shieldcortex 2.20.1 → 3.0.1

package/dist/defence/audit/queries.js

@@ -172,4 +172,182 @@ export function queryAgentOperations(identifier, options = {}) {
     LIMIT @limit OFFSET @offset
   `).all(params);
 }
-//# sourceMappingURL=queries.js.map
+function extractReplayMemoryId(data) {
+    if (!data || typeof data !== 'object')
+        return null;
+    const record = data;
+    if (typeof record.memoryId === 'number')
+        return record.memoryId;
+    if (record.memory && typeof record.memory === 'object' && record.memory) {
+        const nested = record.memory;
+        if (typeof nested.id === 'number')
+            return nested.id;
+    }
+    return null;
+}
+function extractReplayProject(data) {
+    if (!data || typeof data !== 'object')
+        return null;
+    const record = data;
+    if (typeof record.project === 'string')
+        return record.project;
+    if (record.memory && typeof record.memory === 'object' && record.memory) {
+        const nested = record.memory;
+        if (typeof nested.project === 'string')
+            return nested.project;
+    }
+    return null;
+}
+function buildEventSummary(type, data) {
+    if (!data || typeof data !== 'object')
+        return type;
+    const record = data;
+    switch (type) {
+        case 'memory_created':
+        case 'memory_updated':
+            return `Memory ${type === 'memory_created' ? 'created' : 'updated'}: ${String(record.memory?.title ?? 'Untitled')}`;
+        case 'memory_deleted':
+            return `Memory deleted: ${String(record.title ?? `ID ${record.memoryId ?? 'unknown'}`)}`;
+        case 'memory_accessed':
+            return `Memory accessed: ${String(record.memory?.title ?? `ID ${record.memoryId ?? 'unknown'}`)}`;
+        case 'defence_event':
+            return `Defence event: ${String(record.firewall_result ?? 'UNKNOWN')} from ${String(record.source_type ?? 'unknown')}:${String(record.source_identifier ?? 'unknown')}`;
+        case 'consolidation_complete':
+            return `Consolidation complete: ${String(record.consolidated ?? 0)} promoted, ${String(record.deleted ?? 0)} deleted`;
+        case 'kill_switch_activated':
+            return 'Kill switch activated';
+        case 'kill_switch_deactivated':
+            return 'Kill switch deactivated';
+        default:
+            return type.replace(/_/g, ' ');
+    }
+}
+export function queryIncidentReplay(options = {}) {
+    const db = getDatabase();
+    const startTime = options.startTime ?? new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString();
+    const endTime = options.endTime ?? new Date().toISOString();
+    const limit = options.limit ?? 200;
+    const entries = [];
+    const auditConditions = ['timestamp >= @startTime', 'timestamp <= @endTime'];
+    const auditParams = { startTime, endTime, limit };
+    if (options.project) {
+        auditConditions.push('project = @project');
+        auditParams.project = options.project;
+    }
+    if (options.sourceIdentifier) {
+        auditConditions.push('source_identifier = @sourceIdentifier');
+        auditParams.sourceIdentifier = options.sourceIdentifier;
+    }
+    if (options.memoryId !== undefined) {
+        auditConditions.push('memory_id = @memoryId');
+        auditParams.memoryId = options.memoryId;
+    }
+    const auditRows = db.prepare(`
+    SELECT *
+    FROM defence_audit
+    WHERE ${auditConditions.join(' AND ')}
+    ORDER BY timestamp DESC
+    LIMIT @limit
+  `).all(auditParams);
+    entries.push(...auditRows.map((row) => {
+        const severity = row.firewall_result === 'BLOCK' ? 'critical' : row.firewall_result === 'QUARANTINE' ? 'warning' : 'info';
+        return {
+            timestamp: row.timestamp,
+            type: 'audit',
+            eventType: row.firewall_result.toLowerCase(),
+            severity,
+            summary: `${row.firewall_result} ${row.source_type}:${row.source_identifier}`,
+            details: row.reason,
+            source: `${row.source_type}:${row.source_identifier}`,
+            memoryId: row.memory_id,
+            auditId: row.id,
+            metadata: {
+                threatIndicators: row.threat_indicators,
+                blockedPatterns: row.blocked_patterns,
+                trustScore: row.trust_score,
+                anomalyScore: row.anomaly_score,
+                sensitivityLevel: row.sensitivity_level,
+            },
+        };
+    }));
+    const quarantineConditions = ['q.created_at >= @startTime', 'q.created_at <= @endTime'];
+    const quarantineParams = { startTime, endTime, limit };
+    if (options.project) {
+        quarantineConditions.push('q.project = @project');
+        quarantineParams.project = options.project;
+    }
+    if (options.sourceIdentifier) {
+        quarantineConditions.push('q.source_identifier = @sourceIdentifier');
+        quarantineParams.sourceIdentifier = options.sourceIdentifier;
+    }
+    if (options.memoryId !== undefined) {
+        quarantineConditions.push('da.memory_id = @memoryId');
+        quarantineParams.memoryId = options.memoryId;
+    }
+    const quarantineRows = db.prepare(`
+    SELECT q.*, da.memory_id
+    FROM quarantine q
+    LEFT JOIN defence_audit da ON da.id = q.audit_id
+    WHERE ${quarantineConditions.join(' AND ')}
+    ORDER BY q.created_at DESC
+    LIMIT @limit
+  `).all(quarantineParams);
+    entries.push(...quarantineRows.map((row) => {
+        const severity = row.status === 'pending' ? 'warning' : 'info';
+        return {
+            timestamp: String(row.created_at),
+            type: 'quarantine',
+            eventType: `quarantine_${String(row.status)}`,
+            severity,
+            summary: `Quarantine ${String(row.status)}: ${String(row.original_title ?? 'Untitled')}`,
+            details: String(row.reason ?? ''),
+            source: `${String(row.source_type ?? 'unknown')}:${String(row.source_identifier ?? 'unknown')}`,
+            memoryId: typeof row.memory_id === 'number' ? row.memory_id : null,
+            auditId: typeof row.audit_id === 'number' ? row.audit_id : null,
+            quarantineId: row.id,
+            metadata: {
+                reviewedAt: row.reviewed_at ?? null,
+                reviewedBy: row.reviewed_by ?? null,
+                firewallResult: row.firewall_result ?? null,
+                anomalyScore: row.anomaly_score ?? null,
+                threatIndicators: row.threat_indicators ?? '[]',
+            },
+        };
+    }));
+    const eventRows = db.prepare(`
+    SELECT id, type, data, timestamp
+    FROM events
+    WHERE timestamp >= @startTime AND timestamp <= @endTime
+    ORDER BY timestamp DESC
+    LIMIT @limit
+  `).all({ startTime, endTime, limit });
+    for (const row of eventRows) {
+        const parsed = row.data ? JSON.parse(row.data) : null;
+        const eventMemoryId = extractReplayMemoryId(parsed);
+        const eventProject = extractReplayProject(parsed);
+        if (options.memoryId !== undefined && eventMemoryId !== options.memoryId)
+            continue;
+        if (options.project && eventProject && eventProject !== options.project)
+            continue;
+        if (options.sourceIdentifier && row.type !== 'defence_event')
+            continue;
+        if (options.sourceIdentifier && parsed && typeof parsed === 'object') {
+            const record = parsed;
+            if (record.source_identifier !== options.sourceIdentifier)
+                continue;
+        }
+        entries.push({
+            timestamp: row.timestamp,
+            type: 'event',
+            eventType: row.type,
+            severity: row.type.includes('kill_switch') ? 'critical' : row.type === 'defence_event' ? 'warning' : 'info',
+            summary: buildEventSummary(row.type, parsed),
+            details: null,
+            memoryId: eventMemoryId,
+            metadata: parsed && typeof parsed === 'object' ? parsed : undefined,
+        });
+    }
+    return entries
+        .sort((a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime())
+        .slice(0, limit);
+}

package/dist/defence/credential-leak/entropy.d.ts

@@ -39,4 +39,3 @@ export declare function extractHighEntropyTokens(content: string): Array<{
     entropy: number;
     confidence: number;
 }>;
-//# sourceMappingURL=entropy.d.ts.map

package/dist/defence/credential-leak/entropy.js

@@ -102,4 +102,3 @@ function isLikelyFalsePositive(token) {
         return true;
     return false;
 }
-//# sourceMappingURL=entropy.js.map

package/dist/defence/credential-leak/index.d.ts

@@ -51,4 +51,3 @@ export declare function redactCredentials(content: string, config?: Partial<Cred
 export type { CredentialPattern, CredentialType, CredentialSeverity } from './patterns.js';
 export { shannonEntropy, checkHighEntropy } from './entropy.js';
 export { ALL_CREDENTIAL_PATTERNS } from './patterns.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/credential-leak/index.js

@@ -165,4 +165,3 @@ function buildRedactedContent(content, ranges) {
 }
 export { shannonEntropy, checkHighEntropy } from './entropy.js';
 export { ALL_CREDENTIAL_PATTERNS } from './patterns.js';
-//# sourceMappingURL=index.js.map

package/dist/defence/credential-leak/patterns.d.ts

@@ -23,4 +23,3 @@ export declare const PRIVATE_KEY_PATTERNS: CredentialPattern[];
 export declare const CONNECTION_STRING_PATTERNS: CredentialPattern[];
 export declare const ENV_SECRET_PATTERNS: CredentialPattern[];
 export declare const ALL_CREDENTIAL_PATTERNS: CredentialPattern[];
-//# sourceMappingURL=patterns.d.ts.map

package/dist/defence/credential-leak/patterns.js

@@ -301,4 +301,3 @@ export const ALL_CREDENTIAL_PATTERNS = [
     ...GENERIC_SECRET_PATTERNS,
     ...ENV_SECRET_PATTERNS,
 ];
-//# sourceMappingURL=patterns.js.map

package/dist/defence/custom-patterns/store.d.ts

@@ -49,4 +49,3 @@ export declare function testPattern(id: number, text: string): {
  * Get all enabled patterns (used by the defence pipeline).
  */
 export declare function getEnabledCustomPatterns(): CustomPattern[];
-//# sourceMappingURL=store.d.ts.map

package/dist/defence/custom-patterns/store.js

@@ -105,4 +105,3 @@ export function getEnabledCustomPatterns() {
     const db = getDatabase();
     return db.prepare('SELECT * FROM custom_patterns WHERE enabled = 1').all();
 }
-//# sourceMappingURL=store.js.map

package/dist/defence/custom-rules/store.d.ts

@@ -33,4 +33,3 @@ export declare function deleteFirewallRule(id: number): boolean;
  * Get all enabled rules sorted by priority (used by the defence pipeline).
  */
 export declare function getEnabledFirewallRules(): FirewallRule[];
-//# sourceMappingURL=store.d.ts.map

package/dist/defence/custom-rules/store.js

@@ -54,4 +54,3 @@ export function getEnabledFirewallRules() {
     const db = getDatabase();
     return db.prepare('SELECT * FROM firewall_rules WHERE enabled = 1 ORDER BY priority ASC').all();
 }
-//# sourceMappingURL=store.js.map

package/dist/defence/firewall/anomaly-scorer.d.ts

@@ -5,4 +5,3 @@
  * Returns 0 (normal) to 1 (very anomalous).
  */
 export declare function scoreAnomaly(content: string, title: string): number;
-//# sourceMappingURL=anomaly-scorer.d.ts.map

package/dist/defence/firewall/anomaly-scorer.js

@@ -89,4 +89,3 @@ export function scoreAnomaly(content, title) {
     const score = Math.min(signals.reduce((a, b) => a + b, 0), 1.0);
     return Math.round(score * 100) / 100;
 }
-//# sourceMappingURL=anomaly-scorer.js.map

package/dist/defence/firewall/encoding-detector.d.ts

@@ -10,4 +10,3 @@ export interface EncodingDetectionResult {
     decodedSnippets: string[];
 }
 export declare function detectEncoding(content: string): EncodingDetectionResult;
-//# sourceMappingURL=encoding-detector.d.ts.map

package/dist/defence/firewall/encoding-detector.js

@@ -117,4 +117,3 @@ export function detectEncoding(content) {
         decodedSnippets,
     };
 }
-//# sourceMappingURL=encoding-detector.js.map

package/dist/defence/firewall/index.d.ts

@@ -18,4 +18,3 @@ export { scoreAnomaly } from './anomaly-scorer.js';
  * Run the full firewall analysis pipeline on memory content.
  */
 export declare function analyzeFirewall(content: string, title: string, source: DefenceSource, trustScore: number, config: DefenceConfig): FirewallAnalysis;
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/firewall/index.js

@@ -170,4 +170,3 @@ function determineResult(mode, instructions, privilege, encoding, anomalyScore,
     }
     return { result: 'ALLOW', reason: 'No threats detected' };
 }
-//# sourceMappingURL=index.js.map

package/dist/defence/firewall/instruction-detector.d.ts

@@ -9,4 +9,3 @@ export interface InstructionDetectionResult {
     confidence: number;
 }
 export declare function detectInstructions(content: string): InstructionDetectionResult;
-//# sourceMappingURL=instruction-detector.d.ts.map

package/dist/defence/firewall/instruction-detector.js

@@ -134,4 +134,3 @@ export function detectInstructions(content) {
         confidence: Math.round(confidence * 100) / 100,
     };
 }
-//# sourceMappingURL=instruction-detector.js.map

package/dist/defence/firewall/privilege-detector.d.ts

@@ -10,4 +10,3 @@ export interface PrivilegeDetectionResult {
     severity: 'low' | 'medium' | 'high';
 }
 export declare function detectPrivilegeEscalation(content: string): PrivilegeDetectionResult;
-//# sourceMappingURL=privilege-detector.d.ts.map

package/dist/defence/firewall/privilege-detector.js

@@ -86,4 +86,3 @@ export function detectPrivilegeEscalation(content) {
         severity: indicators.length > 0 ? highestSeverity : 'low',
     };
 }
-//# sourceMappingURL=privilege-detector.js.map

package/dist/defence/fragmentation/assembly-detector.d.ts

@@ -15,4 +15,3 @@ export interface AssemblyAnalysis {
  * Detect whether overlapping entities suggest payload assembly
  */
 export declare function detectAssembly(overlapping: OverlappingEntity[], newEntities: ExtractedEntity[]): AssemblyAnalysis;
-//# sourceMappingURL=assembly-detector.d.ts.map

package/dist/defence/fragmentation/assembly-detector.js

@@ -69,4 +69,3 @@ export function detectAssembly(overlapping, newEntities) {
     }
     return { score, risk, suspiciousPatterns };
 }
-//# sourceMappingURL=assembly-detector.js.map

package/dist/defence/fragmentation/entity-extractor.d.ts

@@ -16,4 +16,3 @@ export declare function extractEntities(content: string): ExtractedEntity[];
  * Store extracted entities in the fragmentation_entities table
  */
 export declare function storeExtractedEntities(memoryId: number, entities: ExtractedEntity[]): void;
-//# sourceMappingURL=entity-extractor.d.ts.map

package/dist/defence/fragmentation/entity-extractor.js

@@ -88,4 +88,3 @@ export function storeExtractedEntities(memoryId, entities) {
         // DB not initialized (e.g. SaaS context) — skip entity storage
     }
 }
-//# sourceMappingURL=entity-extractor.js.map

package/dist/defence/fragmentation/index.d.ts

@@ -20,4 +20,3 @@ export declare function analyzeFragmentation(content: string, title: string, con
  * Store fragmentation data for a newly created memory
  */
 export declare function storeFragmentationData(memoryId: number, content: string): void;
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/fragmentation/index.js

@@ -46,4 +46,3 @@ export function storeFragmentationData(memoryId, content) {
     const entities = extractEntities(content);
     storeExtractedEntities(memoryId, entities);
 }
-//# sourceMappingURL=index.js.map

package/dist/defence/fragmentation/temporal-analyzer.d.ts

@@ -25,4 +25,3 @@ export declare function getRecentEntities(windowHours: number): RecentEntity[];
  * Find entities from the new memory that also appear in recent memories
  */
 export declare function findOverlappingEntities(entities: ExtractedEntity[], windowHours: number): OverlappingEntity[];
-//# sourceMappingURL=temporal-analyzer.d.ts.map

package/dist/defence/fragmentation/temporal-analyzer.js

@@ -45,4 +45,3 @@ export function findOverlappingEntities(entities, windowHours) {
     }
     return overlapping;
 }
-//# sourceMappingURL=temporal-analyzer.js.map

package/dist/defence/index.d.ts

@@ -22,4 +22,3 @@ export type { CloudConfig, DefenceMode, VerifyConfig, OpenClawMemoryConfig } fro
 export { syncToCloud } from '../cloud/sync.js';
 export { syncQuarantineToCloud } from '../cloud/quarantine-sync.js';
 export { submitVerification, pollVerification } from '../cloud/verify.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/index.js

@@ -28,4 +28,3 @@ export { getCloudConfig, setCloudConfig, clearCloudConfigCache, getTrustedSkills
 export { syncToCloud } from '../cloud/sync.js';
 export { syncQuarantineToCloud } from '../cloud/quarantine-sync.js';
 export { submitVerification, pollVerification } from '../cloud/verify.js';
-//# sourceMappingURL=index.js.map

package/dist/defence/input-sanitisation/index.d.ts

@@ -25,4 +25,3 @@ export type SanitisationCategory = 'null_byte' | 'control_char' | 'zero_width' |
  * Designed to be fast and non-blocking — runs before all other layers.
  */
 export declare function sanitiseInput(content: string): SanitisationResult;
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/input-sanitisation/index.js

@@ -68,4 +68,3 @@ export function sanitiseInput(content) {
     }
     return { sanitised, modified, strippedCategories, threatIndicators };
 }
-//# sourceMappingURL=index.js.map

package/dist/defence/iron-dome/action-gate.d.ts

@@ -16,4 +16,3 @@ export interface ActionGateResult {
  * Check if an action is allowed under the current Iron Dome configuration.
  */
 export declare function isActionAllowed(action: string, config: IronDomeConfig, source?: DefenceSource): ActionGateResult;
-//# sourceMappingURL=action-gate.d.ts.map

package/dist/defence/iron-dome/action-gate.js

@@ -89,4 +89,3 @@ export function isActionAllowed(action, config, source) {
     });
     return result;
 }
-//# sourceMappingURL=action-gate.js.map

package/dist/defence/iron-dome/audit.d.ts

@@ -17,4 +17,3 @@ export interface IronDomeAuditEvent {
  * Fire-and-forget safe: errors are caught and logged, never thrown.
  */
 export declare function logIronDomeAudit(event: IronDomeAuditEvent): void;
-//# sourceMappingURL=audit.d.ts.map

package/dist/defence/iron-dome/audit.js

@@ -31,4 +31,3 @@ export function logIronDomeAudit(event) {
         console.error('[iron-dome] Failed to log audit event:', err);
     }
 }
-//# sourceMappingURL=audit.js.map

package/dist/defence/iron-dome/config.d.ts

@@ -42,4 +42,3 @@ export interface IronDomeConfig {
 }
 export declare const DEFAULT_IRON_DOME_CONFIG: IronDomeConfig;
 export declare const IRON_DOME_PROFILES: Record<IronDomeProfile, Omit<IronDomeConfig, 'enabled'>>;
-//# sourceMappingURL=config.d.ts.map

package/dist/defence/iron-dome/config.js

@@ -198,4 +198,3 @@ export const IRON_DOME_PROFILES = {
         profile: 'paranoid',
     },
 };
-//# sourceMappingURL=config.js.map

package/dist/defence/iron-dome/confirmation-gate.d.ts

@@ -41,4 +41,3 @@ export declare function requiresConfirmation(action: string, config: IronDomeCon
  * Returns true if the action requires at least an announcement (RED or AMBER tier).
  */
 export declare function requiresAnnouncement(action: string, config: IronDomeConfig): boolean;
-//# sourceMappingURL=confirmation-gate.d.ts.map

package/dist/defence/iron-dome/confirmation-gate.js

@@ -122,4 +122,3 @@ export function requiresAnnouncement(action, config) {
     const tier = classifyAction(action, config).tier;
     return tier === 'red' || tier === 'amber';
 }
-//# sourceMappingURL=confirmation-gate.js.map

package/dist/defence/iron-dome/custom-policies.d.ts

@@ -28,4 +28,3 @@ export declare function updateIronDomePolicy(id: number, updates: Partial<{
     description: string;
     config: Record<string, unknown>;
 }>): IronDomePolicy | undefined;
-//# sourceMappingURL=custom-policies.d.ts.map

package/dist/defence/iron-dome/custom-policies.js

@@ -76,4 +76,3 @@ export function updateIronDomePolicy(id, updates) {
     db.prepare(`UPDATE iron_dome_policies SET ${fields.join(', ')} WHERE id = ?`).run(...values);
     return getIronDomePolicy(id);
 }
-//# sourceMappingURL=custom-policies.js.map

package/dist/defence/iron-dome/gateway.d.ts

@@ -21,4 +21,3 @@ export declare function isChannelTrusted(channel: string, config: IronDomeConfig
  * Returns whether the instruction should be processed.
  */
 export declare function validateGateway(channel: string, instruction: string, config: IronDomeConfig, source?: DefenceSource): GatewayResult;
-//# sourceMappingURL=gateway.d.ts.map

package/dist/defence/iron-dome/gateway.js

@@ -46,4 +46,3 @@ export function validateGateway(channel, instruction, config, source) {
     });
     return result;
 }
-//# sourceMappingURL=gateway.js.map

package/dist/defence/iron-dome/index.d.ts

@@ -76,4 +76,3 @@ export declare function moveConfirmationAction(action: string, tier: Confirmatio
  * Returns true if the action was found in overrides, false if it wasn't overridden.
  */
 export declare function removeConfirmationOverride(action: string): boolean;
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/iron-dome/index.js

@@ -342,4 +342,3 @@ export function removeConfirmationOverride(action) {
     }
     return found;
 }
-//# sourceMappingURL=index.js.map

package/dist/defence/iron-dome/injection-scanner.d.ts

@@ -38,4 +38,3 @@ export declare function getExternalPatternCount(): number;
  * Scan text for prompt injection patterns.
  */
 export declare function scanForInjection(text: string): InjectionScanResult;
-//# sourceMappingURL=injection-scanner.d.ts.map

package/dist/defence/iron-dome/injection-scanner.js

@@ -162,4 +162,3 @@ export function scanForInjection(text) {
         summary,
     };
 }
-//# sourceMappingURL=injection-scanner.js.map

package/dist/defence/iron-dome/kill-switch.d.ts

@@ -13,4 +13,3 @@ export interface KillSwitchResult {
  * Check if the input contains the kill phrase.
  */
 export declare function handleKillPhrase(input: string, config: IronDomeConfig): KillSwitchResult;
-//# sourceMappingURL=kill-switch.d.ts.map

package/dist/defence/iron-dome/kill-switch.js

@@ -27,4 +27,3 @@ export function handleKillPhrase(input, config) {
         phrase: config.killPhrase,
     };
 }
-//# sourceMappingURL=kill-switch.js.map

package/dist/defence/iron-dome/pii-guard.d.ts

@@ -19,4 +19,3 @@ export interface PiiViolation {
  * Check content against PII protection rules.
  */
 export declare function checkPII(content: string, config: IronDomeConfig): PiiCheckResult;
-//# sourceMappingURL=pii-guard.d.ts.map

package/dist/defence/iron-dome/pii-guard.js

@@ -81,4 +81,3 @@ export function checkPII(content, config) {
         violations,
     };
 }
-//# sourceMappingURL=pii-guard.js.map

package/dist/defence/pipeline.d.ts

@@ -17,4 +17,3 @@ export declare function runDefencePipeline(content: string, title: string, sourc
  * Fail-OPEN: if verification fails/times out, original verdict stands.
  */
 export declare function runDefencePipelineWithVerify(content: string, title: string, source: DefenceSource, config?: DefenceConfig, project?: string): Promise<DefencePipelineResultWithVerify>;
-//# sourceMappingURL=pipeline.d.ts.map

package/dist/defence/pipeline.js

@@ -346,4 +346,3 @@ export async function runDefencePipelineWithVerify(content, title, source, confi
     }
     return { ...result, verification };
 }
-//# sourceMappingURL=pipeline.js.map

package/dist/defence/quarantine/auto-expire.d.ts

@@ -12,4 +12,3 @@
  * @returns Number of items expired (rejected)
  */
 export declare function expireQuarantineItems(ttlDays?: number): number;
-//# sourceMappingURL=auto-expire.d.ts.map

package/dist/defence/quarantine/auto-expire.js

@@ -35,4 +35,3 @@ export function expireQuarantineItems(ttlDays = 7) {
     }
     return result.changes;
 }
-//# sourceMappingURL=auto-expire.js.map

package/dist/defence/scanner/index.d.ts

@@ -2,4 +2,3 @@
  * Scanner module — retroactive memory scanning for poisoning detection.
  */
 export { scanExistingMemories, type ScanOptions, type ScanReport, type ThreatFinding, } from './scan-existing.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/scanner/index.js

@@ -2,4 +2,3 @@
  * Scanner module — retroactive memory scanning for poisoning detection.
  */
 export { scanExistingMemories, } from './scan-existing.js';
-//# sourceMappingURL=index.js.map

package/dist/defence/scanner/scan-existing.d.ts

@@ -31,4 +31,3 @@ export interface ScanReport {
  * Scan existing memories for signs of poisoning or sensitive data exposure.
  */
 export declare function scanExistingMemories(options?: ScanOptions): ScanReport;
-//# sourceMappingURL=scan-existing.d.ts.map

package/dist/defence/scanner/scan-existing.js

@@ -133,4 +133,3 @@ export function scanExistingMemories(options) {
         summary,
     };
 }
-//# sourceMappingURL=scan-existing.js.map

package/dist/defence/sensitivity/classifier.d.ts

@@ -3,4 +3,3 @@
  */
 import type { SensitivityClassification } from '../types.js';
 export declare function classifyContent(content: string, title: string): SensitivityClassification;
-//# sourceMappingURL=classifier.d.ts.map

package/dist/defence/sensitivity/classifier.js

@@ -47,4 +47,3 @@ export function classifyContent(content, title) {
         redactionRequired: level === 'RESTRICTED',
     };
 }
-//# sourceMappingURL=classifier.js.map

package/dist/defence/sensitivity/index.d.ts

@@ -8,4 +8,3 @@ export { classifyContent } from './classifier.js';
  * Classify content sensitivity — convenience wrapper around classifyContent.
  */
 export declare function classifySensitivity(content: string, title: string): SensitivityClassification;
-//# sourceMappingURL=index.d.ts.map

package/dist/defence/sensitivity/index.js

@@ -10,4 +10,3 @@ export { classifyContent } from './classifier.js';
 export function classifySensitivity(content, title) {
     return classifyContent(content, title);
 }
-//# sourceMappingURL=index.js.map

package/dist/defence/sensitivity/patterns.d.ts

@@ -11,4 +11,3 @@ export interface SensitivityPattern {
 export declare const RESTRICTED_PATTERNS: SensitivityPattern[];
 export declare const CONFIDENTIAL_PATTERNS: SensitivityPattern[];
 export declare const INTERNAL_PATTERNS: SensitivityPattern[];
-//# sourceMappingURL=patterns.d.ts.map

package/dist/defence/sensitivity/patterns.js

@@ -64,4 +64,3 @@ export const INTERNAL_PATTERNS = [
     { pattern: /\b(?:meeting\s*notes?|standup|retro(?:spective)?|sprint\s*review)\b/gi, label: 'meeting-notes', weight: 0.45 },
     { pattern: /\b(?:DRAFT|INTERNAL(?:\s+ONLY)?|DO NOT (?:SHARE|DISTRIBUTE))\b/gi, label: 'internal-label', weight: 0.60 },
 ];
-//# sourceMappingURL=patterns.js.map

package/dist/defence/sensitivity/redaction.d.ts

@@ -14,4 +14,3 @@ export declare function redactContent(content: string): string;
  * - INTERNAL / PUBLIC: return as-is
  */
 export declare function redactForDisplay(content: string, level: SensitivityLevel): string;
-//# sourceMappingURL=redaction.d.ts.map

package/dist/defence/sensitivity/redaction.js

@@ -44,4 +44,3 @@ export function redactForDisplay(content, level) {
     }
     return content;
 }
-//# sourceMappingURL=redaction.js.map

package/dist/defence/skill-scanner/deep-scan.d.ts

@@ -27,4 +27,3 @@ export declare function runDeepScan(files: Array<{
     content: string;
     format?: string;
 }>): Promise<DeepScanResult>;
-//# sourceMappingURL=deep-scan.d.ts.map

package/dist/defence/skill-scanner/deep-scan.js

@@ -109,4 +109,3 @@ export async function runDeepScan(files) {
         degradedReason,
     };
 }
-//# sourceMappingURL=deep-scan.js.map