elepha 0.1.0

package/dist/rendering/raw-turn-renderer.js

@@ -0,0 +1,85 @@
+// Raw-turn serving filter shared by ingestion (rendered_chars) and the
+// serving surface. It deliberately accepts already-normalized ParsedTurn
+// values: adapter JSONL parsing remains the only code that knows transcript
+// formats, and this module never reads a transcript or starts a subprocess.
+import { escapeShellSyntax } from '../security/sanitize.js';
+export const RAW_TURN_SEPARATOR = '\n\n---\n\n';
+export function omissionMarker(omitted, shown, total) {
+    return `+${omitted} older rendered turns in this episode omitted (${shown} shown of ${total}).`;
+}
+// Codex's internal memory markup is injected content, not part of the human
+// conversation. Non-greedy matching keeps adjacent blocks independent.
+const MEMORY_CITATION_BLOCK = /<oai-mem-citation>[\s\S]*?<\/oai-mem-citation>/g;
+// This is intentionally categorical, never length-based. The pause is explicit
+// in the user message and the turn did no tool work; the acknowledgement may
+// include a sentence about deferred work, which must not defeat the filter.
+const EXPLICIT_PAUSE_REQUEST = /\b(?:no\s+(?:hagas?|hacer|toques?)\s+nada(?:\s+de\s+momento)?|do(?:n't| not)\s+(?:do|change|touch)\s+anything|hold\s+off|pause\s+here|wait\s+for\s+now)\b/i;
+function withoutMemoryCitations(text) {
+    return text.replace(MEMORY_CITATION_BLOCK, '');
+}
+function isExplicitPauseTurn(turn, userMessage) {
+    return turn.toolCalls.length === 0 && EXPLICIT_PAUSE_REQUEST.test(userMessage);
+}
+/** Reports whether a parsed turn survives the raw-serving filter without rendering its body. */
+export function isRenderableRawTurn(turn) {
+    return !isExplicitPauseTurn(turn, withoutMemoryCitations(turn.userMessage).trim());
+}
+function renderToolCalls(turn) {
+    const pathBearing = turn.toolCalls.filter((call) => call.filePaths.length > 0);
+    const withoutPaths = turn.toolCalls.length - pathBearing.length;
+    if (pathBearing.length === 0 && withoutPaths === 0) {
+        return undefined;
+    }
+    const lines = pathBearing.flatMap((call) => [
+        `- \`${escapeShellSyntax(call.name)}\``,
+        ...call.filePaths.map((filePath) => `  - \`${escapeShellSyntax(filePath)}\``),
+    ]);
+    if (withoutPaths > 0) {
+        lines.push(`- ${withoutPaths} tool call${withoutPaths === 1 ? '' : 's'} without file paths omitted`);
+    }
+    return `**Tool calls**\n\n${lines.join('\n')}`;
+}
+/** Renders one kept turn, or null for an explicit no-tool-call pause. */
+export function renderRawTurn(turn, renderedTurnNumber = turn.turnIndex) {
+    // Adapters preserve transcript whitespace. It is not conversation content
+    // at the outer edges, and retaining it would make the stored count differ
+    // from the reviewed golden artifacts.
+    const userMessage = withoutMemoryCitations(turn.userMessage).trim();
+    const assistantText = withoutMemoryCitations(turn.assistantText).trim();
+    if (isExplicitPauseTurn(turn, userMessage)) {
+        return null;
+    }
+    return [
+        `## Turn ${renderedTurnNumber}`,
+        `**User prompt**\n\n${escapeShellSyntax(userMessage)}`,
+        `**Assistant response**\n\n${escapeShellSyntax(assistantText)}`,
+        renderToolCalls(turn),
+    ]
+        .filter((section) => section !== undefined)
+        .join('\n\n');
+}
+/** Produces the rendered sequence once so every consumer shares its filter. */
+export function renderableRawTurns(turns, renderedTurnOffset = 0) {
+    const rendered = [];
+    for (const turn of turns) {
+        const text = renderRawTurn(turn, renderedTurnOffset + rendered.length + 1);
+        if (text !== null) {
+            rendered.push(text);
+        }
+    }
+    return rendered;
+}
+/** Renders a segment's turns with the exact inter-turn bytes served to consumers. */
+export function renderRawTurns(turns) {
+    const rendered = renderableRawTurns(turns);
+    return rendered.length === 0 ? '' : `${rendered.join(RAW_TURN_SEPARATOR)}\n`;
+}
+/** Stored turn-count input: the exact number of turns renderRawTurns keeps. */
+export function renderedTurns(turns) {
+    return renderableRawTurns(turns).length;
+}
+/** Stored token-estimate input: the exact character count of renderRawTurns(). */
+export function renderedChars(turns) {
+    return renderRawTurns(turns).length;
+}
+//# sourceMappingURL=raw-turn-renderer.js.map

package/dist/rendering/raw-turn-renderer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"raw-turn-renderer.js","sourceRoot":"","sources":["../../src/rendering/raw-turn-renderer.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAE5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAG5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAEhD,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa,EAAE,KAAa;IACxE,OAAO,IAAI,OAAO,kDAAkD,KAAK,aAAa,KAAK,IAAI,CAAC;AACpG,CAAC;AAED,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,qBAAqB,GAAG,iDAAiD,CAAC;AAEhF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,MAAM,sBAAsB,GACxB,4JAA4J,CAAC;AAEjK,SAAS,sBAAsB,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAgB,EAAE,WAAmB;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AACnF,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAChD,OAAO,CAAC,mBAAmB,CAAC,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/E,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAChE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QACvC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC;KAChF,CAAC,CAAC;IACH,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,KAAK,YAAY,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,6BAA6B,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,qBAAqB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,IAAgB,EAAE,kBAAkB,GAAW,IAAI,CAAC,SAAS;IACvF,0EAA0E;IAC1E,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,aAAa,GAAG,sBAAsB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO;QACH,WAAW,kBAAkB,EAAE;QAC/B,sBAAsB,iBAAiB,CAAC,WAAW,CAAC,EAAE;QACtD,6BAA6B,iBAAiB,CAAC,aAAa,CAAC,EAAE;QAC/D,eAAe,CAAC,IAAI,CAAC;KACxB;SACI,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC;SAC7D,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAA2B,EAAE,kBAAkB,GAAW,CAAC;IAC1F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,kBAAkB,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,KAA2B;IACtD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,KAA2B;IACrD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AAC5C,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,KAA2B;IACrD,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACxC,CAAC"}

package/dist/security/file-permissions.js

@@ -0,0 +1,15 @@
+// ~/.elepha holds memory synthesized from session transcripts - DB, WAL,
+// backups, logs. Created at the process umask (typically 0755/0644), it's
+// world-readable by default on a shared machine. Pure fs, no subprocess -
+// this module has nothing to do with Security Rule 2's allowlist.
+import { chmodSync, existsSync } from 'node:fs';
+import { PRIVATE_DIR_MODE, PRIVATE_FILE_MODE } from '../config/constants.js';
+export function hardenDir(dir) {
+    chmodSync(dir, PRIVATE_DIR_MODE);
+}
+export function hardenFile(file) {
+    if (existsSync(file)) {
+        chmodSync(file, PRIVATE_FILE_MODE);
+    }
+}
+//# sourceMappingURL=file-permissions.js.map

package/dist/security/file-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-permissions.js","sourceRoot":"","sources":["../../src/security/file-permissions.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,kEAAkE;AAElE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE7E,MAAM,UAAU,SAAS,CAAC,GAAW;IACjC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACnC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACnB,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACvC,CAAC;AACL,CAAC"}

package/dist/security/provider-transcript.js

@@ -0,0 +1,74 @@
+import { O_NOFOLLOW, O_RDONLY } from 'node:constants';
+import { open as fsOpen, realpath as fsRealpath, stat as fsStat } from 'node:fs/promises';
+import { isWithinProviderStore } from '../config/paths.js';
+function failureReason(error) {
+    return error.code === 'ENOENT' ? 'transcript_missing' : 'transcript_unreadable';
+}
+/**
+ * Opens a provider transcript and proves that the opened file is the same
+ * regular file reached by a fresh, contained physical path resolution.
+ */
+export async function openProviderTranscript(tool, sourcePath, dependencies = {}) {
+    const open = dependencies.open ?? fsOpen;
+    const realpath = dependencies.realpath ?? fsRealpath;
+    const stat = dependencies.stat ?? fsStat;
+    let handle;
+    try {
+        handle = await open(sourcePath, O_RDONLY | O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code !== 'ELOOP') {
+            return { reason: failureReason(error) };
+        }
+        // Deliberately relaxes CA-10's leaf-symlink strictness to preserve established same-store symlink ingestion.
+        const initialResolvedPath = await realpath(sourcePath).catch(() => undefined);
+        if (initialResolvedPath === undefined) {
+            return { reason: 'transcript_unreadable' };
+        }
+        if (!isWithinProviderStore(tool, initialResolvedPath)) {
+            return { reason: 'transcript_outside_store' };
+        }
+        try {
+            handle = await open(initialResolvedPath, O_RDONLY | O_NOFOLLOW);
+        }
+        catch (resolvedError) {
+            return { reason: failureReason(resolvedError) };
+        }
+    }
+    const fail = async (reason) => {
+        await handle.close().catch(() => undefined);
+        return { reason };
+    };
+    let openedStat;
+    try {
+        openedStat = await handle.stat();
+    }
+    catch (error) {
+        return fail(failureReason(error));
+    }
+    if (!openedStat.isFile()) {
+        return fail('transcript_unreadable');
+    }
+    let resolvedPath;
+    try {
+        resolvedPath = await realpath(sourcePath);
+    }
+    catch (error) {
+        return fail(failureReason(error));
+    }
+    if (!isWithinProviderStore(tool, resolvedPath)) {
+        return fail('transcript_outside_store');
+    }
+    let resolvedStat;
+    try {
+        resolvedStat = await stat(resolvedPath);
+    }
+    catch (error) {
+        return fail(failureReason(error));
+    }
+    if (resolvedStat.dev !== openedStat.dev || resolvedStat.ino !== openedStat.ino) {
+        return fail('transcript_unreadable');
+    }
+    return { handle, resolvedPath, stat: openedStat };
+}
+//# sourceMappingURL=provider-transcript.js.map

package/dist/security/provider-transcript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-transcript.js","sourceRoot":"","sources":["../../src/security/provider-transcript.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAmB,IAAI,IAAI,MAAM,EAAE,QAAQ,IAAI,UAAU,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC3G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAoB3D,SAAS,aAAa,CAAC,KAAc;IACjC,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,CAAC;AAC/G,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,IAAc,EACd,UAAkB,EAClB,YAAY,GAAkC,EAAE;IAEhD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,IAAI,MAAM,CAAC;IACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,UAAU,CAAC;IACrD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,IAAI,MAAM,CAAC;IAEzC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,UAAU,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,CAAC;QACD,6GAA6G;QAC7G,MAAM,mBAAmB,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9E,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,QAAQ,GAAG,UAAU,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACrB,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;QACpD,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,MAAoC,EAAqD,EAAE;QAC3G,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,MAAM,EAAE,CAAC;IACtB,CAAC,CAAC;IAEF,IAAI,UAAiB,CAAC;IACtB,IAAI,CAAC;QACD,UAAU,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,YAAoB,CAAC;IACzB,IAAI,CAAC;QACD,YAAY,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,YAAmB,CAAC;IACxB,IAAI,CAAC;QACD,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACtD,CAAC"}

package/dist/security/sanitize.js

@@ -0,0 +1,210 @@
+// Security Rule 3 - neutralize shell-active syntax in summarizer output.
+//
+// Everything the store holds is eventually served to a coding AI that writes
+// and executes shell commands, so every stored field is treated as if it will
+// be pasted into a terminal. Sanitization happens ON WRITE, never on read: the
+// store must never hold executable syntax in the first place.
+//
+// Two policies:
+//
+//   strip   - display strings (title, summary, pending_items). The
+//             metacharacter carries no information there, so removing it
+//             loses nothing.
+//   escape  - decisions[].what / decisions[].why, pinned notes, digest output.
+//             A decision may legitimately need to reference the syntax it
+//             ruled out ("rejected `$(date)` in the template"); escaping
+//             preserves that, stripping destroys it.
+//
+// Plus, unconditionally in both: ANSI escape sequences and C0 control
+// characters. A decision string ends up printed to a terminal, so
+// escape-sequence injection is the same class of bug and costs one regex.
+//
+// IDEMPOTENCY IS A REQUIREMENT, not a nicety. The backfill re-runs over rows
+// that may already be clean, the choke points re-run on every rebuild, and the
+// post-backfill verification asserts detectShellSyntax() is false store-wide.
+// Every transform below is written so f(f(x)) === f(x), and each has a test.
+/** Two-character openers escaped by breaking the pair from the inside: `$(` -> `$\(`. */
+const PAIRED_OPENERS = ['$(', '${', '>(', '<('];
+/**
+ * Heredoc. Escaped the same way (`<<` -> `<\<`), which also defuses `<<<`:
+ * `<\<<` contains no unescaped `<<` pair.
+ */
+const HEREDOC = '<<';
+/**
+ * Command chaining is only shell-active at the start of a command, so the test
+ * is line-leading rather than "anywhere" - a `;` mid-sentence is punctuation
+ * and mangling it would corrupt ordinary prose. Escaped by PREFIXING a
+ * backslash to the whole run (`&&` -> `\&&`), never infixing: `&\&` would
+ * still start the line with `&` and the transform would not be idempotent.
+ */
+const LINE_LEADING_CHAIN_RE = /^([ \t]*)(\|\||&&|[|;&])/gm;
+// CSI (`\x1b[...`), OSC (`\x1b]...` terminated by BEL or ST), and any other
+// two-character escape. Matched longest-first so a CSI is never chewed up by
+// the catch-all.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: neutralizing control characters is the entire point of this module
+const ANSI_RE = /\x1b\[[0-?]*[ -/]*[@-~]|\x1b][^\x07\x1b]*(?:\x07|\x1b\\)?|\x1b[@-_]?/g;
+// C0 controls and DEL, keeping \n and \t: those are legitimate in a summary,
+// and \r is not (carriage-return line-overwrite hides text from a reader who
+// only sees the rendered terminal output).
+// biome-ignore lint/suspicious/noControlCharactersInRegex: neutralizing control characters is the entire point of this module
+const CONTROL_RE = /[\x00-\x08\x0b-\x1f\x7f]/g;
+/** Number of backslashes immediately preceding `index`. Even means the character at `index` is unescaped, and therefore shell-active. */
+function precedingBackslashes(s, index) {
+    let n = 0;
+    let i = index - 1;
+    while (i >= 0 && s[i] === '\\') {
+        n++;
+        i--;
+    }
+    return n;
+}
+function isActive(s, index) {
+    return precedingBackslashes(s, index) % 2 === 0;
+}
+function stripControls(s) {
+    return s.replace(ANSI_RE, '').replace(CONTROL_RE, '');
+}
+/**
+ * Finds the closer matching a paired opener at `openIndex`, honouring nesting,
+ * or -1 when the text has no closer at all (unbalanced input is common in
+ * prose and must not throw).
+ */
+function findMatchingCloser(s, openIndex, open, close) {
+    let depth = 0;
+    for (let i = openIndex + 1; i < s.length; i++) {
+        if (s[i] === open) {
+            depth++;
+        }
+        else if (s[i] === close) {
+            if (depth === 0) {
+                return i;
+            }
+            depth--;
+        }
+    }
+    return -1;
+}
+/**
+ * Display-string policy: remove the metacharacter, keep the words.
+ * `` `foo` `` -> `foo`, `$(date)` -> `date`, `${VAR}` -> `VAR`.
+ *
+ * Runs to a fixed point (bounded) because removing one layer can expose
+ * another: `$($(date))` needs two passes to become `date`.
+ */
+export function stripShellSyntax(input) {
+    let s = stripControls(input);
+    for (let pass = 0; pass < 8; pass++) {
+        const before = s;
+        // Paired openers, innermost-safe: remove the opener and its matching
+        // closer together, so the closer is not left orphaned.
+        let i = 0;
+        while (i < s.length - 1) {
+            const two = s.slice(i, i + 2);
+            const opener = PAIRED_OPENERS.find((o) => o === two);
+            if (!opener) {
+                i++;
+                continue;
+            }
+            const close = opener[1] === '(' ? ')' : '}';
+            const closeIndex = findMatchingCloser(s, i + 1, opener[1], close);
+            s = closeIndex === -1 ? s.slice(0, i) + s.slice(i + 2) : s.slice(0, i) + s.slice(i + 2, closeIndex) + s.slice(closeIndex + 1);
+            // Do not advance: the text that shifted into `i` may itself be an opener.
+        }
+        s = s.split('`').join('');
+        s = s.split(HEREDOC).join('');
+        s = s.replace(LINE_LEADING_CHAIN_RE, '$1');
+        if (s === before) {
+            break;
+        }
+    }
+    return s;
+}
+/**
+ * Information-preserving policy: break the token with a backslash. The result
+ * is readable, and inert in both unquoted and double-quoted shell contexts.
+ * `` ` `` -> `` \` ``, `$(` -> `$\(`, `${` -> `$\{`, `<<` -> `<\<`.
+ */
+export function escapeShellSyntax(input) {
+    let s = stripControls(input);
+    // Paired openers and heredoc: infix a backslash. After this the literal
+    // two-character token no longer occurs, so a second run is a no-op.
+    let out = '';
+    for (let i = 0; i < s.length;) {
+        const two = s.slice(i, i + 2);
+        if (PAIRED_OPENERS.includes(two) || two === HEREDOC) {
+            out += `${two[0]}\\${two[1]}`;
+            i += 2;
+            continue;
+        }
+        out += s[i];
+        i++;
+    }
+    s = out;
+    // Backtick is a single character, so it survives escaping as a literal and
+    // needs the parity check to avoid `\\` growing on every pass.
+    out = '';
+    for (let i = 0; i < s.length; i++) {
+        if (s[i] === '`' && isActive(s, i)) {
+            out += '\\`';
+        }
+        else {
+            out += s[i];
+        }
+    }
+    s = out;
+    // Prefix, not infix - see LINE_LEADING_CHAIN_RE.
+    s = s.replace(LINE_LEADING_CHAIN_RE, '$1\\$2');
+    return s;
+}
+/**
+ * True when the text still carries shell-active syntax. Used by the backfill
+ * preview, by the post-backfill verification, and by the read-time assertion.
+ *
+ * Deliberately agrees with both transforms above: anything either of them
+ * would change (other than pure control-character noise) reports true here,
+ * and their output reports false. That equivalence is what makes "the store
+ * never holds executable syntax" a checkable invariant rather than a comment.
+ */
+export function detectShellSyntax(input) {
+    if (ANSI_RE.test(input) || CONTROL_RE.test(input)) {
+        ANSI_RE.lastIndex = 0;
+        CONTROL_RE.lastIndex = 0;
+        return true;
+    }
+    ANSI_RE.lastIndex = 0;
+    CONTROL_RE.lastIndex = 0;
+    for (let i = 0; i < input.length; i++) {
+        if (input[i] === '`' && isActive(input, i)) {
+            return true;
+        }
+        const two = input.slice(i, i + 2);
+        if (PAIRED_OPENERS.includes(two) || two === HEREDOC) {
+            return true;
+        }
+    }
+    LINE_LEADING_CHAIN_RE.lastIndex = 0;
+    const hit = LINE_LEADING_CHAIN_RE.test(input);
+    LINE_LEADING_CHAIN_RE.lastIndex = 0;
+    return hit;
+}
+/**
+ * Read-time ASSERTION, not read-time sanitization.
+ *
+ * "Sanitization happens on write, never on read" is about where the store
+ * gets cleaned. It is not an argument for never checking: a store
+ * invariant that is never verified is documentation drift with extra steps,
+ * and this codebase has paid for that failure mode repeatedly. A hit here
+ * means a write path was missed - which is a bug report, not a routine event,
+ * so it logs loudly and then sanitizes defensively rather than serving
+ * executable syntax to a model that runs shell commands.
+ *
+ * Returns the text to actually serve, and whether it had to be repaired.
+ */
+export function assertNoShellSyntax(text, context, log = console.error) {
+    if (!detectShellSyntax(text)) {
+        return { text, repaired: false };
+    }
+    log(`[elepha] WARNING: shell-active syntax reached the read path from ${context}; a write-time sanitizer was missed. Repairing.`);
+    return { text: escapeShellSyntax(text), repaired: true };
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/security/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/security/sanitize.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,8DAA8D;AAC9D,EAAE;AACF,gBAAgB;AAChB,EAAE;AACF,mEAAmE;AACnE,yEAAyE;AACzE,6BAA6B;AAC7B,+EAA+E;AAC/E,0EAA0E;AAC1E,yEAAyE;AACzE,qDAAqD;AACrD,EAAE;AACF,sEAAsE;AACtE,kEAAkE;AAClE,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAE7E,yFAAyF;AACzF,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAEzD;;;GAGG;AACH,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAE3D,4EAA4E;AAC5E,6EAA6E;AAC7E,iBAAiB;AACjB,8HAA8H;AAC9H,MAAM,OAAO,GAAG,uEAAuE,CAAC;AAExF,6EAA6E;AAC7E,6EAA6E;AAC7E,2CAA2C;AAC3C,8HAA8H;AAC9H,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C,yIAAyI;AACzI,SAAS,oBAAoB,CAAC,CAAS,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7B,CAAC,EAAE,CAAC;QACJ,CAAC,EAAE,CAAC;IACR,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,KAAa;IACtC,OAAO,oBAAoB,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,CAAS,EAAE,SAAiB,EAAE,IAAY,EAAE,KAAa;IACjF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC;QACZ,CAAC;aAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACd,OAAO,CAAC,CAAC;YACb,CAAC;YACD,KAAK,EAAE,CAAC;QACZ,CAAC;IACL,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC1C,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAE7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,CAAC;QAEjB,qEAAqE;QACrE,uDAAuD;QACvD,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,CAAC,EAAE,CAAC;gBACJ,SAAS;YACb,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5C,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAClE,CAAC,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YAC9H,0EAA0E;QAC9E,CAAC;QAED,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAE3C,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;YACf,MAAM;QACV,CAAC;IACL,CAAC;IACD,OAAO,CAAC,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAE7B,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,GAAI,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAK,cAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACzE,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACb,CAAC;QACD,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACZ,CAAC,EAAE,CAAC;IACR,CAAC;IACD,CAAC,GAAG,GAAG,CAAC;IAER,2EAA2E;IAC3E,8DAA8D;IAC9D,GAAG,GAAG,EAAE,CAAC;IACT,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,IAAI,KAAK,CAAC;QACjB,CAAC;aAAM,CAAC;YACJ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC;IACL,CAAC;IACD,CAAC,GAAG,GAAG,CAAC;IAER,iDAAiD;IACjD,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IAE/C,OAAO,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;IACtB,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;IAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,IAAK,cAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,qBAAqB,CAAC,SAAS,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,qBAAqB,CAAC,SAAS,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAC/B,IAAY,EACZ,OAAe,EACf,GAAG,GAA0B,OAAO,CAAC,KAAK;IAK1C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,GAAG,CAAC,oEAAoE,OAAO,iDAAiD,CAAC,CAAC;IAClI,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC7D,CAAC"}

package/dist/security/self-ingestion.js

@@ -0,0 +1,47 @@
+/** Complete textual surface used by both Rule 4 guards. */
+export function turnText(turn) {
+    return [turn.userMessage, turn.assistantText, ...turn.toolCalls.map((call) => JSON.stringify(call))].join('\n');
+}
+export function normalizeForNearVerbatim(text) {
+    return text
+        .toLowerCase()
+        .replace(/[^\p{L}\p{N}\s]+/gu, '')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+function shingles(text, size = 8) {
+    if (text.length < size) {
+        return new Set();
+    }
+    const out = new Set();
+    for (let index = 0; index <= text.length - size; index++) {
+        out.add(text.slice(index, index + size));
+    }
+    return out;
+}
+/**
+ * Rule 4 quote-back threshold: an exact long injected line, or at least 60%
+ * of the body's distinct normalized 8-grams. Short/empty bodies cannot match
+ * through shingles because their denominator would not be meaningful.
+ */
+export function isNearVerbatim(turn, injection) {
+    const normalizedTurn = normalizeForNearVerbatim(turn);
+    const normalizedInjection = normalizeForNearVerbatim(injection);
+    if (normalizedTurn === '' || normalizedInjection === '') {
+        return false;
+    }
+    for (const line of injection.split(/\r?\n/)) {
+        const normalizedLine = normalizeForNearVerbatim(line);
+        if (normalizedLine.length >= 40 && normalizedTurn.includes(normalizedLine)) {
+            return true;
+        }
+    }
+    const injectionShingles = shingles(normalizedInjection);
+    if (injectionShingles.size === 0) {
+        return false;
+    }
+    const turnShingles = shingles(normalizedTurn);
+    const present = [...injectionShingles].filter((shingle) => turnShingles.has(shingle)).length;
+    return present / injectionShingles.size >= 0.6;
+}
+//# sourceMappingURL=self-ingestion.js.map

package/dist/security/self-ingestion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-ingestion.js","sourceRoot":"","sources":["../../src/security/self-ingestion.ts"],"names":[],"mappings":"AAEA,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,IAAqE;IAC1F,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACjD,OAAO,IAAI;SACN,WAAW,EAAE;SACb,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;SACjC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAI,GAAG,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAChE,IAAI,cAAc,KAAK,EAAE,IAAI,mBAAmB,KAAK,EAAE,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,cAAc,CAAC,MAAM,IAAI,EAAE,IAAI,cAAc,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACxD,IAAI,iBAAiB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7F,OAAO,OAAO,GAAG,iBAAiB,CAAC,IAAI,IAAI,GAAG,CAAC;AACnD,CAAC"}

package/dist/security/sentinel.js

@@ -0,0 +1,19 @@
+import { newUlid } from '../storage/ulid.js';
+export const OPEN = '[[elepha:';
+export const CLOSE = '[[/elepha]]';
+export function open(kind, ulid) {
+    return `${OPEN}${kind}:${ulid}]]`;
+}
+/** Wraps an injected body in line-isolated, transcript-stable markers. */
+export function wrap(kind, ulid, body) {
+    return `${open(kind, ulid)}\n${body}\n${CLOSE}`;
+}
+/** The same canonical ULID format used by elepha's other durable records. */
+export function buildInjectionId() {
+    return newUlid();
+}
+/** Deliberately a literal prefix match: malformed markers fail closed. */
+export function containsSentinel(text) {
+    return text.includes(OPEN);
+}
+//# sourceMappingURL=sentinel.js.map

package/dist/security/sentinel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel.js","sourceRoot":"","sources":["../../src/security/sentinel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI7C,MAAM,CAAC,MAAM,IAAI,GAAG,WAAW,CAAC;AAChC,MAAM,CAAC,MAAM,KAAK,GAAG,aAAa,CAAC;AAEnC,MAAM,UAAU,IAAI,CAAC,IAAmB,EAAE,IAAY;IAClD,OAAO,GAAG,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,IAAI,CAAC,IAAmB,EAAE,IAAY,EAAE,IAAY;IAChE,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB;IAC5B,OAAO,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC"}