handoffprobe 0.1.0

package/dist/cli/test-command.js

@@ -0,0 +1,118 @@
+import { CoreRunner } from '../core/index.js';
+import { VERSION } from '../index.js';
+import { sanitizeCliLine } from './diagnostics.js';
+import { CLI_EXECUTION_CATALOG, getCliExecutionBinding } from './execution-catalog.js';
+import { CLI_PROTOCOL_BASELINE } from './protocols.js';
+const SEVERITY_RANK = {
+    info: 0,
+    low: 1,
+    medium: 2,
+    high: 3,
+    critical: 4,
+};
+export function resolveCliTestSelection(requestedIds) {
+    if (requestedIds === undefined || requestedIds.length === 0) {
+        return {
+            bindings: CLI_EXECUTION_CATALOG,
+            unknownIds: [],
+        };
+    }
+    const requested = new Set(requestedIds);
+    const unknownIds = [];
+    for (const id of requested) {
+        if (getCliExecutionBinding(id) === undefined) {
+            unknownIds.push(id);
+        }
+    }
+    return {
+        bindings: CLI_EXECUTION_CATALOG.filter((binding) => requested.has(binding.definition.id)),
+        unknownIds,
+    };
+}
+function summarize(results) {
+    const counts = {
+        pass: 0,
+        fail: 0,
+        not_applicable: 0,
+        inconclusive: 0,
+        error: 0,
+    };
+    for (const result of results) {
+        counts[result.finding.status] += 1;
+    }
+    return {
+        pass: counts.pass,
+        fail: counts.fail,
+        notApplicable: counts.not_applicable,
+        inconclusive: counts.inconclusive,
+        error: counts.error,
+        total: results.length,
+    };
+}
+export async function runCliTests(input) {
+    const runner = new CoreRunner();
+    const results = [];
+    for (const binding of input.bindings) {
+        const id = binding.definition.id;
+        const result = await runner.run({
+            attack: binding.attack,
+            target: binding.createTarget(input.target),
+            context: binding.createContext(),
+            runId: `cli:${input.target}:${id}`,
+            correlationId: `cli:${input.target}:${id}:correlation`,
+        });
+        results.push(result);
+    }
+    return {
+        target: input.target,
+        selectedIds: input.bindings.map((binding) => binding.definition.id),
+        results,
+        summary: summarize(results),
+    };
+}
+export function evaluateCliTestExitCode(run, failOn) {
+    if (run.summary.error > 0) {
+        return 3;
+    }
+    const thresholdRank = SEVERITY_RANK[failOn];
+    const securityFailure = run.results.some((result) => {
+        return (result.finding.status === 'fail' && SEVERITY_RANK[result.finding.severity] >= thresholdRank);
+    });
+    return securityFailure ? 1 : 0;
+}
+function statusLabel(status) {
+    return status.toUpperCase();
+}
+function gateLabel(exitCode, failOn) {
+    const threshold = failOn.toUpperCase();
+    if (exitCode === 3) {
+        return 'Security gate: ERROR (scanner/runtime result present; not reported as a vulnerability gate failure).';
+    }
+    if (exitCode === 1) {
+        return `Security gate: FAIL (at least one vulnerability FAIL at or above ${threshold}).`;
+    }
+    return `Security gate: PASS (no vulnerability FAIL at or above ${threshold}).`;
+}
+export function renderCliTestRun(run, failOn) {
+    const exitCode = evaluateCliTestExitCode(run, failOn);
+    const lines = [
+        'HandoffProbe test',
+        `Version: ${VERSION}`,
+        '',
+        `Target: ${run.target}`,
+        `Protocols: ${CLI_PROTOCOL_BASELINE}`,
+        `Selected attacks: ${run.selectedIds.length}`,
+        `Fail on: ${failOn.toUpperCase()}`,
+        '',
+    ];
+    for (const result of run.results) {
+        const finding = result.finding;
+        lines.push(`${statusLabel(finding.status).padEnd(14)} ${finding.testId} ${sanitizeCliLine(finding.title)} [${finding.severity.toUpperCase()}]`);
+        lines.push(`  ${sanitizeCliLine(finding.observedBehavior)}`);
+        const evidenceRefs = finding.evidenceSequences.length === 0 ? 'none' : finding.evidenceSequences.join(', ');
+        lines.push(`  Evidence: ${result.evidence.length}; refs: ${evidenceRefs}`);
+    }
+    lines.push('', 'Summary:', `  PASS: ${run.summary.pass}`, `  FAIL: ${run.summary.fail}`, `  NOT_APPLICABLE: ${run.summary.notApplicable}`, `  INCONCLUSIVE: ${run.summary.inconclusive}`, `  ERROR: ${run.summary.error}`, `  TOTAL: ${run.summary.total}`, '', gateLabel(exitCode, failOn));
+    return lines.join('\n');
+}
+//# sourceMappingURL=test-command.js.map

package/dist/cli/test-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-command.js","sourceRoot":"","sources":["../../src/cli/test-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAKtC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAyBvD,MAAM,aAAa,GAA8C;IAC/D,IAAI,EAAE,CAAC;IACP,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAC;AAEF,MAAM,UAAU,uBAAuB,CACrC,YAA2C;IAE3C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,QAAQ,EAAE,qBAAqB;YAC/B,UAAU,EAAE,EAAE;SACf,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,sBAAsB,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzF,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAiC;IAClD,MAAM,MAAM,GAAkC;QAC5C,IAAI,EAAE,CAAC;QACP,IAAI,EAAE,CAAC;QACP,cAAc,EAAE,CAAC;QACjB,YAAY,EAAE,CAAC;QACf,KAAK,EAAE,CAAC;KACT,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,cAAc;QACpC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,KAAK,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAGjC;IACC,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAChC,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAEjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC;YAC1C,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE;YAChC,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE;YAClC,aAAa,EAAE,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,cAAc;SACvD,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACnE,OAAO;QACP,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAe,EAAE,MAAiB;IACxE,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAE5C,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QAClD,OAAO,CACL,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,aAAa,CAC5F,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB;IACxC,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,QAAmB,EAAE,MAAiB;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAEvC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,sGAAsG,CAAC;IAChH,CAAC;IAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,oEAAoE,SAAS,IAAI,CAAC;IAC3F,CAAC;IAED,OAAO,0DAA0D,SAAS,IAAI,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAe,EAAE,MAAiB;IACjE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG;QACZ,mBAAmB;QACnB,YAAY,OAAO,EAAE;QACrB,EAAE;QACF,WAAW,GAAG,CAAC,MAAM,EAAE;QACvB,cAAc,qBAAqB,EAAE;QACrC,qBAAqB,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE;QAC7C,YAAY,MAAM,CAAC,WAAW,EAAE,EAAE;QAClC,EAAE;KACH,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAE/B,KAAK,CAAC,IAAI,CACR,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,eAAe,CAC5E,OAAO,CAAC,KAAK,CACd,KAAK,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CACxC,CAAC;QAEF,KAAK,CAAC,IAAI,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAE7D,MAAM,YAAY,GAChB,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEzF,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,CAAC,MAAM,WAAW,YAAY,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,IAAI,CACR,EAAE,EACF,UAAU,EACV,WAAW,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAC7B,WAAW,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAC7B,qBAAqB,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAChD,mBAAmB,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAC7C,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAC/B,YAAY,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAC/B,EAAE,EACF,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAC5B,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { runCli } from './cli/run-cli.js';
+process.exitCode = await runCli(process.argv.slice(2), {
+    stdout(message) {
+        process.stdout.write(`${message}\n`);
+    },
+    stderr(message) {
+        process.stderr.write(`${message}\n`);
+    },
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;IACrD,MAAM,CAAC,OAAO;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,CAAC,OAAO;QACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;IACvC,CAAC;CACF,CAAC,CAAC"}

package/dist/core/adapters.d.ts

@@ -0,0 +1,23 @@
+import type { EvidenceEvent } from './evidence.js';
+import type { SecurityContext } from './security-context.js';
+export interface TargetExecutionInput {
+    runId: string;
+    correlationId: string;
+    context: SecurityContext;
+    signal: AbortSignal;
+}
+export interface TargetExecutionResult {
+    originalContext: SecurityContext;
+    translatedContext: SecurityContext;
+    evidence: readonly EvidenceEvent[];
+    output: unknown;
+}
+export interface TargetAdapter {
+    readonly id: string;
+    execute(input: TargetExecutionInput): Promise<TargetExecutionResult>;
+}
+export interface HandoffAdapter {
+    readonly id: string;
+    translate(context: SecurityContext): SecurityContext | Promise<SecurityContext>;
+}
+//# sourceMappingURL=adapters.d.ts.map

package/dist/core/adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../../src/core/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,eAAe,CAAC;IACjC,iBAAiB,EAAE,eAAe,CAAC;IACnC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACjF"}

package/dist/core/adapters.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapters.js.map

package/dist/core/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/core/adapters.ts"],"names":[],"mappings":""}

package/dist/core/attacks.d.ts

@@ -0,0 +1,29 @@
+import type { FindingSeverity, PropertyClass, ProtocolApplicability } from './findings.js';
+import type { SourceReference } from './provenance.js';
+export type AttackId = `HP-${string}`;
+export type AttackPriority = 'P0' | 'P1' | 'advanced';
+export type SideEffectClass = 'none' | 'synthetic' | 'external';
+export interface AttackDefinition {
+    id: AttackId;
+    name: string;
+    category: string;
+    defaultSeverity: FindingSeverity;
+    priority: AttackPriority;
+    preconditions: readonly string[];
+    mutationSteps: readonly string[];
+    expectedInvariant: string;
+    evidenceRequirements: readonly string[];
+    applicability: ProtocolApplicability;
+    propertyClass: PropertyClass;
+    sourceReferences: readonly SourceReference[];
+    sideEffectClass: SideEffectClass;
+    destructive: boolean;
+}
+export declare class AttackRegistry {
+    private readonly attacks;
+    register(definition: AttackDefinition): void;
+    get(id: AttackId): AttackDefinition | undefined;
+    require(id: AttackId): AttackDefinition;
+    list(): AttackDefinition[];
+}
+//# sourceMappingURL=attacks.d.ts.map

package/dist/core/attacks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attacks.d.ts","sourceRoot":"","sources":["../../src/core/attacks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC;AAEtC,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,GAAG,UAAU,CAAC;AAEtD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,CAAC;AAEhE,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,aAAa,EAAE,qBAAqB,CAAC;IACrC,aAAa,EAAE,aAAa,CAAC;IAC7B,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,OAAO,CAAC;CACtB;AAmBD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IAEjE,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI;IAiB5C,GAAG,CAAC,EAAE,EAAE,QAAQ,GAAG,gBAAgB,GAAG,SAAS;IAI/C,OAAO,CAAC,EAAE,EAAE,QAAQ,GAAG,gBAAgB;IAiBvC,IAAI,IAAI,gBAAgB,EAAE;CAG3B"}

package/dist/core/attacks.js

@@ -0,0 +1,38 @@
+import { HandoffProbeCoreError } from './errors.js';
+function validateAttackId(id) {
+    const pattern = /^HP-[A-Z0-9]+(?:-[A-Z0-9]+)+$/;
+    if (pattern.test(id)) {
+        return;
+    }
+    throw new HandoffProbeCoreError('INVALID_ATTACK_ID', `Invalid HandoffProbe attack ID: ${id}`, 'attack-registry', {
+        attackId: id,
+    });
+}
+export class AttackRegistry {
+    attacks = new Map();
+    register(definition) {
+        validateAttackId(definition.id);
+        if (this.attacks.has(definition.id)) {
+            throw new HandoffProbeCoreError('DUPLICATE_ATTACK_ID', `Attack already registered: ${definition.id}`, 'attack-registry', {
+                attackId: definition.id,
+            });
+        }
+        this.attacks.set(definition.id, definition);
+    }
+    get(id) {
+        return this.attacks.get(id);
+    }
+    require(id) {
+        const definition = this.attacks.get(id);
+        if (definition !== undefined) {
+            return definition;
+        }
+        throw new HandoffProbeCoreError('ATTACK_NOT_FOUND', `Attack is not registered: ${id}`, 'attack-registry', {
+            attackId: id,
+        });
+    }
+    list() {
+        return [...this.attacks.values()].sort((left, right) => left.id.localeCompare(right.id));
+    }
+}
+//# sourceMappingURL=attacks.js.map

package/dist/core/attacks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attacks.js","sourceRoot":"","sources":["../../src/core/attacks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AA2BpD,SAAS,gBAAgB,CAAC,EAAY;IACpC,MAAM,OAAO,GAAG,+BAA+B,CAAC;IAEhD,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,qBAAqB,CAC7B,mBAAmB,EACnB,mCAAmC,EAAE,EAAE,EACvC,iBAAiB,EACjB;QACE,QAAQ,EAAE,EAAE;KACb,CACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEjE,QAAQ,CAAC,UAA4B;QACnC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEhC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,qBAAqB,CAC7B,qBAAqB,EACrB,8BAA8B,UAAU,CAAC,EAAE,EAAE,EAC7C,iBAAiB,EACjB;gBACE,QAAQ,EAAE,UAAU,CAAC,EAAE;aACxB,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAED,GAAG,CAAC,EAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,EAAY;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAExC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,IAAI,qBAAqB,CAC7B,kBAAkB,EAClB,6BAA6B,EAAE,EAAE,EACjC,iBAAiB,EACjB;YACE,QAAQ,EAAE,EAAE;SACb,CACF,CAAC;IACJ,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;CACF"}

package/dist/core/errors.d.ts

@@ -0,0 +1,16 @@
+export type CoreErrorCode = 'INVALID_ATTACK_ID' | 'DUPLICATE_ATTACK_ID' | 'ATTACK_NOT_FOUND' | 'INVALID_TIMEOUT' | 'TIMEOUT' | 'ADAPTER_ERROR' | 'EVALUATION_ERROR' | 'INTERNAL_ERROR';
+export declare class HandoffProbeCoreError extends Error {
+    readonly code: CoreErrorCode;
+    readonly stage: string;
+    readonly details: Readonly<Record<string, unknown>>;
+    readonly name = "HandoffProbeCoreError";
+    constructor(code: CoreErrorCode, message: string, stage: string, details?: Readonly<Record<string, unknown>>);
+    toJSON(): {
+        name: string;
+        code: CoreErrorCode;
+        message: string;
+        stage: string;
+        details: Readonly<Record<string, unknown>>;
+    };
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,GAClB,iBAAiB,GACjB,SAAS,GACT,eAAe,GACf,kBAAkB,GAClB,gBAAgB,CAAC;AAErB,qBAAa,qBAAsB,SAAQ,KAAK;IAI5C,QAAQ,CAAC,IAAI,EAAE,aAAa;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IANrD,SAAkB,IAAI,2BAA2B;gBAGtC,IAAI,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,EACN,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAM;IAK1D,MAAM,IAAI;QACR,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,aAAa,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KAC5C;CASF"}

package/dist/core/errors.js

@@ -0,0 +1,22 @@
+export class HandoffProbeCoreError extends Error {
+    code;
+    stage;
+    details;
+    name = 'HandoffProbeCoreError';
+    constructor(code, message, stage, details = {}) {
+        super(message);
+        this.code = code;
+        this.stage = stage;
+        this.details = details;
+    }
+    toJSON() {
+        return {
+            name: this.name,
+            code: this.code,
+            message: this.message,
+            stage: this.stage,
+            details: this.details,
+        };
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAUA,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAInC;IAEA;IACA;IANO,IAAI,GAAG,uBAAuB,CAAC;IAEjD,YACW,IAAmB,EAC5B,OAAe,EACN,KAAa,EACb,UAA6C,EAAE;QAExD,KAAK,CAAC,OAAO,CAAC,CAAC;QALN,SAAI,GAAJ,IAAI,CAAe;QAEnB,UAAK,GAAL,KAAK,CAAQ;QACb,YAAO,GAAP,OAAO,CAAwC;IAG1D,CAAC;IAED,MAAM;QAOJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;CACF"}

package/dist/core/evidence.d.ts

@@ -0,0 +1,18 @@
+import type { SourceReference } from './provenance.js';
+import type { SecurityContext } from './security-context.js';
+export type EvidenceProtocol = 'A2A' | 'HANDOFF' | 'MCP' | 'TOOL' | 'CORE';
+export interface EvidenceEvent {
+    runId: string;
+    correlationId: string;
+    testId?: `HP-${string}`;
+    sequence: number;
+    fixture?: string;
+    protocol: EvidenceProtocol;
+    protocolVersion: string;
+    boundary: string;
+    event: string;
+    context: SecurityContext;
+    details: Record<string, unknown>;
+    provenance: SourceReference[];
+}
+//# sourceMappingURL=evidence.d.ts.map

package/dist/core/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/core/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B"}

package/dist/core/evidence.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=evidence.js.map

package/dist/core/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/core/evidence.ts"],"names":[],"mappings":""}

package/dist/core/findings.d.ts

@@ -0,0 +1,25 @@
+import type { SourceReference } from './provenance.js';
+export type FindingStatus = 'pass' | 'fail' | 'not_applicable' | 'inconclusive' | 'error';
+export type FindingSeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export type PropertyClass = 'spec_required' | 'spec_recommended' | 'hardening' | 'composition_responsibility';
+export interface ProtocolApplicability {
+    a2a: readonly string[];
+    mcp: readonly string[];
+}
+export interface Finding {
+    testId: `HP-${string}`;
+    runId: string;
+    correlationId: string;
+    title: string;
+    severity: FindingSeverity;
+    status: FindingStatus;
+    propertyClass: PropertyClass;
+    applicability: ProtocolApplicability;
+    expectedInvariant: string;
+    observedBehavior: string;
+    evidenceSequences: readonly number[];
+    sources: readonly SourceReference[];
+    remediation?: string;
+}
+export declare function isSecurityFailure(finding: Pick<Finding, 'status'>): boolean;
+//# sourceMappingURL=findings.d.ts.map

package/dist/core/findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/core/findings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,gBAAgB,GAAG,cAAc,GAAG,OAAO,CAAC;AAE1F,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE9E,MAAM,MAAM,aAAa,GACvB,eAAe,GAAG,kBAAkB,GAAG,WAAW,GAAG,4BAA4B,CAAC;AAEpF,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;IACvB,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,aAAa,EAAE,aAAa,CAAC;IAC7B,aAAa,EAAE,qBAAqB,CAAC;IACrC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,OAAO,CAE3E"}

package/dist/core/findings.js

@@ -0,0 +1,4 @@
+export function isSecurityFailure(finding) {
+    return finding.status === 'fail';
+}
+//# sourceMappingURL=findings.js.map

package/dist/core/findings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/core/findings.ts"],"names":[],"mappings":"AA8BA,MAAM,UAAU,iBAAiB,CAAC,OAAgC;IAChE,OAAO,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;AACnC,CAAC"}

package/dist/core/index.d.ts

@@ -0,0 +1,10 @@
+export * from './adapters.js';
+export * from './attacks.js';
+export * from './errors.js';
+export * from './evidence.js';
+export * from './findings.js';
+export * from './provenance.js';
+export * from './redaction.js';
+export * from './runner.js';
+export * from './security-context.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,10 @@
+export * from './adapters.js';
+export * from './attacks.js';
+export * from './errors.js';
+export * from './evidence.js';
+export * from './findings.js';
+export * from './provenance.js';
+export * from './redaction.js';
+export * from './runner.js';
+export * from './security-context.js';
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC"}

package/dist/core/provenance.d.ts

@@ -0,0 +1,8 @@
+export type SourceReferenceKind = 'spec' | 'research' | 'project';
+export interface SourceReference {
+    kind: SourceReferenceKind;
+    title: string;
+    locator: string;
+    version?: string;
+}
+//# sourceMappingURL=provenance.d.ts.map

package/dist/core/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/core/provenance.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}

package/dist/core/provenance.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=provenance.js.map

package/dist/core/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/core/provenance.ts"],"names":[],"mappings":""}

package/dist/core/redaction.d.ts

@@ -0,0 +1,4 @@
+export declare const REDACTED_VALUE = "[REDACTED]";
+export declare function redactText(input: string): string;
+export declare function redactRecord(input: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/core/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/core/redaction.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,eAAe,CAAC;AAqC3C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAehD;AAoBD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQpF"}

package/dist/core/redaction.js

@@ -0,0 +1,59 @@
+export const REDACTED_VALUE = '[REDACTED]';
+function normalizeKey(key) {
+    return key.toLowerCase().replaceAll('-', '').replaceAll('_', '');
+}
+function isSensitiveKey(key) {
+    const normalized = normalizeKey(key);
+    const exactSensitiveKeys = new Set([
+        'authorization',
+        'authorizationheader',
+        'proxyauthorization',
+        'password',
+        'passwd',
+        'secret',
+        'token',
+        'apikey',
+        'cookie',
+        'setcookie',
+        'clientsecret',
+    ]);
+    if (exactSensitiveKeys.has(normalized)) {
+        return true;
+    }
+    const sensitiveSuffixes = ['password', 'secret', 'token', 'apikey'];
+    return sensitiveSuffixes.some((suffix) => normalized.endsWith(suffix));
+}
+const INLINE_KEY_VALUE_PATTERN = /\b([A-Za-z][A-Za-z0-9_-]*)(\s*[:=]\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|(?:Bearer|Basic)\s+[^\s,;"']+|[^\s,;"']+)/gi;
+const AUTH_SCHEME_PATTERN = /\b(Bearer|Basic)(\s+)[^\s,;"']+/gi;
+export function redactText(input) {
+    const keyed = input.replace(INLINE_KEY_VALUE_PATTERN, (match, key, separator) => {
+        if (!isSensitiveKey(key)) {
+            return match;
+        }
+        return `${key}${separator}${REDACTED_VALUE}`;
+    });
+    return keyed.replace(AUTH_SCHEME_PATTERN, (_match, scheme, spacing) => {
+        return `${scheme}${spacing}${REDACTED_VALUE}`;
+    });
+}
+function redactValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item));
+    }
+    if (value !== null && typeof value === 'object') {
+        const result = {};
+        for (const [key, nested] of Object.entries(value)) {
+            result[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(nested);
+        }
+        return result;
+    }
+    return value;
+}
+export function redactRecord(input) {
+    const result = {};
+    for (const [key, value] of Object.entries(input)) {
+        result[key] = isSensitiveKey(key) ? REDACTED_VALUE : redactValue(value);
+    }
+    return result;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/core/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/core/redaction.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAC;AAE3C,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAErC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;QACjC,eAAe;QACf,qBAAqB;QACrB,oBAAoB;QACpB,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,OAAO;QACP,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,cAAc;KACf,CAAC,CAAC;IAEH,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEpE,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,wBAAwB,GAC5B,8GAA8G,CAAC;AAEjH,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAEhE,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CACzB,wBAAwB,EACxB,CAAC,KAAa,EAAE,GAAW,EAAE,SAAiB,EAAE,EAAE;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,GAAG,GAAG,GAAG,SAAS,GAAG,cAAc,EAAE,CAAC;IAC/C,CAAC,CACF,CAAC;IAEF,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe,EAAE,EAAE;QAC5F,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,cAAc,EAAE,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAA8B;IACzD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/runner.d.ts

@@ -0,0 +1,42 @@
+import type { TargetAdapter, TargetExecutionResult } from './adapters.js';
+import type { AttackDefinition } from './attacks.js';
+import { HandoffProbeCoreError } from './errors.js';
+import type { EvidenceEvent } from './evidence.js';
+import type { Finding, FindingSeverity, FindingStatus } from './findings.js';
+import type { SecurityContext } from './security-context.js';
+export type EvaluationStatus = Exclude<FindingStatus, 'error'>;
+export interface AttackEvaluation {
+    status: EvaluationStatus;
+    observedBehavior: string;
+    severity?: FindingSeverity;
+    evidenceSequences?: readonly number[];
+    remediation?: string;
+}
+export interface AttackCase {
+    definition: AttackDefinition;
+    evaluate(result: TargetExecutionResult): AttackEvaluation | Promise<AttackEvaluation>;
+}
+export interface CoreRunInput {
+    attack: AttackCase;
+    target: TargetAdapter;
+    context: SecurityContext;
+    runId: string;
+    correlationId?: string;
+    timeoutMs?: number;
+}
+export interface StructuredRunError {
+    name: 'HandoffProbeCoreError';
+    code: HandoffProbeCoreError['code'];
+    message: string;
+    stage: string;
+    details: Readonly<Record<string, unknown>>;
+}
+export interface CoreRunResult {
+    finding: Finding;
+    evidence: readonly EvidenceEvent[];
+    error?: StructuredRunError;
+}
+export declare class CoreRunner {
+    run(input: CoreRunInput): Promise<CoreRunResult>;
+}
+//# sourceMappingURL=runner.d.ts.map

package/dist/core/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/core/runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,gBAAgB,CAAC;IAE7B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,GAAG,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACvF;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,eAAe,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IACnC,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAuHD,qBAAa,UAAU;IACf,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;CAyHvD"}