usertrust 0.2.6 → 1.0.1

package/dist/ledger/pricing.d.ts

@@ -14,18 +14,22 @@ export interface ModelRates {
  * Key: model identifier as sent by the client.
  */
 export declare const PRICING_TABLE: Record<string, ModelRates>;
+/** Date the PRICING_TABLE rates were last verified against provider pricing pages. */
+export declare const PRICING_TABLE_VERSION = "2026-03-29";
 /** Fallback rate for unknown models (sonnet-class pricing). */
 export declare const FALLBACK_RATE: ModelRates;
+/** Return all PRICING_TABLE model keys that belong to a given provider. */
+export declare function modelsForProvider(provider: string): string[];
 /**
  * Look up rates by model string. Falls back to prefix matching,
  * then FALLBACK_RATE for unknown models.
  */
-export declare function getModelRates(model: string): ModelRates;
+export declare function getModelRates(model: string, customRates?: Record<string, ModelRates>): ModelRates;
 /**
  * Estimate cost in usertokens for a model call.
  * Returns at least 1 (floor to prevent zero-amount transfers).
  */
-export declare function estimateCost(model: string, inputTokens: number, outputTokens: number): number;
+export declare function estimateCost(model: string, inputTokens: number, outputTokens: number, customRates?: Record<string, ModelRates>): number;
 /**
  * Estimate input token count from a messages array.
  * Heuristic: ~4 chars/token with a 1.5x safety margin so the PENDING

package/dist/ledger/pricing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../src/ledger/pricing.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AAEH,MAAM,WAAW,UAAU;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA0CpD,CAAC;AAKF,+DAA+D;AAC/D,eAAO,MAAM,aAAa,EAAE,UAAiD,CAAC;AAE9E;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAUvD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAK7F;AA6BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAqC/D"}
+{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../../src/ledger/pricing.ts"],"names":[],"mappings":"AAGA;;;;;;GAMG;AAEH,MAAM,WAAW,UAAU;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA0CpD,CAAC;AAEF,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,eAAe,CAAC;AAKlD,+DAA+D;AAC/D,eAAO,MAAM,aAAa,EAAE,UAAiD,CAAC;AAiB9E,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAI5D;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,UAAU,CAejG;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC3B,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GACtC,MAAM,CAKR;AA6BD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAqC/D"}

package/dist/ledger/pricing.js

@@ -37,15 +37,43 @@ export const PRICING_TABLE = {
     // ── Amazon ──
     "nova-pro": { inputPer1k: 8, outputPer1k: 32 },
 };
+/** Date the PRICING_TABLE rates were last verified against provider pricing pages. */
+export const PRICING_TABLE_VERSION = "2026-03-29";
 /** Pre-sorted entries for prefix matching (longest key first). */
 const SORTED_TABLE = Object.entries(PRICING_TABLE).sort((a, b) => b[0].length - a[0].length);
 /** Fallback rate for unknown models (sonnet-class pricing). */
 export const FALLBACK_RATE = { inputPer1k: 30, outputPer1k: 150 };
+/** Maps provider names to their model key prefixes in PRICING_TABLE. */
+const PROVIDER_MODEL_MAP = {
+    anthropic: ["claude-"],
+    openai: ["gpt-", "o3", "o4-"],
+    google: ["gemini-"],
+    mistral: ["mistral-"],
+    deepseek: ["deepseek-"],
+    xai: ["grok-"],
+    meta: ["llama-"],
+    cohere: ["command-"],
+    perplexity: ["sonar-"],
+    alibaba: ["qwen-"],
+    amazon: ["nova-"],
+};
+/** Return all PRICING_TABLE model keys that belong to a given provider. */
+export function modelsForProvider(provider) {
+    const prefixes = PROVIDER_MODEL_MAP[provider];
+    if (!prefixes)
+        return [];
+    return Object.keys(PRICING_TABLE).filter((model) => prefixes.some((p) => model.startsWith(p)));
+}
 /**
  * Look up rates by model string. Falls back to prefix matching,
  * then FALLBACK_RATE for unknown models.
  */
-export function getModelRates(model) {
+export function getModelRates(model, customRates) {
+    if (customRates) {
+        const custom = customRates[model];
+        if (custom)
+            return custom;
+    }
     const exact = PRICING_TABLE[model];
     if (exact)
         return exact;
@@ -60,8 +88,8 @@ export function getModelRates(model) {
  * Estimate cost in usertokens for a model call.
  * Returns at least 1 (floor to prevent zero-amount transfers).
  */
-export function estimateCost(model, inputTokens, outputTokens) {
-    const rates = getModelRates(model);
+export function estimateCost(model, inputTokens, outputTokens, customRates) {
+    const rates = getModelRates(model, customRates);
     const inputCost = (inputTokens / 1000) * rates.inputPer1k;
     const outputCost = (outputTokens / 1000) * rates.outputPer1k;
     return Math.max(1, Math.ceil(inputCost + outputCost));

package/dist/ledger/pricing.js.map

@@ -1 +1 @@
-{"version":3,"file":"pricing.js","sourceRoot":"","sources":["../../src/ledger/pricing.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAejC;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAA+B;IACxD,kBAAkB;IAClB,mBAAmB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IACzD,kBAAkB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACvD,iBAAiB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAEvD,eAAe;IACf,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAC9C,aAAa,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE;IAClD,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAC/C,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACvC,SAAS,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE;IAE/C,sBAAsB;IACtB,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;IACtD,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;IACxD,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAEtD,gBAAgB;IAChB,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;IAEnD,iBAAiB;IACjB,eAAe,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;IACtD,mBAAmB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;IAE1D,YAAY;IACZ,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAE9C,2BAA2B;IAC3B,kBAAkB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;IAEzD,eAAe;IACf,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAEjD,mBAAmB;IACnB,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAEjD,gBAAgB;IAChB,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;IAEjD,eAAe;IACf,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;CAC9C,CAAC;AAEF,kEAAkE;AAClE,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAe,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AAE9E;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,4DAA4D;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,WAAmB,EAAE,YAAoB;IACpF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAA8B;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,KAAK,IAAK,KAAK,CAAC,IAAe,CAAC,MAAM,CAAC;IAC3E,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,KAAK,IAAK,KAAK,CAAC,OAAkB,CAAC,MAAM,CAAC;IAEjF,8CAA8C;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAoB,EAAE,CAAC;YAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;YACtB,CAAC;iBAAM,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,kDAAkD;IAClD,IAAI,KAAK,KAAK,CAAC;QAAE,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAEtD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAmB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,CAAC;IAEvC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACrD,MAAM,CAAC,GAAG,GAA8B,CAAC;QAEzC,mDAAmD;QACnD,SAAS,IAAI,EAAE,CAAC;QAEhB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;QAC7B,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACzD,MAAM,CAAC,GAAG,KAAgC,CAAC;gBAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,SAAS,IAAK,CAAC,CAAC,IAAe,CAAC,MAAM,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACP,WAAW,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBACvC,CAAC;YACF,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,WAAW,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,UAAU,GAAG,WAAW,CAAC;IAErC,qBAAqB;IACrB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"pricing.js","sourceRoot":"","sources":["../../src/ledger/pricing.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAejC;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAA+B;IACxD,kBAAkB;IAClB,mBAAmB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IACzD,kBAAkB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACvD,iBAAiB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAEvD,eAAe;IACf,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAC9C,aAAa,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAAE;IAClD,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAC/C,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;IACvC,SAAS,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE;IAE/C,sBAAsB;IACtB,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;IACtD,gBAAgB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;IACxD,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAEtD,gBAAgB;IAChB,eAAe,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;IAEnD,iBAAiB;IACjB,eAAe,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;IACtD,mBAAmB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;IAE1D,YAAY;IACZ,QAAQ,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAE9C,2BAA2B;IAC3B,kBAAkB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;IAEzD,eAAe;IACf,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAEjD,mBAAmB;IACnB,WAAW,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE;IAEjD,gBAAgB;IAChB,UAAU,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE;IAEjD,eAAe;IACf,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE;CAC9C,CAAC;AAEF,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,kEAAkE;AAClE,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7F,+DAA+D;AAC/D,MAAM,CAAC,MAAM,aAAa,GAAe,EAAE,UAAU,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AAE9E,wEAAwE;AACxE,MAAM,kBAAkB,GAA6B;IACpD,SAAS,EAAE,CAAC,SAAS,CAAC;IACtB,MAAM,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;IAC7B,MAAM,EAAE,CAAC,SAAS,CAAC;IACnB,OAAO,EAAE,CAAC,UAAU,CAAC;IACrB,QAAQ,EAAE,CAAC,WAAW,CAAC;IACvB,GAAG,EAAE,CAAC,OAAO,CAAC;IACd,IAAI,EAAE,CAAC,QAAQ,CAAC;IAChB,MAAM,EAAE,CAAC,UAAU,CAAC;IACpB,UAAU,EAAE,CAAC,QAAQ,CAAC;IACtB,OAAO,EAAE,CAAC,OAAO,CAAC;IAClB,MAAM,EAAE,CAAC,OAAO,CAAC;CACjB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IACjD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,WAAwC;IACpF,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,4DAA4D;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACzC,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC3B,KAAa,EACb,WAAmB,EACnB,YAAoB,EACpB,WAAwC;IAExC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IAC1D,MAAM,UAAU,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IAC7D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,KAA8B;IAC1D,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,KAAK,IAAK,KAAK,CAAC,IAAe,CAAC,MAAM,CAAC;IAC3E,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAAE,KAAK,IAAK,KAAK,CAAC,OAAkB,CAAC,MAAM,CAAC;IAEjF,8CAA8C;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAoB,EAAE,CAAC;YAC/C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;YACtB,CAAC;iBAAM,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YACtC,CAAC;QACF,CAAC;IACF,CAAC;IAED,kDAAkD;IAClD,IAAI,KAAK,KAAK,CAAC;QAAE,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAEtD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAmB;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,CAAC;IAEvC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACrD,MAAM,CAAC,GAAG,GAA8B,CAAC;QAEzC,mDAAmD;QACnD,SAAS,IAAI,EAAE,CAAC;QAEhB,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QAC1B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YACjC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;QAC7B,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACzD,MAAM,CAAC,GAAG,KAAgC,CAAC;gBAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACrD,SAAS,IAAK,CAAC,CAAC,IAAe,CAAC,MAAM,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACP,WAAW,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBACvC,CAAC;YACF,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,WAAW,IAAI,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,UAAU,GAAG,WAAW,CAAC;IAErC,qBAAqB;IACrB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/policy/canary.d.ts

@@ -0,0 +1,17 @@
+import type { CanaryToken } from "../shared/types.js";
+/**
+ * Generate a new canary token.
+ * Returns a 32-char hex token and an HTML comment marker.
+ */
+export declare function generateCanary(): CanaryToken;
+/**
+ * Inject a canary token into a system prompt.
+ * Prepends the HTML comment marker to the prompt.
+ */
+export declare function injectCanary(systemPrompt: string, canary: CanaryToken): string;
+/**
+ * Detect if a canary token leaked into model output.
+ * Returns true if the token appears anywhere in the output.
+ */
+export declare function detectCanaryLeak(output: string, canary: CanaryToken): boolean;
+//# sourceMappingURL=canary.d.ts.map

package/dist/policy/canary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary.d.ts","sourceRoot":"","sources":["../../src/policy/canary.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAI5C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAE9E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAE7E"}

package/dist/policy/canary.js

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+/**
+ * Canary Token Utilities
+ *
+ * Generate, inject, and detect canary tokens for prompt leak detection.
+ * A canary token is a random secret embedded in system prompts. If it
+ * appears in model output, the system prompt was leaked.
+ *
+ * Pure module — uses only Node.js crypto.
+ *
+ * INTEGRATION NOTE: These utilities are NOT automatically wired into the
+ * governance pipeline. Callers must manually:
+ *   1. Generate a canary: const canary = generateCanary()
+ *   2. Inject into system prompt: injectCanary(systemPrompt, canary)
+ *   3. After LLM response, check: detectCanaryLeak(output, canary)
+ *
+ * Automatic integration is planned for a future version.
+ */
+import { randomBytes } from "node:crypto";
+/**
+ * Generate a new canary token.
+ * Returns a 32-char hex token and an HTML comment marker.
+ */
+export function generateCanary() {
+    const token = randomBytes(16).toString("hex");
+    const marker = `<!-- ${token} -->`;
+    return { token, marker };
+}
+/**
+ * Inject a canary token into a system prompt.
+ * Prepends the HTML comment marker to the prompt.
+ */
+export function injectCanary(systemPrompt, canary) {
+    return `${canary.marker}\n${systemPrompt}`;
+}
+/**
+ * Detect if a canary token leaked into model output.
+ * Returns true if the token appears anywhere in the output.
+ */
+export function detectCanaryLeak(output, canary) {
+    return output.includes(canary.token);
+}
+//# sourceMappingURL=canary.js.map

package/dist/policy/canary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canary.js","sourceRoot":"","sources":["../../src/policy/canary.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC7B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,KAAK,MAAM,CAAC;IACnC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,YAAoB,EAAE,MAAmB;IACrE,OAAO,GAAG,MAAM,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,MAAmB;IACnE,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC"}

package/dist/policy/injection.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Prompt Injection Detector
+ *
+ * Multi-layer heuristic detection for prompt injection attempts.
+ * Recursively scans strings in objects/arrays and returns
+ * which injection patterns were matched and at which paths.
+ *
+ * Pure module — no side effects, no network calls.
+ *
+ * Layers:
+ *   1. Keyword combo matching (verb × object phrases)
+ *   2. Role boundary detection (role redefinition attempts)
+ *   3. Base64 evasion detection (encoded injection payloads)
+ *   4. Delimiter injection detection (escape attempts)
+ */
+import type { InjectionDetection } from "../shared/types.js";
+/**
+ * Detect prompt injection attempts in any value by recursively scanning
+ * strings in objects/arrays.
+ *
+ * Returns which injection patterns were matched and at which dot-paths.
+ */
+export declare function detectInjection(data: unknown): InjectionDetection;
+//# sourceMappingURL=injection.d.ts.map

package/dist/policy/injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../../src/policy/injection.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAyL7D;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,kBAAkB,CAejE"}

package/dist/policy/injection.js

@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+// ---------------------------------------------------------------------------
+// Layer 1: Keyword combo matching
+// ---------------------------------------------------------------------------
+const VERBS = [
+    "ignore",
+    "disregard",
+    "skip",
+    "forget",
+    "bypass",
+    "override",
+    "do not follow",
+    "stop following",
+    "forget about",
+];
+const OBJECTS = [
+    "instructions",
+    "rules",
+    "guidelines",
+    "system prompt",
+    "previous instructions",
+    "above instructions",
+    "context",
+    "constraints",
+];
+/** Pre-computed lowercased injection phrases (verb + " " + object). */
+const KEYWORD_COMBOS = [];
+for (const verb of VERBS) {
+    for (const obj of OBJECTS) {
+        KEYWORD_COMBOS.push(`${verb} ${obj}`);
+    }
+}
+function checkKeywordCombo(lower) {
+    for (const combo of KEYWORD_COMBOS) {
+        if (lower.includes(combo))
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Layer 2: Role boundary detection
+// ---------------------------------------------------------------------------
+const ROLE_PATTERNS = [
+    // Role redefinition
+    "you are now",
+    "act as if",
+    "pretend you are",
+    "from now on",
+    "new instructions:",
+    "### instruction",
+    "## system",
+    // System prompt extraction
+    "repeat your instructions",
+    "print your system prompt",
+    "what are your instructions",
+    "show me your prompt",
+    "output your system",
+];
+function checkRoleBoundary(lower) {
+    for (const pattern of ROLE_PATTERNS) {
+        if (lower.includes(pattern))
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Layer 3: Base64 evasion detection
+// ---------------------------------------------------------------------------
+const BASE64_RE = /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{20,}={0,2}(?![A-Za-z0-9=])/g;
+function checkBase64Evasion(value) {
+    const candidates = value.match(BASE64_RE);
+    if (!candidates)
+        return false;
+    for (const candidate of candidates) {
+        try {
+            const decoded = Buffer.from(candidate, "base64").toString("utf-8");
+            // Filter binary data: require printable ASCII only
+            if (!/^[\x20-\x7E\t\n\r]+$/.test(decoded))
+                continue;
+            const lower = decoded.toLowerCase();
+            if (checkKeywordCombo(lower) || checkRoleBoundary(lower))
+                return true;
+        }
+        catch {
+            // Invalid base64 — skip
+        }
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Layer 4: Delimiter injection detection
+// ---------------------------------------------------------------------------
+/** Triple backtick escape followed by system-like content. */
+const DELIMITER_BACKTICK_RE = /```[\s\S]*?(?:system|instruction|admin)/i;
+/** XML tag injection closing a role-like tag. */
+const DELIMITER_XML_RE = /<\/(?:system|user|assistant|human|ai)>/i;
+/** Markdown heading injection for role. */
+const DELIMITER_HEADING_RE = /^#{1,3}\s*(?:system|instruction|new role)/im;
+function checkDelimiterInjection(value) {
+    return (DELIMITER_BACKTICK_RE.test(value) ||
+        DELIMITER_XML_RE.test(value) ||
+        DELIMITER_HEADING_RE.test(value));
+}
+function scanString(value, currentPath, state) {
+    const normalized = value
+        .normalize("NFKC")
+        .replace(/\u200B|\u200C|\u200D|\uFEFF|\u00AD|\u200E|\u200F/g, "")
+        .toLowerCase();
+    if (checkKeywordCombo(normalized)) {
+        state.patterns.add("keyword_combo");
+        state.paths.push(currentPath ? `${currentPath}(keyword_combo)` : "(keyword_combo)");
+        if (0.9 > state.score)
+            state.score = 0.9;
+    }
+    if (checkRoleBoundary(normalized)) {
+        state.patterns.add("role_boundary");
+        state.paths.push(currentPath ? `${currentPath}(role_boundary)` : "(role_boundary)");
+        if (0.85 > state.score)
+            state.score = 0.85;
+    }
+    if (checkBase64Evasion(value)) {
+        state.patterns.add("base64_evasion");
+        state.paths.push(currentPath ? `${currentPath}(base64_evasion)` : "(base64_evasion)");
+        if (0.95 > state.score)
+            state.score = 0.95;
+    }
+    if (checkDelimiterInjection(value)) {
+        state.patterns.add("delimiter_injection");
+        state.paths.push(currentPath ? `${currentPath}(delimiter_injection)` : "(delimiter_injection)");
+        if (0.8 > state.score)
+            state.score = 0.8;
+    }
+}
+function scanValue(value, currentPath, state) {
+    if (typeof value === "string") {
+        scanString(value, currentPath, state);
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            const itemPath = currentPath ? `${currentPath}[${i}]` : `[${i}]`;
+            scanValue(value[i], itemPath, state);
+        }
+        return;
+    }
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        for (const key of Object.keys(record)) {
+            const fieldPath = currentPath ? `${currentPath}.${key}` : key;
+            scanValue(record[key], fieldPath, state);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Detect prompt injection attempts in any value by recursively scanning
+ * strings in objects/arrays.
+ *
+ * Returns which injection patterns were matched and at which dot-paths.
+ */
+export function detectInjection(data) {
+    const state = {
+        score: 0,
+        patterns: new Set(),
+        paths: [],
+    };
+    scanValue(data, "", state);
+    return {
+        detected: state.patterns.size > 0,
+        score: state.score,
+        patterns: [...state.patterns],
+        paths: state.paths,
+    };
+}
+//# sourceMappingURL=injection.js.map

package/dist/policy/injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.js","sourceRoot":"","sources":["../../src/policy/injection.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoBjC,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E,MAAM,KAAK,GAAG;IACb,QAAQ;IACR,WAAW;IACX,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,eAAe;IACf,gBAAgB;IAChB,cAAc;CACd,CAAC;AAEF,MAAM,OAAO,GAAG;IACf,cAAc;IACd,OAAO;IACP,YAAY;IACZ,eAAe;IACf,uBAAuB;IACvB,oBAAoB;IACpB,SAAS;IACT,aAAa;CACb,CAAC;AAEF,uEAAuE;AACvE,MAAM,cAAc,GAAa,EAAE,CAAC;AACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;IAC1B,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACvC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E,MAAM,aAAa,GAAa;IAC/B,oBAAoB;IACpB,aAAa;IACb,WAAW;IACX,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,iBAAiB;IACjB,WAAW;IACX,2BAA2B;IAC3B,0BAA0B;IAC1B,0BAA0B;IAC1B,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;CACpB,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAa;IACvC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,SAAS,GAAG,6DAA6D,CAAC;AAEhF,SAAS,kBAAkB,CAAC,KAAa;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACnE,mDAAmD;YACnD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACR,wBAAwB;QACzB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AAEzE,iDAAiD;AACjD,MAAM,gBAAgB,GAAG,yCAAyC,CAAC;AAEnE,2CAA2C;AAC3C,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAE3E,SAAS,uBAAuB,CAAC,KAAa;IAC7C,OAAO,CACN,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC5B,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAChC,CAAC;AACH,CAAC;AAYD,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAgB;IACvE,MAAM,UAAU,GAAG,KAAK;SACtB,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,mDAAmD,EAAE,EAAE,CAAC;SAChE,WAAW,EAAE,CAAC;IAEhB,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpF,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;IAC1C,CAAC;IAED,IAAI,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACpC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpF,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACrC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACtF,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IAC5C,CAAC;IAED,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC1C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,uBAAuB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAChG,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;IAC1C,CAAC;AACF,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,WAAmB,EAAE,KAAgB;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC1C,CAAC;IACF,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAa;IAC5C,MAAM,KAAK,GAAc;QACxB,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,IAAI,GAAG,EAAU;QAC3B,KAAK,EAAE,EAAE;KACT,CAAC;IAEF,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAE3B,OAAO;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;KAClB,CAAC;AACH,CAAC"}

package/dist/policy/pii.d.ts

@@ -7,7 +7,8 @@
  *
  * Pure module — no side effects, no network calls.
  *
- * Detects: email, phone, SSN, credit card (Luhn-validated), IPv4.
+ * Detects: email, phone, SSN, credit card (Luhn-validated), IPv4,
+ * API keys, AWS keys, GitHub tokens, bearer tokens, generic secrets.
  */
 export interface PIIDetection {
     /** Whether any PII was found */
@@ -23,4 +24,15 @@ export interface PIIDetection {
  * Returns which PII types were found and at which dot-paths.
  */
 export declare function detectPII(data: unknown): PIIDetection;
+export interface RedactedData {
+    /** The data with PII values replaced by placeholders */
+    data: unknown;
+    /** The detection result (same as detectPII) */
+    detection: PIIDetection;
+}
+/**
+ * Deep-clone data and replace detected PII values with redacted placeholders.
+ * Returns both the redacted data and the detection metadata.
+ */
+export declare function redactPII(data: unknown): RedactedData;
 //# sourceMappingURL=pii.d.ts.map

package/dist/policy/pii.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pii.d.ts","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAMH,MAAM,WAAW,YAAY;IAC5B,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qFAAqF;IACrF,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAiFD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAWrD"}
+{"version":3,"file":"pii.d.ts","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,YAAY;IAC5B,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,iDAAiD;IACjD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qFAAqF;IACrF,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAuID;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAWrD;AAsCD,MAAM,WAAW,YAAY;IAC5B,wDAAwD;IACxD,IAAI,EAAE,OAAO,CAAC;IACd,+CAA+C;IAC/C,SAAS,EAAE,YAAY,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAOrD"}

package/dist/policy/pii.js

@@ -57,12 +57,56 @@ function luhnCheck(digits) {
     }
     return sum % 10 === 0;
 }
+/** API key: sk-... (OpenAI/Anthropic) or sk_live_/sk_test_ (Stripe) */
+function isApiKey(value) {
+    return /\b(?:sk-|sk_(?:live|test)_)[a-zA-Z0-9_-]{20,}\b/.test(value);
+}
+/** AWS access key: AKIA followed by 16 uppercase alphanumeric chars */
+function isAwsKey(value) {
+    return /\bAKIA[0-9A-Z]{16}\b/.test(value);
+}
+/** GitHub token: ghp_, gho_, ghs_, ghr_, github_pat_ followed by 22+ alphanumeric chars */
+function isGithubToken(value) {
+    return /\b(?:ghp_|gho_|ghs_|ghr_|github_pat_)[a-zA-Z0-9]{22,}\b/.test(value);
+}
+/** Bearer token: Authorization header with 20+ char token */
+function isBearerToken(value) {
+    return /\bBearer\s+\S{20,}/.test(value);
+}
+/** JWT token: eyJ... header.payload.signature */
+function isJwt(value) {
+    return /\beyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\b/.test(value);
+}
+/** PEM-encoded private key */
+function isPrivateKey(value) {
+    return /-----BEGIN [A-Z ]*PRIVATE KEY-----/.test(value);
+}
+/** Generic secret: known prefixes (xox, SG., glpat-, npm_) or long hex strings (64+ chars) */
+function isGenericSecret(value) {
+    // Note: sk- and sk_ prefixes handled by isApiKey — not duplicated here
+    if (/\b(?:xox[bpars]-[a-zA-Z0-9-]+|SG\.[a-zA-Z0-9_-]{20,}|glpat-[a-zA-Z0-9_-]{20,}|npm_[a-zA-Z0-9]{36,})\b/.test(value)) {
+        return true;
+    }
+    // Long hex strings — require at least one digit and one letter to avoid false positives
+    const hexMatch = value.match(/\b[0-9a-fA-F]{64,}\b/);
+    if (!hexMatch)
+        return false;
+    const hex = hexMatch[0];
+    return /[0-9]/.test(hex) && /[a-fA-F]/.test(hex);
+}
 const PII_PATTERNS = [
     { type: "email", test: isEmail },
     { type: "phone", test: isPhoneNumber },
     { type: "ssn", test: isSSN },
     { type: "credit_card", test: isCreditCard },
     { type: "ipv4", test: isIPv4 },
+    { type: "api_key", test: isApiKey },
+    { type: "aws_key", test: isAwsKey },
+    { type: "github_token", test: isGithubToken },
+    { type: "bearer_token", test: isBearerToken },
+    { type: "jwt", test: isJwt },
+    { type: "private_key", test: isPrivateKey },
+    { type: "generic_secret", test: isGenericSecret },
 ];
 // ---------------------------------------------------------------------------
 // Recursive scanner
@@ -110,4 +154,48 @@ function scanString(value, currentPath, types, paths) {
         }
     }
 }
+/**
+ * Deep-clone data and replace detected PII values with redacted placeholders.
+ * Returns both the redacted data and the detection metadata.
+ */
+export function redactPII(data) {
+    const detection = detectPII(data);
+    if (!detection.found) {
+        return { data, detection };
+    }
+    const redacted = redactValue(data);
+    return { data: redacted, detection };
+}
+/** Return matched PII type names for a string value. */
+function matchedTypes(value) {
+    const matched = [];
+    for (const pattern of PII_PATTERNS) {
+        if (pattern.test(value)) {
+            matched.push(pattern.type);
+        }
+    }
+    return matched;
+}
+/** Recursively traverse data and replace PII strings with redacted placeholders. */
+function redactValue(value) {
+    if (typeof value === "string") {
+        const types = matchedTypes(value);
+        if (types.length > 0) {
+            return `[REDACTED:${types.join(",")}]`;
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item));
+    }
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        const result = {};
+        for (const key of Object.keys(record)) {
+            result[key] = redactValue(record[key]);
+        }
+        return result;
+    }
+    return value;
+}
 //# sourceMappingURL=pii.js.map

package/dist/policy/pii.js.map

@@ -1 +1 @@
-{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAoCjC,6CAA6C;AAC7C,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,4CAA4C;AAC5C,SAAS,MAAM,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IAC3B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,SAAS,SAAS,CAAC,MAAc;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,SAAS,EAAE,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,SAAS,GAAG,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,YAAY,GAAiB;IAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAChC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE;IACtC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;IAC5B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;CAC9B,CAAC;AAEF,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAElC,OAAO;QACN,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACrB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,KAAK;KACL,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,WAAmB,EAAE,KAAkB,EAAE,KAAe;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAkB,EAAE,KAAe;IAC1F,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;AACF,CAAC"}
+{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/policy/pii.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAqCjC,6CAA6C;AAC7C,SAAS,OAAO,CAAC,KAAa;IAC7B,OAAO,gDAAgD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAAa;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,6DAA6D,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrF,CAAC;AAED,0EAA0E;AAC1E,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,4CAA4C;AAC5C,SAAS,MAAM,CAAC,KAAa;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;IAC3B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,SAAS,SAAS,CAAC,MAAc;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,SAAS,EAAE,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,SAAS,GAAG,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,iDAAiD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,KAAa;IAC9B,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,6DAA6D;AAC7D,SAAS,aAAa,CAAC,KAAa;IACnC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,iDAAiD;AACjD,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,8BAA8B;AAC9B,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,8FAA8F;AAC9F,SAAS,eAAe,CAAC,KAAa;IACrC,uEAAuE;IACvE,IACC,uGAAuG,CAAC,IAAI,CAC3G,KAAK,CACL,EACA,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IACD,wFAAwF;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,YAAY,GAAiB;IAClC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAChC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE;IACtC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;IAC5B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;IAC9B,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAC7C,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE;IAC7C,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;IAC5B,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE;IAC3C,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE;CACjD,CAAC;AAEF,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAElC,OAAO;QACN,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;QACrB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,KAAK;KACL,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,WAAmB,EAAE,KAAkB,EAAE,KAAe;IAC1F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO;IACR,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACjE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO;IACR,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC9D,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,WAAmB,EAAE,KAAkB,EAAE,KAAe;IAC1F,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;AACF,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAa;IACtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,wDAAwD;AACxD,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;QACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,aAAa,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/shared/errors.d.ts

@@ -36,10 +36,30 @@ export declare class AuditDegradedError extends Error {
     readonly docsUrl: string;
     constructor(reason: string);
 }
+export declare class CredentialAccessDeniedError extends Error {
+    readonly credentialName: string;
+    readonly reason: string;
+    readonly hint: string;
+    readonly docsUrl: string;
+    constructor(credentialName: string, reason: string);
+}
 export declare class VaultNotInitializedError extends Error {
     readonly path: string;
     readonly hint: string;
     readonly docsUrl: string;
     constructor(path: string);
 }
+export declare class SkillVerificationError extends Error {
+    readonly skillId: string;
+    readonly reason: string;
+    readonly hint: string;
+    readonly docsUrl: string;
+    constructor(skillId: string, reason: string);
+}
+export declare class VaultKeyMissingError extends Error {
+    readonly envVar: string;
+    readonly hint: string;
+    readonly docsUrl: string;
+    constructor(envVar: string);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/shared/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/shared/errors.ts"],"names":[],"mappings":"AAGA,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAa/D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAU1B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAU1B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,GAAG,EAAE,MAAM;CASvB;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAU1B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAS1B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,IAAI,EAAE,MAAM;CASxB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/shared/errors.ts"],"names":[],"mappings":"AAGA,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAa/D;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAU1B;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAU1B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAgB,GAAG,EAAE,MAAM,CAAC;IAC5B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,GAAG,EAAE,MAAM;CASvB;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAU1B;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,SAAgB,aAAa,EAAE,MAAM,CAAC;IACtC,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAS1B;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACrD,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAalD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,IAAI,EAAE,MAAM;CASxB;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAChD,SAAgB,OAAO,EAAE,MAAM,CAAC;IAChC,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAa3C;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,SAAgB,MAAM,EAAE,MAAM,CAAC;IAC/B,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,MAAM,EAAE,MAAM;CAW1B"}