usesteady 0.1.0-alpha.1

package/dist/src/safety/detectors/bulk-data-exfil.detector.js

@@ -0,0 +1,90 @@
+/**
+ * Bulk data exfiltration detector.
+ *
+ * Catches inputs that combine:
+ *   - a data-movement verb (export, dump, extract, download, send, pull, get)
+ *   - with a bulk-scope qualifier (all, every, entire, full)
+ *   - with a sensitive target (customer, user, account + emails, passwords,
+ *     credentials, data, PII, records)
+ *
+ * Also catches standalone high-signal credential-dump phrases regardless
+ * of the bulk qualifier.
+ *
+ * Scope: NARROW. Only fires on language that clearly describes bulk exfiltration
+ * of sensitive user data. Does not fire on legitimate analytics queries
+ * ("pull the conversion funnel") or single-record lookups.
+ *
+ * Priority: 15 (between destructive_mass_action:10 and credential_or_secret_access:20)
+ */
+/**
+ * High-confidence patterns: explicit credential dump phrases that are
+ * inherently exfiltration-shaped in any context.
+ *
+ * Scope: deliberately narrow. Only covers clear "X's passwords/credentials"
+ * noun phrases where exfiltration intent is unambiguous. Does NOT cover
+ * "reset user password" (legitimate single-record operation) or "set password"
+ * flows. The combinator patterns below handle verb+bulk+target cases.
+ */
+const HIGH_CONFIDENCE_PATTERNS = [
+    // "customer passwords/credentials" — almost exclusively exfiltration language
+    { regex: /\bcustomer\s+passwords?\b/i, label: "customer passwords" },
+    { regex: /\bcustomer\s+credentials?\b/i, label: "customer credentials" },
+    // Explicit bulk credential dumps
+    { regex: /\bpassword\s+(list|dump|export|file)\b/i, label: "password list/dump" },
+    // Plaintext credential exposure
+    { regex: /\bplaintext\s+passwords?\b/i, label: "plaintext passwords" },
+    { regex: /\bclear\s*text\s+passwords?\b/i, label: "cleartext passwords" },
+];
+/**
+ * Verb × bulk-qualifier × sensitive-target combinator patterns.
+ * All three components must be present in the input.
+ *
+ * Target terms include plural forms (emails, passwords, credentials, records)
+ * and data-class terms (data, database, PII, info).
+ */
+const MOVEMENT_VERBS = /\b(export|dump|extract|download|send|pull|get|fetch|retrieve|expose)\b/i;
+const BULK_QUALIFIERS = /\b(all|every|entire|full|bulk|complete|whole)\b/i;
+const SENSITIVE_TARGETS = /\b(customer|user|account|member|subscriber)\b[\s\S]*?\b(emails?|passwords?|credentials?|pii|personal\s+data|private\s+data|records?|database|data|info)\b/i;
+const BULK_EXFIL_COMBO = {
+    // Label only — actual matching uses isBulkExfil() with separate regexes
+    regex: /^$/,
+    label: "bulk customer data exfiltration",
+};
+function findHighConfidenceMatch(input) {
+    return HIGH_CONFIDENCE_PATTERNS.find(({ regex }) => regex.test(input)) ?? null;
+}
+function isBulkExfil(input) {
+    // All three components must appear anywhere in the input
+    return MOVEMENT_VERBS.test(input)
+        && BULK_QUALIFIERS.test(input)
+        && SENSITIVE_TARGETS.test(input);
+}
+function findMatch(input) {
+    // High-confidence patterns fire first (no verb/bulk context needed)
+    const hc = findHighConfidenceMatch(input);
+    if (hc !== null)
+        return hc;
+    // Then try the three-component combinator
+    if (isBulkExfil(input))
+        return BULK_EXFIL_COMBO;
+    return null;
+}
+export const bulkDataExfilDetector = {
+    id: "bulk_data_exfiltration",
+    priority: 15,
+    supports(input) {
+        return findMatch(input) !== null;
+    },
+    detect(input) {
+        const match = findMatch(input);
+        if (match === null)
+            return null;
+        return {
+            verdict: "block",
+            reason: "bulk_data_exfiltration",
+            matchedPattern: match.label,
+            note: "Input contains a pattern associated with bulk extraction of sensitive user data or credentials.",
+        };
+    },
+};
+//# sourceMappingURL=bulk-data-exfil.detector.js.map

package/dist/src/safety/detectors/bulk-data-exfil.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulk-data-exfil.detector.js","sourceRoot":"","sources":["../../../../src/safety/detectors/bulk-data-exfil.detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH;;;;;;;;GAQG;AACH,MAAM,wBAAwB,GAAkC;IAC9D,8EAA8E;IAC9E,EAAE,KAAK,EAAE,4BAA4B,EAAe,KAAK,EAAE,oBAAoB,EAAE;IACjF,EAAE,KAAK,EAAE,8BAA8B,EAAa,KAAK,EAAE,sBAAsB,EAAE;IACnF,iCAAiC;IACjC,EAAE,KAAK,EAAE,yCAAyC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACjF,gCAAgC;IAChC,EAAE,KAAK,EAAE,6BAA6B,EAAc,KAAK,EAAE,qBAAqB,EAAE;IAClF,EAAE,KAAK,EAAE,gCAAgC,EAAW,KAAK,EAAE,qBAAqB,EAAE;CACnF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,cAAc,GAAM,yEAAyE,CAAC;AACpG,MAAM,eAAe,GAAK,kDAAkD,CAAC;AAC7E,MAAM,iBAAiB,GAAG,4JAA4J,CAAC;AAEvL,MAAM,gBAAgB,GAAmB;IACvC,wEAAwE;IACxE,KAAK,EAAE,IAAI;IACX,KAAK,EAAE,iCAAiC;CACzC,CAAC;AAEF,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,yDAAyD;IACzD,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;WAC5B,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;WAC3B,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,oEAAoE;IACpE,MAAM,EAAE,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,EAAE,EAAE,wBAAwB;IAC5B,QAAQ,EAAE,EAAE;IAEZ,QAAQ,CAAC,KAAa;QACpB,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO;YACL,OAAO,EAAS,OAAO;YACvB,MAAM,EAAU,wBAAwB;YACxC,cAAc,EAAE,KAAK,CAAC,KAAK;YAC3B,IAAI,EAAE,iGAAiG;SACxG,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/safety/detectors/destructive.detector.d.ts

@@ -0,0 +1,3 @@
+import type { SafetyDetector } from "../types.js";
+export declare const destructiveDetector: SafetyDetector;
+//# sourceMappingURL=destructive.detector.d.ts.map

package/dist/src/safety/detectors/destructive.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive.detector.d.ts","sourceRoot":"","sources":["../../../../src/safety/detectors/destructive.detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,aAAa,CAAC;AAehE,eAAO,MAAM,mBAAmB,EAAE,cAkBjC,CAAC"}

package/dist/src/safety/detectors/destructive.detector.js

@@ -0,0 +1,28 @@
+const PATTERNS = [
+    { regex: /\brm\s+-[a-zA-Z]*r[a-zA-Z]*f\b/i, label: "rm -rf" },
+    { regex: /\bdelete\s+all\b/i, label: "delete all" },
+    { regex: /\bwipe\b/i, label: "wipe" },
+    { regex: /\bpurge\b/i, label: "purge" },
+];
+function findMatch(input) {
+    return PATTERNS.find(({ regex }) => regex.test(input)) ?? null;
+}
+export const destructiveDetector = {
+    id: "destructive_mass_action",
+    priority: 10,
+    supports(input) {
+        return findMatch(input) !== null;
+    },
+    detect(input) {
+        const match = findMatch(input);
+        if (match === null)
+            return null;
+        return {
+            verdict: "block",
+            reason: "destructive_mass_action",
+            matchedPattern: match.label,
+            note: "Input contains a pattern associated with irreversible bulk data destruction.",
+        };
+    },
+};
+//# sourceMappingURL=destructive.detector.js.map

package/dist/src/safety/detectors/destructive.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive.detector.js","sourceRoot":"","sources":["../../../../src/safety/detectors/destructive.detector.ts"],"names":[],"mappings":"AAIA,MAAM,QAAQ,GAAkC;IAC9C,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC7D,EAAE,KAAK,EAAE,mBAAmB,EAAgB,KAAK,EAAE,YAAY,EAAE;IACjE,EAAE,KAAK,EAAE,WAAW,EAAyB,KAAK,EAAE,MAAM,EAAE;IAC5D,EAAE,KAAK,EAAE,YAAY,EAAwB,KAAK,EAAE,OAAO,EAAE;CAC9D,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAmB;IACjD,EAAE,EAAE,yBAAyB;IAC7B,QAAQ,EAAE,EAAE;IAEZ,QAAQ,CAAC,KAAa;QACpB,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,yBAAyB;YACjC,cAAc,EAAE,KAAK,CAAC,KAAK;YAC3B,IAAI,EAAE,8EAA8E;SACrF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/safety/detectors/evasion.detector.d.ts

@@ -0,0 +1,3 @@
+import type { SafetyDetector } from "../types.js";
+export declare const evasionDetector: SafetyDetector;
+//# sourceMappingURL=evasion.detector.d.ts.map

package/dist/src/safety/detectors/evasion.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evasion.detector.d.ts","sourceRoot":"","sources":["../../../../src/safety/detectors/evasion.detector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,aAAa,CAAC;AAehE,eAAO,MAAM,eAAe,EAAE,cAkB7B,CAAC"}

package/dist/src/safety/detectors/evasion.detector.js

@@ -0,0 +1,28 @@
+const PATTERNS = [
+    { regex: /\bignore\s+(?:the\s+)?rules?\b/i, label: "ignore rules" },
+    { regex: /\bwithout\s+approval\b/i, label: "without approval" },
+    { regex: /\bsilently\b/i, label: "silently" },
+    { regex: /\bbypass\b/i, label: "bypass" },
+];
+function findMatch(input) {
+    return PATTERNS.find(({ regex }) => regex.test(input)) ?? null;
+}
+export const evasionDetector = {
+    id: "evasion_or_rule_bypass",
+    priority: 30,
+    supports(input) {
+        return findMatch(input) !== null;
+    },
+    detect(input) {
+        const match = findMatch(input);
+        if (match === null)
+            return null;
+        return {
+            verdict: "block",
+            reason: "evasion_or_rule_bypass",
+            matchedPattern: match.label,
+            note: "Input contains a pattern associated with policy evasion or rule bypass.",
+        };
+    },
+};
+//# sourceMappingURL=evasion.detector.js.map

package/dist/src/safety/detectors/evasion.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evasion.detector.js","sourceRoot":"","sources":["../../../../src/safety/detectors/evasion.detector.ts"],"names":[],"mappings":"AAIA,MAAM,QAAQ,GAAkC;IAC9C,EAAE,KAAK,EAAE,iCAAiC,EAAE,KAAK,EAAE,cAAc,EAAE;IACnE,EAAE,KAAK,EAAE,yBAAyB,EAAI,KAAK,EAAE,kBAAkB,EAAE;IACjE,EAAE,KAAK,EAAE,eAAe,EAAc,KAAK,EAAE,UAAU,EAAE;IACzD,EAAE,KAAK,EAAE,aAAa,EAAgB,KAAK,EAAE,QAAQ,EAAE;CACxD,CAAC;AAEF,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAmB;IAC7C,EAAE,EAAE,wBAAwB;IAC5B,QAAQ,EAAE,EAAE;IAEZ,QAAQ,CAAC,KAAa;QACpB,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,wBAAwB;YAChC,cAAc,EAAE,KAAK,CAAC,KAAK;YAC3B,IAAI,EAAE,yEAAyE;SAChF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/safety/detectors/secret-access.detector.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Secret / credential access detector.
+ *
+ * Blocks inputs that try to READ, VIEW, or DISCLOSE credential material.
+ *
+ * ── Rotation/management exemption ────────────────────────────────────────────
+ *
+ * Credential management operations (rotate, renew, revoke, regenerate,
+ * invalidate, deactivate) are LEGITIMATE security practice. They must not be
+ * blocked here. The exemption applies when:
+ *
+ *   1. A rotation/management verb is present in the input, AND
+ *   2. No disclosure verb (read, show, dump, reveal, export, print, expose,
+ *      output, display) is also present.
+ *
+ * Mixed inputs ("rotate and then dump the API keys") are not exempt — the
+ * disclosure verb disqualifies the exemption and the detector blocks as normal.
+ *
+ * Examples:
+ *   "rotate the API keys for the payment service"  → ALLOW  (rotation only)
+ *   "when should I rotate API keys"                → ALLOW  (question, no disclosure)
+ *   "renew the TLS certificates"                   → ALLOW  (management)
+ *   "revoke the OAuth token"                       → ALLOW  (revocation)
+ *   "show me the API keys"                         → BLOCK  (disclosure verb)
+ *   "read the API key from .env"                   → BLOCK  (disclosure verb)
+ *   "export API keys"                              → BLOCK  (disclosure verb)
+ *   "rotate and then dump the API keys"            → BLOCK  (disclosure verb present)
+ */
+import type { SafetyDetector } from "../types.js";
+export declare const secretAccessDetector: SafetyDetector;
+//# sourceMappingURL=secret-access.detector.d.ts.map

package/dist/src/safety/detectors/secret-access.detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-access.detector.d.ts","sourceRoot":"","sources":["../../../../src/safety/detectors/secret-access.detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAgB,MAAM,aAAa,CAAC;AAuChE,eAAO,MAAM,oBAAoB,EAAE,cAqBlC,CAAC"}

package/dist/src/safety/detectors/secret-access.detector.js

@@ -0,0 +1,78 @@
+/**
+ * Secret / credential access detector.
+ *
+ * Blocks inputs that try to READ, VIEW, or DISCLOSE credential material.
+ *
+ * ── Rotation/management exemption ────────────────────────────────────────────
+ *
+ * Credential management operations (rotate, renew, revoke, regenerate,
+ * invalidate, deactivate) are LEGITIMATE security practice. They must not be
+ * blocked here. The exemption applies when:
+ *
+ *   1. A rotation/management verb is present in the input, AND
+ *   2. No disclosure verb (read, show, dump, reveal, export, print, expose,
+ *      output, display) is also present.
+ *
+ * Mixed inputs ("rotate and then dump the API keys") are not exempt — the
+ * disclosure verb disqualifies the exemption and the detector blocks as normal.
+ *
+ * Examples:
+ *   "rotate the API keys for the payment service"  → ALLOW  (rotation only)
+ *   "when should I rotate API keys"                → ALLOW  (question, no disclosure)
+ *   "renew the TLS certificates"                   → ALLOW  (management)
+ *   "revoke the OAuth token"                       → ALLOW  (revocation)
+ *   "show me the API keys"                         → BLOCK  (disclosure verb)
+ *   "read the API key from .env"                   → BLOCK  (disclosure verb)
+ *   "export API keys"                              → BLOCK  (disclosure verb)
+ *   "rotate and then dump the API keys"            → BLOCK  (disclosure verb present)
+ */
+const PATTERNS = [
+    { regex: /\bapi\s*keys?\b/i, label: "api key" },
+    { regex: /\btoken\b/i, label: "token" },
+    { regex: /\bpasswords?\b/i, label: "password" },
+    { regex: /\.env\b/i, label: ".env" },
+    { regex: /\bsecret\b/i, label: "secret" },
+];
+/**
+ * Verbs that indicate credential rotation or management — the user wants to
+ * CHANGE or REVOKE the credential, not read its current value.
+ */
+const ROTATION_MGMT_RE = /\b(rotat\w*|renew(?:al|ing|ed)?|reissue\w*|regenerat\w*|revok\w*|invalidat\w*|deactivat\w*|expir(?:e|ed|ing|ation)?|cycl(?:e|ed|ing)|roll(?:(?:\s+(?:over|back))?(?:ing|ed)?))\b/i;
+/**
+ * Verbs that indicate intent to read, view, or disclose the credential value.
+ * Presence of any of these disqualifies the rotation exemption.
+ */
+const DISCLOSURE_VERBS_RE = /\b(read|show|dump|print|expos\w*|reveal|output|display)\b/i;
+/**
+ * Returns true when the input describes a credential rotation/management
+ * operation with no disclosure intent. These inputs are security-hygiene
+ * operations and must not be blocked.
+ */
+function isRotationWithoutDisclosure(input) {
+    return ROTATION_MGMT_RE.test(input) && !DISCLOSURE_VERBS_RE.test(input);
+}
+function findMatch(input) {
+    return PATTERNS.find(({ regex }) => regex.test(input)) ?? null;
+}
+export const secretAccessDetector = {
+    id: "credential_or_secret_access",
+    priority: 20,
+    supports(input) {
+        return findMatch(input) !== null;
+    },
+    detect(input) {
+        // Rotation/management intents are legitimate security practice — allow them.
+        if (isRotationWithoutDisclosure(input))
+            return null;
+        const match = findMatch(input);
+        if (match === null)
+            return null;
+        return {
+            verdict: "block",
+            reason: "credential_or_secret_access",
+            matchedPattern: match.label,
+            note: "Input contains a pattern associated with credential or secret material access.",
+        };
+    },
+};
+//# sourceMappingURL=secret-access.detector.js.map

package/dist/src/safety/detectors/secret-access.detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-access.detector.js","sourceRoot":"","sources":["../../../../src/safety/detectors/secret-access.detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAMH,MAAM,QAAQ,GAAkC;IAC9C,EAAE,KAAK,EAAE,kBAAkB,EAAG,KAAK,EAAE,SAAS,EAAE;IAChD,EAAE,KAAK,EAAE,YAAY,EAAS,KAAK,EAAE,OAAO,EAAE;IAC9C,EAAE,KAAK,EAAE,iBAAiB,EAAI,KAAK,EAAE,UAAU,EAAE;IACjD,EAAE,KAAK,EAAE,UAAU,EAAW,KAAK,EAAE,MAAM,EAAE;IAC7C,EAAE,KAAK,EAAE,aAAa,EAAQ,KAAK,EAAE,QAAQ,EAAE;CAChD,CAAC;AAEF;;;GAGG;AACH,MAAM,gBAAgB,GACpB,mLAAmL,CAAC;AAEtL;;;GAGG;AACH,MAAM,mBAAmB,GACvB,4DAA4D,CAAC;AAE/D;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,KAAa;IAChD,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAmB;IAClD,EAAE,EAAE,6BAA6B;IACjC,QAAQ,EAAE,EAAE;IAEZ,QAAQ,CAAC,KAAa;QACpB,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;IACnC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,6EAA6E;QAC7E,IAAI,2BAA2B,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,MAAM,EAAE,6BAA6B;YACrC,cAAc,EAAE,KAAK,CAAC,KAAK;YAC3B,IAAI,EAAE,gFAAgF;SACvF,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/safety/registry.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Safety detector registry.
+ *
+ * Detectors are sorted by priority ascending (lower number = runs first).
+ * The gate iterates in priority order and returns the first blocking match.
+ */
+import type { SafetyDetector } from "./types.js";
+export declare function getSafetyDetectors(): ReadonlyArray<SafetyDetector>;
+//# sourceMappingURL=registry.d.ts.map

package/dist/src/safety/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/safety/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAejD,wBAAgB,kBAAkB,IAAI,aAAa,CAAC,cAAc,CAAC,CAElE"}

package/dist/src/safety/registry.js

@@ -0,0 +1,22 @@
+/**
+ * Safety detector registry.
+ *
+ * Detectors are sorted by priority ascending (lower number = runs first).
+ * The gate iterates in priority order and returns the first blocking match.
+ */
+import { destructiveDetector } from "./detectors/destructive.detector.js";
+import { bulkDataExfilDetector } from "./detectors/bulk-data-exfil.detector.js";
+import { secretAccessDetector } from "./detectors/secret-access.detector.js";
+import { evasionDetector } from "./detectors/evasion.detector.js";
+import { arbitraryExecDetector } from "./detectors/arbitrary-exec.detector.js";
+const REGISTERED_DETECTORS = [
+    destructiveDetector, // priority 10
+    bulkDataExfilDetector, // priority 15
+    secretAccessDetector, // priority 20
+    evasionDetector,
+    arbitraryExecDetector,
+].sort((a, b) => a.priority - b.priority);
+export function getSafetyDetectors() {
+    return REGISTERED_DETECTORS;
+}
+//# sourceMappingURL=registry.js.map

package/dist/src/safety/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/safety/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAS,qCAAqC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAQ,yCAAyC,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAS,uCAAuC,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAc,iCAAiC,CAAC;AAC1E,OAAO,EAAE,qBAAqB,EAAE,MAAQ,wCAAwC,CAAC;AAEjF,MAAM,oBAAoB,GAAkC;IAC1D,mBAAmB,EAAQ,cAAc;IACzC,qBAAqB,EAAM,cAAc;IACzC,oBAAoB,EAAO,cAAc;IACzC,eAAe;IACf,qBAAqB;CACtB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,UAAU,kBAAkB;IAChC,OAAO,oBAAoB,CAAC;AAC9B,CAAC"}

package/dist/src/safety/safety-gate.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Safety Gate — runs detectors in priority order, injects detectorId on block.
+ *
+ * Detectors report `matchedPattern` (the specific phrase that matched).
+ * The gate adds `detectorId` from `detector.id` so callers can identify
+ * which detector fired without inspecting the source.
+ *
+ * Inspectable fields on a block result:
+ *   result.detectorId      — which detector fired
+ *   result.matchedPattern  — which phrase triggered it
+ *   result.reason          — enum category
+ *   result.note            — plain-English explanation
+ */
+import type { SafetyResult } from "./types.js";
+export declare function runSafetyGate(input: string): SafetyResult;
+//# sourceMappingURL=safety-gate.d.ts.map

package/dist/src/safety/safety-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-gate.d.ts","sourceRoot":"","sources":["../../../src/safety/safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAUzD"}

package/dist/src/safety/safety-gate.js

@@ -0,0 +1,26 @@
+/**
+ * Safety Gate — runs detectors in priority order, injects detectorId on block.
+ *
+ * Detectors report `matchedPattern` (the specific phrase that matched).
+ * The gate adds `detectorId` from `detector.id` so callers can identify
+ * which detector fired without inspecting the source.
+ *
+ * Inspectable fields on a block result:
+ *   result.detectorId      — which detector fired
+ *   result.matchedPattern  — which phrase triggered it
+ *   result.reason          — enum category
+ *   result.note            — plain-English explanation
+ */
+import { getSafetyDetectors } from "./registry.js";
+export function runSafetyGate(input) {
+    for (const detector of getSafetyDetectors()) {
+        if (detector.supports(input)) {
+            const result = detector.detect(input);
+            if (result !== null && result.verdict === "block") {
+                return { ...result, detectorId: detector.id };
+            }
+        }
+    }
+    return { verdict: "allow" };
+}
+//# sourceMappingURL=safety-gate.js.map

package/dist/src/safety/safety-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety-gate.js","sourceRoot":"","sources":["../../../src/safety/safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAClD,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/src/safety/types.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Safety Gate types.
+ *
+ * SafetyResult now carries inspection fields so callers can determine
+ * exactly which detector fired and which input phrase triggered it —
+ * without needing to re-run detectors or read source code.
+ *
+ * Fields:
+ *   detectorId      — id of the detector that produced this result (injected by gate)
+ *   matchedPattern  — human-readable label of the specific phrase that matched
+ *   note            — plain-English explanation of why this is blocked
+ */
+export type SafetyVerdict = "allow" | "block";
+export type SafetyReason = "destructive_mass_action" | "bulk_data_exfiltration" | "credential_or_secret_access" | "evasion_or_rule_bypass" | "arbitrary_script_execution";
+export type SafetyResult = {
+    readonly verdict: SafetyVerdict;
+    readonly reason?: SafetyReason;
+    readonly detectorId?: string;
+    readonly matchedPattern?: string;
+    readonly note?: string;
+};
+/**
+ * A SafetyDetector examines an input string and returns a blocking SafetyResult
+ * if it detects a pattern it covers, or null if the input is outside its scope.
+ *
+ * Detectors set `matchedPattern` on their results.
+ * The gate injects `detectorId` from `detector.id` — detectors do not self-report their id.
+ */
+export type SafetyDetector = {
+    readonly id: string;
+    readonly priority: number;
+    supports(input: string): boolean;
+    detect(input: string): SafetyResult | null;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/src/safety/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/safety/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,CAAC;AAE9C,MAAM,MAAM,YAAY,GACpB,yBAAyB,GACzB,wBAAwB,GACxB,6BAA6B,GAC7B,wBAAwB,GACxB,4BAA4B,CAAC;AAEjC,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC;CAC5C,CAAC"}

package/dist/src/safety/types.js

@@ -0,0 +1,14 @@
+/**
+ * Safety Gate types.
+ *
+ * SafetyResult now carries inspection fields so callers can determine
+ * exactly which detector fired and which input phrase triggered it —
+ * without needing to re-run detectors or read source code.
+ *
+ * Fields:
+ *   detectorId      — id of the detector that produced this result (injected by gate)
+ *   matchedPattern  — human-readable label of the specific phrase that matched
+ *   note            — plain-English explanation of why this is blocked
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/safety/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/safety/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/src/shell/claude-shell.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Phase 9A: Claude shell advance functions.
+ *
+ * ── Purpose ───────────────────────────────────────────────────────────────────
+ *
+ *   Pure (or async-pure) functions that map a user answer + current Claude
+ *   session state → next session state. Mirror of cursor-shell.ts for Claude.
+ *
+ * ── What these functions do ───────────────────────────────────────────────────
+ *
+ *   advanceClaudeOnConfirm — handles "confirm" prompt answers (y/n).
+ *     - From "conflict":  y → acceptClaudeConflict() → back to "prepared"
+ *                         n → rejectClaude()
+ *     - From "prepared":  y → approveClaude() then immediately deliverClaude()
+ *                         n → rejectClaude()
+ *
+ *   advanceClaudeOnChoice — handles "choose" prompt answers (1-N).
+ *     - From "scope_question": resolves the candidate file, calls answerClaudeScope(),
+ *       then immediately delivers (answerClaudeScope → "approved" → deliverClaude).
+ *     - Out-of-range index: returns state unchanged (re-prompt).
+ *
+ * ── Design note ───────────────────────────────────────────────────────────────
+ *
+ *   Same approve-then-deliver combination as cursor-shell.ts.
+ *   approveClaude() and deliverClaude() remain distinct session transitions
+ *   (P3, P4). The CLI collapses them into one user action for the same reason.
+ *
+ * ── What these functions are NOT ──────────────────────────────────────────────
+ *
+ *   NOT authority layers — all decisions are delegated to session functions.
+ *   NOT renderers — rendering is in render.ts.
+ *   NOT stateful — they return new state; they do not mutate.
+ */
+import type { ClaudeSessionState } from "../product/claude-product-session.js";
+import type { ClaudeAgentPlugin } from "../claude/delivery-gate.js";
+import type { ClaudeGateDeps } from "../claude/delivery-gate.js";
+/**
+ * Advance the Claude session based on a yes/no answer.
+ *
+ * Called when `renderClaudeFrame(state).prompt.kind === "confirm"`.
+ *
+ * @param state    Current session state (must be "prepared" or "conflict").
+ * @param yes      true = user said yes; false = user said no.
+ * @param plugin   The Claude agent plugin for delivery.
+ * @param storeDir UCP store directory for envelope persistence.
+ * @param deps     Optional gate dependencies (for test injection).
+ */
+export declare function advanceClaudeOnConfirm(state: ClaudeSessionState, yes: boolean, plugin: ClaudeAgentPlugin, storeDir: string, deps?: ClaudeGateDeps): Promise<ClaudeSessionState>;
+/**
+ * Advance the Claude session based on a numbered scope candidate selection.
+ *
+ * Called when `renderClaudeFrame(state).prompt.kind === "choose"`.
+ *
+ * @param state      Current session state (must be "scope_question").
+ * @param choiceIdx  1-based index into `state.scopeQuestion.candidates`.
+ * @param plugin     The Claude agent plugin for delivery.
+ * @param storeDir   UCP store directory for envelope persistence.
+ * @param deps       Optional gate dependencies (for test injection).
+ * @returns          Next session state. If choiceIdx is out of range,
+ *                   returns state unchanged so the CLI can re-prompt.
+ */
+export declare function advanceClaudeOnChoice(state: ClaudeSessionState, choiceIdx: number, plugin: ClaudeAgentPlugin, storeDir: string, deps?: ClaudeGateDeps): Promise<ClaudeSessionState>;
+//# sourceMappingURL=claude-shell.d.ts.map

package/dist/src/shell/claude-shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-shell.d.ts","sourceRoot":"","sources":["../../../src/shell/claude-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAO,4BAA4B,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAU,4BAA4B,CAAC;AAWrE;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAK,kBAAkB,EAC5B,GAAG,EAAO,OAAO,EACjB,MAAM,EAAI,iBAAiB,EAC3B,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAK,cAAc,GACvB,OAAO,CAAC,kBAAkB,CAAC,CAa7B;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAM,kBAAkB,EAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAK,iBAAiB,EAC5B,QAAQ,EAAG,MAAM,EACjB,IAAI,CAAC,EAAM,cAAc,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAQ7B"}

package/dist/src/shell/claude-shell.js

@@ -0,0 +1,81 @@
+/**
+ * Phase 9A: Claude shell advance functions.
+ *
+ * ── Purpose ───────────────────────────────────────────────────────────────────
+ *
+ *   Pure (or async-pure) functions that map a user answer + current Claude
+ *   session state → next session state. Mirror of cursor-shell.ts for Claude.
+ *
+ * ── What these functions do ───────────────────────────────────────────────────
+ *
+ *   advanceClaudeOnConfirm — handles "confirm" prompt answers (y/n).
+ *     - From "conflict":  y → acceptClaudeConflict() → back to "prepared"
+ *                         n → rejectClaude()
+ *     - From "prepared":  y → approveClaude() then immediately deliverClaude()
+ *                         n → rejectClaude()
+ *
+ *   advanceClaudeOnChoice — handles "choose" prompt answers (1-N).
+ *     - From "scope_question": resolves the candidate file, calls answerClaudeScope(),
+ *       then immediately delivers (answerClaudeScope → "approved" → deliverClaude).
+ *     - Out-of-range index: returns state unchanged (re-prompt).
+ *
+ * ── Design note ───────────────────────────────────────────────────────────────
+ *
+ *   Same approve-then-deliver combination as cursor-shell.ts.
+ *   approveClaude() and deliverClaude() remain distinct session transitions
+ *   (P3, P4). The CLI collapses them into one user action for the same reason.
+ *
+ * ── What these functions are NOT ──────────────────────────────────────────────
+ *
+ *   NOT authority layers — all decisions are delegated to session functions.
+ *   NOT renderers — rendering is in render.ts.
+ *   NOT stateful — they return new state; they do not mutate.
+ */
+import { approveClaude, rejectClaude, acceptClaudeConflict, answerClaudeScope, deliverClaude, } from "../product/claude-product-session.js";
+// ─── Confirm advance (y/n) ────────────────────────────────────────────────────
+/**
+ * Advance the Claude session based on a yes/no answer.
+ *
+ * Called when `renderClaudeFrame(state).prompt.kind === "confirm"`.
+ *
+ * @param state    Current session state (must be "prepared" or "conflict").
+ * @param yes      true = user said yes; false = user said no.
+ * @param plugin   The Claude agent plugin for delivery.
+ * @param storeDir UCP store directory for envelope persistence.
+ * @param deps     Optional gate dependencies (for test injection).
+ */
+export async function advanceClaudeOnConfirm(state, yes, plugin, storeDir, deps) {
+    if (!yes)
+        return rejectClaude(state);
+    if (state.phase === "conflict") {
+        return acceptClaudeConflict(state);
+    }
+    if (state.phase === "prepared") {
+        const approved = approveClaude(state);
+        return deliverClaude(approved, plugin, storeDir, deps);
+    }
+    return state;
+}
+// ─── Choice advance (1-N selection) ──────────────────────────────────────────
+/**
+ * Advance the Claude session based on a numbered scope candidate selection.
+ *
+ * Called when `renderClaudeFrame(state).prompt.kind === "choose"`.
+ *
+ * @param state      Current session state (must be "scope_question").
+ * @param choiceIdx  1-based index into `state.scopeQuestion.candidates`.
+ * @param plugin     The Claude agent plugin for delivery.
+ * @param storeDir   UCP store directory for envelope persistence.
+ * @param deps       Optional gate dependencies (for test injection).
+ * @returns          Next session state. If choiceIdx is out of range,
+ *                   returns state unchanged so the CLI can re-prompt.
+ */
+export async function advanceClaudeOnChoice(state, choiceIdx, plugin, storeDir, deps) {
+    const candidates = state.scopeQuestion?.candidates ?? [];
+    const file = candidates[choiceIdx - 1];
+    if (!file)
+        return state;
+    const narrowed = answerClaudeScope(state, file);
+    return deliverClaude(narrowed, plugin, storeDir, deps);
+}
+//# sourceMappingURL=claude-shell.js.map

package/dist/src/shell/claude-shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-shell.js","sourceRoot":"","sources":["../../../src/shell/claude-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,OAAO,EACL,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,iBAAiB,EACjB,aAAa,GACd,MAAM,sCAAsC,CAAC;AAE9C,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA4B,EAC5B,GAAiB,EACjB,MAA2B,EAC3B,QAAgB,EAChB,IAAwB;IAExB,IAAI,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC/B,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA6B,EAC7B,SAAiB,EACjB,MAA4B,EAC5B,QAAiB,EACjB,IAAyB;IAEzB,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE,UAAU,IAAI,EAAE,CAAC;IACzD,MAAM,IAAI,GAAS,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAE7C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/src/shell/cli/friction-admin.d.ts

@@ -0,0 +1,14 @@
+/**
+ * src/shell/cli/friction-admin.ts
+ *
+ * Admin CLI for friction report review and payout management.
+ *
+ * Usage (via `usesteady admin friction <sub>`):
+ *   usesteady admin friction list             List pending friction issues
+ *   usesteady admin friction review           AI-classify + approve/reject interactively
+ *   usesteady admin friction review --dry-run  AI-classify only, no writes
+ *   usesteady admin friction payouts           Show payout ledger
+ *   usesteady admin friction payouts --pending Show only unpaid approved entries
+ */
+export declare function runAdmin(args: string[]): Promise<void>;
+//# sourceMappingURL=friction-admin.d.ts.map

package/dist/src/shell/cli/friction-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"friction-admin.d.ts","sourceRoot":"","sources":["../../../../src/shell/cli/friction-admin.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAySH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgD5D"}