+export { AGENT_AUDIT_SCHEMA_VERSION, AGENT_PLAN_RISK_ATTR, AGENT_SECURITY_ATTR, type ActionRiskHints, type AgentActionFactory, type AgentActionMetadata, type AgentActionOptions, type AgentActionRiskClass, type AgentAiMetadata, type AgentAuditEventEnvelope, type AgentConsentOutcome, type AgentContext, type AgentDecisionMetadata, type AgentEventKind, type AgentHandler, type AgentIdentity, type AgentIdentityRecord, type AgentIdentityRegistry, type AgentIdentityStatus, type AgentInputProvenance, type AgentMemoryOperation, type AgentMetadataInput, type AgentOutcome, type AgentOutputFormat, type AgentPlanClassifier, type AgentPlanClassifierInput, type AgentPlanClassifierResult, type AgentPlanRiskVerdict, type AgentSecurityRecordOptions, type AgentSessionActionMetadata, type AgentSessionMetadata, type AgentSessionStatus, type AgentToolCallActionMetadata, type AgentToolCallOptions, type AiLifecycleStage, type CreateSignedEventEnvelopeOptions, type CrossAgentDetection, type CrossAgentEvent, CrossAgentMonitor, type CrossAgentMonitorOptions, type CrossAgentSecurityEvent, type DelegateToAgentInput, type DelegationContext, type DetectCrossAgentPatternOptions, EVAL_IDENTITY_ATTR, type EvalIncidentQueryResult, type GovernanceMetadata, type HashPayloadOptions, type HoneyTokenToolDefinition, type HoneyTokenToolOptions, type ModelPricing, type PolicyDecision, type PolicyMetadata, type PrivacyProfile, type PrivacyProfileInput, type PrivacyProfileName, type ProvisionAgentIdentityInput, type RecordActiveScopesInput, type RecordAgentHandoffMetadata, type RecordControllerInput, type RecordEvalRunIdentityInput, type RecordHumanApprovalInput, type RecordInputProvenanceInput, type RecordMemoryAccessInput, type RecordPlanRiskAssessmentOptions, type RecordPlanStepInput, type RecordRenderOutputInput, type RevokeAgentIdentityInput, type RotateAgentIdentityInput, type ScopedToolDefinition, type TokenUsage, type ToolCallMetadata, type ToolStatus, agentContextFromSpan, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createHoneyTokenTool, createSignedEventEnvelope, crossAgentDetectionsToSecurityEvents, defineAgentAction, defineAgentToolCall, delegateToAgent, deriveActionRiskClass, detectCrossAgentPattern, flattenAgentAttributes, hashPayload, heuristicPlanRiskClassifier, querySpansForEvalIncident, recordActionRiskClass, recordActiveScopes, recordAgentHandoff, recordControllerId, recordDecisionBasis, recordEvalRunIdentity, recordHumanApproval, recordInputProvenance, recordMemoryAccess, recordPlanRiskAssessment, recordPlanStep, recordPolicyDecision, recordRenderOutput, resolvePrivacyProfile, runAgentPlanClassifier, sanitizeAuditPayload, setAgentAttributes, spansToCrossAgentEvents, tryRecordHumanApproval, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };

package/dist/agent/index.d.ts

@@ -1,4 +1,4 @@
-import { $ as AgentToolCallOptions, A as delegateToAgent, B as AgentDecisionMetadata, C as defineAgentToolCall, D as withAgentToolCall, E as withAgentAction, F as AgentActionFactory, G as AgentIdentityRegistry, H as AgentHandler, I as AgentActionMetadata, J as AgentOutcome, K as AgentIdentityStatus, L as AgentActionOptions, M as flattenAgentAttributes, N as setAgentAttributes, O as DelegateToAgentInput, P as createAgentAuditMetadata, Q as AgentToolCallActionMetadata, R as AgentAiMetadata, S as defineAgentAction, T as recordPolicyDecision, U as AgentIdentity, V as AgentEventKind, W as AgentIdentityRecord, X as AgentSessionMetadata, Y as AgentSessionActionMetadata, Z as AgentSessionStatus, _ as ProvisionAgentIdentityInput, a as AgentPlanRiskVerdict, at as PrivacyProfile, b as createAgentIdentityRegistry, c as recordPlanRiskAssessment, ct as ToolCallMetadata, d as CreateSignedEventEnvelopeOptions, dt as canonicalizeForHash, et as AiLifecycleStage, f as createSignedEventEnvelope, ft as hashPayload, g as sanitizeAuditPayload, h as resolvePrivacyProfile, i as AgentPlanClassifierResult, it as PolicyMetadata, j as recordAgentHandoff, k as RecordAgentHandoffMetadata, l as runAgentPlanClassifier, lt as ToolStatus, m as PrivacyProfileInput, n as AgentPlanClassifier, nt as GovernanceMetadata, o as RecordPlanRiskAssessmentOptions, ot as PrivacyProfileName, p as verifyEventEnvelopeHash, pt as AGENT_AUDIT_SCHEMA_VERSION, q as AgentMetadataInput, r as AgentPlanClassifierInput, rt as PolicyDecision, s as heuristicPlanRiskClassifier, st as ScopedToolDefinition, t as AGENT_PLAN_RISK_ATTR, tt as DelegationContext, u as withScopedTool, ut as HashPayloadOptions, v as RevokeAgentIdentityInput, w as recordDecisionBasis, x as withAgentSession, y as RotateAgentIdentityInput, z as AgentAuditEventEnvelope } from "../index-D010Y_xS.js";
+import { $ as canonicalizeForHash, A as verifyEventEnvelopeHash, B as defineAgentToolCall, C as CrossAgentSecurityEvent, D as withScopedTool, E as detectCrossAgentPattern, F as RevokeAgentIdentityInput, G as DelegateToAgentInput, H as recordPolicyDecision, I as RotateAgentIdentityInput, J as recordAgentHandoff, K as RecordAgentHandoffMetadata, L as createAgentIdentityRegistry, M as resolvePrivacyProfile, N as sanitizeAuditPayload, O as CreateSignedEventEnvelopeOptions, P as ProvisionAgentIdentityInput, Q as HashPayloadOptions, R as withAgentSession, S as CrossAgentEvent, T as crossAgentDetectionsToSecurityEvents, U as withAgentAction, V as recordDecisionBasis, W as withAgentToolCall, X as setAgentAttributes, Y as flattenAgentAttributes, Z as createAgentAuditMetadata, _ as RecordEvalRunIdentityInput, a as AgentPlanRiskVerdict, b as CrossAgentMonitorOptions, c as recordPlanRiskAssessment, d as querySpansForEvalIncident, et as hashPayload, f as spansToCrossAgentEvents, g as EVAL_IDENTITY_ATTR, h as createHoneyTokenTool, i as AgentPlanClassifierResult, j as PrivacyProfileInput, k as createSignedEventEnvelope, l as runAgentPlanClassifier, m as HoneyTokenToolOptions, n as AgentPlanClassifier, o as RecordPlanRiskAssessmentOptions, p as HoneyTokenToolDefinition, q as delegateToAgent, r as AgentPlanClassifierInput, s as heuristicPlanRiskClassifier, t as AGENT_PLAN_RISK_ATTR, tt as AGENT_AUDIT_SCHEMA_VERSION, u as EvalIncidentQueryResult, v as recordEvalRunIdentity, w as DetectCrossAgentPatternOptions, x as CrossAgentDetection, y as CrossAgentMonitor, z as defineAgentAction } from "../index-CCECca0b.js";
 import { a as TokenUsage, i as ModelPricing } from "../cost-C1FkUNG1.js";
-import { C as recordPlanStep, D as agentContextFromSpan, E as AgentContext, S as recordMemoryAccess, T as tryRecordHumanApproval, _ as recordActionRiskClass, a as AgentInputProvenance, b as recordHumanApproval, c as AgentSecurityRecordOptions, d as RecordHumanApprovalInput, f as RecordInputProvenanceInput, g as deriveActionRiskClass, h as RecordRenderOutputInput, i as AgentConsentOutcome, l as RecordActiveScopesInput, m as RecordPlanStepInput, n as ActionRiskHints, o as AgentMemoryOperation, p as RecordMemoryAccessInput, r as AgentActionRiskClass, s as AgentOutputFormat, t as AGENT_SECURITY_ATTR, u as RecordControllerInput, v as recordActiveScopes, w as recordRenderOutput, x as recordInputProvenance, y as recordControllerId } from "../agent-security-BHdP6ZPG.js";
-export { AGENT_AUDIT_SCHEMA_VERSION, AGENT_PLAN_RISK_ATTR, AGENT_SECURITY_ATTR, type ActionRiskHints, type AgentActionFactory, type AgentActionMetadata, type AgentActionOptions, type AgentActionRiskClass, type AgentAiMetadata, type AgentAuditEventEnvelope, type AgentConsentOutcome, type AgentContext, type AgentDecisionMetadata, type AgentEventKind, type AgentHandler, type AgentIdentity, type AgentIdentityRecord, type AgentIdentityRegistry, type AgentIdentityStatus, type AgentInputProvenance, type AgentMemoryOperation, type AgentMetadataInput, type AgentOutcome, type AgentOutputFormat, type AgentPlanClassifier, type AgentPlanClassifierInput, type AgentPlanClassifierResult, type AgentPlanRiskVerdict, type AgentSecurityRecordOptions, type AgentSessionActionMetadata, type AgentSessionMetadata, type AgentSessionStatus, type AgentToolCallActionMetadata, type AgentToolCallOptions, type AiLifecycleStage, type CreateSignedEventEnvelopeOptions, type DelegateToAgentInput, type DelegationContext, type GovernanceMetadata, type HashPayloadOptions, type ModelPricing, type PolicyDecision, type PolicyMetadata, type PrivacyProfile, type PrivacyProfileInput, type PrivacyProfileName, type ProvisionAgentIdentityInput, type RecordActiveScopesInput, type RecordAgentHandoffMetadata, type RecordControllerInput, type RecordHumanApprovalInput, type RecordInputProvenanceInput, type RecordMemoryAccessInput, type RecordPlanRiskAssessmentOptions, type RecordPlanStepInput, type RecordRenderOutputInput, type RevokeAgentIdentityInput, type RotateAgentIdentityInput, type ScopedToolDefinition, type TokenUsage, type ToolCallMetadata, type ToolStatus, agentContextFromSpan, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createSignedEventEnvelope, defineAgentAction, defineAgentToolCall, delegateToAgent, deriveActionRiskClass, flattenAgentAttributes, hashPayload, heuristicPlanRiskClassifier, recordActionRiskClass, recordActiveScopes, recordAgentHandoff, recordControllerId, recordDecisionBasis, recordHumanApproval, recordInputProvenance, recordMemoryAccess, recordPlanRiskAssessment, recordPlanStep, recordPolicyDecision, recordRenderOutput, resolvePrivacyProfile, runAgentPlanClassifier, sanitizeAuditPayload, setAgentAttributes, tryRecordHumanApproval, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };
+import { $ as ScopedToolDefinition, A as AgentAuditEventEnvelope, B as AgentSessionActionMetadata, C as recordPlanStep, D as AgentActionMetadata, E as AgentActionFactory, F as AgentIdentityRecord, G as AiLifecycleStage, H as AgentSessionStatus, I as AgentIdentityRegistry, J as GovernanceMetadata, K as DelegationContext, L as AgentIdentityStatus, M as AgentEventKind, N as AgentHandler, O as AgentActionOptions, P as AgentIdentity, Q as PrivacyProfileName, R as AgentMetadataInput, S as recordMemoryAccess, T as tryRecordHumanApproval, U as AgentToolCallActionMetadata, V as AgentSessionMetadata, W as AgentToolCallOptions, X as PolicyMetadata, Y as PolicyDecision, Z as PrivacyProfile, _ as recordActionRiskClass, a as AgentInputProvenance, b as recordHumanApproval, c as AgentSecurityRecordOptions, d as RecordHumanApprovalInput, et as ToolCallMetadata, f as RecordInputProvenanceInput, g as deriveActionRiskClass, h as RecordRenderOutputInput, i as AgentConsentOutcome, j as AgentDecisionMetadata, k as AgentAiMetadata, l as RecordActiveScopesInput, m as RecordPlanStepInput, n as ActionRiskHints, nt as AgentContext, o as AgentMemoryOperation, p as RecordMemoryAccessInput, r as AgentActionRiskClass, rt as agentContextFromSpan, s as AgentOutputFormat, t as AGENT_SECURITY_ATTR, tt as ToolStatus, u as RecordControllerInput, v as recordActiveScopes, w as recordRenderOutput, x as recordInputProvenance, y as recordControllerId, z as AgentOutcome } from "../agent-security-CWkxz1j3.js";
+export { AGENT_AUDIT_SCHEMA_VERSION, AGENT_PLAN_RISK_ATTR, AGENT_SECURITY_ATTR, type ActionRiskHints, type AgentActionFactory, type AgentActionMetadata, type AgentActionOptions, type AgentActionRiskClass, type AgentAiMetadata, type AgentAuditEventEnvelope, type AgentConsentOutcome, type AgentContext, type AgentDecisionMetadata, type AgentEventKind, type AgentHandler, type AgentIdentity, type AgentIdentityRecord, type AgentIdentityRegistry, type AgentIdentityStatus, type AgentInputProvenance, type AgentMemoryOperation, type AgentMetadataInput, type AgentOutcome, type AgentOutputFormat, type AgentPlanClassifier, type AgentPlanClassifierInput, type AgentPlanClassifierResult, type AgentPlanRiskVerdict, type AgentSecurityRecordOptions, type AgentSessionActionMetadata, type AgentSessionMetadata, type AgentSessionStatus, type AgentToolCallActionMetadata, type AgentToolCallOptions, type AiLifecycleStage, type CreateSignedEventEnvelopeOptions, type CrossAgentDetection, type CrossAgentEvent, CrossAgentMonitor, type CrossAgentMonitorOptions, type CrossAgentSecurityEvent, type DelegateToAgentInput, type DelegationContext, type DetectCrossAgentPatternOptions, EVAL_IDENTITY_ATTR, type EvalIncidentQueryResult, type GovernanceMetadata, type HashPayloadOptions, type HoneyTokenToolDefinition, type HoneyTokenToolOptions, type ModelPricing, type PolicyDecision, type PolicyMetadata, type PrivacyProfile, type PrivacyProfileInput, type PrivacyProfileName, type ProvisionAgentIdentityInput, type RecordActiveScopesInput, type RecordAgentHandoffMetadata, type RecordControllerInput, type RecordEvalRunIdentityInput, type RecordHumanApprovalInput, type RecordInputProvenanceInput, type RecordMemoryAccessInput, type RecordPlanRiskAssessmentOptions, type RecordPlanStepInput, type RecordRenderOutputInput, type RevokeAgentIdentityInput, type RotateAgentIdentityInput, type ScopedToolDefinition, type TokenUsage, type ToolCallMetadata, type ToolStatus, agentContextFromSpan, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createHoneyTokenTool, createSignedEventEnvelope, crossAgentDetectionsToSecurityEvents, defineAgentAction, defineAgentToolCall, delegateToAgent, deriveActionRiskClass, detectCrossAgentPattern, flattenAgentAttributes, hashPayload, heuristicPlanRiskClassifier, querySpansForEvalIncident, recordActionRiskClass, recordActiveScopes, recordAgentHandoff, recordControllerId, recordDecisionBasis, recordEvalRunIdentity, recordHumanApproval, recordInputProvenance, recordMemoryAccess, recordPlanRiskAssessment, recordPlanStep, recordPolicyDecision, recordRenderOutput, resolvePrivacyProfile, runAgentPlanClassifier, sanitizeAuditPayload, setAgentAttributes, spansToCrossAgentEvents, tryRecordHumanApproval, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };

package/dist/agent/index.js

@@ -1,4 +1,4 @@
 import { a as recordControllerId, c as recordMemoryAccess, d as tryRecordHumanApproval, i as recordActiveScopes, l as recordPlanStep, n as deriveActionRiskClass, o as recordHumanApproval, p as agentContextFromSpan, r as recordActionRiskClass, s as recordInputProvenance, t as AGENT_SECURITY_ATTR, u as recordRenderOutput } from "../agent-security-CUDUKOEK.js";
-import { C as canonicalizeForHash, S as createAgentAuditMetadata, T as AGENT_AUDIT_SCHEMA_VERSION, _ as recordPolicyDecision, a as withScopedTool, b as flattenAgentAttributes, c as resolvePrivacyProfile, d as withAgentSession, f as delegateToAgent, g as recordDecisionBasis, h as defineAgentToolCall, i as runAgentPlanClassifier, l as sanitizeAuditPayload, m as defineAgentAction, n as heuristicPlanRiskClassifier, o as createSignedEventEnvelope, p as recordAgentHandoff, r as recordPlanRiskAssessment, s as verifyEventEnvelopeHash, t as AGENT_PLAN_RISK_ATTR, u as createAgentIdentityRegistry, v as withAgentAction, w as hashPayload, x as setAgentAttributes, y as withAgentToolCall } from "../agent-oCfaqmYw.js";
+import { A as createAgentAuditMetadata, C as defineAgentToolCall, D as withAgentToolCall, E as withAgentAction, M as hashPayload, N as AGENT_AUDIT_SCHEMA_VERSION, O as flattenAgentAttributes, S as defineAgentAction, T as recordPolicyDecision, _ as sanitizeAuditPayload, a as querySpansForEvalIncident, b as delegateToAgent, c as EVAL_IDENTITY_ATTR, d as crossAgentDetectionsToSecurityEvents, f as detectCrossAgentPattern, g as resolvePrivacyProfile, h as verifyEventEnvelopeHash, i as runAgentPlanClassifier, j as canonicalizeForHash, k as setAgentAttributes, l as recordEvalRunIdentity, m as createSignedEventEnvelope, n as heuristicPlanRiskClassifier, o as spansToCrossAgentEvents, p as withScopedTool, r as recordPlanRiskAssessment, s as createHoneyTokenTool, t as AGENT_PLAN_RISK_ATTR, u as CrossAgentMonitor, v as createAgentIdentityRegistry, w as recordDecisionBasis, x as recordAgentHandoff, y as withAgentSession } from "../agent-DYs6JLN5.js";
 
-export { AGENT_AUDIT_SCHEMA_VERSION, AGENT_PLAN_RISK_ATTR, AGENT_SECURITY_ATTR, agentContextFromSpan, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createSignedEventEnvelope, defineAgentAction, defineAgentToolCall, delegateToAgent, deriveActionRiskClass, flattenAgentAttributes, hashPayload, heuristicPlanRiskClassifier, recordActionRiskClass, recordActiveScopes, recordAgentHandoff, recordControllerId, recordDecisionBasis, recordHumanApproval, recordInputProvenance, recordMemoryAccess, recordPlanRiskAssessment, recordPlanStep, recordPolicyDecision, recordRenderOutput, resolvePrivacyProfile, runAgentPlanClassifier, sanitizeAuditPayload, setAgentAttributes, tryRecordHumanApproval, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };
+export { AGENT_AUDIT_SCHEMA_VERSION, AGENT_PLAN_RISK_ATTR, AGENT_SECURITY_ATTR, CrossAgentMonitor, EVAL_IDENTITY_ATTR, agentContextFromSpan, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createHoneyTokenTool, createSignedEventEnvelope, crossAgentDetectionsToSecurityEvents, defineAgentAction, defineAgentToolCall, delegateToAgent, deriveActionRiskClass, detectCrossAgentPattern, flattenAgentAttributes, hashPayload, heuristicPlanRiskClassifier, querySpansForEvalIncident, recordActionRiskClass, recordActiveScopes, recordAgentHandoff, recordControllerId, recordDecisionBasis, recordEvalRunIdentity, recordHumanApproval, recordInputProvenance, recordMemoryAccess, recordPlanRiskAssessment, recordPlanStep, recordPolicyDecision, recordRenderOutput, resolvePrivacyProfile, runAgentPlanClassifier, sanitizeAuditPayload, setAgentAttributes, spansToCrossAgentEvents, tryRecordHumanApproval, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };

package/dist/{agent-CnXNAj9B.cjs → agent-CpucMj6w.cjs}

@@ -1,5 +1,6 @@
 const require_cost = require('./cost.cjs');
-const require_attributes = require('./attributes-BSunBoIR.cjs');
+const require_attributes = require('./attributes-BbHetlqB.cjs');
+const require_values = require('./values-m4hAgUuq.cjs');
 const require_agent_security = require('./agent-security-kfpXuwL4.cjs');
 let autotel = require("autotel");
 let autotel_audit = require("autotel-audit");
@@ -758,11 +759,10 @@ const PRIVACY_PROFILES = {
 	}
 };
 function maskValue(value) {
-	if (typeof value !== "string") {
-		return "<masked>";
-	}
-	if (value.length <= 6) return "***";
-	return `${value.slice(0, 3)}***${value.slice(-3)}`;
+	const text = require_values.asString(value);
+	if (text === undefined) return "<masked>";
+	if (text.length <= 6) return "***";
+	return `${text.slice(0, 3)}***${text.slice(-3)}`;
 }
 function matches(patterns, key) {
 	return patterns?.some((pattern) => pattern.test(key)) ?? false;
@@ -787,19 +787,23 @@ function sanitizeNode(value, profile, keyPath) {
 	if (matches(profile.maskKeys, lowered)) {
 		return maskValue(value);
 	}
-	if (typeof value === "string") {
-		return truncateString(value, profile.maxStringLength);
+	const text = require_values.asString(value);
+	if (text !== undefined) {
+		return truncateString(text, profile.maxStringLength);
 	}
 	if (Array.isArray(value)) {
 		return value.map((entry, index) => sanitizeNode(entry, profile, `${keyPath}[${index}]`));
 	}
-	if (value && typeof value === "object") {
-		return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, sanitizeNode(entry, profile, keyPath ? `${keyPath}.${key}` : key)]));
-	}
-	if (typeof value === "bigint") {
-		return value.toString(10);
+	const record = require_values.asRecord(value);
+	if (record) {
+		const out = {};
+		for (const [key, entry] of Object.entries(record)) {
+			out[key] = sanitizeNode(entry, profile, keyPath ? `${keyPath}.${key}` : key);
+		}
+		return out;
 	}
-	return value;
+	if (typeof value === "bigint") return value.toString(10);
+	return require_values.asNumber(value) ?? require_values.asBoolean(value) ?? (value === null ? null : undefined);
 }
 function resolvePrivacyProfile(profile = "strict") {
 	return typeof profile === "string" ? PRIVACY_PROFILES[profile] : profile;
@@ -982,6 +986,250 @@ async function withScopedTool(definition, input, fn, options = {}) {
 	}, fn, options);
 }
 
+//#endregion
+//#region src/agent/cross-agent-detect.ts
+function groupKey(event) {
+	return event.isolationKey ? `memory:${event.isolationKey}` : `resource:${event.resource}`;
+}
+/**
+* Detect shared-channel usage across agent identities. Pure function — safe to
+* run over exported span batches or audit logs in incident replay.
+*/
+function detectCrossAgentPattern(events, options = {}) {
+	const { minAgents = 2, windowMs = 864e5 } = options;
+	const grouped = new Map();
+	for (const event of events) {
+		const key = groupKey(event);
+		const existing = grouped.get(key);
+		if (existing) {
+			existing.events.push(event);
+		} else {
+			grouped.set(key, {
+				resource: event.resource,
+				events: [event]
+			});
+		}
+	}
+	const detections = [];
+	for (const { resource, events: groupEvents } of grouped.values()) {
+		const sorted = windowMs > 0 ? groupEvents.toSorted((a, b) => (a.timestamp ?? 0) - (b.timestamp ?? 0)) : groupEvents;
+		const agentIds = new Set();
+		for (const event of sorted) {
+			const ts = event.timestamp ?? Date.now();
+			if (windowMs > 0) {
+				const windowStart = ts - windowMs;
+				const inWindow = sorted.filter((e) => {
+					const eTs = e.timestamp ?? Date.now();
+					return eTs >= windowStart && eTs <= ts;
+				});
+				const windowAgents = new Set(inWindow.map((e) => e.agentId));
+				if (windowAgents.size >= minAgents) {
+					for (const id of windowAgents) agentIds.add(id);
+				}
+			} else {
+				agentIds.add(event.agentId);
+			}
+		}
+		if (agentIds.size >= minAgents) {
+			detections.push({
+				resource,
+				agentIds: [...agentIds],
+				eventCount: groupEvents.length,
+				reason: `${agentIds.size} agents touched shared resource "${resource}" — possible message board`
+			});
+		}
+	}
+	return detections;
+}
+/**
+* Map detections to autotel-audit `securityEvent` payloads for emission during IR.
+*/
+function crossAgentDetectionsToSecurityEvents(detections) {
+	return detections.map((detection) => ({
+		name: "agent.shared_channel.detected",
+		category: "llm",
+		outcome: "denied",
+		severity: "error",
+		reason: detection.reason,
+		targetType: "resource",
+		targetId: detection.resource,
+		metadata: {
+			agentIds: detection.agentIds,
+			eventCount: detection.eventCount
+		}
+	}));
+}
+
+//#endregion
+//#region src/agent/cross-agent-monitor.ts
+/**
+* Live monitor for shared-channel abuse (Artifactory message-board pattern).
+* Feed tool/memory events as they occur; emits `agent.shared_channel.detected`.
+*/
+var CrossAgentMonitor = class {
+	events = [];
+	seen = new Set();
+	options;
+	constructor(options = {}) {
+		this.options = options;
+	}
+	record(event) {
+		this.events.push({
+			...event,
+			timestamp: event.timestamp ?? Date.now()
+		});
+		const detections = detectCrossAgentPattern(this.events, this.options);
+		const fresh = [];
+		for (const detection of detections) {
+			const key = detection.resource;
+			if (this.seen.has(key)) continue;
+			this.seen.add(key);
+			fresh.push(detection);
+			this.options.onDetection?.(detection);
+			for (const payload of crossAgentDetectionsToSecurityEvents([detection])) {
+				(0, autotel_audit.securityEvent)(payload, {
+					ctx: this.options.ctx,
+					onMissingContext: this.options.onMissingContext ?? "warn"
+				});
+			}
+		}
+		return fresh;
+	}
+	reset() {
+		this.events.length = 0;
+		this.seen.clear();
+	}
+};
+
+//#endregion
+//#region src/agent/eval-identity.ts
+/** Canonical eval-run attribute keys for sandbox / IR correlation. */
+const EVAL_IDENTITY_ATTR = {
+	runId: "eval.run_id",
+	taskId: "eval.task_id",
+	sandboxId: "eval.sandbox_id"
+};
+function setEvalAttrs(ctx, attrs) {
+	const traceCtx = require_agent_security.resolveContext(ctx);
+	const mapped = {};
+	for (const [key, value] of Object.entries(attrs)) {
+		const attr = require_agent_security.toAttributeValue(value);
+		if (typeof attr === "string" || typeof attr === "number" || typeof attr === "boolean") {
+			mapped[key] = attr;
+		}
+	}
+	if (Object.keys(mapped).length > 0) {
+		traceCtx.setAttributes(mapped);
+	}
+}
+/** Stamp eval-run identity on the active span for cross-agent IR queries. */
+function recordEvalRunIdentity(input) {
+	setEvalAttrs(input.ctx, {
+		[EVAL_IDENTITY_ATTR.runId]: input.runId,
+		...input.taskId !== undefined && { [EVAL_IDENTITY_ATTR.taskId]: input.taskId },
+		...input.sandboxId !== undefined && { [EVAL_IDENTITY_ATTR.sandboxId]: input.sandboxId }
+	});
+}
+
+//#endregion
+//#region src/agent/honey-token.ts
+/**
+* Decoy tool — touching it emits a high-severity security event (deception /
+* uncertainty for offensive agent loops).
+*/
+function createHoneyTokenTool(options = {}) {
+	const name = options.name ?? "readLeakedCredential";
+	const bait = options.bait ?? "AKIA_HONEY_TOKEN_DO_NOT_USE — paste bin archive entry #4412";
+	return {
+		name,
+		description: `Read a credential from the leak archive: ${bait}`,
+		execute: async () => {
+			(0, autotel_audit.securityEvent)({
+				name: "agent.honey_token.triggered",
+				category: "llm",
+				outcome: "denied",
+				severity: "critical",
+				reason: "Agent invoked honey-token decoy tool",
+				targetType: "tool",
+				targetId: name
+			}, {
+				ctx: options.ctx,
+				onMissingContext: options.onMissingContext ?? "warn"
+			});
+			return {
+				triggered: true,
+				message: "Honey token touched — security alerted"
+			};
+		}
+	};
+}
+
+//#endregion
+//#region src/agent/forensic.ts
+function attr(span, key) {
+	return span.attributes[key];
+}
+function stringAttr(span, key) {
+	const v = attr(span, key);
+	return typeof v === "string" ? v : undefined;
+}
+function spansToCrossAgentEvents(spans) {
+	const events = [];
+	for (const span of spans) {
+		const agentId = stringAttr(span, "agent.id") ?? stringAttr(span, "gen_ai.agent.name") ?? stringAttr(span, EVAL_IDENTITY_ATTR.runId);
+		const toolName = stringAttr(span, "gen_ai.tool.name");
+		if (!agentId || !toolName) continue;
+		if (!/artifactory|registry|package/i.test(toolName)) continue;
+		events.push({
+			agentId,
+			resource: `artifactory:/remote-cache/${toolName}`,
+			timestamp: span.startTime[0] * 1e3 + span.startTime[1] / 1e6
+		});
+	}
+	return events;
+}
+function querySpansForEvalIncident(spans) {
+	const summary = [`Spans analyzed: ${spans.length}`];
+	const policyDenials = [];
+	const planRiskElevated = [];
+	const exfilCapableActions = [];
+	const evalRuns = new Set();
+	for (const span of spans) {
+		const runId = stringAttr(span, EVAL_IDENTITY_ATTR.runId);
+		if (runId) evalRuns.add(runId);
+		if (attr(span, "policy.decision") === "deny") {
+			policyDenials.push(`${span.name}: ${stringAttr(span, "policy.reason") ?? "denied"}`);
+		}
+		const verdict = attr(span, "agent.plan.risk.verdict");
+		if (verdict && verdict !== "low") {
+			planRiskElevated.push(`${span.name}: plan-risk=${String(verdict)}`);
+		}
+		if (attr(span, "agent.action.risk_class") === "exfiltration_capable") {
+			exfilCapableActions.push(span.name);
+		}
+	}
+	const crossAgentEvents = crossAgentDetectionsToSecurityEvents(detectCrossAgentPattern(spansToCrossAgentEvents(spans), { minAgents: 2 }));
+	if (policyDenials.length) summary.push(`Policy denials: ${policyDenials.length}`);
+	if (planRiskElevated.length) {
+		summary.push(`Elevated plan-risk: ${planRiskElevated.length}`);
+	}
+	if (exfilCapableActions.length) {
+		summary.push(`Exfil-capable actions: ${exfilCapableActions.length}`);
+	}
+	if (crossAgentEvents.length) {
+		summary.push(`Cross-agent alerts: ${crossAgentEvents.length}`);
+	}
+	if (evalRuns.size) summary.push(`Eval runs: ${evalRuns.size}`);
+	return {
+		summary,
+		policyDenials,
+		planRiskElevated,
+		exfilCapableActions,
+		crossAgentEvents,
+		evalRuns: [...evalRuns]
+	};
+}
+
 //#endregion
 //#region src/agent/agent-plan-classifier.ts
 /** Canonical plan-risk attribute keys (Google SAIF plan-risk predictor aligned). */
@@ -1100,6 +1348,18 @@ Object.defineProperty(exports, 'AGENT_PLAN_RISK_ATTR', {
     return AGENT_PLAN_RISK_ATTR;
   }
 });
+Object.defineProperty(exports, 'CrossAgentMonitor', {
+  enumerable: true,
+  get: function () {
+    return CrossAgentMonitor;
+  }
+});
+Object.defineProperty(exports, 'EVAL_IDENTITY_ATTR', {
+  enumerable: true,
+  get: function () {
+    return EVAL_IDENTITY_ATTR;
+  }
+});
 Object.defineProperty(exports, 'canonicalizeForHash', {
   enumerable: true,
   get: function () {
@@ -1118,12 +1378,24 @@ Object.defineProperty(exports, 'createAgentIdentityRegistry', {
     return createAgentIdentityRegistry;
   }
 });
+Object.defineProperty(exports, 'createHoneyTokenTool', {
+  enumerable: true,
+  get: function () {
+    return createHoneyTokenTool;
+  }
+});
 Object.defineProperty(exports, 'createSignedEventEnvelope', {
   enumerable: true,
   get: function () {
     return createSignedEventEnvelope;
   }
 });
+Object.defineProperty(exports, 'crossAgentDetectionsToSecurityEvents', {
+  enumerable: true,
+  get: function () {
+    return crossAgentDetectionsToSecurityEvents;
+  }
+});
 Object.defineProperty(exports, 'defineAgentAction', {
   enumerable: true,
   get: function () {
@@ -1142,6 +1414,12 @@ Object.defineProperty(exports, 'delegateToAgent', {
     return delegateToAgent;
   }
 });
+Object.defineProperty(exports, 'detectCrossAgentPattern', {
+  enumerable: true,
+  get: function () {
+    return detectCrossAgentPattern;
+  }
+});
 Object.defineProperty(exports, 'flattenAgentAttributes', {
   enumerable: true,
   get: function () {
@@ -1160,6 +1438,12 @@ Object.defineProperty(exports, 'heuristicPlanRiskClassifier', {
     return heuristicPlanRiskClassifier;
   }
 });
+Object.defineProperty(exports, 'querySpansForEvalIncident', {
+  enumerable: true,
+  get: function () {
+    return querySpansForEvalIncident;
+  }
+});
 Object.defineProperty(exports, 'recordAgentHandoff', {
   enumerable: true,
   get: function () {
@@ -1172,6 +1456,12 @@ Object.defineProperty(exports, 'recordDecisionBasis', {
     return recordDecisionBasis;
   }
 });
+Object.defineProperty(exports, 'recordEvalRunIdentity', {
+  enumerable: true,
+  get: function () {
+    return recordEvalRunIdentity;
+  }
+});
 Object.defineProperty(exports, 'recordPlanRiskAssessment', {
   enumerable: true,
   get: function () {
@@ -1208,6 +1498,12 @@ Object.defineProperty(exports, 'setAgentAttributes', {
     return setAgentAttributes;
   }
 });
+Object.defineProperty(exports, 'spansToCrossAgentEvents', {
+  enumerable: true,
+  get: function () {
+    return spansToCrossAgentEvents;
+  }
+});
 Object.defineProperty(exports, 'verifyEventEnvelopeHash', {
   enumerable: true,
   get: function () {