hackmyagent 0.16.5 → 0.16.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (64) hide show
  1. package/dist/.integrity-manifest.json +1 -1
  2. package/dist/arp/crypto/hybrid-signing.d.ts +107 -0
  3. package/dist/arp/crypto/hybrid-signing.d.ts.map +1 -0
  4. package/dist/arp/crypto/hybrid-signing.js +321 -0
  5. package/dist/arp/crypto/hybrid-signing.js.map +1 -0
  6. package/dist/arp/crypto/index.d.ts +13 -0
  7. package/dist/arp/crypto/index.d.ts.map +1 -0
  8. package/dist/arp/crypto/index.js +33 -0
  9. package/dist/arp/crypto/index.js.map +1 -0
  10. package/dist/arp/crypto/manifest-loader.d.ts +117 -0
  11. package/dist/arp/crypto/manifest-loader.d.ts.map +1 -0
  12. package/dist/arp/crypto/manifest-loader.js +361 -0
  13. package/dist/arp/crypto/manifest-loader.js.map +1 -0
  14. package/dist/arp/crypto/types.d.ts +69 -0
  15. package/dist/arp/crypto/types.d.ts.map +1 -0
  16. package/dist/arp/crypto/types.js +11 -0
  17. package/dist/arp/crypto/types.js.map +1 -0
  18. package/dist/arp/index.d.ts +27 -0
  19. package/dist/arp/index.d.ts.map +1 -1
  20. package/dist/arp/index.js +94 -1
  21. package/dist/arp/index.js.map +1 -1
  22. package/dist/arp/intelligence/behavioral-risk-server.d.ts +82 -0
  23. package/dist/arp/intelligence/behavioral-risk-server.d.ts.map +1 -0
  24. package/dist/arp/intelligence/behavioral-risk-server.js +258 -0
  25. package/dist/arp/intelligence/behavioral-risk-server.js.map +1 -0
  26. package/dist/arp/intelligence/behavioral-risk.d.ts +217 -0
  27. package/dist/arp/intelligence/behavioral-risk.d.ts.map +1 -0
  28. package/dist/arp/intelligence/behavioral-risk.js +429 -0
  29. package/dist/arp/intelligence/behavioral-risk.js.map +1 -0
  30. package/dist/arp/intelligence/coordinator.d.ts +93 -2
  31. package/dist/arp/intelligence/coordinator.d.ts.map +1 -1
  32. package/dist/arp/intelligence/coordinator.js +281 -1
  33. package/dist/arp/intelligence/coordinator.js.map +1 -1
  34. package/dist/arp/intelligence/guard-anomaly.d.ts +349 -0
  35. package/dist/arp/intelligence/guard-anomaly.d.ts.map +1 -0
  36. package/dist/arp/intelligence/guard-anomaly.js +399 -0
  37. package/dist/arp/intelligence/guard-anomaly.js.map +1 -0
  38. package/dist/arp/intelligence/nanomind-l1.d.ts +37 -0
  39. package/dist/arp/intelligence/nanomind-l1.d.ts.map +1 -1
  40. package/dist/arp/intelligence/nanomind-l1.js +78 -0
  41. package/dist/arp/intelligence/nanomind-l1.js.map +1 -1
  42. package/dist/arp/intelligence/verify-classification.d.ts +124 -0
  43. package/dist/arp/intelligence/verify-classification.d.ts.map +1 -0
  44. package/dist/arp/intelligence/verify-classification.js +329 -0
  45. package/dist/arp/intelligence/verify-classification.js.map +1 -0
  46. package/dist/arp/proxy/server.d.ts +38 -8
  47. package/dist/arp/proxy/server.d.ts.map +1 -1
  48. package/dist/arp/proxy/server.js +89 -0
  49. package/dist/arp/proxy/server.js.map +1 -1
  50. package/dist/arp/types.d.ts +228 -1
  51. package/dist/arp/types.d.ts.map +1 -1
  52. package/dist/cli.js +85 -18
  53. package/dist/cli.js.map +1 -1
  54. package/dist/nanomind-core/compiler/semantic-compiler.d.ts.map +1 -1
  55. package/dist/nanomind-core/compiler/semantic-compiler.js +170 -10
  56. package/dist/nanomind-core/compiler/semantic-compiler.js.map +1 -1
  57. package/dist/nanomind-core/compiler/source-code-preprocessor.d.ts +64 -0
  58. package/dist/nanomind-core/compiler/source-code-preprocessor.d.ts.map +1 -0
  59. package/dist/nanomind-core/compiler/source-code-preprocessor.js +656 -0
  60. package/dist/nanomind-core/compiler/source-code-preprocessor.js.map +1 -0
  61. package/dist/nanomind-core/ingestion/artifact-parser.d.ts.map +1 -1
  62. package/dist/nanomind-core/ingestion/artifact-parser.js +15 -6
  63. package/dist/nanomind-core/ingestion/artifact-parser.js.map +1 -1
  64. package/package.json +3 -1
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/arp/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAa,QAAA,OAAO,GAAG,OAAO,CAAC;AA4B/B,uBAAuB;AACvB,sDAAoD;AAA3C,2GAAA,WAAW,OAAA;AACpB,oDAAyD;AAAhD,gHAAA,iBAAiB,OAAA;AAC1B,0DAAqE;AAA5D,sHAAA,uBAAuB,OAAA;AAChC,gDAAyD;AAAhD,0GAAA,gBAAgB,OAAA;AACzB,kDAAyD;AAAhD,0GAAA,eAAe,OAAA;AACxB,0DAAwD;AAA/C,yGAAA,UAAU,OAAA;AACnB,oDAA2H;AAAlH,4GAAA,gBAAgB,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AACzF,8CAAoD;AAA3C,yGAAA,cAAc,OAAA;AACvB,8CAAoD;AAA3C,yGAAA,cAAc,OAAA;AACvB,oDAA0D;AAAjD,+GAAA,iBAAiB,OAAA;AAC1B,gFAAiI;AAAxH,kIAAA,sBAAsB,OAAA;AAAE,mIAAA,uBAAuB,OAAA;AAAE,qIAAA,yBAAyB,OAAA;AAEnF,kDAA4D;AAAnD,6GAAA,kBAAkB,OAAA;AAC3B,kDAA4D;AAAnD,6GAAA,kBAAkB,OAAA;AAC3B,wDAAkE;AAAzD,mHAAA,qBAAqB,OAAA;AAC9B,gDAA0D;AAAjD,2GAAA,iBAAiB,OAAA;AAC1B,4DAAqE;AAA5D,sHAAA,sBAAsB,OAAA;AAC/B,4DAAqE;AAA5D,sHAAA,sBAAsB,OAAA;AAC/B,yDAAkF;AAAzE,gHAAA,iBAAiB,OAAA;AAC1B,mDAAoD;AAA3C,wGAAA,WAAW,OAAA;AACpB,0CAA4D;AAAnD,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AAClC,oDAAkH;AAAzG,sGAAA,QAAQ,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,0GAAA,YAAY,OAAA;AAC7C,yCAA6D;AAApD,kGAAA,QAAQ,OAAA;AACjB,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,mHAAA,wBAAwB,OAAA;AACxB,2GAAA,gBAAgB,OAAA;AAKlB,sBAAsB;AACtB,yCAYqB;AAXnB,0GAAA,aAAa,OAAA;AACb,gHAAA,mBAAmB,OAAA;AACnB,6GAAA,gBAAgB,OAAA;AAChB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,yGAAA,YAAY,OAAA;AAQd,2CAA6B;AAE7B,wDAAoD;AACpD,4DAAqE;AACrE,2DAAkF;AAClF,qDAAoD;AACpD,gDAAoD;AACpD,gDAAoD;AACpD,sDAA0D;AAC1D,oDAA4D;AAC5D,oDAA4D;AAC5D,0DAAkE;AAClE,kDAA0D;AAC1D,8DAAqE;AACrE,8DAAqE;AACrE,4CAA6C;AAC7C,qDAAsD;AACtD,2CAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAa,sBAAsB;IAUjC,YAAY,YAAiC;QAJ5B,aAAQ,GAAc,EAAE,CAAC;QAClC,kBAAa,GAAyB,IAAI,CAAC;QAC3C,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,YAAY,IAAI,IAAA,mBAAU,GAAE,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,GAAG,IAAI,0BAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,IAAI,qCAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,IAAI,+BAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,gCAAgC;QAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,kCAAkC;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,wBAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,wBAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,8BAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QACnH,CAAC;QAED,8EAA8E;QAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACpC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,4BAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,4BAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,kCAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC;QAED,+BAA+B;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,0BAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,qCAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,qCAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAA,0BAAmB,GAAE,CAAC;YAC1E,IAAI,CAAC,aAAa,GAAG,IAAI,yBAAa,CAAC;gBACrC,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW;gBACzC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aACnC,CAAC,CAAC;YAEH,4DAA4D;YAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAEzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,8BAA8B;IAC9B,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,yBAAyB;IACzB,SAAS;QAMP,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9E,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE;YAC3C,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,SAAS,CAAC,KAAc;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,oFAAoF;IACpF,OAAO,CAAC,OAAkD;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,2CAA2C;IAC3C,aAAa,CAAC,OAA8E;QAC1F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,wDAAwD;IACxD,gBAAgB,CAAC,QAAuB;QACtC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,qDAAqD;IACrD,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,sDAAsD;IACtD,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAhLD,wDAgLC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/arp/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAa,QAAA,OAAO,GAAG,OAAO,CAAC;AA4B/B,uBAAuB;AACvB,sDAAoD;AAA3C,2GAAA,WAAW,OAAA;AACpB,oDAAyD;AAAhD,gHAAA,iBAAiB,OAAA;AAC1B,0DAAqE;AAA5D,sHAAA,uBAAuB,OAAA;AAChC,gDAAyD;AAAhD,0GAAA,gBAAgB,OAAA;AACzB,kDAAyD;AAAhD,0GAAA,eAAe,OAAA;AACxB,0DAAwD;AAA/C,yGAAA,UAAU,OAAA;AACnB,oDAA2H;AAAlH,4GAAA,gBAAgB,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AACzF,8CAAoD;AAA3C,yGAAA,cAAc,OAAA;AACvB,8CAAoD;AAA3C,yGAAA,cAAc,OAAA;AACvB,oDAA0D;AAAjD,+GAAA,iBAAiB,OAAA;AAC1B,gFAAiI;AAAxH,kIAAA,sBAAsB,OAAA;AAAE,mIAAA,uBAAuB,OAAA;AAAE,qIAAA,yBAAyB,OAAA;AAEnF,kDAA4D;AAAnD,6GAAA,kBAAkB,OAAA;AAC3B,kDAA4D;AAAnD,6GAAA,kBAAkB,OAAA;AAC3B,wDAAkE;AAAzD,mHAAA,qBAAqB,OAAA;AAC9B,gDAA0D;AAAjD,2GAAA,iBAAiB,OAAA;AAC1B,4DAAqE;AAA5D,sHAAA,sBAAsB,OAAA;AAC/B,4DAAqE;AAA5D,sHAAA,sBAAsB,OAAA;AAC/B,yDAAkF;AAAzE,gHAAA,iBAAiB,OAAA;AAC1B,mDAAoD;AAA3C,wGAAA,WAAW,OAAA;AACpB,0CAA4D;AAAnD,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AAClC,oDAAkH;AAAzG,sGAAA,QAAQ,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,0GAAA,YAAY,OAAA;AAC7C,yCAA6D;AAApD,kGAAA,QAAQ,OAAA;AACjB,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,mHAAA,wBAAwB,OAAA;AACxB,2GAAA,gBAAgB,OAAA;AAKlB,sBAAsB;AACtB,yCAYqB;AAXnB,0GAAA,aAAa,OAAA;AACb,gHAAA,mBAAmB,OAAA;AACnB,6GAAA,gBAAgB,OAAA;AAChB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,yGAAA,YAAY,OAAA;AAQd,2CAA6B;AAE7B,wDAAoD;AACpD,4DAAqE;AACrE,4DAAwD;AACxD,oEAGwC;AACxC,gEAGsC;AACtC,2DAAkF;AAClF,qDAAoD;AACpD,gDAAoD;AACpD,gDAAoD;AACpD,sDAA0D;AAC1D,oDAA4D;AAC5D,oDAA4D;AAC5D,0DAAkE;AAClE,kDAA0D;AAC1D,8DAAqE;AACrE,8DAAqE;AACrE,4CAA6C;AAC7C,qDAAsD;AACtD,2CAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAa,sBAAsB;IA2BjC,YAAY,YAAiC;QArB5B,aAAQ,GAAc,EAAE,CAAC;QAClC,kBAAa,GAAyB,IAAI,CAAC;QAC3C,YAAO,GAAG,KAAK,CAAC;QAoBtB,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,YAAY,IAAI,IAAA,mBAAU,GAAE,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,GAAG,IAAI,0BAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3C,qEAAqE;QACrE,0DAA0D;QAC1D,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,kBAAkB;QAClB,IAAI,CAAC,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,WAAW;YAC1C,CAAC,CAAC,IAAI,+CAA6B,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC;YAC5E,CAAC,CAAC,IAAI,CAAC;QAET,qEAAqE;QACrE,2DAA2D;QAC3D,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnD,6DAA6D;QAC7D,iEAAiE;QACjE,oEAAoE;QACpE,oDAAoD;QACpD,IAAI,CAAC,YAAY,GAAG,IAAI,qCAAuB,CAC7C,IAAI,CAAC,MAAM,EACX,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,+BAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,gCAAgC;QAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,kCAAkC;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,wBAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,wBAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,8BAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QACnH,CAAC;QAED,8EAA8E;QAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACpC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,4BAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,4BAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,kCAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC;QAED,+BAA+B;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,0BAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,qCAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,qCAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAA,0BAAmB,GAAE,CAAC;YAC1E,IAAI,CAAC,aAAa,GAAG,IAAI,yBAAa,CAAC;gBACrC,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW;gBACzC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aACnC,CAAC,CAAC;YAEH,4DAA4D;YAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAEzB,oEAAoE;QACpE,iEAAiE;QACjE,iEAAiE;QACjE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,8BAA8B;IAC9B,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,yBAAyB;IACzB,SAAS;QAMP,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9E,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE;YAC3C,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,SAAS,CAAC,KAAc;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,oFAAoF;IACpF,OAAO,CAAC,OAAkD;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,2CAA2C;IAC3C,aAAa,CAAC,OAA8E;QAC1F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,wDAAwD;IACxD,gBAAgB,CAAC,QAAuB;QACtC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,qDAAqD;IACrD,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,sDAAsD;IACtD,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAlPD,wDAkPC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,MAAiB;IACzC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IAC/B,IAAI,EAAE,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,EAAE,EAAE,WAAW,CAAC;IAChC,IAAI,OAAO,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,IAAI,wBAAU,CAAC,MAAM,CAAC,SAAS,EAAE;QACtC,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,KAAK;QAC5C,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,SAAS;KACnD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,MAAiB;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,IAAI,oCAAoB,CAAC;QAC9B,QAAQ;QACR,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC"}
@@ -0,0 +1,82 @@
1
+ /**
2
+ * Behavioral risk IPC server (AIComply P1, producer side).
3
+ *
4
+ * Partner to `behavioral-risk.ts`. Listens on a unix domain socket (or
5
+ * Windows named pipe) and answers risk signal requests by delegating to a
6
+ * caller-supplied `BehavioralRiskScoreable`, which in production is a
7
+ * `NanoMindL1` instance running in the twin's own process.
8
+ *
9
+ * The server is deliberately narrow: one request per connection, no
10
+ * session state, no authentication beyond filesystem permissions on the
11
+ * socket path. The threat model assumes the socket is owned by the same
12
+ * local user and is reachable only from processes with appropriate
13
+ * filesystem access; cross-host or cross-user use is out of scope.
14
+ *
15
+ * Wire format (both directions, newline-delimited JSON):
16
+ *
17
+ * request {"kind":"risk_signal_request","version":1,"event":<ARPEvent>}
18
+ * response {"kind":"risk_signal_response","version":1,"score":...,
19
+ * "action":"allow|alert|throttle|suspend|kill","reason":"...",
20
+ * "source":"...","computedAtMs":...}
21
+ * error {"kind":"risk_signal_error","version":1,"code":<code>,
22
+ * "reason":"..."}
23
+ *
24
+ * Any parse failure, unknown kind, or thrown exception inside the scorer
25
+ * is converted to a structured `risk_signal_error` message. The server
26
+ * never crashes on a malformed request; per-request isolation keeps a
27
+ * bad client from affecting others.
28
+ */
29
+ import { type BehavioralRiskScoreable, type BehavioralRiskUnavailableCode } from './behavioral-risk';
30
+ /**
31
+ * Options accepted by `startBehavioralRiskServer`. Only `twin` is
32
+ * required; everything else has a defensible default.
33
+ */
34
+ export interface BehavioralRiskServerOptions {
35
+ /**
36
+ * Handle that knows how to score an ARP event. In production this is a
37
+ * NanoMindL1 instance. In tests it can be any stub that returns a
38
+ * deterministic risk score.
39
+ */
40
+ twin: BehavioralRiskScoreable;
41
+ /**
42
+ * Filesystem path where the server listens. On POSIX systems, a unix
43
+ * domain socket; on Windows, a named pipe path. Any existing socket
44
+ * file at this path is removed before binding (POSIX only).
45
+ */
46
+ socketPath: string;
47
+ /**
48
+ * Identifier written back into the `source` field of every response.
49
+ * Helps the coordinator's audit log distinguish between multiple risk
50
+ * sources during A/B rollout.
51
+ */
52
+ sourceName?: string;
53
+ /**
54
+ * Invoked whenever the server rejects a request with an error response.
55
+ * Gets the code and reason. Useful for routing to a SIEM or surfacing
56
+ * in an operator dashboard. Optional; defaults to a no-op.
57
+ */
58
+ onError?: (code: BehavioralRiskUnavailableCode, reason: string) => void;
59
+ }
60
+ /**
61
+ * Handle returned by `startBehavioralRiskServer`. Callers hold this for
62
+ * the lifetime of the coordinator and invoke `close()` on shutdown.
63
+ */
64
+ export interface BehavioralRiskServerHandle {
65
+ /** The listening socket path. */
66
+ readonly socketPath: string;
67
+ /**
68
+ * Stop accepting new connections, tear down the listening socket, and
69
+ * clean up the socket file on POSIX. Safe to call more than once.
70
+ */
71
+ close(): Promise<void>;
72
+ }
73
+ /**
74
+ * Start the behavioral risk IPC server. Resolves once the server is
75
+ * actively listening on the socket path so the caller can hand the path
76
+ * to clients without a race against a half-open listener.
77
+ *
78
+ * Throws on bind failure (unrecoverable; the caller should decide
79
+ * whether to degrade to an in-process source or fail the startup).
80
+ */
81
+ export declare function startBehavioralRiskServer(options: BehavioralRiskServerOptions): Promise<BehavioralRiskServerHandle>;
82
+ //# sourceMappingURL=behavioral-risk-server.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"behavioral-risk-server.d.ts","sourceRoot":"","sources":["../../../src/arp/intelligence/behavioral-risk-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,IAAI,EAAE,uBAAuB,CAAC;IAC9B;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACzE;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAkGrC"}
@@ -0,0 +1,258 @@
1
+ "use strict";
2
+ /**
3
+ * Behavioral risk IPC server (AIComply P1, producer side).
4
+ *
5
+ * Partner to `behavioral-risk.ts`. Listens on a unix domain socket (or
6
+ * Windows named pipe) and answers risk signal requests by delegating to a
7
+ * caller-supplied `BehavioralRiskScoreable`, which in production is a
8
+ * `NanoMindL1` instance running in the twin's own process.
9
+ *
10
+ * The server is deliberately narrow: one request per connection, no
11
+ * session state, no authentication beyond filesystem permissions on the
12
+ * socket path. The threat model assumes the socket is owned by the same
13
+ * local user and is reachable only from processes with appropriate
14
+ * filesystem access; cross-host or cross-user use is out of scope.
15
+ *
16
+ * Wire format (both directions, newline-delimited JSON):
17
+ *
18
+ * request {"kind":"risk_signal_request","version":1,"event":<ARPEvent>}
19
+ * response {"kind":"risk_signal_response","version":1,"score":...,
20
+ * "action":"allow|alert|throttle|suspend|kill","reason":"...",
21
+ * "source":"...","computedAtMs":...}
22
+ * error {"kind":"risk_signal_error","version":1,"code":<code>,
23
+ * "reason":"..."}
24
+ *
25
+ * Any parse failure, unknown kind, or thrown exception inside the scorer
26
+ * is converted to a structured `risk_signal_error` message. The server
27
+ * never crashes on a malformed request; per-request isolation keeps a
28
+ * bad client from affecting others.
29
+ */
30
+ var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
31
+ if (k2 === undefined) k2 = k;
32
+ var desc = Object.getOwnPropertyDescriptor(m, k);
33
+ if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
34
+ desc = { enumerable: true, get: function() { return m[k]; } };
35
+ }
36
+ Object.defineProperty(o, k2, desc);
37
+ }) : (function(o, m, k, k2) {
38
+ if (k2 === undefined) k2 = k;
39
+ o[k2] = m[k];
40
+ }));
41
+ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
42
+ Object.defineProperty(o, "default", { enumerable: true, value: v });
43
+ }) : function(o, v) {
44
+ o["default"] = v;
45
+ });
46
+ var __importStar = (this && this.__importStar) || (function () {
47
+ var ownKeys = function(o) {
48
+ ownKeys = Object.getOwnPropertyNames || function (o) {
49
+ var ar = [];
50
+ for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
51
+ return ar;
52
+ };
53
+ return ownKeys(o);
54
+ };
55
+ return function (mod) {
56
+ if (mod && mod.__esModule) return mod;
57
+ var result = {};
58
+ if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
59
+ __setModuleDefault(result, mod);
60
+ return result;
61
+ };
62
+ })();
63
+ Object.defineProperty(exports, "__esModule", { value: true });
64
+ exports.startBehavioralRiskServer = startBehavioralRiskServer;
65
+ const net = __importStar(require("net"));
66
+ const fs = __importStar(require("fs"));
67
+ const path = __importStar(require("path"));
68
+ const behavioral_risk_1 = require("./behavioral-risk");
69
+ /**
70
+ * Start the behavioral risk IPC server. Resolves once the server is
71
+ * actively listening on the socket path so the caller can hand the path
72
+ * to clients without a race against a half-open listener.
73
+ *
74
+ * Throws on bind failure (unrecoverable; the caller should decide
75
+ * whether to degrade to an in-process source or fail the startup).
76
+ */
77
+ async function startBehavioralRiskServer(options) {
78
+ const { twin, socketPath, sourceName = 'nanomind-l1-ipc', onError } = options;
79
+ // On POSIX, a stale socket file from a crashed previous run blocks
80
+ // bind. We remove it defensively. On Windows named pipes, the path is
81
+ // in its own namespace and this step is a no-op.
82
+ if (process.platform !== 'win32') {
83
+ try {
84
+ const dir = path.dirname(socketPath);
85
+ if (!fs.existsSync(dir))
86
+ fs.mkdirSync(dir, { recursive: true });
87
+ if (fs.existsSync(socketPath))
88
+ fs.unlinkSync(socketPath);
89
+ }
90
+ catch {
91
+ // If we cannot clean up the stale file, let listen() surface the
92
+ // real error below.
93
+ }
94
+ }
95
+ const server = net.createServer((socket) => {
96
+ let buffer = '';
97
+ let handled = false;
98
+ const sendAndClose = (payload) => {
99
+ if (handled)
100
+ return;
101
+ handled = true;
102
+ try {
103
+ socket.write(JSON.stringify(payload) + '\n');
104
+ }
105
+ catch {
106
+ // If the client already hung up, there is nothing useful to do.
107
+ }
108
+ socket.end();
109
+ };
110
+ const sendError = (code, reason) => {
111
+ onError?.(code, reason);
112
+ sendAndClose({
113
+ kind: 'risk_signal_error',
114
+ version: behavioral_risk_1.BEHAVIORAL_RISK_WIRE_VERSION,
115
+ code,
116
+ reason,
117
+ });
118
+ };
119
+ socket.on('data', (chunk) => {
120
+ if (handled)
121
+ return;
122
+ buffer += chunk.toString('utf8');
123
+ const nl = buffer.indexOf('\n');
124
+ if (nl < 0) {
125
+ // Cap unparsed buffer to keep a misbehaving client from
126
+ // exhausting server memory. One request per connection means a
127
+ // single line; anything beyond a reasonable ceiling is hostile.
128
+ if (buffer.length > 64 * 1024) {
129
+ sendError('PARSE_ERROR', 'request exceeded maximum size');
130
+ }
131
+ return;
132
+ }
133
+ const line = buffer.slice(0, nl);
134
+ handleRequest(line, twin, sourceName, sendAndClose, sendError);
135
+ });
136
+ socket.on('error', () => {
137
+ // Drop per-connection errors; nothing to log that the client will
138
+ // see. A wedged client eventually times out.
139
+ });
140
+ });
141
+ server.on('error', (err) => {
142
+ // Per-connection errors bubble up here after a catastrophic failure.
143
+ // We defer to the caller's onError hook so operators can spot
144
+ // repeating listen-level failures.
145
+ onError?.('TRANSPORT_ERROR', `server error: ${err.message}`);
146
+ });
147
+ await new Promise((resolve, reject) => {
148
+ server.once('error', reject);
149
+ server.listen(socketPath, () => {
150
+ server.removeListener('error', reject);
151
+ resolve();
152
+ });
153
+ });
154
+ let closed = false;
155
+ return {
156
+ socketPath,
157
+ close: async () => {
158
+ if (closed)
159
+ return;
160
+ closed = true;
161
+ await new Promise((resolve) => {
162
+ server.close(() => resolve());
163
+ });
164
+ if (process.platform !== 'win32') {
165
+ try {
166
+ if (fs.existsSync(socketPath))
167
+ fs.unlinkSync(socketPath);
168
+ }
169
+ catch {
170
+ // Nothing actionable; the socket file may already be gone.
171
+ }
172
+ }
173
+ },
174
+ };
175
+ }
176
+ /**
177
+ * Parse and dispatch a single request line. Extracted so the connection
178
+ * handler stays readable and so the request path can be unit tested in
179
+ * isolation later if needed. Every failure path resolves to a
180
+ * `risk_signal_error` rather than propagating an exception: the server
181
+ * must never crash on a malformed request.
182
+ */
183
+ function handleRequest(line, twin, sourceName, sendAndClose, sendError) {
184
+ let msg;
185
+ try {
186
+ msg = JSON.parse(line);
187
+ }
188
+ catch (err) {
189
+ sendError('PARSE_ERROR', `invalid json: ${err.message}`);
190
+ return;
191
+ }
192
+ if (msg === null || typeof msg !== 'object') {
193
+ sendError('PARSE_ERROR', 'request is not a json object');
194
+ return;
195
+ }
196
+ const obj = msg;
197
+ if (obj.version !== behavioral_risk_1.BEHAVIORAL_RISK_WIRE_VERSION) {
198
+ sendError('PARSE_ERROR', `unsupported wire version: ${JSON.stringify(obj.version)}`);
199
+ return;
200
+ }
201
+ if (obj.kind !== 'risk_signal_request') {
202
+ sendError('PARSE_ERROR', `unexpected kind: ${JSON.stringify(obj.kind)}`);
203
+ return;
204
+ }
205
+ const event = obj.event;
206
+ if (!isArpEventLike(event)) {
207
+ sendError('PARSE_ERROR', 'event field is missing required ARPEvent shape');
208
+ return;
209
+ }
210
+ let result;
211
+ try {
212
+ result = twin.scoreARPEvent(event);
213
+ }
214
+ catch (err) {
215
+ sendError('INTERNAL_ERROR', `twin threw: ${err.message ?? String(err)}`);
216
+ return;
217
+ }
218
+ if (result === null) {
219
+ sendError('NOT_READY', 'twin baseline not yet trained');
220
+ return;
221
+ }
222
+ sendAndClose({
223
+ kind: 'risk_signal_response',
224
+ version: behavioral_risk_1.BEHAVIORAL_RISK_WIRE_VERSION,
225
+ score: result.score,
226
+ action: result.action,
227
+ reason: result.reason,
228
+ source: sourceName,
229
+ computedAtMs: Date.now(),
230
+ });
231
+ }
232
+ /**
233
+ * Narrow runtime check for an ARPEvent-shaped request payload. Only
234
+ * validates the fields the twin's scoreARPEvent path actually reads,
235
+ * which is by design: stricter validation would reject valid events
236
+ * whose extra fields the server does not care about.
237
+ */
238
+ function isArpEventLike(v) {
239
+ if (v === null || typeof v !== 'object')
240
+ return false;
241
+ const e = v;
242
+ if (typeof e.id !== 'string')
243
+ return false;
244
+ if (typeof e.timestamp !== 'string')
245
+ return false;
246
+ if (typeof e.source !== 'string')
247
+ return false;
248
+ if (typeof e.category !== 'string')
249
+ return false;
250
+ if (typeof e.severity !== 'string')
251
+ return false;
252
+ if (typeof e.description !== 'string')
253
+ return false;
254
+ if (e.data === null || typeof e.data !== 'object')
255
+ return false;
256
+ return true;
257
+ }
258
+ //# sourceMappingURL=behavioral-risk-server.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"behavioral-risk-server.js","sourceRoot":"","sources":["../../../src/arp/intelligence/behavioral-risk-server.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiEH,8DAoGC;AAnKD,yCAA2B;AAC3B,uCAAyB;AACzB,2CAA6B;AAE7B,uDAI2B;AA+C3B;;;;;;;GAOG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAoC;IAEpC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,iBAAiB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE9E,mEAAmE;IACnE,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,oBAAoB;QACtB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,YAAY,GAAG,CAAC,OAAgC,EAAE,EAAE;YACxD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,CAAC,IAAmC,EAAE,MAAc,EAAE,EAAE;YACxE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxB,YAAY,CAAC;gBACX,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,8CAA4B;gBACrC,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACX,wDAAwD;gBACxD,+DAA+D;gBAC/D,gEAAgE;gBAChE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;oBAC9B,SAAS,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,kEAAkE;YAClE,6CAA6C;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,qEAAqE;QACrE,8DAA8D;QAC9D,mCAAmC;QACnC,OAAO,EAAE,CAAC,iBAAiB,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,UAAU;QACV,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;wBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBACP,2DAA2D;gBAC7D,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,IAAY,EACZ,IAA6B,EAC7B,UAAkB,EAClB,YAAwD,EACxD,SAAwE;IAExE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,aAAa,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,SAAS,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,8CAA4B,EAAE,CAAC;QACjD,SAAS,CAAC,aAAa,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACvC,SAAS,CAAC,aAAa,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,aAAa,EAAE,gDAAgD,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,gBAAgB,EAAE,eAAgB,GAAa,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,SAAS,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IACD,YAAY,CAAC;QACX,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,8CAA4B;QACrC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC"}
@@ -0,0 +1,217 @@
1
+ /**
2
+ * Behavioral risk signal channel (AIComply P1, coordinator hot path).
3
+ *
4
+ * The `IntelligenceCoordinator` needs a way to ask the behavioral twin
5
+ * (`NanoMindL1` in `nanomind-l1.ts`) "how anomalous does this event look
6
+ * against the agent's behavioral baseline?" without importing the twin
7
+ * directly into the comply path. Direct coupling would re-introduce the
8
+ * layering break that the L0-comply gate was added to prevent: the twin
9
+ * would sit inline with the crypto verifier, and a bug in the twin would
10
+ * cascade into every classified event.
11
+ *
12
+ * The solution here is an IPC contract. The coordinator holds a
13
+ * `BehavioralRiskSource` that abstracts transport. Two implementations
14
+ * ship in this module:
15
+ *
16
+ * - `InProcessBehavioralRiskSource` wraps any object that exposes
17
+ * `scoreARPEvent(event)`. This is the single-process fast path: no
18
+ * serialization, no socket, just a direct call guarded by a try/catch.
19
+ * `NanoMindL1` satisfies the interface via its readonly scoreARPEvent
20
+ * method, but tests can inject any stub.
21
+ *
22
+ * - `UnixSocketBehavioralRiskSource` speaks newline-delimited JSON over
23
+ * a unix domain socket (or a Windows named pipe via node `net`). This
24
+ * is the cross-process variant, used when the twin runs in its own
25
+ * daemon to isolate a crashy baseline from the enforcement path.
26
+ *
27
+ * Every caller-visible method is bounded:
28
+ *
29
+ * - `getBehavioralRiskSignal(event, timeoutMs)` enforces a deadline on
30
+ * every call. The unix socket transport destroys the socket on timeout
31
+ * and resolves to `{status: 'unavailable', code: 'TIMEOUT'}`; the
32
+ * in-process source has no IO but still wraps the call in a bounded
33
+ * try/catch so a throwing twin cannot take down the coordinator.
34
+ *
35
+ * - A five-failure circuit breaker opens the unix socket transport for
36
+ * 30 seconds on repeated unavailable outcomes. A wedged IPC source
37
+ * therefore cannot cascade-block the coordinator indefinitely: after
38
+ * the breaker opens, calls resolve instantly with a cached error until
39
+ * cooldown expires.
40
+ *
41
+ * Parse-to-deny (CR-001) is honored on every path: the public surface
42
+ * never throws. Every error branch resolves to a typed
43
+ * `{status: 'unavailable', code, reason}` so the coordinator can route on
44
+ * the code without string scraping. What "deny" means when the twin is
45
+ * unavailable is the coordinator's policy, not this module's: the
46
+ * coordinator records the unavailable signal on `event.data.behavioralRisk`
47
+ * for downstream audit and leaves severity untouched. An IPC outage is
48
+ * not evidence of threat, and raising severity on every event during twin
49
+ * startup would be a regression; security-paranoid deployments can layer
50
+ * a stricter policy on top of the recorded signal.
51
+ */
52
+ import type { ARPEvent } from '../types';
53
+ /**
54
+ * Shape returned by the twin's on-demand scorer. Mirrors NanoMindL1's
55
+ * internal AnomalyResult so this module does not need to import the twin
56
+ * directly, and so test stubs can produce it without depending on the
57
+ * full NanoMindL1 class surface.
58
+ */
59
+ export interface BehavioralRiskScore {
60
+ /** Normalized anomaly score in [0, 1]. Higher is riskier. */
61
+ score: number;
62
+ /** Response mapping derived from the score band. */
63
+ action: 'allow' | 'alert' | 'throttle' | 'suspend' | 'kill';
64
+ /** Human-readable reason for the action, safe to log. */
65
+ reason: string;
66
+ }
67
+ /**
68
+ * Minimum interface an in-process twin handle must satisfy to be plugged
69
+ * into `InProcessBehavioralRiskSource`. NanoMindL1.scoreARPEvent matches
70
+ * this shape by construction.
71
+ */
72
+ export interface BehavioralRiskScoreable {
73
+ scoreARPEvent(event: ARPEvent): BehavioralRiskScore | null;
74
+ }
75
+ /**
76
+ * Ok branch returned to the coordinator when the twin scored the event.
77
+ * The `source` string identifies which twin produced the signal (for
78
+ * audit) and `computedAtMs` is the wall clock at the time of scoring so
79
+ * callers can age out old values if they cache.
80
+ */
81
+ export interface BehavioralRiskSignal extends BehavioralRiskScore {
82
+ source: string;
83
+ computedAtMs: number;
84
+ }
85
+ /**
86
+ * Discrete error codes on the unavailable branch. Kept as a closed union
87
+ * so the coordinator can route on the code without parsing strings.
88
+ */
89
+ export type BehavioralRiskUnavailableCode = 'NOT_READY' | 'TIMEOUT' | 'TRANSPORT_ERROR' | 'PARSE_ERROR' | 'CIRCUIT_OPEN' | 'DISABLED' | 'INTERNAL_ERROR';
90
+ /**
91
+ * Discriminated union a caller routes on. The ok branch carries the full
92
+ * signal; the unavailable branch carries a code and a short reason.
93
+ */
94
+ export type BehavioralRiskResult = {
95
+ status: 'ok';
96
+ signal: BehavioralRiskSignal;
97
+ } | {
98
+ status: 'unavailable';
99
+ code: BehavioralRiskUnavailableCode;
100
+ reason: string;
101
+ };
102
+ /**
103
+ * Abstract transport the coordinator holds. All error paths resolve to an
104
+ * `unavailable` result; `getBehavioralRiskSignal` must never throw and
105
+ * must honor the timeout deadline.
106
+ */
107
+ export interface BehavioralRiskSource {
108
+ /**
109
+ * Ask the twin for the behavioral risk signal associated with `event`.
110
+ * Must resolve within `timeoutMs`. Must never throw. Must never block
111
+ * the caller beyond the timeout: implementations that wait on IO must
112
+ * tear down any pending work on deadline.
113
+ */
114
+ getBehavioralRiskSignal(event: ARPEvent, timeoutMs: number): Promise<BehavioralRiskResult>;
115
+ /**
116
+ * Release any transport resources. Coordinator calls this on shutdown.
117
+ * Safe to call repeatedly.
118
+ */
119
+ close(): Promise<void>;
120
+ }
121
+ /**
122
+ * Default timeout for a single risk signal request. Chosen to keep the
123
+ * comply hot path well under a frame budget even under transport jitter.
124
+ * The in-process source ignores this; the unix socket source enforces it.
125
+ */
126
+ export declare const DEFAULT_BEHAVIORAL_RISK_TIMEOUT_MS = 25;
127
+ /**
128
+ * Number of consecutive unavailable outcomes that open the circuit
129
+ * breaker on the unix socket source. A wedged twin daemon will hit this
130
+ * after five calls and stop consuming coordinator time.
131
+ */
132
+ export declare const CIRCUIT_BREAKER_THRESHOLD = 5;
133
+ /**
134
+ * Cooldown before the circuit breaker allows a single probe call to try
135
+ * the transport again. 30 seconds is long enough to absorb transient
136
+ * restarts without burning too many coordinator cycles on probes.
137
+ */
138
+ export declare const CIRCUIT_BREAKER_COOLDOWN_MS = 30000;
139
+ /**
140
+ * IPC wire format version. Clients and servers both advertise `version: 1`
141
+ * in every message; mismatched versions are treated as PARSE_ERROR rather
142
+ * than silently accepted, so a future protocol change cannot be downgraded.
143
+ */
144
+ export declare const BEHAVIORAL_RISK_WIRE_VERSION = 1;
145
+ /**
146
+ * Resolve the platform-appropriate default socket path for the behavioral
147
+ * risk server. Unix-like systems get a socket under
148
+ * `~/.opena2a/arp/behavioral-risk-<agentId>.sock`; Windows gets a named
149
+ * pipe in the `\\.\pipe\opena2a-arp-behavioral-risk-<agentId>` namespace.
150
+ * Callers are free to override this.
151
+ */
152
+ export declare function defaultBehavioralRiskSocketPath(agentId: string): string;
153
+ /**
154
+ * In-process risk source. Wraps a handle that implements
155
+ * `scoreARPEvent`. Intended for single-process deployments where the
156
+ * twin and the coordinator live in the same Node process. Synchronous by
157
+ * construction, so the timeout is only a safety net against a
158
+ * misbehaving twin that throws.
159
+ *
160
+ * Decoupling rationale: the coordinator holds this as a
161
+ * `BehavioralRiskSource`, not as a `NanoMindL1`. The comply path has no
162
+ * knowledge of twin internals and a bug in the twin surfaces as an
163
+ * `unavailable` result, not a cascade failure.
164
+ */
165
+ export declare class InProcessBehavioralRiskSource implements BehavioralRiskSource {
166
+ private readonly twin;
167
+ private readonly sourceName;
168
+ constructor(twin: BehavioralRiskScoreable, sourceName?: string);
169
+ getBehavioralRiskSignal(event: ARPEvent, _timeoutMs: number): Promise<BehavioralRiskResult>;
170
+ close(): Promise<void>;
171
+ }
172
+ /**
173
+ * Unix-socket (or Windows named pipe) risk source. Opens a fresh
174
+ * connection per request. Rationale: per-request connections keep the
175
+ * transport state machine trivial (no pooling, no reconnection dance) and
176
+ * the request cost is dominated by the twin's scoring latency, not the
177
+ * connect itself. If perf measurement later shows connect-per-request is
178
+ * a bottleneck, a pooled variant can be added without changing the
179
+ * public BehavioralRiskSource interface.
180
+ *
181
+ * Circuit breaker semantics:
182
+ * - After `CIRCUIT_BREAKER_THRESHOLD` consecutive unavailable outcomes,
183
+ * the breaker opens and subsequent calls fast-fail with
184
+ * `CIRCUIT_OPEN` without touching the socket.
185
+ * - After `CIRCUIT_BREAKER_COOLDOWN_MS`, the breaker half-opens: the
186
+ * next call is allowed through. A successful call resets the failure
187
+ * counter and closes the breaker. A failed probe leaves the breaker
188
+ * open and restarts the cooldown.
189
+ */
190
+ export declare class UnixSocketBehavioralRiskSource implements BehavioralRiskSource {
191
+ private readonly socketPath;
192
+ private readonly sourceName;
193
+ private readonly now;
194
+ private consecutiveFailures;
195
+ private circuitOpen;
196
+ private circuitOpenedAtMs;
197
+ constructor(socketPath: string, options?: {
198
+ sourceName?: string;
199
+ now?: () => number;
200
+ });
201
+ getBehavioralRiskSignal(event: ARPEvent, timeoutMs: number): Promise<BehavioralRiskResult>;
202
+ private roundTrip;
203
+ private parseResponse;
204
+ private recordOutcome;
205
+ /**
206
+ * Test-only accessor for the current breaker state. Exposed so tests
207
+ * can assert breaker opens at the threshold and closes on a successful
208
+ * probe without scraping internals through reflection.
209
+ */
210
+ _getBreakerStateForTest(): {
211
+ open: boolean;
212
+ failures: number;
213
+ openedAtMs: number;
214
+ };
215
+ close(): Promise<void>;
216
+ }
217
+ //# sourceMappingURL=behavioral-risk.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"behavioral-risk.d.ts","sourceRoot":"","sources":["../../../src/arp/intelligence/behavioral-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IAC5D,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,mBAAmB,GAAG,IAAI,CAAC;CAC5D;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GACrC,WAAW,GACX,SAAS,GACT,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,6BAA6B,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3F;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,YAAW,oBAAoB;IACxE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0B;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,IAAI,EAAE,uBAAuB,EAAE,UAAU,SAAuB;IAKtE,uBAAuB,CAC3B,KAAK,EAAE,QAAQ,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,oBAAoB,CAAC;IAoC1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,8BAA+B,YAAW,oBAAoB;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,iBAAiB,CAAK;gBAG5B,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAOrD,uBAAuB,CAC3B,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC;IAqBhC,OAAO,CAAC,SAAS;IAmFjB,OAAO,CAAC,aAAa;IA2ErB,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACH,uBAAuB,IAAI;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAQ5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}