hackmyagent 0.16.5 → 0.16.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/.integrity-manifest.json +1 -1
- package/dist/arp/crypto/hybrid-signing.d.ts +107 -0
- package/dist/arp/crypto/hybrid-signing.d.ts.map +1 -0
- package/dist/arp/crypto/hybrid-signing.js +321 -0
- package/dist/arp/crypto/hybrid-signing.js.map +1 -0
- package/dist/arp/crypto/index.d.ts +13 -0
- package/dist/arp/crypto/index.d.ts.map +1 -0
- package/dist/arp/crypto/index.js +33 -0
- package/dist/arp/crypto/index.js.map +1 -0
- package/dist/arp/crypto/manifest-loader.d.ts +117 -0
- package/dist/arp/crypto/manifest-loader.d.ts.map +1 -0
- package/dist/arp/crypto/manifest-loader.js +361 -0
- package/dist/arp/crypto/manifest-loader.js.map +1 -0
- package/dist/arp/crypto/types.d.ts +69 -0
- package/dist/arp/crypto/types.d.ts.map +1 -0
- package/dist/arp/crypto/types.js +11 -0
- package/dist/arp/crypto/types.js.map +1 -0
- package/dist/arp/index.d.ts +27 -0
- package/dist/arp/index.d.ts.map +1 -1
- package/dist/arp/index.js +94 -1
- package/dist/arp/index.js.map +1 -1
- package/dist/arp/intelligence/behavioral-risk-server.d.ts +82 -0
- package/dist/arp/intelligence/behavioral-risk-server.d.ts.map +1 -0
- package/dist/arp/intelligence/behavioral-risk-server.js +258 -0
- package/dist/arp/intelligence/behavioral-risk-server.js.map +1 -0
- package/dist/arp/intelligence/behavioral-risk.d.ts +217 -0
- package/dist/arp/intelligence/behavioral-risk.d.ts.map +1 -0
- package/dist/arp/intelligence/behavioral-risk.js +429 -0
- package/dist/arp/intelligence/behavioral-risk.js.map +1 -0
- package/dist/arp/intelligence/coordinator.d.ts +93 -2
- package/dist/arp/intelligence/coordinator.d.ts.map +1 -1
- package/dist/arp/intelligence/coordinator.js +281 -1
- package/dist/arp/intelligence/coordinator.js.map +1 -1
- package/dist/arp/intelligence/guard-anomaly.d.ts +349 -0
- package/dist/arp/intelligence/guard-anomaly.d.ts.map +1 -0
- package/dist/arp/intelligence/guard-anomaly.js +399 -0
- package/dist/arp/intelligence/guard-anomaly.js.map +1 -0
- package/dist/arp/intelligence/nanomind-l1.d.ts +37 -0
- package/dist/arp/intelligence/nanomind-l1.d.ts.map +1 -1
- package/dist/arp/intelligence/nanomind-l1.js +78 -0
- package/dist/arp/intelligence/nanomind-l1.js.map +1 -1
- package/dist/arp/intelligence/verify-classification.d.ts +124 -0
- package/dist/arp/intelligence/verify-classification.d.ts.map +1 -0
- package/dist/arp/intelligence/verify-classification.js +329 -0
- package/dist/arp/intelligence/verify-classification.js.map +1 -0
- package/dist/arp/proxy/server.d.ts +38 -8
- package/dist/arp/proxy/server.d.ts.map +1 -1
- package/dist/arp/proxy/server.js +89 -0
- package/dist/arp/proxy/server.js.map +1 -1
- package/dist/arp/types.d.ts +228 -1
- package/dist/arp/types.d.ts.map +1 -1
- package/dist/cli.js +85 -18
- package/dist/cli.js.map +1 -1
- package/dist/nanomind-core/compiler/semantic-compiler.d.ts.map +1 -1
- package/dist/nanomind-core/compiler/semantic-compiler.js +170 -10
- package/dist/nanomind-core/compiler/semantic-compiler.js.map +1 -1
- package/dist/nanomind-core/compiler/source-code-preprocessor.d.ts +64 -0
- package/dist/nanomind-core/compiler/source-code-preprocessor.d.ts.map +1 -0
- package/dist/nanomind-core/compiler/source-code-preprocessor.js +656 -0
- package/dist/nanomind-core/compiler/source-code-preprocessor.js.map +1 -0
- package/dist/nanomind-core/ingestion/artifact-parser.d.ts.map +1 -1
- package/dist/nanomind-core/ingestion/artifact-parser.js +15 -6
- package/dist/nanomind-core/ingestion/artifact-parser.js.map +1 -1
- package/package.json +3 -1
package/dist/arp/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/arp/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAa,QAAA,OAAO,GAAG,OAAO,CAAC;AA4B/B,uBAAuB;AACvB,sDAAoD;AAA3C,2GAAA,WAAW,OAAA;AACpB,oDAAyD;AAAhD,gHAAA,iBAAiB,OAAA;AAC1B,0DAAqE;AAA5D,sHAAA,uBAAuB,OAAA;AAChC,gDAAyD;AAAhD,0GAAA,gBAAgB,OAAA;AACzB,kDAAyD;AAAhD,0GAAA,eAAe,OAAA;AACxB,0DAAwD;AAA/C,yGAAA,UAAU,OAAA;AACnB,oDAA2H;AAAlH,4GAAA,gBAAgB,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AACzF,8CAAoD;AAA3C,yGAAA,cAAc,OAAA;AACvB,8CAAoD;AAA3C,yGAAA,cAAc,OAAA;AACvB,oDAA0D;AAAjD,+GAAA,iBAAiB,OAAA;AAC1B,gFAAiI;AAAxH,kIAAA,sBAAsB,OAAA;AAAE,mIAAA,uBAAuB,OAAA;AAAE,qIAAA,yBAAyB,OAAA;AAEnF,kDAA4D;AAAnD,6GAAA,kBAAkB,OAAA;AAC3B,kDAA4D;AAAnD,6GAAA,kBAAkB,OAAA;AAC3B,wDAAkE;AAAzD,mHAAA,qBAAqB,OAAA;AAC9B,gDAA0D;AAAjD,2GAAA,iBAAiB,OAAA;AAC1B,4DAAqE;AAA5D,sHAAA,sBAAsB,OAAA;AAC/B,4DAAqE;AAA5D,sHAAA,sBAAsB,OAAA;AAC/B,yDAAkF;AAAzE,gHAAA,iBAAiB,OAAA;AAC1B,mDAAoD;AAA3C,wGAAA,WAAW,OAAA;AACpB,0CAA4D;AAAnD,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AAClC,oDAAkH;AAAzG,sGAAA,QAAQ,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,0GAAA,YAAY,OAAA;AAC7C,yCAA6D;AAApD,kGAAA,QAAQ,OAAA;AACjB,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,mHAAA,wBAAwB,OAAA;AACxB,2GAAA,gBAAgB,OAAA;AAKlB,sBAAsB;AACtB,yCAYqB;AAXnB,0GAAA,aAAa,OAAA;AACb,gHAAA,mBAAmB,OAAA;AACnB,6GAAA,gBAAgB,OAAA;AAChB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,yGAAA,YAAY,OAAA;AAQd,2CAA6B;AAE7B,wDAAoD;AACpD,4DAAqE;AACrE,2DAAkF;AAClF,qDAAoD;AACpD,gDAAoD;AACpD,gDAAoD;AACpD,sDAA0D;AAC1D,oDAA4D;AAC5D,oDAA4D;AAC5D,0DAAkE;AAClE,kDAA0D;AAC1D,8DAAqE;AACrE,8DAAqE;AACrE,4CAA6C;AAC7C,qDAAsD;AACtD,2CAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAa,sBAAsB;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/arp/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAa,QAAA,OAAO,GAAG,OAAO,CAAC;AA4B/B,uBAAuB;AACvB,sDAAoD;AAA3C,2GAAA,WAAW,OAAA;AACpB,oDAAyD;AAAhD,gHAAA,iBAAiB,OAAA;AAC1B,0DAAqE;AAA5D,sHAAA,uBAAuB,OAAA;AAChC,gDAAyD;AAAhD,0GAAA,gBAAgB,OAAA;AACzB,kDAAyD;AAAhD,0GAAA,eAAe,OAAA;AACxB,0DAAwD;AAA/C,yGAAA,UAAU,OAAA;AACnB,oDAA2H;AAAlH,4GAAA,gBAAgB,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AACzF,8CAAoD;AAA3C,yGAAA,cAAc,OAAA;AACvB,8CAAoD;AAA3C,yGAAA,cAAc,OAAA;AACvB,oDAA0D;AAAjD,+GAAA,iBAAiB,OAAA;AAC1B,gFAAiI;AAAxH,kIAAA,sBAAsB,OAAA;AAAE,mIAAA,uBAAuB,OAAA;AAAE,qIAAA,yBAAyB,OAAA;AAEnF,kDAA4D;AAAnD,6GAAA,kBAAkB,OAAA;AAC3B,kDAA4D;AAAnD,6GAAA,kBAAkB,OAAA;AAC3B,wDAAkE;AAAzD,mHAAA,qBAAqB,OAAA;AAC9B,gDAA0D;AAAjD,2GAAA,iBAAiB,OAAA;AAC1B,4DAAqE;AAA5D,sHAAA,sBAAsB,OAAA;AAC/B,4DAAqE;AAA5D,sHAAA,sBAAsB,OAAA;AAC/B,yDAAkF;AAAzE,gHAAA,iBAAiB,OAAA;AAC1B,mDAAoD;AAA3C,wGAAA,WAAW,OAAA;AACpB,0CAA4D;AAAnD,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AAClC,oDAAkH;AAAzG,sGAAA,QAAQ,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,0GAAA,YAAY,OAAA;AAC7C,yCAA6D;AAApD,kGAAA,QAAQ,OAAA;AACjB,qCAOmB;AANjB,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AACV,mHAAA,wBAAwB,OAAA;AACxB,2GAAA,gBAAgB,OAAA;AAKlB,sBAAsB;AACtB,yCAYqB;AAXnB,0GAAA,aAAa,OAAA;AACb,gHAAA,mBAAmB,OAAA;AACnB,6GAAA,gBAAgB,OAAA;AAChB,4GAAA,eAAe,OAAA;AACf,6GAAA,gBAAgB,OAAA;AAChB,yGAAA,YAAY,OAAA;AAQd,2CAA6B;AAE7B,wDAAoD;AACpD,4DAAqE;AACrE,4DAAwD;AACxD,oEAGwC;AACxC,gEAGsC;AACtC,2DAAkF;AAClF,qDAAoD;AACpD,gDAAoD;AACpD,gDAAoD;AACpD,sDAA0D;AAC1D,oDAA4D;AAC5D,oDAA4D;AAC5D,0DAAkE;AAClE,kDAA0D;AAC1D,8DAAqE;AACrE,8DAAqE;AACrE,4CAA6C;AAC7C,qDAAsD;AACtD,2CAAuD;AAEvD;;;;;;;;;;;;;GAaG;AACH,MAAa,sBAAsB;IA2BjC,YAAY,YAAiC;QArB5B,aAAQ,GAAc,EAAE,CAAC;QAClC,kBAAa,GAAyB,IAAI,CAAC;QAC3C,YAAO,GAAG,KAAK,CAAC;QAoBtB,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,GAAG,IAAA,mBAAU,EAAC,YAAY,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,YAAY,IAAI,IAAA,mBAAU,GAAE,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAEnF,IAAI,CAAC,MAAM,GAAG,IAAI,0BAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3C,qEAAqE;QACrE,0DAA0D;QAC1D,mEAAmE;QACnE,iEAAiE;QACjE,kEAAkE;QAClE,kBAAkB;QAClB,IAAI,CAAC,WAAW,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,WAAW;YAC1C,CAAC,CAAC,IAAI,+CAA6B,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC;YAC5E,CAAC,CAAC,IAAI,CAAC;QAET,qEAAqE;QACrE,2DAA2D;QAC3D,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEnD,6DAA6D;QAC7D,iEAAiE;QACjE,oEAAoE;QACpE,oDAAoD;QACpD,IAAI,CAAC,YAAY,GAAG,IAAI,qCAAuB,CAC7C,IAAI,CAAC,MAAM,EACX,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,+BAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,uBAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,gCAAgC;QAChC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7E,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,kCAAkC;QAClC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,wBAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,wBAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,8BAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QACnH,CAAC;QAED,8EAA8E;QAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;QACpC,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,4BAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,4BAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,kCAAqB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpG,CAAC;QAED,+BAA+B;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,0BAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,qCAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,qCAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QACpF,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,IAAA,0BAAmB,GAAE,CAAC;YAC1E,IAAI,CAAC,aAAa,GAAG,IAAI,yBAAa,CAAC;gBACrC,OAAO,EAAE,IAAI;gBACb,WAAW;gBACX,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW;gBACzC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aACnC,CAAC,CAAC;YAEH,4DAA4D;YAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACrC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAEzB,oEAAoE;QACpE,iEAAiE;QACjE,iEAAiE;QACjE,6CAA6C;QAC7C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,qCAAqC;QACrC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAED,oCAAoC;QACpC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,8BAA8B;IAC9B,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,yBAAyB;IACzB,SAAS;QAMP,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9E,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE;YAC3C,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,SAAS,CAAC,KAAc;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,8BAA8B;IAC9B,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,oFAAoF;IACpF,OAAO,CAAC,OAAkD;QACxD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,2CAA2C;IAC3C,aAAa,CAAC,OAA8E;QAC1F,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,wDAAwD;IACxD,gBAAgB,CAAC,QAAuB;QACtC,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAED,qDAAqD;IACrD,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,sDAAsD;IACtD,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,wDAAwD;IACxD,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF;AAlPD,wDAkPC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB,CAAC,MAAiB;IACzC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC;IAC/B,IAAI,EAAE,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,EAAE,EAAE,WAAW,CAAC;IAChC,IAAI,OAAO,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,IAAI,wBAAU,CAAC,MAAM,CAAC,SAAS,EAAE;QACtC,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,OAAO,EAAE,YAAY,IAAI,KAAK;QAC5C,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,SAAS;KACnD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,MAAiB;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,IAAI,oCAAoB,CAAC;QAC9B,QAAQ;QACR,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Behavioral risk IPC server (AIComply P1, producer side).
|
|
3
|
+
*
|
|
4
|
+
* Partner to `behavioral-risk.ts`. Listens on a unix domain socket (or
|
|
5
|
+
* Windows named pipe) and answers risk signal requests by delegating to a
|
|
6
|
+
* caller-supplied `BehavioralRiskScoreable`, which in production is a
|
|
7
|
+
* `NanoMindL1` instance running in the twin's own process.
|
|
8
|
+
*
|
|
9
|
+
* The server is deliberately narrow: one request per connection, no
|
|
10
|
+
* session state, no authentication beyond filesystem permissions on the
|
|
11
|
+
* socket path. The threat model assumes the socket is owned by the same
|
|
12
|
+
* local user and is reachable only from processes with appropriate
|
|
13
|
+
* filesystem access; cross-host or cross-user use is out of scope.
|
|
14
|
+
*
|
|
15
|
+
* Wire format (both directions, newline-delimited JSON):
|
|
16
|
+
*
|
|
17
|
+
* request {"kind":"risk_signal_request","version":1,"event":<ARPEvent>}
|
|
18
|
+
* response {"kind":"risk_signal_response","version":1,"score":...,
|
|
19
|
+
* "action":"allow|alert|throttle|suspend|kill","reason":"...",
|
|
20
|
+
* "source":"...","computedAtMs":...}
|
|
21
|
+
* error {"kind":"risk_signal_error","version":1,"code":<code>,
|
|
22
|
+
* "reason":"..."}
|
|
23
|
+
*
|
|
24
|
+
* Any parse failure, unknown kind, or thrown exception inside the scorer
|
|
25
|
+
* is converted to a structured `risk_signal_error` message. The server
|
|
26
|
+
* never crashes on a malformed request; per-request isolation keeps a
|
|
27
|
+
* bad client from affecting others.
|
|
28
|
+
*/
|
|
29
|
+
import { type BehavioralRiskScoreable, type BehavioralRiskUnavailableCode } from './behavioral-risk';
|
|
30
|
+
/**
|
|
31
|
+
* Options accepted by `startBehavioralRiskServer`. Only `twin` is
|
|
32
|
+
* required; everything else has a defensible default.
|
|
33
|
+
*/
|
|
34
|
+
export interface BehavioralRiskServerOptions {
|
|
35
|
+
/**
|
|
36
|
+
* Handle that knows how to score an ARP event. In production this is a
|
|
37
|
+
* NanoMindL1 instance. In tests it can be any stub that returns a
|
|
38
|
+
* deterministic risk score.
|
|
39
|
+
*/
|
|
40
|
+
twin: BehavioralRiskScoreable;
|
|
41
|
+
/**
|
|
42
|
+
* Filesystem path where the server listens. On POSIX systems, a unix
|
|
43
|
+
* domain socket; on Windows, a named pipe path. Any existing socket
|
|
44
|
+
* file at this path is removed before binding (POSIX only).
|
|
45
|
+
*/
|
|
46
|
+
socketPath: string;
|
|
47
|
+
/**
|
|
48
|
+
* Identifier written back into the `source` field of every response.
|
|
49
|
+
* Helps the coordinator's audit log distinguish between multiple risk
|
|
50
|
+
* sources during A/B rollout.
|
|
51
|
+
*/
|
|
52
|
+
sourceName?: string;
|
|
53
|
+
/**
|
|
54
|
+
* Invoked whenever the server rejects a request with an error response.
|
|
55
|
+
* Gets the code and reason. Useful for routing to a SIEM or surfacing
|
|
56
|
+
* in an operator dashboard. Optional; defaults to a no-op.
|
|
57
|
+
*/
|
|
58
|
+
onError?: (code: BehavioralRiskUnavailableCode, reason: string) => void;
|
|
59
|
+
}
|
|
60
|
+
/**
|
|
61
|
+
* Handle returned by `startBehavioralRiskServer`. Callers hold this for
|
|
62
|
+
* the lifetime of the coordinator and invoke `close()` on shutdown.
|
|
63
|
+
*/
|
|
64
|
+
export interface BehavioralRiskServerHandle {
|
|
65
|
+
/** The listening socket path. */
|
|
66
|
+
readonly socketPath: string;
|
|
67
|
+
/**
|
|
68
|
+
* Stop accepting new connections, tear down the listening socket, and
|
|
69
|
+
* clean up the socket file on POSIX. Safe to call more than once.
|
|
70
|
+
*/
|
|
71
|
+
close(): Promise<void>;
|
|
72
|
+
}
|
|
73
|
+
/**
|
|
74
|
+
* Start the behavioral risk IPC server. Resolves once the server is
|
|
75
|
+
* actively listening on the socket path so the caller can hand the path
|
|
76
|
+
* to clients without a race against a half-open listener.
|
|
77
|
+
*
|
|
78
|
+
* Throws on bind failure (unrecoverable; the caller should decide
|
|
79
|
+
* whether to degrade to an in-process source or fail the startup).
|
|
80
|
+
*/
|
|
81
|
+
export declare function startBehavioralRiskServer(options: BehavioralRiskServerOptions): Promise<BehavioralRiskServerHandle>;
|
|
82
|
+
//# sourceMappingURL=behavioral-risk-server.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"behavioral-risk-server.d.ts","sourceRoot":"","sources":["../../../src/arp/intelligence/behavioral-risk-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAE3B;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,IAAI,EAAE,uBAAuB,CAAC;IAC9B;;;;OAIG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CACzE;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAkGrC"}
|
|
@@ -0,0 +1,258 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
/**
|
|
3
|
+
* Behavioral risk IPC server (AIComply P1, producer side).
|
|
4
|
+
*
|
|
5
|
+
* Partner to `behavioral-risk.ts`. Listens on a unix domain socket (or
|
|
6
|
+
* Windows named pipe) and answers risk signal requests by delegating to a
|
|
7
|
+
* caller-supplied `BehavioralRiskScoreable`, which in production is a
|
|
8
|
+
* `NanoMindL1` instance running in the twin's own process.
|
|
9
|
+
*
|
|
10
|
+
* The server is deliberately narrow: one request per connection, no
|
|
11
|
+
* session state, no authentication beyond filesystem permissions on the
|
|
12
|
+
* socket path. The threat model assumes the socket is owned by the same
|
|
13
|
+
* local user and is reachable only from processes with appropriate
|
|
14
|
+
* filesystem access; cross-host or cross-user use is out of scope.
|
|
15
|
+
*
|
|
16
|
+
* Wire format (both directions, newline-delimited JSON):
|
|
17
|
+
*
|
|
18
|
+
* request {"kind":"risk_signal_request","version":1,"event":<ARPEvent>}
|
|
19
|
+
* response {"kind":"risk_signal_response","version":1,"score":...,
|
|
20
|
+
* "action":"allow|alert|throttle|suspend|kill","reason":"...",
|
|
21
|
+
* "source":"...","computedAtMs":...}
|
|
22
|
+
* error {"kind":"risk_signal_error","version":1,"code":<code>,
|
|
23
|
+
* "reason":"..."}
|
|
24
|
+
*
|
|
25
|
+
* Any parse failure, unknown kind, or thrown exception inside the scorer
|
|
26
|
+
* is converted to a structured `risk_signal_error` message. The server
|
|
27
|
+
* never crashes on a malformed request; per-request isolation keeps a
|
|
28
|
+
* bad client from affecting others.
|
|
29
|
+
*/
|
|
30
|
+
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
|
|
31
|
+
if (k2 === undefined) k2 = k;
|
|
32
|
+
var desc = Object.getOwnPropertyDescriptor(m, k);
|
|
33
|
+
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
|
|
34
|
+
desc = { enumerable: true, get: function() { return m[k]; } };
|
|
35
|
+
}
|
|
36
|
+
Object.defineProperty(o, k2, desc);
|
|
37
|
+
}) : (function(o, m, k, k2) {
|
|
38
|
+
if (k2 === undefined) k2 = k;
|
|
39
|
+
o[k2] = m[k];
|
|
40
|
+
}));
|
|
41
|
+
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
|
|
42
|
+
Object.defineProperty(o, "default", { enumerable: true, value: v });
|
|
43
|
+
}) : function(o, v) {
|
|
44
|
+
o["default"] = v;
|
|
45
|
+
});
|
|
46
|
+
var __importStar = (this && this.__importStar) || (function () {
|
|
47
|
+
var ownKeys = function(o) {
|
|
48
|
+
ownKeys = Object.getOwnPropertyNames || function (o) {
|
|
49
|
+
var ar = [];
|
|
50
|
+
for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
|
|
51
|
+
return ar;
|
|
52
|
+
};
|
|
53
|
+
return ownKeys(o);
|
|
54
|
+
};
|
|
55
|
+
return function (mod) {
|
|
56
|
+
if (mod && mod.__esModule) return mod;
|
|
57
|
+
var result = {};
|
|
58
|
+
if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
|
|
59
|
+
__setModuleDefault(result, mod);
|
|
60
|
+
return result;
|
|
61
|
+
};
|
|
62
|
+
})();
|
|
63
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
64
|
+
exports.startBehavioralRiskServer = startBehavioralRiskServer;
|
|
65
|
+
const net = __importStar(require("net"));
|
|
66
|
+
const fs = __importStar(require("fs"));
|
|
67
|
+
const path = __importStar(require("path"));
|
|
68
|
+
const behavioral_risk_1 = require("./behavioral-risk");
|
|
69
|
+
/**
|
|
70
|
+
* Start the behavioral risk IPC server. Resolves once the server is
|
|
71
|
+
* actively listening on the socket path so the caller can hand the path
|
|
72
|
+
* to clients without a race against a half-open listener.
|
|
73
|
+
*
|
|
74
|
+
* Throws on bind failure (unrecoverable; the caller should decide
|
|
75
|
+
* whether to degrade to an in-process source or fail the startup).
|
|
76
|
+
*/
|
|
77
|
+
async function startBehavioralRiskServer(options) {
|
|
78
|
+
const { twin, socketPath, sourceName = 'nanomind-l1-ipc', onError } = options;
|
|
79
|
+
// On POSIX, a stale socket file from a crashed previous run blocks
|
|
80
|
+
// bind. We remove it defensively. On Windows named pipes, the path is
|
|
81
|
+
// in its own namespace and this step is a no-op.
|
|
82
|
+
if (process.platform !== 'win32') {
|
|
83
|
+
try {
|
|
84
|
+
const dir = path.dirname(socketPath);
|
|
85
|
+
if (!fs.existsSync(dir))
|
|
86
|
+
fs.mkdirSync(dir, { recursive: true });
|
|
87
|
+
if (fs.existsSync(socketPath))
|
|
88
|
+
fs.unlinkSync(socketPath);
|
|
89
|
+
}
|
|
90
|
+
catch {
|
|
91
|
+
// If we cannot clean up the stale file, let listen() surface the
|
|
92
|
+
// real error below.
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
const server = net.createServer((socket) => {
|
|
96
|
+
let buffer = '';
|
|
97
|
+
let handled = false;
|
|
98
|
+
const sendAndClose = (payload) => {
|
|
99
|
+
if (handled)
|
|
100
|
+
return;
|
|
101
|
+
handled = true;
|
|
102
|
+
try {
|
|
103
|
+
socket.write(JSON.stringify(payload) + '\n');
|
|
104
|
+
}
|
|
105
|
+
catch {
|
|
106
|
+
// If the client already hung up, there is nothing useful to do.
|
|
107
|
+
}
|
|
108
|
+
socket.end();
|
|
109
|
+
};
|
|
110
|
+
const sendError = (code, reason) => {
|
|
111
|
+
onError?.(code, reason);
|
|
112
|
+
sendAndClose({
|
|
113
|
+
kind: 'risk_signal_error',
|
|
114
|
+
version: behavioral_risk_1.BEHAVIORAL_RISK_WIRE_VERSION,
|
|
115
|
+
code,
|
|
116
|
+
reason,
|
|
117
|
+
});
|
|
118
|
+
};
|
|
119
|
+
socket.on('data', (chunk) => {
|
|
120
|
+
if (handled)
|
|
121
|
+
return;
|
|
122
|
+
buffer += chunk.toString('utf8');
|
|
123
|
+
const nl = buffer.indexOf('\n');
|
|
124
|
+
if (nl < 0) {
|
|
125
|
+
// Cap unparsed buffer to keep a misbehaving client from
|
|
126
|
+
// exhausting server memory. One request per connection means a
|
|
127
|
+
// single line; anything beyond a reasonable ceiling is hostile.
|
|
128
|
+
if (buffer.length > 64 * 1024) {
|
|
129
|
+
sendError('PARSE_ERROR', 'request exceeded maximum size');
|
|
130
|
+
}
|
|
131
|
+
return;
|
|
132
|
+
}
|
|
133
|
+
const line = buffer.slice(0, nl);
|
|
134
|
+
handleRequest(line, twin, sourceName, sendAndClose, sendError);
|
|
135
|
+
});
|
|
136
|
+
socket.on('error', () => {
|
|
137
|
+
// Drop per-connection errors; nothing to log that the client will
|
|
138
|
+
// see. A wedged client eventually times out.
|
|
139
|
+
});
|
|
140
|
+
});
|
|
141
|
+
server.on('error', (err) => {
|
|
142
|
+
// Per-connection errors bubble up here after a catastrophic failure.
|
|
143
|
+
// We defer to the caller's onError hook so operators can spot
|
|
144
|
+
// repeating listen-level failures.
|
|
145
|
+
onError?.('TRANSPORT_ERROR', `server error: ${err.message}`);
|
|
146
|
+
});
|
|
147
|
+
await new Promise((resolve, reject) => {
|
|
148
|
+
server.once('error', reject);
|
|
149
|
+
server.listen(socketPath, () => {
|
|
150
|
+
server.removeListener('error', reject);
|
|
151
|
+
resolve();
|
|
152
|
+
});
|
|
153
|
+
});
|
|
154
|
+
let closed = false;
|
|
155
|
+
return {
|
|
156
|
+
socketPath,
|
|
157
|
+
close: async () => {
|
|
158
|
+
if (closed)
|
|
159
|
+
return;
|
|
160
|
+
closed = true;
|
|
161
|
+
await new Promise((resolve) => {
|
|
162
|
+
server.close(() => resolve());
|
|
163
|
+
});
|
|
164
|
+
if (process.platform !== 'win32') {
|
|
165
|
+
try {
|
|
166
|
+
if (fs.existsSync(socketPath))
|
|
167
|
+
fs.unlinkSync(socketPath);
|
|
168
|
+
}
|
|
169
|
+
catch {
|
|
170
|
+
// Nothing actionable; the socket file may already be gone.
|
|
171
|
+
}
|
|
172
|
+
}
|
|
173
|
+
},
|
|
174
|
+
};
|
|
175
|
+
}
|
|
176
|
+
/**
|
|
177
|
+
* Parse and dispatch a single request line. Extracted so the connection
|
|
178
|
+
* handler stays readable and so the request path can be unit tested in
|
|
179
|
+
* isolation later if needed. Every failure path resolves to a
|
|
180
|
+
* `risk_signal_error` rather than propagating an exception: the server
|
|
181
|
+
* must never crash on a malformed request.
|
|
182
|
+
*/
|
|
183
|
+
function handleRequest(line, twin, sourceName, sendAndClose, sendError) {
|
|
184
|
+
let msg;
|
|
185
|
+
try {
|
|
186
|
+
msg = JSON.parse(line);
|
|
187
|
+
}
|
|
188
|
+
catch (err) {
|
|
189
|
+
sendError('PARSE_ERROR', `invalid json: ${err.message}`);
|
|
190
|
+
return;
|
|
191
|
+
}
|
|
192
|
+
if (msg === null || typeof msg !== 'object') {
|
|
193
|
+
sendError('PARSE_ERROR', 'request is not a json object');
|
|
194
|
+
return;
|
|
195
|
+
}
|
|
196
|
+
const obj = msg;
|
|
197
|
+
if (obj.version !== behavioral_risk_1.BEHAVIORAL_RISK_WIRE_VERSION) {
|
|
198
|
+
sendError('PARSE_ERROR', `unsupported wire version: ${JSON.stringify(obj.version)}`);
|
|
199
|
+
return;
|
|
200
|
+
}
|
|
201
|
+
if (obj.kind !== 'risk_signal_request') {
|
|
202
|
+
sendError('PARSE_ERROR', `unexpected kind: ${JSON.stringify(obj.kind)}`);
|
|
203
|
+
return;
|
|
204
|
+
}
|
|
205
|
+
const event = obj.event;
|
|
206
|
+
if (!isArpEventLike(event)) {
|
|
207
|
+
sendError('PARSE_ERROR', 'event field is missing required ARPEvent shape');
|
|
208
|
+
return;
|
|
209
|
+
}
|
|
210
|
+
let result;
|
|
211
|
+
try {
|
|
212
|
+
result = twin.scoreARPEvent(event);
|
|
213
|
+
}
|
|
214
|
+
catch (err) {
|
|
215
|
+
sendError('INTERNAL_ERROR', `twin threw: ${err.message ?? String(err)}`);
|
|
216
|
+
return;
|
|
217
|
+
}
|
|
218
|
+
if (result === null) {
|
|
219
|
+
sendError('NOT_READY', 'twin baseline not yet trained');
|
|
220
|
+
return;
|
|
221
|
+
}
|
|
222
|
+
sendAndClose({
|
|
223
|
+
kind: 'risk_signal_response',
|
|
224
|
+
version: behavioral_risk_1.BEHAVIORAL_RISK_WIRE_VERSION,
|
|
225
|
+
score: result.score,
|
|
226
|
+
action: result.action,
|
|
227
|
+
reason: result.reason,
|
|
228
|
+
source: sourceName,
|
|
229
|
+
computedAtMs: Date.now(),
|
|
230
|
+
});
|
|
231
|
+
}
|
|
232
|
+
/**
|
|
233
|
+
* Narrow runtime check for an ARPEvent-shaped request payload. Only
|
|
234
|
+
* validates the fields the twin's scoreARPEvent path actually reads,
|
|
235
|
+
* which is by design: stricter validation would reject valid events
|
|
236
|
+
* whose extra fields the server does not care about.
|
|
237
|
+
*/
|
|
238
|
+
function isArpEventLike(v) {
|
|
239
|
+
if (v === null || typeof v !== 'object')
|
|
240
|
+
return false;
|
|
241
|
+
const e = v;
|
|
242
|
+
if (typeof e.id !== 'string')
|
|
243
|
+
return false;
|
|
244
|
+
if (typeof e.timestamp !== 'string')
|
|
245
|
+
return false;
|
|
246
|
+
if (typeof e.source !== 'string')
|
|
247
|
+
return false;
|
|
248
|
+
if (typeof e.category !== 'string')
|
|
249
|
+
return false;
|
|
250
|
+
if (typeof e.severity !== 'string')
|
|
251
|
+
return false;
|
|
252
|
+
if (typeof e.description !== 'string')
|
|
253
|
+
return false;
|
|
254
|
+
if (e.data === null || typeof e.data !== 'object')
|
|
255
|
+
return false;
|
|
256
|
+
return true;
|
|
257
|
+
}
|
|
258
|
+
//# sourceMappingURL=behavioral-risk-server.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"behavioral-risk-server.js","sourceRoot":"","sources":["../../../src/arp/intelligence/behavioral-risk-server.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiEH,8DAoGC;AAnKD,yCAA2B;AAC3B,uCAAyB;AACzB,2CAA6B;AAE7B,uDAI2B;AA+C3B;;;;;;;GAOG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAoC;IAEpC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,GAAG,iBAAiB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE9E,mEAAmE;IACnE,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,oBAAoB;QACtB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,YAAY,GAAG,CAAC,OAAgC,EAAE,EAAE;YACxD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,CAAC,IAAmC,EAAE,MAAc,EAAE,EAAE;YACxE,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxB,YAAY,CAAC;gBACX,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,8CAA4B;gBACrC,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,IAAI,OAAO;gBAAE,OAAO;YACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACX,wDAAwD;gBACxD,+DAA+D;gBAC/D,gEAAgE;gBAChE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;oBAC9B,SAAS,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,kEAAkE;YAClE,6CAA6C;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,qEAAqE;QACrE,8DAA8D;QAC9D,mCAAmC;QACnC,OAAO,EAAE,CAAC,iBAAiB,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,UAAU;QACV,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;wBAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBAC3D,CAAC;gBAAC,MAAM,CAAC;oBACP,2DAA2D;gBAC7D,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,IAAY,EACZ,IAA6B,EAC7B,UAAkB,EAClB,YAAwD,EACxD,SAAwE;IAExE,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,aAAa,EAAE,iBAAkB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5C,SAAS,CAAC,aAAa,EAAE,8BAA8B,CAAC,CAAC;QACzD,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,IAAI,GAAG,CAAC,OAAO,KAAK,8CAA4B,EAAE,CAAC;QACjD,SAAS,CAAC,aAAa,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;QACvC,SAAS,CAAC,aAAa,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,aAAa,EAAE,gDAAgD,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,SAAS,CAAC,gBAAgB,EAAE,eAAgB,GAAa,CAAC,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,SAAS,CAAC,WAAW,EAAE,+BAA+B,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IACD,YAAY,CAAC;QACX,IAAI,EAAE,sBAAsB;QAC5B,OAAO,EAAE,8CAA4B;QACrC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;KACzB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,CAAU;IAChC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
@@ -0,0 +1,217 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Behavioral risk signal channel (AIComply P1, coordinator hot path).
|
|
3
|
+
*
|
|
4
|
+
* The `IntelligenceCoordinator` needs a way to ask the behavioral twin
|
|
5
|
+
* (`NanoMindL1` in `nanomind-l1.ts`) "how anomalous does this event look
|
|
6
|
+
* against the agent's behavioral baseline?" without importing the twin
|
|
7
|
+
* directly into the comply path. Direct coupling would re-introduce the
|
|
8
|
+
* layering break that the L0-comply gate was added to prevent: the twin
|
|
9
|
+
* would sit inline with the crypto verifier, and a bug in the twin would
|
|
10
|
+
* cascade into every classified event.
|
|
11
|
+
*
|
|
12
|
+
* The solution here is an IPC contract. The coordinator holds a
|
|
13
|
+
* `BehavioralRiskSource` that abstracts transport. Two implementations
|
|
14
|
+
* ship in this module:
|
|
15
|
+
*
|
|
16
|
+
* - `InProcessBehavioralRiskSource` wraps any object that exposes
|
|
17
|
+
* `scoreARPEvent(event)`. This is the single-process fast path: no
|
|
18
|
+
* serialization, no socket, just a direct call guarded by a try/catch.
|
|
19
|
+
* `NanoMindL1` satisfies the interface via its readonly scoreARPEvent
|
|
20
|
+
* method, but tests can inject any stub.
|
|
21
|
+
*
|
|
22
|
+
* - `UnixSocketBehavioralRiskSource` speaks newline-delimited JSON over
|
|
23
|
+
* a unix domain socket (or a Windows named pipe via node `net`). This
|
|
24
|
+
* is the cross-process variant, used when the twin runs in its own
|
|
25
|
+
* daemon to isolate a crashy baseline from the enforcement path.
|
|
26
|
+
*
|
|
27
|
+
* Every caller-visible method is bounded:
|
|
28
|
+
*
|
|
29
|
+
* - `getBehavioralRiskSignal(event, timeoutMs)` enforces a deadline on
|
|
30
|
+
* every call. The unix socket transport destroys the socket on timeout
|
|
31
|
+
* and resolves to `{status: 'unavailable', code: 'TIMEOUT'}`; the
|
|
32
|
+
* in-process source has no IO but still wraps the call in a bounded
|
|
33
|
+
* try/catch so a throwing twin cannot take down the coordinator.
|
|
34
|
+
*
|
|
35
|
+
* - A five-failure circuit breaker opens the unix socket transport for
|
|
36
|
+
* 30 seconds on repeated unavailable outcomes. A wedged IPC source
|
|
37
|
+
* therefore cannot cascade-block the coordinator indefinitely: after
|
|
38
|
+
* the breaker opens, calls resolve instantly with a cached error until
|
|
39
|
+
* cooldown expires.
|
|
40
|
+
*
|
|
41
|
+
* Parse-to-deny (CR-001) is honored on every path: the public surface
|
|
42
|
+
* never throws. Every error branch resolves to a typed
|
|
43
|
+
* `{status: 'unavailable', code, reason}` so the coordinator can route on
|
|
44
|
+
* the code without string scraping. What "deny" means when the twin is
|
|
45
|
+
* unavailable is the coordinator's policy, not this module's: the
|
|
46
|
+
* coordinator records the unavailable signal on `event.data.behavioralRisk`
|
|
47
|
+
* for downstream audit and leaves severity untouched. An IPC outage is
|
|
48
|
+
* not evidence of threat, and raising severity on every event during twin
|
|
49
|
+
* startup would be a regression; security-paranoid deployments can layer
|
|
50
|
+
* a stricter policy on top of the recorded signal.
|
|
51
|
+
*/
|
|
52
|
+
import type { ARPEvent } from '../types';
|
|
53
|
+
/**
|
|
54
|
+
* Shape returned by the twin's on-demand scorer. Mirrors NanoMindL1's
|
|
55
|
+
* internal AnomalyResult so this module does not need to import the twin
|
|
56
|
+
* directly, and so test stubs can produce it without depending on the
|
|
57
|
+
* full NanoMindL1 class surface.
|
|
58
|
+
*/
|
|
59
|
+
export interface BehavioralRiskScore {
|
|
60
|
+
/** Normalized anomaly score in [0, 1]. Higher is riskier. */
|
|
61
|
+
score: number;
|
|
62
|
+
/** Response mapping derived from the score band. */
|
|
63
|
+
action: 'allow' | 'alert' | 'throttle' | 'suspend' | 'kill';
|
|
64
|
+
/** Human-readable reason for the action, safe to log. */
|
|
65
|
+
reason: string;
|
|
66
|
+
}
|
|
67
|
+
/**
|
|
68
|
+
* Minimum interface an in-process twin handle must satisfy to be plugged
|
|
69
|
+
* into `InProcessBehavioralRiskSource`. NanoMindL1.scoreARPEvent matches
|
|
70
|
+
* this shape by construction.
|
|
71
|
+
*/
|
|
72
|
+
export interface BehavioralRiskScoreable {
|
|
73
|
+
scoreARPEvent(event: ARPEvent): BehavioralRiskScore | null;
|
|
74
|
+
}
|
|
75
|
+
/**
|
|
76
|
+
* Ok branch returned to the coordinator when the twin scored the event.
|
|
77
|
+
* The `source` string identifies which twin produced the signal (for
|
|
78
|
+
* audit) and `computedAtMs` is the wall clock at the time of scoring so
|
|
79
|
+
* callers can age out old values if they cache.
|
|
80
|
+
*/
|
|
81
|
+
export interface BehavioralRiskSignal extends BehavioralRiskScore {
|
|
82
|
+
source: string;
|
|
83
|
+
computedAtMs: number;
|
|
84
|
+
}
|
|
85
|
+
/**
|
|
86
|
+
* Discrete error codes on the unavailable branch. Kept as a closed union
|
|
87
|
+
* so the coordinator can route on the code without parsing strings.
|
|
88
|
+
*/
|
|
89
|
+
export type BehavioralRiskUnavailableCode = 'NOT_READY' | 'TIMEOUT' | 'TRANSPORT_ERROR' | 'PARSE_ERROR' | 'CIRCUIT_OPEN' | 'DISABLED' | 'INTERNAL_ERROR';
|
|
90
|
+
/**
|
|
91
|
+
* Discriminated union a caller routes on. The ok branch carries the full
|
|
92
|
+
* signal; the unavailable branch carries a code and a short reason.
|
|
93
|
+
*/
|
|
94
|
+
export type BehavioralRiskResult = {
|
|
95
|
+
status: 'ok';
|
|
96
|
+
signal: BehavioralRiskSignal;
|
|
97
|
+
} | {
|
|
98
|
+
status: 'unavailable';
|
|
99
|
+
code: BehavioralRiskUnavailableCode;
|
|
100
|
+
reason: string;
|
|
101
|
+
};
|
|
102
|
+
/**
|
|
103
|
+
* Abstract transport the coordinator holds. All error paths resolve to an
|
|
104
|
+
* `unavailable` result; `getBehavioralRiskSignal` must never throw and
|
|
105
|
+
* must honor the timeout deadline.
|
|
106
|
+
*/
|
|
107
|
+
export interface BehavioralRiskSource {
|
|
108
|
+
/**
|
|
109
|
+
* Ask the twin for the behavioral risk signal associated with `event`.
|
|
110
|
+
* Must resolve within `timeoutMs`. Must never throw. Must never block
|
|
111
|
+
* the caller beyond the timeout: implementations that wait on IO must
|
|
112
|
+
* tear down any pending work on deadline.
|
|
113
|
+
*/
|
|
114
|
+
getBehavioralRiskSignal(event: ARPEvent, timeoutMs: number): Promise<BehavioralRiskResult>;
|
|
115
|
+
/**
|
|
116
|
+
* Release any transport resources. Coordinator calls this on shutdown.
|
|
117
|
+
* Safe to call repeatedly.
|
|
118
|
+
*/
|
|
119
|
+
close(): Promise<void>;
|
|
120
|
+
}
|
|
121
|
+
/**
|
|
122
|
+
* Default timeout for a single risk signal request. Chosen to keep the
|
|
123
|
+
* comply hot path well under a frame budget even under transport jitter.
|
|
124
|
+
* The in-process source ignores this; the unix socket source enforces it.
|
|
125
|
+
*/
|
|
126
|
+
export declare const DEFAULT_BEHAVIORAL_RISK_TIMEOUT_MS = 25;
|
|
127
|
+
/**
|
|
128
|
+
* Number of consecutive unavailable outcomes that open the circuit
|
|
129
|
+
* breaker on the unix socket source. A wedged twin daemon will hit this
|
|
130
|
+
* after five calls and stop consuming coordinator time.
|
|
131
|
+
*/
|
|
132
|
+
export declare const CIRCUIT_BREAKER_THRESHOLD = 5;
|
|
133
|
+
/**
|
|
134
|
+
* Cooldown before the circuit breaker allows a single probe call to try
|
|
135
|
+
* the transport again. 30 seconds is long enough to absorb transient
|
|
136
|
+
* restarts without burning too many coordinator cycles on probes.
|
|
137
|
+
*/
|
|
138
|
+
export declare const CIRCUIT_BREAKER_COOLDOWN_MS = 30000;
|
|
139
|
+
/**
|
|
140
|
+
* IPC wire format version. Clients and servers both advertise `version: 1`
|
|
141
|
+
* in every message; mismatched versions are treated as PARSE_ERROR rather
|
|
142
|
+
* than silently accepted, so a future protocol change cannot be downgraded.
|
|
143
|
+
*/
|
|
144
|
+
export declare const BEHAVIORAL_RISK_WIRE_VERSION = 1;
|
|
145
|
+
/**
|
|
146
|
+
* Resolve the platform-appropriate default socket path for the behavioral
|
|
147
|
+
* risk server. Unix-like systems get a socket under
|
|
148
|
+
* `~/.opena2a/arp/behavioral-risk-<agentId>.sock`; Windows gets a named
|
|
149
|
+
* pipe in the `\\.\pipe\opena2a-arp-behavioral-risk-<agentId>` namespace.
|
|
150
|
+
* Callers are free to override this.
|
|
151
|
+
*/
|
|
152
|
+
export declare function defaultBehavioralRiskSocketPath(agentId: string): string;
|
|
153
|
+
/**
|
|
154
|
+
* In-process risk source. Wraps a handle that implements
|
|
155
|
+
* `scoreARPEvent`. Intended for single-process deployments where the
|
|
156
|
+
* twin and the coordinator live in the same Node process. Synchronous by
|
|
157
|
+
* construction, so the timeout is only a safety net against a
|
|
158
|
+
* misbehaving twin that throws.
|
|
159
|
+
*
|
|
160
|
+
* Decoupling rationale: the coordinator holds this as a
|
|
161
|
+
* `BehavioralRiskSource`, not as a `NanoMindL1`. The comply path has no
|
|
162
|
+
* knowledge of twin internals and a bug in the twin surfaces as an
|
|
163
|
+
* `unavailable` result, not a cascade failure.
|
|
164
|
+
*/
|
|
165
|
+
export declare class InProcessBehavioralRiskSource implements BehavioralRiskSource {
|
|
166
|
+
private readonly twin;
|
|
167
|
+
private readonly sourceName;
|
|
168
|
+
constructor(twin: BehavioralRiskScoreable, sourceName?: string);
|
|
169
|
+
getBehavioralRiskSignal(event: ARPEvent, _timeoutMs: number): Promise<BehavioralRiskResult>;
|
|
170
|
+
close(): Promise<void>;
|
|
171
|
+
}
|
|
172
|
+
/**
|
|
173
|
+
* Unix-socket (or Windows named pipe) risk source. Opens a fresh
|
|
174
|
+
* connection per request. Rationale: per-request connections keep the
|
|
175
|
+
* transport state machine trivial (no pooling, no reconnection dance) and
|
|
176
|
+
* the request cost is dominated by the twin's scoring latency, not the
|
|
177
|
+
* connect itself. If perf measurement later shows connect-per-request is
|
|
178
|
+
* a bottleneck, a pooled variant can be added without changing the
|
|
179
|
+
* public BehavioralRiskSource interface.
|
|
180
|
+
*
|
|
181
|
+
* Circuit breaker semantics:
|
|
182
|
+
* - After `CIRCUIT_BREAKER_THRESHOLD` consecutive unavailable outcomes,
|
|
183
|
+
* the breaker opens and subsequent calls fast-fail with
|
|
184
|
+
* `CIRCUIT_OPEN` without touching the socket.
|
|
185
|
+
* - After `CIRCUIT_BREAKER_COOLDOWN_MS`, the breaker half-opens: the
|
|
186
|
+
* next call is allowed through. A successful call resets the failure
|
|
187
|
+
* counter and closes the breaker. A failed probe leaves the breaker
|
|
188
|
+
* open and restarts the cooldown.
|
|
189
|
+
*/
|
|
190
|
+
export declare class UnixSocketBehavioralRiskSource implements BehavioralRiskSource {
|
|
191
|
+
private readonly socketPath;
|
|
192
|
+
private readonly sourceName;
|
|
193
|
+
private readonly now;
|
|
194
|
+
private consecutiveFailures;
|
|
195
|
+
private circuitOpen;
|
|
196
|
+
private circuitOpenedAtMs;
|
|
197
|
+
constructor(socketPath: string, options?: {
|
|
198
|
+
sourceName?: string;
|
|
199
|
+
now?: () => number;
|
|
200
|
+
});
|
|
201
|
+
getBehavioralRiskSignal(event: ARPEvent, timeoutMs: number): Promise<BehavioralRiskResult>;
|
|
202
|
+
private roundTrip;
|
|
203
|
+
private parseResponse;
|
|
204
|
+
private recordOutcome;
|
|
205
|
+
/**
|
|
206
|
+
* Test-only accessor for the current breaker state. Exposed so tests
|
|
207
|
+
* can assert breaker opens at the threshold and closes on a successful
|
|
208
|
+
* probe without scraping internals through reflection.
|
|
209
|
+
*/
|
|
210
|
+
_getBreakerStateForTest(): {
|
|
211
|
+
open: boolean;
|
|
212
|
+
failures: number;
|
|
213
|
+
openedAtMs: number;
|
|
214
|
+
};
|
|
215
|
+
close(): Promise<void>;
|
|
216
|
+
}
|
|
217
|
+
//# sourceMappingURL=behavioral-risk.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"behavioral-risk.d.ts","sourceRoot":"","sources":["../../../src/arp/intelligence/behavioral-risk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IAC5D,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,KAAK,EAAE,QAAQ,GAAG,mBAAmB,GAAG,IAAI,CAAC;CAC5D;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,mBAAmB;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,MAAM,6BAA6B,GACrC,WAAW,GACX,SAAS,GACT,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,UAAU,GACV,gBAAgB,CAAC;AAErB;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAC9C;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,6BAA6B,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,uBAAuB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3F;;;OAGG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,YAAW,oBAAoB;IACxE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0B;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,IAAI,EAAE,uBAAuB,EAAE,UAAU,SAAuB;IAKtE,uBAAuB,CAC3B,KAAK,EAAE,QAAQ,EACf,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,oBAAoB,CAAC;IAoC1B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,8BAA+B,YAAW,oBAAoB;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,iBAAiB,CAAK;gBAG5B,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAOrD,uBAAuB,CAC3B,KAAK,EAAE,QAAQ,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC;IAqBhC,OAAO,CAAC,SAAS;IAmFjB,OAAO,CAAC,aAAa;IA2ErB,OAAO,CAAC,aAAa;IAkBrB;;;;OAIG;IACH,uBAAuB,IAAI;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAQ5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
|