handoffprobe 0.1.0

package/dist/attacks/p1/replay.js

@@ -0,0 +1,285 @@
+import { P0_AUTHORIZED_DOWNSTREAM, P0_AUTHORIZED_RESOURCE, P0_AUTHORIZED_TENANT, P0_CALLER, P0_CAPABILITY_UPDATE, P0_PRINCIPAL, createP0ReferenceContext, createP0UpdateInvoiceScenario, } from '../../p0-fixture/index.js';
+const FULL_CHAIN = [P0_PRINCIPAL, P0_CALLER, P0_AUTHORIZED_DOWNSTREAM];
+function projectSources(section) {
+    return [
+        {
+            kind: 'project',
+            title: 'P1 Security Test Specification',
+            locator: `docs/P1_TEST_SPECIFICATION.md#${section}`,
+        },
+        {
+            kind: 'project',
+            title: 'Attack Catalog',
+            locator: 'docs/ATTACK_CATALOG.md#v01-p1--add-after-p0-engine-is-credible',
+        },
+    ];
+}
+function createDefinition(input) {
+    return {
+        id: input.id,
+        name: input.name,
+        category: 'replay',
+        defaultSeverity: 'high',
+        priority: 'P1',
+        preconditions: input.preconditions,
+        mutationSteps: input.mutationSteps,
+        expectedInvariant: input.invariant,
+        evidenceRequirements: input.evidence,
+        applicability: {
+            a2a: ['1.0'],
+            mcp: ['2026-07-28'],
+        },
+        propertyClass: 'composition_responsibility',
+        sourceReferences: projectSources(input.section),
+        sideEffectClass: 'synthetic',
+        destructive: false,
+    };
+}
+function createUpdateContext() {
+    const context = createP0ReferenceContext();
+    if (context.upstreamAuthority === undefined || context.effectiveAuthority === undefined) {
+        throw new Error('P1 replay attacks require authority bindings.');
+    }
+    context.capabilities = [P0_CAPABILITY_UPDATE];
+    context.upstreamAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+    context.effectiveAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+    return context;
+}
+function relevantEvidenceSequences(result) {
+    const names = new Set([
+        'p1.replay.baseline',
+        'p1.replay.first_execution',
+        'p1.retry.acknowledgement_lost',
+        'p1.replay.classify',
+        'p1.replay.blocked',
+        'p1.replay.bypassed',
+        'p1.replay.second_execution',
+        'mcp.tool.call',
+        'mcp.tool.result',
+    ]);
+    return result.evidence.filter((event) => names.has(event.event)).map((event) => event.sequence);
+}
+function evaluateReplay(result, messages) {
+    const output = result.output;
+    const evidenceSequences = relevantEvidenceSequences(result);
+    const firstDelta = output.sideEffectCounterAfterFirst - output.sideEffectCounterBefore;
+    if (!output.baselineExecuted || firstDelta !== 1) {
+        return {
+            status: 'inconclusive',
+            observedBehavior: 'The baseline protected action did not produce exactly one deterministic synthetic side effect.',
+            evidenceSequences,
+        };
+    }
+    const replayDelta = output.sideEffectCounterAfterSecond - output.sideEffectCounterAfterFirst;
+    if (!output.replayExecuted && replayDelta === 0) {
+        return {
+            status: 'pass',
+            observedBehavior: messages.pass,
+            evidenceSequences,
+        };
+    }
+    if (output.replayExecuted && replayDelta === 1) {
+        return {
+            status: 'fail',
+            observedBehavior: messages.fail,
+            evidenceSequences,
+        };
+    }
+    return {
+        status: 'inconclusive',
+        observedBehavior: 'Replay execution and synthetic side-effect evidence could not establish a deterministic PASS or FAIL.',
+        evidenceSequences,
+    };
+}
+const REPLAY_001_DEFINITION = createDefinition({
+    id: 'HP-REPLAY-001',
+    name: 'Exact action replay',
+    preconditions: [
+        'A protected logical action executes once successfully.',
+        'Its authority is marked single-use.',
+        'The translated action can be replayed with the same logical action identity.',
+    ],
+    mutationSteps: [
+        'Execute action:ACT-1001 once.',
+        'Record authority consumption and the first protected side effect.',
+        'Replay the identical logical action using a second execution attempt.',
+    ],
+    invariant: 'A single-use protected logical action must not produce a second protected side effect when replayed.',
+    evidence: [
+        'logical action ID',
+        'first attempt ID',
+        'replay attempt ID',
+        'delegation ID',
+        'consumption state',
+        'side-effect counter before',
+        'side-effect counter after first execution',
+        'side-effect counter after replay',
+    ],
+    section: 'hp-replay-001--exact-action-replay',
+});
+const REPLAY_002_DEFINITION = createDefinition({
+    id: 'HP-REPLAY-002',
+    name: 'Cross-context / cross-run replay',
+    preconditions: [
+        'Authority is explicitly bound to task:P1-TASK-A and run:P1-RUN-A.',
+        'The original context can execute the protected action.',
+    ],
+    mutationSteps: [
+        'Capture the authority associated with the original task and run.',
+        'Reuse it under task:P1-TASK-B and run:P1-RUN-B without issuing a new grant.',
+        'Attempt the protected action in the new context.',
+    ],
+    invariant: 'Authority bound to one explicit task/run context must not automatically authorize another task/run context.',
+    evidence: [
+        'original task and run',
+        'replay task and run',
+        'delegation ID',
+        'task/run binding decision',
+        'authorization result',
+        'protected side effect',
+    ],
+    section: 'hp-replay-002--cross-context--cross-run-replay',
+});
+const REPLAY_003_DEFINITION = createDefinition({
+    id: 'HP-REPLAY-003',
+    name: 'Retry double execution',
+    preconditions: [
+        'One logical protected action can have multiple execution attempts.',
+        'The first attempt executes but its synthetic acknowledgement is lost.',
+    ],
+    mutationSteps: [
+        'Execute attempt:ATT-1 for action:ACT-RETRY-1001.',
+        'Simulate loss of the acknowledgement after the side effect occurred.',
+        'Send attempt:ATT-2 as a retry for the same logical action.',
+    ],
+    invariant: 'A retry representing the same logical protected action must not produce a second protected side effect.',
+    evidence: [
+        'logical action ID',
+        'attempt:ATT-1',
+        'attempt:ATT-2',
+        'acknowledgement ambiguity',
+        'retry classification',
+        'action completion state',
+        'side-effect counter before and after each attempt',
+    ],
+    section: 'hp-replay-003--retry-double-execution',
+});
+const REPLAY_001_CASE = {
+    definition: REPLAY_001_DEFINITION,
+    evaluate(result) {
+        return evaluateReplay(result, {
+            pass: 'The exact replay was rejected after the single-use action was consumed, so no second synthetic side effect occurred.',
+            fail: 'The exact same consumed logical action executed again and produced a second protected synthetic side effect.',
+        });
+    },
+};
+const REPLAY_002_CASE = {
+    definition: REPLAY_002_DEFINITION,
+    evaluate(result) {
+        return evaluateReplay(result, {
+            pass: 'Authority captured from task/run A was rejected when replayed under task/run B.',
+            fail: 'Authority captured from task/run A was accepted under task/run B and produced another protected synthetic side effect.',
+        });
+    },
+};
+const REPLAY_003_CASE = {
+    definition: REPLAY_003_DEFINITION,
+    evaluate(result) {
+        return evaluateReplay(result, {
+            pass: 'The retry was recognized as the same completed logical action and did not create a second synthetic side effect.',
+            fail: 'The retry was treated as a new execution and produced a duplicate protected synthetic side effect.',
+        });
+    },
+};
+function createDelegation(input) {
+    return {
+        id: input.id,
+        principal: P0_PRINCIPAL,
+        delegate: P0_AUTHORIZED_DOWNSTREAM,
+        tenant: P0_AUTHORIZED_TENANT,
+        resources: [P0_AUTHORIZED_RESOURCE],
+        capabilities: [P0_CAPABILITY_UPDATE],
+        chain: [...FULL_CHAIN],
+        taskId: 'task:P1-TASK-A',
+        runId: 'run:P1-RUN-A',
+        issuedAt: 10,
+        expiresAt: 30,
+        singleUse: input.singleUse,
+    };
+}
+function createRequest(taskId, runId) {
+    return {
+        principal: P0_PRINCIPAL,
+        delegate: P0_AUTHORIZED_DOWNSTREAM,
+        tenant: P0_AUTHORIZED_TENANT,
+        resource: P0_AUTHORIZED_RESOURCE,
+        capability: P0_CAPABILITY_UPDATE,
+        taskId,
+        runId,
+        requiredChain: FULL_CHAIN,
+    };
+}
+export const HP_REPLAY_001 = {
+    attack: REPLAY_001_CASE,
+    scenario: {
+        id: 'exact-action-replay',
+        kind: 'exact-action-replay',
+        actionId: 'action:ACT-1001',
+        firstAttemptId: 'attempt:ATT-1',
+        secondAttemptId: 'attempt:ATT-2',
+        delegation: createDelegation({
+            id: 'delegation:DEL-REPLAY-1001',
+            singleUse: true,
+        }),
+        baselineRequest: createRequest('task:P1-TASK-A', 'run:P1-RUN-A'),
+        replayRequest: createRequest('task:P1-TASK-A', 'run:P1-RUN-A'),
+        logicalTime: 15,
+        p0Scenario: createP0UpdateInvoiceScenario(24101),
+    },
+    createContext: createUpdateContext,
+};
+export const HP_REPLAY_002 = {
+    attack: REPLAY_002_CASE,
+    scenario: {
+        id: 'cross-context-replay',
+        kind: 'cross-context-replay',
+        actionId: 'action:ACT-CONTEXT-1001',
+        firstAttemptId: 'attempt:ATT-1',
+        secondAttemptId: 'attempt:ATT-2',
+        delegation: createDelegation({
+            id: 'delegation:DEL-REPLAY-1002',
+            singleUse: false,
+        }),
+        baselineRequest: createRequest('task:P1-TASK-A', 'run:P1-RUN-A'),
+        replayRequest: createRequest('task:P1-TASK-B', 'run:P1-RUN-B'),
+        logicalTime: 15,
+        p0Scenario: createP0UpdateInvoiceScenario(24102),
+    },
+    createContext: createUpdateContext,
+};
+export const HP_REPLAY_003 = {
+    attack: REPLAY_003_CASE,
+    scenario: {
+        id: 'retry-double-execution',
+        kind: 'retry-double-execution',
+        actionId: 'action:ACT-RETRY-1001',
+        firstAttemptId: 'attempt:ATT-1',
+        secondAttemptId: 'attempt:ATT-2',
+        delegation: createDelegation({
+            id: 'delegation:DEL-REPLAY-1003',
+            singleUse: false,
+        }),
+        baselineRequest: createRequest('task:P1-TASK-A', 'run:P1-RUN-A'),
+        replayRequest: createRequest('task:P1-TASK-A', 'run:P1-RUN-A'),
+        logicalTime: 15,
+        acknowledgementAmbiguity: true,
+        p0Scenario: createP0UpdateInvoiceScenario(24103),
+    },
+    createContext: createUpdateContext,
+};
+export const P1_REPLAY_ATTACKS = [
+    HP_REPLAY_001,
+    HP_REPLAY_002,
+    HP_REPLAY_003,
+];
+//# sourceMappingURL=replay.js.map

package/dist/attacks/p1/replay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.js","sourceRoot":"","sources":["../../../src/attacks/p1/replay.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAMnC,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,wBAAwB,CAAU,CAAC;AAEhF,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO;QACL;YACE,IAAI,EAAE,SAAkB;YAExB,KAAK,EAAE,gCAAgC;YAEvC,OAAO,EAAE,iCAAiC,OAAO,EAAE;SACpD;QAED;YACE,IAAI,EAAE,SAAkB;YAExB,KAAK,EAAE,gBAAgB;YAEvB,OAAO,EAAE,gEAAgE;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAczB;IACC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QAEZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAEhB,QAAQ,EAAE,QAAQ;QAElB,eAAe,EAAE,MAAM;QAEvB,QAAQ,EAAE,IAAI;QAEd,aAAa,EAAE,KAAK,CAAC,aAAa;QAElC,aAAa,EAAE,KAAK,CAAC,aAAa;QAElC,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAElC,oBAAoB,EAAE,KAAK,CAAC,QAAQ;QAEpC,aAAa,EAAE;YACb,GAAG,EAAE,CAAC,KAAK,CAAC;YAEZ,GAAG,EAAE,CAAC,YAAY,CAAC;SACpB;QAED,aAAa,EAAE,4BAA4B;QAE3C,gBAAgB,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAE/C,eAAe,EAAE,WAAW;QAE5B,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAE3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE9C,OAAO,CAAC,iBAAiB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEhE,OAAO,CAAC,kBAAkB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA6B;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;QACpB,oBAAoB;QAEpB,2BAA2B;QAE3B,+BAA+B;QAE/B,oBAAoB;QAEpB,mBAAmB;QAEnB,oBAAoB;QAEpB,4BAA4B;QAE5B,eAAe;QAEf,iBAAiB;KAClB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CACrB,MAA6B,EAC7B,QAIC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAA8B,CAAC;IAErD,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,MAAM,CAAC,2BAA2B,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAEvF,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,cAAc;YAEtB,gBAAgB,EACd,gGAAgG;YAElG,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,4BAA4B,GAAG,MAAM,CAAC,2BAA2B,CAAC;IAE7F,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,MAAM,EAAE,MAAM;YAEd,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAE/B,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,MAAM,EAAE,MAAM;YAEd,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAE/B,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc;QAEtB,gBAAgB,EACd,uGAAuG;QAEzG,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;IAC7C,EAAE,EAAE,eAAe;IAEnB,IAAI,EAAE,qBAAqB;IAE3B,aAAa,EAAE;QACb,wDAAwD;QAExD,qCAAqC;QAErC,8EAA8E;KAC/E;IAED,aAAa,EAAE;QACb,+BAA+B;QAE/B,mEAAmE;QAEnE,uEAAuE;KACxE;IAED,SAAS,EACP,sGAAsG;IAExG,QAAQ,EAAE;QACR,mBAAmB;QAEnB,kBAAkB;QAElB,mBAAmB;QAEnB,eAAe;QAEf,mBAAmB;QAEnB,4BAA4B;QAE5B,2CAA2C;QAE3C,kCAAkC;KACnC;IAED,OAAO,EAAE,oCAAoC;CAC9C,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;IAC7C,EAAE,EAAE,eAAe;IAEnB,IAAI,EAAE,kCAAkC;IAExC,aAAa,EAAE;QACb,mEAAmE;QAEnE,wDAAwD;KACzD;IAED,aAAa,EAAE;QACb,kEAAkE;QAElE,6EAA6E;QAE7E,kDAAkD;KACnD;IAED,SAAS,EACP,6GAA6G;IAE/G,QAAQ,EAAE;QACR,uBAAuB;QAEvB,qBAAqB;QAErB,eAAe;QAEf,2BAA2B;QAE3B,sBAAsB;QAEtB,uBAAuB;KACxB;IAED,OAAO,EAAE,gDAAgD;CAC1D,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;IAC7C,EAAE,EAAE,eAAe;IAEnB,IAAI,EAAE,wBAAwB;IAE9B,aAAa,EAAE;QACb,oEAAoE;QAEpE,uEAAuE;KACxE;IAED,aAAa,EAAE;QACb,kDAAkD;QAElD,sEAAsE;QAEtE,4DAA4D;KAC7D;IAED,SAAS,EACP,yGAAyG;IAE3G,QAAQ,EAAE;QACR,mBAAmB;QAEnB,eAAe;QAEf,eAAe;QAEf,2BAA2B;QAE3B,sBAAsB;QAEtB,yBAAyB;QAEzB,mDAAmD;KACpD;IAED,OAAO,EAAE,uCAAuC;CACjD,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACtB,UAAU,EAAE,qBAAqB;IAEjC,QAAQ,CAAC,MAA6B;QACpC,OAAO,cAAc,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,sHAAsH;YAE5H,IAAI,EAAE,8GAA8G;SACrH,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,UAAU,EAAE,qBAAqB;IAEjC,QAAQ,CAAC,MAA6B;QACpC,OAAO,cAAc,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,iFAAiF;YAEvF,IAAI,EAAE,wHAAwH;SAC/H,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,UAAU,EAAE,qBAAqB;IAEjC,QAAQ,CAAC,MAA6B;QACpC,OAAO,cAAc,CAAC,MAAM,EAAE;YAC5B,IAAI,EAAE,kHAAkH;YAExH,IAAI,EAAE,oGAAoG;SAC3G,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAIzB;IACC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QAEZ,SAAS,EAAE,YAAY;QAEvB,QAAQ,EAAE,wBAAwB;QAElC,MAAM,EAAE,oBAAoB;QAE5B,SAAS,EAAE,CAAC,sBAAsB,CAAC;QAEnC,YAAY,EAAE,CAAC,oBAAoB,CAAC;QAEpC,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC;QAEtB,MAAM,EAAE,gBAAgB;QAExB,KAAK,EAAE,cAAc;QAErB,QAAQ,EAAE,EAAE;QAEZ,SAAS,EAAE,EAAE;QAEb,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,MAA2C,EAE3C,KAAsC;IAEtC,OAAO;QACL,SAAS,EAAE,YAAY;QAEvB,QAAQ,EAAE,wBAAwB;QAElC,MAAM,EAAE,oBAAoB;QAE5B,QAAQ,EAAE,sBAAsB;QAEhC,UAAU,EAAE,oBAAoB;QAEhC,MAAM;QAEN,KAAK;QAEL,aAAa,EAAE,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAuB;IAC/C,MAAM,EAAE,eAAe;IAEvB,QAAQ,EAAE;QACR,EAAE,EAAE,qBAAqB;QAEzB,IAAI,EAAE,qBAAqB;QAE3B,QAAQ,EAAE,iBAAiB;QAE3B,cAAc,EAAE,eAAe;QAE/B,eAAe,EAAE,eAAe;QAEhC,UAAU,EAAE,gBAAgB,CAAC;YAC3B,EAAE,EAAE,4BAA4B;YAEhC,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,eAAe,EAAE,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAEhE,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAE9D,WAAW,EAAE,EAAE;QAEf,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;KACjD;IAED,aAAa,EAAE,mBAAmB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAuB;IAC/C,MAAM,EAAE,eAAe;IAEvB,QAAQ,EAAE;QACR,EAAE,EAAE,sBAAsB;QAE1B,IAAI,EAAE,sBAAsB;QAE5B,QAAQ,EAAE,yBAAyB;QAEnC,cAAc,EAAE,eAAe;QAE/B,eAAe,EAAE,eAAe;QAEhC,UAAU,EAAE,gBAAgB,CAAC;YAC3B,EAAE,EAAE,4BAA4B;YAEhC,SAAS,EAAE,KAAK;SACjB,CAAC;QAEF,eAAe,EAAE,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAEhE,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAE9D,WAAW,EAAE,EAAE;QAEf,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;KACjD;IAED,aAAa,EAAE,mBAAmB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAuB;IAC/C,MAAM,EAAE,eAAe;IAEvB,QAAQ,EAAE;QACR,EAAE,EAAE,wBAAwB;QAE5B,IAAI,EAAE,wBAAwB;QAE9B,QAAQ,EAAE,uBAAuB;QAEjC,cAAc,EAAE,eAAe;QAE/B,eAAe,EAAE,eAAe;QAEhC,UAAU,EAAE,gBAAgB,CAAC;YAC3B,EAAE,EAAE,4BAA4B;YAEhC,SAAS,EAAE,KAAK;SACjB,CAAC;QAEF,eAAe,EAAE,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAEhE,aAAa,EAAE,aAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAE9D,WAAW,EAAE,EAAE;QAEf,wBAAwB,EAAE,IAAI;QAE9B,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;KACjD;IAED,aAAa,EAAE,mBAAmB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,aAAa;IACb,aAAa;IACb,aAAa;CACd,CAAC"}

package/dist/attacks/p1/types.d.ts

@@ -0,0 +1,28 @@
+import type { AttackCase, SecurityContext } from '../../core/index.js';
+import type { P1ApprovalScenario, P1AuditScenario, P1AuthorizationScenario, P1RaceScenario, P1ReplayScenario } from '../../p1-fixture/index.js';
+export interface P1AttackPlan {
+    attack: AttackCase;
+    scenario: P1AuthorizationScenario;
+    createContext(): SecurityContext;
+}
+export interface P1ReplayAttackPlan {
+    attack: AttackCase;
+    scenario: P1ReplayScenario;
+    createContext(): SecurityContext;
+}
+export interface P1ApprovalAttackPlan {
+    attack: AttackCase;
+    scenario: P1ApprovalScenario;
+    createContext(): SecurityContext;
+}
+export interface P1RaceAttackPlan {
+    attack: AttackCase;
+    scenario: P1RaceScenario;
+    createContext(): SecurityContext;
+}
+export interface P1AuditAttackPlan {
+    attack: AttackCase;
+    scenario: P1AuditScenario;
+    createContext(): SecurityContext;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/attacks/p1/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/attacks/p1/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EACjB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,uBAAuB,CAAC;IAClC,aAAa,IAAI,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,aAAa,IAAI,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,aAAa,IAAI,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,IAAI,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,aAAa,IAAI,eAAe,CAAC;CAClC"}

package/dist/attacks/p1/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/attacks/p1/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/attacks/p1/types.ts"],"names":[],"mappings":""}

package/dist/cli/config.d.ts

@@ -0,0 +1,15 @@
+import type { FindingSeverity } from '../core/index.js';
+import type { CliTargetFixture } from './execution-catalog.js';
+export type CliFailOn = FindingSeverity;
+export type CliReporter = 'terminal' | 'json' | 'markdown';
+export interface HandoffProbeConfig {
+    target?: CliTargetFixture;
+    tests?: readonly string[];
+    failOn?: CliFailOn;
+    reporter?: CliReporter;
+    output?: string;
+}
+export declare const DEFAULT_FAIL_ON: CliFailOn;
+export declare function parseHandoffProbeConfig(value: unknown): HandoffProbeConfig;
+export declare function loadHandoffProbeConfig(cwd: string): Promise<HandoffProbeConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/cli/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,MAAM,SAAS,GAAG,eAAe,CAAC;AACxC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,eAAe,EAAE,SAAkB,CAAC;AAoEjD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAsC1E;AAED,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAwBrF"}

package/dist/cli/config.js

@@ -0,0 +1,100 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export const DEFAULT_FAIL_ON = 'high';
+const CONFIG_FILENAME = 'handoffprobe.config.json';
+const ALLOWED_KEYS = new Set(['target', 'tests', 'failOn', 'reporter', 'output']);
+const FAIL_ON_VALUES = ['info', 'low', 'medium', 'high', 'critical'];
+const REPORTERS = ['terminal', 'json', 'markdown'];
+function configError(message) {
+    return new Error(`${CONFIG_FILENAME}: ${message}`);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseTarget(value) {
+    if (value === 'secure' || value === 'vulnerable') {
+        return value;
+    }
+    throw configError('"target" must be "secure" or "vulnerable".');
+}
+function parseTests(value) {
+    if (!Array.isArray(value)) {
+        throw configError('"tests" must be an array of non-empty HP-ID strings.');
+    }
+    const tests = [];
+    for (const item of value) {
+        if (typeof item !== 'string' || item.trim().length === 0) {
+            throw configError('"tests" must be an array of non-empty HP-ID strings.');
+        }
+        tests.push(item);
+    }
+    return tests;
+}
+function parseFailOn(value) {
+    if (typeof value === 'string' && FAIL_ON_VALUES.includes(value)) {
+        return value;
+    }
+    throw configError('"failOn" must be info, low, medium, high, or critical.');
+}
+function parseReporter(value) {
+    if (typeof value === 'string' && REPORTERS.includes(value)) {
+        return value;
+    }
+    throw configError('"reporter" must be terminal, json, or markdown.');
+}
+function parseOutput(value) {
+    if (typeof value === 'string' && value.trim().length > 0) {
+        return value;
+    }
+    throw configError('"output" must be a non-empty string.');
+}
+export function parseHandoffProbeConfig(value) {
+    if (!isRecord(value)) {
+        throw configError('top-level value must be a JSON object.');
+    }
+    const unknownKeys = Object.keys(value)
+        .filter((key) => !ALLOWED_KEYS.has(key))
+        .sort();
+    if (unknownKeys.length > 0) {
+        throw configError(`unknown key${unknownKeys.length === 1 ? '' : 's'}: ${unknownKeys.join(', ')}.`);
+    }
+    const config = {};
+    if (value.target !== undefined) {
+        config.target = parseTarget(value.target);
+    }
+    if (value.tests !== undefined) {
+        config.tests = parseTests(value.tests);
+    }
+    if (value.failOn !== undefined) {
+        config.failOn = parseFailOn(value.failOn);
+    }
+    if (value.reporter !== undefined) {
+        config.reporter = parseReporter(value.reporter);
+    }
+    if (value.output !== undefined) {
+        config.output = parseOutput(value.output);
+    }
+    return config;
+}
+export async function loadHandoffProbeConfig(cwd) {
+    const path = join(cwd, CONFIG_FILENAME);
+    let source;
+    try {
+        source = await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return {};
+        }
+        throw configError('could not be read.');
+    }
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        throw configError('contains invalid JSON.');
+    }
+    return parseHandoffProbeConfig(value);
+}
+//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAiBjC,MAAM,CAAC,MAAM,eAAe,GAAc,MAAM,CAAC;AAEjD,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;AAElF,MAAM,cAAc,GAAyB,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAE3F,MAAM,SAAS,GAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAE3E,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAI,KAAK,CAAC,GAAG,eAAe,KAAK,OAAO,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,CAAC,4CAA4C,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,WAAW,CAAC,sDAAsD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,KAAkB,EAAE,CAAC;QACtC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,WAAW,CAAC,sDAAsD,CAAC,CAAC;QAC5E,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,CAAC,KAAkB,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAkB,CAAC;IAC5B,CAAC;IAED,MAAM,WAAW,CAAC,wDAAwD,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAoB,CAAC,EAAE,CAAC;QAC1E,OAAO,KAAoB,CAAC;IAC9B,CAAC;IAED,MAAM,WAAW,CAAC,iDAAiD,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,WAAW,CAAC,sCAAsC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,WAAW,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACnC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SACvC,IAAI,EAAE,CAAC;IAEV,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,WAAW,CACf,cAAc,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAW;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAExC,IAAI,MAAc,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,KAAc,CAAC;IAEnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,WAAW,CAAC,wBAAwB,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC"}

package/dist/cli/diagnostics.d.ts

@@ -0,0 +1,4 @@
+export type CliRuntimeFailureKind = 'scanner' | 'output';
+export declare function sanitizeCliLine(value: string): string;
+export declare function renderCliRuntimeDiagnostic(kind: CliRuntimeFailureKind, error: unknown): readonly string[];
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/cli/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../src/cli/diagnostics.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEzD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,OAAO,GACb,SAAS,MAAM,EAAE,CAmBnB"}

package/dist/cli/diagnostics.js

@@ -0,0 +1,23 @@
+import { HandoffProbeCoreError, redactText } from '../core/index.js';
+export function sanitizeCliLine(value) {
+    return redactText(value).replace(/[\r\n]+/g, ' ');
+}
+export function renderCliRuntimeDiagnostic(kind, error) {
+    if (kind === 'output') {
+        return [
+            'HandoffProbe: output write failure.',
+            'Troubleshooting: check that the output parent directory exists and is writable.',
+        ];
+    }
+    if (error instanceof HandoffProbeCoreError) {
+        return [
+            `HandoffProbe: scanner runtime failure (${error.code} at ${sanitizeCliLine(error.stage)}).`,
+            'Troubleshooting: verify the selected target/adapter and rerun the same command.',
+        ];
+    }
+    return [
+        'HandoffProbe: scanner runtime failure.',
+        'Troubleshooting: rerun the same command; if it repeats, report the command and HandoffProbe version.',
+    ];
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/cli/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/cli/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAIrE,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,IAA2B,EAC3B,KAAc;IAEd,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,qCAAqC;YACrC,iFAAiF;SAClF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC3C,OAAO;YACL,0CAA0C,KAAK,CAAC,IAAI,OAAO,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3F,iFAAiF;SAClF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,wCAAwC;QACxC,sGAAsG;KACvG,CAAC;AACJ,CAAC"}

package/dist/cli/discovery.d.ts

@@ -0,0 +1,3 @@
+export declare function renderAttackList(): string;
+export declare function renderAttackExplanation(id: string): string | undefined;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/cli/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/cli/discovery.ts"],"names":[],"mappings":"AAwBA,wBAAgB,gBAAgB,IAAI,MAAM,CAoCzC;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsCtE"}

package/dist/cli/discovery.js

@@ -0,0 +1,75 @@
+import { CLI_EXECUTION_CATALOG, getCliExecutionBinding } from './execution-catalog.js';
+function upper(value) {
+    return value.toUpperCase();
+}
+function numbered(values) {
+    return values.map((value, index) => `  ${index + 1}. ${value}`);
+}
+function bullets(values) {
+    return values.map((value) => `  - ${value}`);
+}
+function renderSource(definition) {
+    return definition.sourceReferences.map((source) => {
+        const version = source.version === undefined ? '' : ` (${source.version})`;
+        return `  - [${source.kind}] ${source.title}${version} — ${source.locator}`;
+    });
+}
+export function renderAttackList() {
+    const definitions = CLI_EXECUTION_CATALOG.map((binding) => binding.definition);
+    const idWidth = Math.max('ID'.length, ...definitions.map((definition) => definition.id.length));
+    const priorityWidth = Math.max('PRIORITY'.length, ...definitions.map((definition) => definition.priority.length));
+    const severityWidth = Math.max('SEVERITY'.length, ...definitions.map((definition) => definition.defaultSeverity.length));
+    const categoryWidth = Math.max('CATEGORY'.length, ...definitions.map((definition) => definition.category.length));
+    const header = [
+        'ID'.padEnd(idWidth),
+        'PRIORITY'.padEnd(priorityWidth),
+        'SEVERITY'.padEnd(severityWidth),
+        'CATEGORY'.padEnd(categoryWidth),
+        'NAME',
+    ].join('  ');
+    const rows = definitions.map((definition) => [
+        definition.id.padEnd(idWidth),
+        definition.priority.padEnd(priorityWidth),
+        upper(definition.defaultSeverity).padEnd(severityWidth),
+        definition.category.padEnd(categoryWidth),
+        definition.name,
+    ].join('  '));
+    return [`HandoffProbe attacks (${definitions.length})`, '', header, ...rows].join('\n');
+}
+export function renderAttackExplanation(id) {
+    const binding = getCliExecutionBinding(id);
+    if (binding === undefined) {
+        return undefined;
+    }
+    const definition = binding.definition;
+    return [
+        `${definition.id} — ${definition.name}`,
+        '',
+        `Priority: ${definition.priority}`,
+        `Severity: ${upper(definition.defaultSeverity)}`,
+        `Category: ${definition.category}`,
+        `Property class: ${definition.propertyClass}`,
+        `Side effects: ${definition.sideEffectClass}`,
+        `Destructive: ${definition.destructive ? 'yes' : 'no'}`,
+        '',
+        'Protocols:',
+        `  A2A: ${definition.applicability.a2a.join(', ') || 'not applicable'}`,
+        `  MCP: ${definition.applicability.mcp.join(', ') || 'not applicable'}`,
+        '',
+        'Expected invariant:',
+        `  ${definition.expectedInvariant}`,
+        '',
+        'Preconditions:',
+        ...numbered(definition.preconditions),
+        '',
+        'Mutation steps:',
+        ...numbered(definition.mutationSteps),
+        '',
+        'Required evidence:',
+        ...bullets(definition.evidenceRequirements),
+        '',
+        'Sources:',
+        ...renderSource(definition),
+    ].join('\n');
+}
+//# sourceMappingURL=discovery.js.map

package/dist/cli/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/cli/discovery.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEvF,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,MAAyB;IACzC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,OAAO,CAAC,MAAyB;IACxC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,UAA4B;IAChD,OAAO,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,GAAG,CAAC;QAE3E,OAAO,QAAQ,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,GAAG,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAE/E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAChG,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,UAAU,CAAC,MAAM,EACjB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/D,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,UAAU,CAAC,MAAM,EACjB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CACtE,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,UAAU,CAAC,MAAM,EACjB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/D,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QACpB,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC;QAChC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC;QAChC,UAAU,CAAC,MAAM,CAAC,aAAa,CAAC;QAChC,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C;QACE,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC;QACzC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QACvD,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC;QACzC,UAAU,CAAC,IAAI;KAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEF,OAAO,CAAC,yBAAyB,WAAW,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAU;IAChD,MAAM,OAAO,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAE3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAEtC,OAAO;QACL,GAAG,UAAU,CAAC,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE;QACvC,EAAE;QACF,aAAa,UAAU,CAAC,QAAQ,EAAE;QAClC,aAAa,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;QAChD,aAAa,UAAU,CAAC,QAAQ,EAAE;QAClC,mBAAmB,UAAU,CAAC,aAAa,EAAE;QAC7C,iBAAiB,UAAU,CAAC,eAAe,EAAE;QAC7C,gBAAgB,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QACvD,EAAE;QACF,YAAY;QACZ,UAAU,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,EAAE;QACvE,UAAU,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,EAAE;QACvE,EAAE;QACF,qBAAqB;QACrB,KAAK,UAAU,CAAC,iBAAiB,EAAE;QACnC,EAAE;QACF,gBAAgB;QAChB,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;QACrC,EAAE;QACF,iBAAiB;QACjB,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;QACrC,EAAE;QACF,oBAAoB;QACpB,GAAG,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAC3C,EAAE;QACF,UAAU;QACV,GAAG,YAAY,CAAC,UAAU,CAAC;KAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/cli/execution-catalog.d.ts

@@ -0,0 +1,12 @@
+import type { AttackCase, AttackDefinition, SecurityContext, TargetAdapter } from '../core/index.js';
+export type CliTargetFixture = 'secure' | 'vulnerable';
+export interface CliExecutionBinding {
+    readonly attack: AttackCase;
+    readonly definition: AttackDefinition;
+    createContext(): SecurityContext;
+    createTarget(fixture: CliTargetFixture): TargetAdapter;
+}
+export declare const CLI_EXECUTION_CATALOG: readonly CliExecutionBinding[];
+export declare const CLI_EXECUTION_CATALOG_BY_ID: ReadonlyMap<string, CliExecutionBinding>;
+export declare function getCliExecutionBinding(id: string): CliExecutionBinding | undefined;
+//# sourceMappingURL=execution-catalog.d.ts.map

package/dist/cli/execution-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-catalog.d.ts","sourceRoot":"","sources":["../../src/cli/execution-catalog.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EACV,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,EACd,MAAM,kBAAkB,CAAC;AAY1B,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEvD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEtC,aAAa,IAAI,eAAe,CAAC;IACjC,YAAY,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAAC;CACxD;AA8GD,eAAO,MAAM,qBAAqB,EAAE,SAAS,mBAAmB,EAAY,CAAC;AAE7E,eAAO,MAAM,2BAA2B,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAEhF,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAElF"}