theorum 0.1.15 → 1.1.3

package/esm/mod.d.ts

@@ -11,24 +11,31 @@
  *
  * const profile = defineProfile({
  *   id: "assistant.basic",
- *   model: {
- *     allow: ["gemini35FlashLite"],
- *     config: {
- *       gemini35FlashLite: {
- *         apiId: "gemini-3.5-flash-lite",
- *         thinking: { on: "high", off: "minimal" },
- *         thinkingLevels: ["minimal", "low", "medium", "high"],
- *         summaries: { on: "auto", off: "none" },
- *         maxOutputTokens: 8192,
- *         temperature: 1,
- *         keyBuiltins: [],
- *       },
+ *   type: "text",
+ *   identity: {
+ *     handle: "assistant",
+ *     system: "Answer plainly.",
+ *   },
+ *   models: {
+ *     default: {
+ *       protocol: "openAi",
+ *       provider: "openrouter",
+ *       apiId: "perplexity/sonar",
+ *       efforts: { normal: "minimal" },
+ *       summaries: false,
+ *       maxOutputTokens: 8192,
+ *       temperature: 1,
  *     },
  *   },
+ *   maxSteps: 1,
  *   tools: { allow: [] },
  *   inputs: { text: true },
- *   outputs: {},
- *   guardrails: { quota: { perDay: 100 } },
+ *   outputs: {
+ *     streaming: { streamThoughts: false },
+ *   },
+ *   guardrails: {
+ *     quota: { perDay: 100 },
+ *   },
  * });
  *
  * registerProfile(profile);
@@ -37,23 +44,45 @@
  * @module
  */
 import "./_dnt.polyfills.js";
-export { describeError, isAbortError, publicError, TheorumError, throwIfAborted, toErrorEvent, } from './src/guardrails/error.js';
-export type { QuotaSlotStatus } from './src/guardrails/quota.js';
-export { clientIp, quotaMessage, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
-export { PROJECT_ID_MAX, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, } from './src/guardrails/sanitize.js';
+export { describeError, isAbortError, PUBLIC_CANARY, publicError, TheorumError, throwIfAborted, toErrorEvent, } from './src/guardrails/error.js';
+export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './src/guardrails/events.js';
+export { GUARDRAIL_MATCH_PREVIEW_MAX, hitFromSpan, matchPreview, projectGuardrailEvent, } from './src/guardrails/hits.js';
+export type { LexiconKey, LexiconOverrides, LexiconParams } from './src/guardrails/lexicon.js';
+export { LEXICON_KEYS, lexiconDefault, lexiconText, overrideLexicon, resetLexicon, } from './src/guardrails/lexicon.js';
+export type { AdvisoryLevel, CanaryGateResult, CanaryGateSession, CanaryGuardrailSpec, CanaryStreamGate, DetectionOptions, EgressEnforcer, EgressOnBlock, GuardedToolText, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, LiveOutboundBatchResult, LiveOutboundGateSession, NetworkGuardrailSpec, OutboundPayload, ProfileEgressSpec, ProfileGuardrailsSpec, ProgressiveYieldGate, ProgressiveYieldGateOptions, ProgressiveYieldResult, Provenance, QuotaGuardrailSpec, ResolvedGuardrailPolicy, ScanText, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, Verdict, } from './src/guardrails/mod.js';
+export { ADVISORY_LEVELS, bindCanary, checkTaintGate, collectEgressHits, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DEFAULT_HOLDBACK, DIRECTIVE_RULES, detectionForTrust, directiveHits, EGRESS_ON_BLOCK, EGRESS_RULES, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, looksDirective, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, runEnforcer, SEVERITIES, scanTextForCanaryLeak, scanTextOf, standardEgressEnforce, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
+export { assertSafeUrl, isLocalhostName, isPrivateOrLocalAddress, } from './src/guardrails/network.js';
+export type { QuotaExhausted, QuotaSlotStatus } from './src/guardrails/quota.js';
+export { clientIp, quotaExhausted, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
+export { detectionForProfile, detectText, PROJECT_ID_MAX, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestForTrace, sanitizeTurnRequestWithEvents, } from './src/guardrails/sanitize.js';
 export type { CompactionSplit, CompactionTokens } from './src/kernel/engine/compaction.js';
 export { compactionMeter, compactionNeeded, estimateHistoryTokens, HISTORY_MEDIA_TOKENS, HISTORY_TEXT_ENCODING, resolveCompactionTokens, resolveHistoryTokens, shouldCompact, splitForCompaction, } from './src/kernel/engine/compaction.js';
+export { prepareLiveInboundText } from './src/kernel/engine/live-inbound.js';
+export type { LiveIngressChannel } from './src/kernel/engine/live-ingress.js';
+export { assertLiveIngress, assertLiveIngressConfigured, hasAnyLiveIngress, liveIngressChannelDefault, liveIngressEnabled, liveIngressEnabledFromSpec, } from './src/kernel/engine/live-ingress.js';
 export { runTurn } from './src/kernel/engine/runner.js';
-export { CATALOG, clampThinkingLevel, clampThinkingLevelForApiId, getTool, listBuiltinIds, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, registerTools, requireModelSpec, resetTools, } from './src/kernel/registry/catalog.js';
-export type { ProfileDefinition } from './src/kernel/registry/profiles.js';
+export type { RunSessionOptions } from './src/kernel/engine/session/mod.js';
+export { runSession } from './src/kernel/engine/session/mod.js';
+export type { ProfileGraphEditor, ProfileGraphFacet, ProfileGraphFacetId, ProfileGraphRole, } from './src/kernel/profile-graph.js';
+export { PROFILE_GRAPH, profileGraphFacet, spineFacetsForProfileType, } from './src/kernel/profile-graph.js';
+export { assertAttachmentLimits, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, sanitizeTurnBlobsForProfile, } from './src/kernel/registry/attachments.js';
+export type { MediaInputChannel } from './src/kernel/registry/catalog.js';
+export { clampThinkingLevel, clampThinkingLevelForApiId, mediaChannelForMime, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, requireModelBinding, } from './src/kernel/registry/catalog.js';
+export type { ImageProfileDefinition, LiveProfileDefinition, ProfileDefinition, ProfileDefinitionBase, SpeechProfileDefinition, TextProfileDefinition, } from './src/kernel/registry/profiles.js';
 export { clearProfiles, defineProfile, getProfile, hasProfile, listProfiles, registerProfile, registerProfiles, } from './src/kernel/registry/profiles.js';
-export { projectProfile, resolveTurn } from './src/kernel/registry/resolve.js';
+export { pickModel, projectProfile, resolveTurn } from './src/kernel/registry/resolve.js';
 export { getStructured, registerStructured } from './src/kernel/registry/schemas.js';
-export { executeTool } from './src/kernel/registry/tools.js';
-export type { ProfileResumeSpec, TurnContinueFrom, TurnStop, TurnStopKind, } from './src/kernel/stop.js';
-export { AUTO_CONTINUE_DELAY_MS, CONTINUE_INSTRUCTION, DEFAULT_AUTO_CONTINUE, GenerationStopError, isGenerationStopError, isResumeableStop, isUserCancelledStop, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenRouter, } from './src/kernel/stop.js';
+export type { AuthUnauthenticatedPolicy, ContinueStopKind, CustomToolType, HttpMethod, PlaygroundAuthType, ToolAccess, ToolAuthType, ToolPermission, ToolType, TurnStopKind, } from './src/kernel/schema.js';
+export { ATTACHMENT_ACCEPT_MIMES, AUTH_UNAUTHENTICATED_POLICIES, AWAITING_USER_INPUT_KINDS, AWAITING_USER_INPUT_STATUS, COMPACTION_METERS, COMPACTION_TIMINGS, CONTINUE_STOP_KINDS, catalogPathFor, coerceProtocol, coerceProvider, coerceSpeechFormat, DYNAMIC_FIELD_PARENTS, EXTRA_FIELDS, fieldMeta, HTTP_METHODS, isSpeechFormatAllowedForProtocol, isToolGateKind, isTurnInjectStage, isTurnStage, isValidPair, isValidProfileProtocol, KEY_SLOTS, LIVE_ACTIVITY_HANDLINGS, LIVE_CONTEXT_COMPRESSIONS, LIVE_SPEECH_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, OVERFLOW_KEY_SLOTS, PLAYGROUND_AUTH_TYPES, PROFILE_FIELDS, PROFILE_TYPE_PROTOCOLS, PROFILE_TYPES, PROTOCOL_PROVIDERS, PROTOCOLS, PROVIDERS, protocolsFor, protocolsForProfileType, providersFor, SCHEMA_ENFORCEMENTS, SPEECH_AUDIO_FORMATS, STREAM_MODES, SUMMARY_MODES, speechFormatsForProtocol, THINKING_LEVELS, TOOL_ACCESS, TOOL_AUTH_TYPES, TOOL_GATE_KINDS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_INJECT_STAGES, TURN_STAGES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
+export type { AwaitingUserInput, StageAffordance, StageApplyInput, StageApplyOutput, StageApplyWarning, StageApplyWarningCode, StageContext, StageEventExtra, StageHandler, StageMutate, StageResult, } from './src/kernel/stages.js';
+export { applyStageResult, isAwaitingUserInput, parseAwaitingUserInput, parseToolGate, STAGE_AFFORDANCE_MATRIX, STAGE_AFFORDANCES, stageAllowsAffordance, stageEventFields, } from './src/kernel/stages.js';
+export type { ProfileTurnBehaviourSpec, ProfileTurnResumptionSpec, TurnContinueFrom, TurnStop, } from './src/kernel/stop.js';
+export { AUTO_CONTINUE_DELAY_MS, CONTINUE_INSTRUCTION, DEFAULT_ALLOW_CONTINUE, DEFAULT_AUTO_CONTINUE, GenerationStopError, isContinueStopKind, isGenerationStopError, isResumeableStop, isUserCancelledStop, profileAllowsInject, profileAllowsSteering, profileTurnResumption, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenAiFinishReason, } from './src/kernel/stop.js';
+export type { McpProtocolVersion, McpRpcResponse } from './src/kernel/tools/mod.js';
+export { buildHttpToolTarget, executeHttpTool, executeMcpTool, formatToolResult, getTool, hasTool, invokeTool, isUnsupportedMcpProtocolError, listBuiltinIds, listFunctionIds, listTools, MCP_PROTOCOL_VERSIONS, parseMcpRpcResponse, prepareTurnToolSnapshot, registerHarnessTools, registerTool, registerTools, requireTool, resetTools, resolveToolAuth, } from './src/kernel/tools/mod.js';
 export type * from './src/kernel/types.js';
-export { jsonlSink, memorySink, noopSink, resolveTraceDir, sinkFromDir, writeTrace, } from './src/observability/trace.js';
-export type { TraceRecord } from './src/observability/trace-record.js';
-export type { CreateProviderOptions, GeminiTransport, GeminiVault, LocalProviderConfig, } from './src/providers/mod.js';
-export { createLocalProvider, createProvider, DEFAULT_LOCAL_BASE_URL, } from './src/providers/mod.js';
+export type { JsonlSinkOptions, JsonlTraceDestination, ProfileObservabilitySpec, ResolvedObservabilityPolicy, ResolvedTraceInclude, ResolvedTraceScrub, TraceDestination, TraceIncludeSpec, TraceRecord, TraceScrubSpec, TraceSink, } from './src/observability/mod.js';
+export { clearTraceDestinations, getTraceDestination, isJsonlTraceDestination, isTraceSink, jsonlDestination, jsonlSink, listTraceDestinationIds, memorySink, noopSink, registerTraceDestination, requireTraceDestination, resolveObservabilityPolicy, resolveTraceDir, resolveTraceWriter, sinkFromDir, writeTrace, } from './src/observability/mod.js';
+export * from './src/presets/mod.js';
+export type { CreateProviderOptions, GeminiTransport, KeyVault, LocalProviderConfig, OpenAiGatewayConfig, } from './src/providers/mod.js';
+export { createProvider } from './src/providers/mod.js';

package/esm/mod.js

@@ -11,24 +11,31 @@
  *
  * const profile = defineProfile({
  *   id: "assistant.basic",
- *   model: {
- *     allow: ["gemini35FlashLite"],
- *     config: {
- *       gemini35FlashLite: {
- *         apiId: "gemini-3.5-flash-lite",
- *         thinking: { on: "high", off: "minimal" },
- *         thinkingLevels: ["minimal", "low", "medium", "high"],
- *         summaries: { on: "auto", off: "none" },
- *         maxOutputTokens: 8192,
- *         temperature: 1,
- *         keyBuiltins: [],
- *       },
+ *   type: "text",
+ *   identity: {
+ *     handle: "assistant",
+ *     system: "Answer plainly.",
+ *   },
+ *   models: {
+ *     default: {
+ *       protocol: "openAi",
+ *       provider: "openrouter",
+ *       apiId: "perplexity/sonar",
+ *       efforts: { normal: "minimal" },
+ *       summaries: false,
+ *       maxOutputTokens: 8192,
+ *       temperature: 1,
  *     },
  *   },
+ *   maxSteps: 1,
  *   tools: { allow: [] },
  *   inputs: { text: true },
- *   outputs: {},
- *   guardrails: { quota: { perDay: 100 } },
+ *   outputs: {
+ *     streaming: { streamThoughts: false },
+ *   },
+ *   guardrails: {
+ *     quota: { perDay: 100 },
+ *   },
  * });
  *
  * registerProfile(profile);
@@ -37,16 +44,29 @@
  * @module
  */
 import "./_dnt.polyfills.js";
-export { describeError, isAbortError, publicError, TheorumError, throwIfAborted, toErrorEvent, } from './src/guardrails/error.js';
-export { clientIp, quotaMessage, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
-export { PROJECT_ID_MAX, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, } from './src/guardrails/sanitize.js';
+export { describeError, isAbortError, PUBLIC_CANARY, publicError, TheorumError, throwIfAborted, toErrorEvent, } from './src/guardrails/error.js';
+export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './src/guardrails/events.js';
+export { GUARDRAIL_MATCH_PREVIEW_MAX, hitFromSpan, matchPreview, projectGuardrailEvent, } from './src/guardrails/hits.js';
+export { LEXICON_KEYS, lexiconDefault, lexiconText, overrideLexicon, resetLexicon, } from './src/guardrails/lexicon.js';
+export { ADVISORY_LEVELS, bindCanary, checkTaintGate, collectEgressHits, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DEFAULT_HOLDBACK, DIRECTIVE_RULES, detectionForTrust, directiveHits, EGRESS_ON_BLOCK, EGRESS_RULES, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, looksDirective, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, runEnforcer, SEVERITIES, scanTextForCanaryLeak, scanTextOf, standardEgressEnforce, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
+export { assertSafeUrl, isLocalhostName, isPrivateOrLocalAddress, } from './src/guardrails/network.js';
+export { clientIp, quotaExhausted, releaseSlot, resetSlots, skipQuota, takeSlot, } from './src/guardrails/quota.js';
+export { detectionForProfile, detectText, PROJECT_ID_MAX, redactSensitiveOnly, sanitizeProjectId, sanitizeText, sanitizeTurnRequest, sanitizeTurnRequestForTrace, sanitizeTurnRequestWithEvents, } from './src/guardrails/sanitize.js';
 export { compactionMeter, compactionNeeded, estimateHistoryTokens, HISTORY_MEDIA_TOKENS, HISTORY_TEXT_ENCODING, resolveCompactionTokens, resolveHistoryTokens, shouldCompact, splitForCompaction, } from './src/kernel/engine/compaction.js';
+export { prepareLiveInboundText } from './src/kernel/engine/live-inbound.js';
+export { assertLiveIngress, assertLiveIngressConfigured, hasAnyLiveIngress, liveIngressChannelDefault, liveIngressEnabled, liveIngressEnabledFromSpec, } from './src/kernel/engine/live-ingress.js';
 export { runTurn } from './src/kernel/engine/runner.js';
-export { CATALOG, clampThinkingLevel, clampThinkingLevelForApiId, getTool, listBuiltinIds, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, registerTools, requireModelSpec, resetTools, } from './src/kernel/registry/catalog.js';
+export { runSession } from './src/kernel/engine/session/mod.js';
+export { PROFILE_GRAPH, profileGraphFacet, spineFacetsForProfileType, } from './src/kernel/profile-graph.js';
+export { assertAttachmentLimits, maxBytesForMime, requireMediaLimits, resolveMediaLimits, sanitizeCsvText, sanitizeTurnBlobs, sanitizeTurnBlobsForProfile, } from './src/kernel/registry/attachments.js';
+export { clampThinkingLevel, clampThinkingLevelForApiId, mediaChannelForMime, mediaKindForMime, mimeAllowed, mimeEssence, modelEntryByApiId, requireModelBinding, } from './src/kernel/registry/catalog.js';
 export { clearProfiles, defineProfile, getProfile, hasProfile, listProfiles, registerProfile, registerProfiles, } from './src/kernel/registry/profiles.js';
-export { projectProfile, resolveTurn } from './src/kernel/registry/resolve.js';
+export { pickModel, projectProfile, resolveTurn } from './src/kernel/registry/resolve.js';
 export { getStructured, registerStructured } from './src/kernel/registry/schemas.js';
-export { executeTool } from './src/kernel/registry/tools.js';
-export { AUTO_CONTINUE_DELAY_MS, CONTINUE_INSTRUCTION, DEFAULT_AUTO_CONTINUE, GenerationStopError, isGenerationStopError, isResumeableStop, isUserCancelledStop, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenRouter, } from './src/kernel/stop.js';
-export { jsonlSink, memorySink, noopSink, resolveTraceDir, sinkFromDir, writeTrace, } from './src/observability/trace.js';
-export { createLocalProvider, createProvider, DEFAULT_LOCAL_BASE_URL, } from './src/providers/mod.js';
+export { ATTACHMENT_ACCEPT_MIMES, AUTH_UNAUTHENTICATED_POLICIES, AWAITING_USER_INPUT_KINDS, AWAITING_USER_INPUT_STATUS, COMPACTION_METERS, COMPACTION_TIMINGS, CONTINUE_STOP_KINDS, catalogPathFor, coerceProtocol, coerceProvider, coerceSpeechFormat, DYNAMIC_FIELD_PARENTS, EXTRA_FIELDS, fieldMeta, HTTP_METHODS, isSpeechFormatAllowedForProtocol, isToolGateKind, isTurnInjectStage, isTurnStage, isValidPair, isValidProfileProtocol, KEY_SLOTS, LIVE_ACTIVITY_HANDLINGS, LIVE_CONTEXT_COMPRESSIONS, LIVE_SPEECH_SENSITIVITIES, MEDIA_INPUT_KIND_VALUES, MEDIA_INPUT_KINDS, MEDIA_WILDCARDS, OVERFLOW_KEY_SLOTS, PLAYGROUND_AUTH_TYPES, PROFILE_FIELDS, PROFILE_TYPE_PROTOCOLS, PROFILE_TYPES, PROTOCOL_PROVIDERS, PROTOCOLS, PROVIDERS, protocolsFor, protocolsForProfileType, providersFor, SCHEMA_ENFORCEMENTS, SPEECH_AUDIO_FORMATS, STREAM_MODES, SUMMARY_MODES, speechFormatsForProtocol, THINKING_LEVELS, TOOL_ACCESS, TOOL_AUTH_TYPES, TOOL_GATE_KINDS, TOOL_LOAD_TIERS, TOOL_PERMISSION, TOOL_TYPES, TURN_INJECT_STAGES, TURN_STAGES, TURN_STOP_KINDS, VOICE_ACCEPT_MIMES, } from './src/kernel/schema.js';
+export { applyStageResult, isAwaitingUserInput, parseAwaitingUserInput, parseToolGate, STAGE_AFFORDANCE_MATRIX, STAGE_AFFORDANCES, stageAllowsAffordance, stageEventFields, } from './src/kernel/stages.js';
+export { AUTO_CONTINUE_DELAY_MS, CONTINUE_INSTRUCTION, DEFAULT_ALLOW_CONTINUE, DEFAULT_AUTO_CONTINUE, GenerationStopError, isContinueStopKind, isGenerationStopError, isResumeableStop, isUserCancelledStop, profileAllowsInject, profileAllowsSteering, profileTurnResumption, shouldAutoContinue, turnStopFromClientStreamEnd, turnStopFromInteractionStatus, turnStopFromOpenAiFinishReason, } from './src/kernel/stop.js';
+export { buildHttpToolTarget, executeHttpTool, executeMcpTool, formatToolResult, getTool, hasTool, invokeTool, isUnsupportedMcpProtocolError, listBuiltinIds, listFunctionIds, listTools, MCP_PROTOCOL_VERSIONS, parseMcpRpcResponse, prepareTurnToolSnapshot, registerHarnessTools, registerTool, registerTools, requireTool, resetTools, resolveToolAuth, } from './src/kernel/tools/mod.js';
+export { clearTraceDestinations, getTraceDestination, isJsonlTraceDestination, isTraceSink, jsonlDestination, jsonlSink, listTraceDestinationIds, memorySink, noopSink, registerTraceDestination, requireTraceDestination, resolveObservabilityPolicy, resolveTraceDir, resolveTraceWriter, sinkFromDir, writeTrace, } from './src/observability/mod.js';
+export * from './src/presets/mod.js';
+export { createProvider } from './src/providers/mod.js';

package/esm/src/cli/commands/bench.js

@@ -12,11 +12,12 @@
  *
  * @module
  */
+import { bindCanary, eventHasCanary, mintCanary } from '../../guardrails/canary.js';
 import { sanitizeTurnRequest } from '../../guardrails/sanitize.js';
-import { bindCanary, eventHasCanary, mintCanary } from '../../kernel/engine/boundary.js';
 import { runTurn } from '../../kernel/engine/runner.js';
 import { clearProfiles, registerProfile } from '../../kernel/registry/profiles.js';
-import { pickSystemRole, resolveTurn } from '../../kernel/registry/resolve.js';
+import { resolveTurn } from '../../kernel/registry/resolve.js';
+import { pickSystemRole } from '../../kernel/registry/system-role.js';
 import { buildRecord } from '../../observability/trace-record.js';
 const DEFAULT_CHUNKS = 200;
 const DEFAULT_ITERATIONS = 50;
@@ -25,28 +26,27 @@ const MS_PER_SEC = 1000;
 const BENCH_PROFILE_ID = '__bench__';
 function registerBenchProfile() {
     registerProfile({
+        type: 'text',
         id: BENCH_PROFILE_ID,
         identity: {
             handle: 'bench',
             system: 'You are a benchmark stub.',
         },
-        model: {
-            protocol: 'openAi',
-            provider: 'openrouter',
-            allow: ['bench-model'],
-            config: {
-                'bench-model': {
-                    apiId: 'bench-model',
-                    thinking: { on: 'none', off: 'none' },
-                    thinkingLevels: ['none'],
-                    summaries: { on: 'none', off: 'none' },
-                    maxOutputTokens: 4096,
-                    temperature: 0,
-                    keyBuiltins: [],
-                },
+        models: {
+            'bench-model': {
+                protocol: 'openAi',
+                provider: 'openrouter',
+                apiId: 'bench-model',
+                efforts: { normal: 'none' },
+                summaries: false,
+                maxOutputTokens: 4096,
+                temperature: 0,
+                builtInTools: [],
             },
-            thinking: 'none',
         },
+        defaultModel: 'bench-model',
+        tools: { allow: [] },
+        inputs: { text: true },
         guardrails: {
             canary: true,
             sanitizeInput: true,
@@ -94,7 +94,7 @@ async function measureRawProvider(provider) {
         model: 'bench-model',
         apiId: 'bench-model',
         thinking: 'none',
-        summaries: 'none',
+        summaries: undefined,
         maxOutputTokens: 4096,
         temperature: 0,
         builtins: [],

package/esm/src/cli/commands/fuzz-canary.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Adversarial canary egress fuzzer.
+ *
+ * Pipes synthetic model leak attempts through the real runTurn stream gate
+ * and Live batch gate, then reports bypasses — output that still contains
+ * the raw per-turn canary token where the gate should have blocked.
+ *
+ * @module
+ */
+/** Run adversarial canary fuzz; returns true when no bypasses or false alarms. */
+export declare function fuzzCanaryCommand(options?: {
+    canary?: string;
+}): Promise<boolean>;

package/esm/src/cli/commands/fuzz-canary.js

@@ -0,0 +1,191 @@
+/**
+ * Adversarial canary egress fuzzer.
+ *
+ * Pipes synthetic model leak attempts through the real runTurn stream gate
+ * and Live batch gate, then reports bypasses — output that still contains
+ * the raw per-turn canary token where the gate should have blocked.
+ *
+ * @module
+ */
+import { bindCanary, mintCanary, scanTextForCanaryLeak } from '../../guardrails/canary.js';
+import { buildCanaryEgressAttacks, FIXED_CANARY, } from '../../guardrails/corpus/canary-egress-attacks.js';
+import { createLiveOutboundGateSession, finalizeLiveOutboundTurn, processLiveOutboundBatch, } from '../../guardrails/live-outbound-gate.js';
+import { yieldProviderEvents } from '../../kernel/engine/runner/stream.js';
+import { clearProfiles, getProfile, registerProfile } from '../../kernel/registry/profiles.js';
+import { resolveTurn } from '../../kernel/registry/resolve.js';
+const FUZZ_PROFILE_ID = '__fuzz_canary__';
+function registerFuzzCanaryProfile() {
+    registerProfile({
+        type: 'text',
+        id: FUZZ_PROFILE_ID,
+        identity: { handle: 'fuzz-canary', system: 'Canary fuzz profile.' },
+        models: {
+            'fuzz-model': {
+                protocol: 'openAi',
+                provider: 'openrouter',
+                apiId: 'fuzz-model',
+                efforts: { normal: 'none' },
+                summaries: false,
+                maxOutputTokens: 4096,
+                temperature: 0,
+                builtInTools: [],
+            },
+        },
+        defaultModel: 'fuzz-model',
+        tools: { allow: [] },
+        inputs: { text: true },
+        guardrails: { canary: true },
+    });
+}
+function resolveFuzzGeneration(canary) {
+    const { generation } = resolveTurn({
+        profile: FUZZ_PROFILE_ID,
+        input: { text: 'fuzz' },
+    });
+    return { ...generation, canary };
+}
+async function collectEvents(gen) {
+    const out = [];
+    for await (const event of gen) {
+        out.push(event);
+    }
+    return out;
+}
+function clientVisibleWire(events) {
+    return JSON.stringify(events.filter((event) => event.type !== 'error'));
+}
+function literalCanaryReachedClient(events, canary) {
+    return clientVisibleWire(events).includes(canary);
+}
+function gateBlocked(events) {
+    return events.some((event) => event.type === 'error');
+}
+async function runStreamChannel(attack, generation, canary) {
+    async function* mockProvider() {
+        await Promise.resolve();
+        for (const event of attack.events) {
+            yield event;
+        }
+    }
+    const events = await collectEvents(yieldProviderEvents({
+        profile: getProfile(FUZZ_PROFILE_ID),
+        generation,
+        system: bindCanary('fuzz system', canary),
+        provider: { complete: mockProvider },
+        upstream: [],
+    }));
+    const blocked = gateBlocked(events);
+    const bypassed = attack.shouldBlock && literalCanaryReachedClient(events, canary);
+    const falseAlarm = !attack.shouldBlock && blocked;
+    return {
+        attack,
+        channel: 'runTurn.stream',
+        blocked,
+        bypassed,
+        falseAlarm,
+        clientWire: clientVisibleWire(events),
+    };
+}
+async function runLiveBatchChannel(attack, canary) {
+    const session = createLiveOutboundGateSession(getProfile(FUZZ_PROFILE_ID), canary);
+    const batch = await processLiveOutboundBatch(session, attack.events);
+    if (batch.action === 'withhold') {
+        return {
+            attack,
+            channel: 'live.batch',
+            blocked: true,
+            bypassed: false,
+            falseAlarm: !attack.shouldBlock,
+            clientWire: '',
+        };
+    }
+    const emitted = batch.action === 'emit' ? [...batch.events] : [];
+    const finalized = await finalizeLiveOutboundTurn(session);
+    if (finalized.action === 'withhold') {
+        return {
+            attack,
+            channel: 'live.batch',
+            blocked: true,
+            bypassed: false,
+            falseAlarm: !attack.shouldBlock,
+            clientWire: clientVisibleWire(emitted),
+        };
+    }
+    if (finalized.action === 'emit') {
+        emitted.push(...finalized.events);
+    }
+    const bypassed = attack.shouldBlock && literalCanaryReachedClient(emitted, canary);
+    const blocked = attack.shouldBlock && !bypassed;
+    return {
+        attack,
+        channel: 'live.batch',
+        blocked,
+        bypassed,
+        falseAlarm: false,
+        clientWire: clientVisibleWire(emitted),
+    };
+}
+function truncate(s, max) {
+    if (s.length <= max)
+        return s;
+    return `${s.slice(0, max - 3)}...`;
+}
+function printResults(results) {
+    const bypassed = results.filter((r) => r.bypassed);
+    const falseAlarms = results.filter((r) => r.falseAlarm);
+    const caught = results.filter((r) => r.attack.shouldBlock && r.blocked && !r.bypassed);
+    console.log(`\n${'═'.repeat(72)}`);
+    console.log(`  TOTAL: ${results.length} | CAUGHT: ${caught.length} | BYPASSED: ${bypassed.length} | FALSE ALARM: ${falseAlarms.length}`);
+    console.log(`${'═'.repeat(72)}`);
+    if (bypassed.length > 0) {
+        console.log('\n\x1b[31mBYPASSED (canary reached client-visible output):\x1b[0m\n');
+        for (const r of bypassed) {
+            console.log(`  ✗ ${r.attack.category}/${r.attack.name} [${r.channel}]`);
+            console.log(`    \x1b[2m${truncate(r.clientWire, 90)}\x1b[0m`);
+        }
+    }
+    if (falseAlarms.length > 0) {
+        console.log('\n\x1b[33mFALSE ALARMS (benign payload blocked):\x1b[0m\n');
+        for (const r of falseAlarms) {
+            console.log(`  ⚠ ${r.attack.category}/${r.attack.name} [${r.channel}]`);
+        }
+    }
+    if (bypassed.length === 0 && falseAlarms.length === 0) {
+        console.log('\n\x1b[32mAll leak attempts blocked; benign controls passed.\x1b[0m\n');
+    }
+    return bypassed.length === 0 && falseAlarms.length === 0;
+}
+/** Run adversarial canary fuzz; returns true when no bypasses or false alarms. */
+export async function fuzzCanaryCommand(options) {
+    console.log('\n🔐 Theorum Canary Egress Adversarial Fuzzer\n');
+    clearProfiles();
+    registerFuzzCanaryProfile();
+    const canary = options?.canary ?? FIXED_CANARY;
+    if (!/^theo-[0-9a-f]{32}$/.test(canary)) {
+        console.error(`Invalid canary shape (expected theo- + 32 hex): ${canary}`);
+        return false;
+    }
+    // Sanity: mint path uses same shape
+    const minted = mintCanary();
+    if (!/^theo-[0-9a-f]{32}$/.test(minted)) {
+        console.error(`mintCanary produced unexpected shape: ${minted}`);
+        return false;
+    }
+    const generation = resolveFuzzGeneration(canary);
+    const attacks = buildCanaryEgressAttacks(canary);
+    console.log(`Canary: ${canary.slice(0, 12)}… (${attacks.length} attacks × 2 channels)`);
+    const results = [];
+    for (const attack of attacks) {
+        results.push(await runStreamChannel(attack, generation, canary));
+        results.push(await runLiveBatchChannel(attack, canary));
+    }
+    // Spot-check scan helper matches expectations
+    if (!scanTextForCanaryLeak(canary, canary)) {
+        console.error('scanTextForCanaryLeak failed to detect literal canary');
+        return false;
+    }
+    const ok = printResults(results);
+    clearProfiles();
+    console.log('');
+    return ok;
+}

package/esm/src/cli/commands/fuzz-guardrails.d.ts

@@ -1,9 +1,7 @@
 /**
- * Adversarial guardrail fuzzer.
- *
- * Throws injection payloads at every sanitization ingress and reports
- * what gets through unchanged — meaning the guardrails missed it.
+ * Adversarial inbound guardrail fuzzer (CLI entry).
  *
  * @module
  */
-export declare function fuzzGuardrailsCommand(): void;
+/** Run inbound fuzz; returns true when no expected catches are missed. */
+export declare function fuzzGuardrailsCommand(): boolean;