wotann 0.5.0 → 0.5.39

package/dist/sandbox/backends/cloud-auth.d.ts

@@ -1,50 +0,0 @@
-/**
- * Cloud-sandbox auth token helper — V9 T12.16.
- *
- * Resolves API tokens for the Modal + Fly cloud sandbox backends from
- * the process environment. Caches resolved tokens in-memory per process
- * so repeat calls are zero-cost. The helper performs NO network I/O —
- * it only reads env vars and returns a structured result.
- *
- * Provider env keys
- *   - Modal: MODAL_TOKEN_ID + MODAL_TOKEN_SECRET (both required, joined
- *     with a colon to form the canonical Modal credential string).
- *   - Fly:   FLY_API_TOKEN
- *
- * Quality bars
- *   - QB #6 honest stubs: missing env → returns `null` + a real reason
- *     describing which key was missing. No silent fallbacks.
- *   - QB #7 per-call state: cache key includes the env reference and
- *     provider; callers passing a custom env get an isolated cache slot.
- *   - TypeScript strict; zero `any`.
- */
-export type CloudAuthProvider = "modal" | "flyio";
-export type CloudAuthSource = "env" | "keychain";
-export interface CloudAuthToken {
-    readonly token: string;
-    readonly source: CloudAuthSource;
-}
-export interface CloudAuthMissing {
-    readonly token: null;
-    readonly reason: string;
-}
-export type CloudAuthResult = CloudAuthToken | CloudAuthMissing;
-/**
- * Resolve a cloud-sandbox API token from the environment, with an
- * in-memory cache. Returns either `{ token, source }` on success or
- * `{ token: null, reason }` when the required env vars are missing.
- *
- * Pure with respect to network — no HTTP calls, no filesystem access.
- *
- * @param provider The cloud provider whose token to resolve.
- * @param env Optional process env. Defaults to `process.env`. Pass a
- *            custom env to isolate cache (useful for tests).
- */
-export declare function getCloudAuthToken(provider: CloudAuthProvider, env?: NodeJS.ProcessEnv): Promise<CloudAuthResult>;
-/**
- * Drop the in-memory token cache. Intended for tests + long-running
- * daemons that need to react to env-var rotation. Safe to call from
- * any execution context.
- */
-export declare function clearCloudAuthCache(): void;
-//# sourceMappingURL=cloud-auth.d.ts.map

package/dist/sandbox/backends/cloud-auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloud-auth.d.ts","sourceRoot":"","sources":["../../../src/sandbox/backends/cloud-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,CAAC;AAElD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,UAAU,CAAC;AAEjD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,gBAAgB,CAAC;AA4DhE;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,iBAAiB,EAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GACtB,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/dist/sandbox/backends/cloud-auth.js

@@ -1,93 +0,0 @@
-/**
- * Cloud-sandbox auth token helper — V9 T12.16.
- *
- * Resolves API tokens for the Modal + Fly cloud sandbox backends from
- * the process environment. Caches resolved tokens in-memory per process
- * so repeat calls are zero-cost. The helper performs NO network I/O —
- * it only reads env vars and returns a structured result.
- *
- * Provider env keys
- *   - Modal: MODAL_TOKEN_ID + MODAL_TOKEN_SECRET (both required, joined
- *     with a colon to form the canonical Modal credential string).
- *   - Fly:   FLY_API_TOKEN
- *
- * Quality bars
- *   - QB #6 honest stubs: missing env → returns `null` + a real reason
- *     describing which key was missing. No silent fallbacks.
- *   - QB #7 per-call state: cache key includes the env reference and
- *     provider; callers passing a custom env get an isolated cache slot.
- *   - TypeScript strict; zero `any`.
- */
-const TOKEN_CACHE = new Map();
-const ENV_IDS = new WeakMap();
-let envIdCounter = 0;
-function cacheKey(env, provider) {
-    let id = ENV_IDS.get(env);
-    if (id === undefined) {
-        envIdCounter += 1;
-        id = `env#${envIdCounter}`;
-        ENV_IDS.set(env, id);
-    }
-    return `${id}::${provider}`;
-}
-// ── Provider resolvers ─────────────────────────────────────
-function resolveModal(env) {
-    const id = env["MODAL_TOKEN_ID"];
-    const secret = env["MODAL_TOKEN_SECRET"];
-    if (typeof id !== "string" || id.length === 0) {
-        return {
-            token: null,
-            reason: "Modal auth unavailable: MODAL_TOKEN_ID env var is missing. Set both MODAL_TOKEN_ID and MODAL_TOKEN_SECRET.",
-        };
-    }
-    if (typeof secret !== "string" || secret.length === 0) {
-        return {
-            token: null,
-            reason: "Modal auth unavailable: MODAL_TOKEN_SECRET env var is missing. Set both MODAL_TOKEN_ID and MODAL_TOKEN_SECRET.",
-        };
-    }
-    return { token: `${id}:${secret}`, source: "env" };
-}
-function resolveFlyio(env) {
-    const token = env["FLY_API_TOKEN"];
-    if (typeof token !== "string" || token.length === 0) {
-        return {
-            token: null,
-            reason: "Fly auth unavailable: FLY_API_TOKEN env var is missing.",
-        };
-    }
-    return { token, source: "env" };
-}
-// ── Public API ─────────────────────────────────────────────
-/**
- * Resolve a cloud-sandbox API token from the environment, with an
- * in-memory cache. Returns either `{ token, source }` on success or
- * `{ token: null, reason }` when the required env vars are missing.
- *
- * Pure with respect to network — no HTTP calls, no filesystem access.
- *
- * @param provider The cloud provider whose token to resolve.
- * @param env Optional process env. Defaults to `process.env`. Pass a
- *            custom env to isolate cache (useful for tests).
- */
-export async function getCloudAuthToken(provider, env) {
-    const resolvedEnv = env ?? process.env;
-    const key = cacheKey(resolvedEnv, provider);
-    const hit = TOKEN_CACHE.get(key);
-    if (hit !== undefined)
-        return hit;
-    const result = provider === "modal" ? resolveModal(resolvedEnv) : resolveFlyio(resolvedEnv);
-    if (result.token !== null) {
-        TOKEN_CACHE.set(key, result);
-    }
-    return result;
-}
-/**
- * Drop the in-memory token cache. Intended for tests + long-running
- * daemons that need to react to env-var rotation. Safe to call from
- * any execution context.
- */
-export function clearCloudAuthCache() {
-    TOKEN_CACHE.clear();
-}
-//# sourceMappingURL=cloud-auth.js.map

package/dist/sandbox/backends/cloud-auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cloud-auth.js","sourceRoot":"","sources":["../../../src/sandbox/backends/cloud-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA2BH,MAAM,WAAW,GAAkC,IAAI,GAAG,EAAE,CAAC;AAC7D,MAAM,OAAO,GAAuC,IAAI,OAAO,EAAE,CAAC;AAClE,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,SAAS,QAAQ,CAAC,GAAsB,EAAE,QAA2B;IACnE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,YAAY,IAAI,CAAC,CAAC;QAClB,EAAE,GAAG,OAAO,YAAY,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,EAAE,KAAK,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,8DAA8D;AAE9D,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACzC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EACJ,4GAA4G;SAC/G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EACJ,gHAAgH;SACnH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,yDAAyD;SAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,8DAA8D;AAE9D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAA2B,EAC3B,GAAuB;IAEvB,MAAM,WAAW,GAAsB,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC1D,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE5C,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAElC,MAAM,MAAM,GACV,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;IAE/E,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC"}

package/dist/security/anti-distillation.d.ts

@@ -1,46 +0,0 @@
-/**
- * Anti-distillation defenses from CC leak.
- *
- * Two defense layers:
- * 1. Polymorphic fake tool injection -- randomized tool names, descriptions,
- *    and schemas each request, making distillation data non-reproducible
- * 2. Multi-point response watermarking -- zero-width characters inserted at
- *    multiple positions with per-request unique watermark IDs
- */
-export interface FakeToolDefinition {
-    readonly name: string;
-    readonly description: string;
-    readonly inputSchema: Record<string, unknown>;
-}
-/**
- * Generate polymorphic fake tools with randomized names, descriptions,
- * and schemas. Each invocation produces a unique set that poisons
- * distillation attempts.
- */
-export declare function generateFakeTools(count?: number): readonly FakeToolDefinition[];
-/**
- * Generate a batch of polymorphic fake tools suitable for a single
- * API request. Randomized on every call.
- */
-export declare function generatePolymorphicBatch(minCount?: number, maxCount?: number): readonly FakeToolDefinition[];
-/**
- * Embed a watermark at multiple insertion points in the text.
- * Each insertion point gets a fragment of the watermark, making
- * removal harder since all fragments must be found and stripped.
- */
-export declare function embedWatermark(text: string, watermarkId: string): string;
-/**
- * Extract a watermark from text by collecting all zero-width character
- * sequences and decoding them.
- */
-export declare function extractWatermark(text: string): string | null;
-/**
- * Check if a text contains any zero-width watermarks.
- */
-export declare function hasWatermark(text: string): boolean;
-/**
- * Count the number of watermark fragments found in the text.
- * Useful for detecting partial stripping attempts.
- */
-export declare function countWatermarkFragments(text: string): number;
-//# sourceMappingURL=anti-distillation.d.ts.map

package/dist/security/anti-distillation.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"anti-distillation.d.ts","sourceRoot":"","sources":["../../src/security/anti-distillation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C;AA+GD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,GAAE,MAAU,GAAG,SAAS,kBAAkB,EAAE,CAmBlF;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,GAAE,MAAU,EACpB,QAAQ,GAAE,MAAU,GACnB,SAAS,kBAAkB,EAAE,CAG/B;AAwFD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAqBxE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkB5D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGlD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ5D"}

package/dist/security/anti-distillation.js

@@ -1,358 +0,0 @@
-/**
- * Anti-distillation defenses from CC leak.
- *
- * Two defense layers:
- * 1. Polymorphic fake tool injection -- randomized tool names, descriptions,
- *    and schemas each request, making distillation data non-reproducible
- * 2. Multi-point response watermarking -- zero-width characters inserted at
- *    multiple positions with per-request unique watermark IDs
- */
-// ── Polymorphic Name Components ─────────────────────────────
-const NAME_PREFIXES = [
-    "internal",
-    "system",
-    "harness",
-    "runtime",
-    "core",
-    "meta",
-    "infra",
-    "platform",
-    "framework",
-    "engine",
-];
-const NAME_ACTIONS = [
-    "diagnostic",
-    "verify",
-    "heartbeat",
-    "prefetch",
-    "invalidate",
-    "sync",
-    "calibrate",
-    "audit",
-    "reconcile",
-    "probe",
-    "validate",
-    "checkpoint",
-    "snapshot",
-    "compress",
-    "rebalance",
-];
-const NAME_SUFFIXES = [
-    "v2",
-    "v3",
-    "v4",
-    "beta",
-    "internal",
-    "signal",
-    "hint",
-    "check",
-    "pulse",
-    "scan",
-    "gate",
-    "hook",
-    "tracker",
-    "monitor",
-];
-const DESCRIPTION_TEMPLATES = [
-    "Run {action} on harness {target}",
-    "Perform {action} for {target} subsystem",
-    "Execute {action} against {target} layer",
-    "Trigger {action} in {target} pipeline",
-    "Signal {action} to {target} controller",
-    "Initiate {action} for {target} module",
-    "Report {action} status from {target}",
-    "Validate {action} within {target} boundary",
-];
-const DESCRIPTION_ACTIONS = [
-    "diagnostic check",
-    "compliance verification",
-    "telemetry report",
-    "cache revalidation",
-    "context prefetch",
-    "health check",
-    "performance calibration",
-    "integrity audit",
-    "state reconciliation",
-    "security probe",
-    "configuration validation",
-    "resource checkpoint",
-];
-const DESCRIPTION_TARGETS = [
-    "subsystems",
-    "components",
-    "middleware",
-    "providers",
-    "execution engine",
-    "memory store",
-    "context manager",
-    "orchestration layer",
-    "sandbox environment",
-    "hook engine",
-];
-const SCHEMA_PROPERTY_NAMES = [
-    "subsystem",
-    "component",
-    "metric",
-    "policy_id",
-    "cache_key",
-    "target",
-    "scope",
-    "level",
-    "threshold",
-    "operation_id",
-    "trace_id",
-    "checkpoint",
-    "partition",
-    "namespace",
-    "priority",
-];
-const SCHEMA_PROPERTY_TYPES = ["string", "number", "boolean"];
-/**
- * Generate polymorphic fake tools with randomized names, descriptions,
- * and schemas. Each invocation produces a unique set that poisons
- * distillation attempts.
- */
-export function generateFakeTools(count = 3) {
-    const fakes = [];
-    const usedNames = new Set();
-    for (let i = 0; i < count; i++) {
-        let name;
-        do {
-            name = generateRandomToolName();
-        } while (usedNames.has(name));
-        usedNames.add(name);
-        fakes.push({
-            name,
-            description: generateRandomDescription(),
-            inputSchema: generateRandomSchema(),
-        });
-    }
-    return fakes;
-}
-/**
- * Generate a batch of polymorphic fake tools suitable for a single
- * API request. Randomized on every call.
- */
-export function generatePolymorphicBatch(minCount = 2, maxCount = 5) {
-    const count = minCount + Math.floor(Math.random() * (maxCount - minCount + 1));
-    return generateFakeTools(count);
-}
-// ── Polymorphic Generators ──────────────────────────────────
-function generateRandomToolName() {
-    const prefix = pickRandom(NAME_PREFIXES);
-    const action = pickRandom(NAME_ACTIONS);
-    const suffix = pickRandom(NAME_SUFFIXES);
-    // Randomly choose between formats
-    const format = Math.floor(Math.random() * 3);
-    switch (format) {
-        case 0:
-            return `${prefix}_${action}_${suffix}`;
-        case 1:
-            return `${prefix}_${action}`;
-        default:
-            return `${action}_${suffix}`;
-    }
-}
-function generateRandomDescription() {
-    const template = pickRandom(DESCRIPTION_TEMPLATES);
-    const action = pickRandom(DESCRIPTION_ACTIONS);
-    const target = pickRandom(DESCRIPTION_TARGETS);
-    return template.replace("{action}", action).replace("{target}", target);
-}
-function generateRandomSchema() {
-    const propCount = 1 + Math.floor(Math.random() * 3);
-    const properties = {};
-    const usedNames = new Set();
-    for (let i = 0; i < propCount; i++) {
-        let propName;
-        do {
-            propName = pickRandom(SCHEMA_PROPERTY_NAMES);
-        } while (usedNames.has(propName));
-        usedNames.add(propName);
-        const propType = pickRandom(SCHEMA_PROPERTY_TYPES);
-        // Sometimes add an array type instead
-        if (Math.random() < 0.2) {
-            properties[propName] = {
-                type: "array",
-                items: { type: propType },
-            };
-        }
-        else {
-            properties[propName] = { type: propType };
-        }
-    }
-    return { type: "object", properties };
-}
-function pickRandom(arr) {
-    return arr[Math.floor(Math.random() * arr.length)];
-}
-// ── Multi-Point Response Watermarking ───────────────────────
-// Zero-width characters for watermarking
-const ZWC_MAP = {
-    "0": "\u200B", // Zero-width space
-    "1": "\u200C", // Zero-width non-joiner
-    "2": "\u200D", // Zero-width joiner
-    "3": "\uFEFF", // Zero-width no-break space
-};
-const INSERTION_STRATEGIES = [
-    "after-first-sentence",
-    "mid-paragraph",
-    "before-last-sentence",
-    "after-newline",
-];
-/**
- * Embed a watermark at multiple insertion points in the text.
- * Each insertion point gets a fragment of the watermark, making
- * removal harder since all fragments must be found and stripped.
- */
-export function embedWatermark(text, watermarkId) {
-    const encoded = encodeWatermark(watermarkId);
-    // Split the encoded watermark into fragments for multi-point insertion
-    const fragmentCount = Math.min(INSERTION_STRATEGIES.length, Math.max(1, Math.floor(encoded.length / 4)));
-    const fragments = splitIntoFragments(encoded, fragmentCount);
-    const insertionPoints = findInsertionPoints(text, fragmentCount);
-    // Insert fragments at their points (reverse order to preserve indices)
-    let result = text;
-    const sortedPoints = [...insertionPoints].sort((a, b) => b - a);
-    for (let i = 0; i < sortedPoints.length && i < fragments.length; i++) {
-        const point = sortedPoints[i];
-        const fragment = fragments[i];
-        result = result.slice(0, point) + fragment + result.slice(point);
-    }
-    return result;
-}
-/**
- * Extract a watermark from text by collecting all zero-width character
- * sequences and decoding them.
- */
-export function extractWatermark(text) {
-    // ESLint no-misleading-character-class fires on ZWJ (U+200D) because
-    // it's an emoji joiner — but for watermark detection we want the
-    // single-codepoint semantic, which is the security-relevant intent.
-    // eslint-disable-next-line no-misleading-character-class
-    const zwcPattern = /[\u200B\u200C\u200D\uFEFF]+/g;
-    const matches = [];
-    let found = zwcPattern.exec(text);
-    while (found !== null) {
-        matches.push(found[0]);
-        found = zwcPattern.exec(text);
-    }
-    if (matches.length === 0)
-        return null;
-    // Concatenate all fragments and decode
-    const combined = matches.join("");
-    return decodeWatermark(combined);
-}
-/**
- * Check if a text contains any zero-width watermarks.
- */
-export function hasWatermark(text) {
-    // eslint-disable-next-line no-misleading-character-class
-    return /[\u200B\u200C\u200D\uFEFF]/.test(text);
-}
-/**
- * Count the number of watermark fragments found in the text.
- * Useful for detecting partial stripping attempts.
- */
-export function countWatermarkFragments(text) {
-    // eslint-disable-next-line no-misleading-character-class
-    const zwcPattern = /[\u200B\u200C\u200D\uFEFF]+/g;
-    let count = 0;
-    while (zwcPattern.exec(text) !== null) {
-        count++;
-    }
-    return count;
-}
-// ── Watermark Encoding/Decoding ─────────────────────────────
-function encodeWatermark(watermarkId) {
-    return watermarkId
-        .split("")
-        .map((char) => {
-        const code = char.charCodeAt(0).toString(4); // Base-4 encoding
-        return code
-            .split("")
-            .map((d) => ZWC_MAP[d] ?? "")
-            .join("");
-    })
-        .join("");
-}
-function decodeWatermark(encoded) {
-    const reverseMap = {};
-    for (const [digit, zwc] of Object.entries(ZWC_MAP)) {
-        reverseMap[zwc] = digit;
-    }
-    try {
-        const digits = encoded
-            .split("")
-            .map((c) => reverseMap[c] ?? "")
-            .join("");
-        // Decode base-4 back to characters
-        const chars = [];
-        for (let i = 0; i < digits.length; i += 2) {
-            const code = parseInt(digits.slice(i, i + 2), 4);
-            if (!isNaN(code) && code > 0) {
-                chars.push(String.fromCharCode(code));
-            }
-        }
-        return chars.length > 0 ? chars.join("") : null;
-    }
-    catch {
-        return null;
-    }
-}
-// ── Multi-Point Insertion Helpers ───────────────────────────
-function findInsertionPoints(text, count) {
-    const points = [];
-    for (let i = 0; i < count && i < INSERTION_STRATEGIES.length; i++) {
-        const strategy = INSERTION_STRATEGIES[i];
-        const point = findPointForStrategy(text, strategy, points);
-        if (point >= 0 && point <= text.length) {
-            points.push(point);
-        }
-    }
-    // If we found fewer points than needed, add midpoints
-    while (points.length < count && points.length < text.length) {
-        const segment = Math.floor(text.length / (points.length + 2));
-        const newPoint = segment * (points.length + 1);
-        if (!points.includes(newPoint)) {
-            points.push(newPoint);
-        }
-        else {
-            break;
-        }
-    }
-    return points;
-}
-function findPointForStrategy(text, strategy, existingPoints) {
-    switch (strategy) {
-        case "after-first-sentence": {
-            const match = text.indexOf(". ");
-            return match >= 0 ? match + 2 : Math.floor(text.length / 4);
-        }
-        case "mid-paragraph": {
-            return Math.floor(text.length / 2);
-        }
-        case "before-last-sentence": {
-            const lastPeriod = text.lastIndexOf(". ");
-            return lastPeriod >= 0 ? lastPeriod : Math.floor(text.length * 0.75);
-        }
-        case "after-newline": {
-            const newlineIdx = text.indexOf("\n");
-            if (newlineIdx >= 0 && !existingPoints.includes(newlineIdx + 1)) {
-                return newlineIdx + 1;
-            }
-            return Math.floor(text.length * 0.6);
-        }
-    }
-}
-function splitIntoFragments(encoded, count) {
-    if (count <= 1)
-        return [encoded];
-    const fragmentSize = Math.ceil(encoded.length / count);
-    const fragments = [];
-    for (let i = 0; i < encoded.length; i += fragmentSize) {
-        fragments.push(encoded.slice(i, i + fragmentSize));
-    }
-    return fragments;
-}
-//# sourceMappingURL=anti-distillation.js.map

package/dist/security/anti-distillation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"anti-distillation.js","sourceRoot":"","sources":["../../src/security/anti-distillation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,+DAA+D;AAE/D,MAAM,aAAa,GAAsB;IACvC,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,WAAW;IACX,QAAQ;CACT,CAAC;AAEF,MAAM,YAAY,GAAsB;IACtC,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,UAAU;IACV,YAAY;IACZ,MAAM;IACN,WAAW;IACX,OAAO;IACP,WAAW;IACX,OAAO;IACP,UAAU;IACV,YAAY;IACZ,UAAU;IACV,UAAU;IACV,WAAW;CACZ,CAAC;AAEF,MAAM,aAAa,GAAsB;IACvC,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,UAAU;IACV,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,SAAS;CACV,CAAC;AAEF,MAAM,qBAAqB,GAAsB;IAC/C,kCAAkC;IAClC,yCAAyC;IACzC,yCAAyC;IACzC,uCAAuC;IACvC,wCAAwC;IACxC,uCAAuC;IACvC,sCAAsC;IACtC,4CAA4C;CAC7C,CAAC;AAEF,MAAM,mBAAmB,GAAsB;IAC7C,kBAAkB;IAClB,yBAAyB;IACzB,kBAAkB;IAClB,oBAAoB;IACpB,kBAAkB;IAClB,cAAc;IACd,yBAAyB;IACzB,iBAAiB;IACjB,sBAAsB;IACtB,gBAAgB;IAChB,0BAA0B;IAC1B,qBAAqB;CACtB,CAAC;AAEF,MAAM,mBAAmB,GAAsB;IAC7C,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,kBAAkB;IAClB,cAAc;IACd,iBAAiB;IACjB,qBAAqB;IACrB,qBAAqB;IACrB,aAAa;CACd,CAAC;AAEF,MAAM,qBAAqB,GAAsB;IAC/C,WAAW;IACX,WAAW;IACX,QAAQ;IACR,WAAW;IACX,WAAW;IACX,QAAQ;IACR,OAAO;IACP,OAAO;IACP,WAAW;IACX,cAAc;IACd,UAAU;IACV,YAAY;IACZ,WAAW;IACX,WAAW;IACX,UAAU;CACX,CAAC;AAEF,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAEjF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB,CAAC;IACjD,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,IAAY,CAAC;QACjB,GAAG,CAAC;YACF,IAAI,GAAG,sBAAsB,EAAE,CAAC;QAClC,CAAC,QAAQ,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC9B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEpB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,WAAW,EAAE,yBAAyB,EAAE;YACxC,WAAW,EAAE,oBAAoB,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAmB,CAAC,EACpB,WAAmB,CAAC;IAEpB,MAAM,KAAK,GAAG,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,+DAA+D;AAE/D,SAAS,sBAAsB;IAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAEzC,kCAAkC;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACzC,KAAK,CAAC;YACJ,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;QAC/B;YACE,OAAO,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,QAAQ,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAE/C,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACpD,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,QAAgB,CAAC;QACrB,GAAG,CAAC;YACF,QAAQ,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC,QAAQ,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;QAClC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,QAAQ,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;QAEnD,sCAAsC;QACtC,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACxB,UAAU,CAAC,QAAQ,CAAC,GAAG;gBACrB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC1B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAI,GAAiB;IACtC,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAAE,CAAC;AACtD,CAAC;AAED,+DAA+D;AAE/D,yCAAyC;AACzC,MAAM,OAAO,GAA2B;IACtC,GAAG,EAAE,QAAQ,EAAE,mBAAmB;IAClC,GAAG,EAAE,QAAQ,EAAE,wBAAwB;IACvC,GAAG,EAAE,QAAQ,EAAE,oBAAoB;IACnC,GAAG,EAAE,QAAQ,EAAE,4BAA4B;CAC5C,CAAC;AAYF,MAAM,oBAAoB,GAAiC;IACzD,sBAAsB;IACtB,eAAe;IACf,sBAAsB;IACtB,eAAe;CAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,WAAmB;IAC9D,MAAM,OAAO,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAE7C,uEAAuE;IACvE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,oBAAoB,CAAC,MAAM,EAC3B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAC5C,CAAC;IACF,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAEjE,uEAAuE;IACvE,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,YAAY,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAE,CAAC;QAC/B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,UAAU,GAAG,8BAA8B,CAAC;IAClD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,uCAAuC;IACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,yDAAyD;IACzD,OAAO,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,yDAAyD;IACzD,MAAM,UAAU,GAAG,8BAA8B,CAAC;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+DAA+D;AAE/D,SAAS,eAAe,CAAC,WAAmB;IAC1C,OAAO,WAAW;SACf,KAAK,CAAC,EAAE,CAAC;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAC/D,OAAO,IAAI;aACR,KAAK,CAAC,EAAE,CAAC;aACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAC5B,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO;aACnB,KAAK,CAAC,EAAE,CAAC;aACT,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aAC/B,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,mCAAmC;QACnC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+DAA+D;AAE/D,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa;IACtD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,OAAO,MAAM,CAAC,MAAM,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,QAA2B,EAC3B,cAAiC;IAEjC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACjC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC9D,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,sBAAsB,CAAC,CAAC,CAAC;YAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;gBAChE,OAAO,UAAU,GAAG,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAa;IACxD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;IACvD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC;QACtD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/security/multi-encoding-decoder.d.ts

@@ -1,47 +0,0 @@
-/**
- * Multi-encoding pre-decoder — V9 Tier 10 SB-06 (CometJacking + ShadowPrompt).
- *
- * Defenses against attackers that wrap their injection payload in
- * ONE OR MORE of: base64 (single + nested rounds), hex, URL-encoding,
- * punycode (xn--), HTML-entity. The url-instruction-guard already
- * scans single-round base64/hex/rot13/url; this module is the
- * COMPREHENSIVE pre-decoder that produces every plausible decoded
- * form so the caller can scan each independently.
- *
- * Caller contract:
- *   `decodeAndScanForInjection(input)` -> returns `suspicious=true`
- *   when ANY decoded form contains an injection marker. The decoded
- *   variants and matched markers are surfaced for logging.
- *
- * -- Quality bars ----------------------------------------------------
- *  - QB #6 honest stubs: malformed/empty input -> suspicious=false +
- *    decoded=[]; never throws.
- *  - QB #7 per-call state: pure functions. No module-level mutation.
- *  - QB #11 sibling-site scan: this is the ONLY multi-round
- *    pre-decoder. The url-instruction-guard does single-round; this
- *    module composes them and adds punycode + HTML-entity. They are
- *    complementary -- both must remain in sync on the imperative list.
- *  - QB #13 env guard: no `process.env` reads.
- */
-export interface DecoderResult {
-    readonly suspicious: boolean;
-    /** Every distinct non-empty decoded form produced. Useful for logs. */
-    readonly decoded: readonly string[];
-    /** Concrete injection markers that matched at least one decoded form. */
-    readonly markers: readonly string[];
-}
-export interface DecoderOptions {
-    /** Max nested base64 rounds before stopping (default 3). */
-    readonly maxBase64Rounds?: number;
-    /** Additional injection markers to match. Lowercase. */
-    readonly extraMarkers?: readonly string[];
-}
-/**
- * Pre-decode `input` through every plausible wrapper and scan each
- * decoded form for injection markers. Returns the aggregate verdict
- * + every decoded form + every marker that hit.
- */
-export declare function decodeAndScanForInjection(input: string, options?: DecoderOptions): DecoderResult;
-/** Convenience export so callers can extend without touching internals. */
-export declare function defaultInjectionMarkers(): readonly string[];
-//# sourceMappingURL=multi-encoding-decoder.d.ts.map

package/dist/security/multi-encoding-decoder.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"multi-encoding-decoder.d.ts","sourceRoot":"","sources":["../../src/security/multi-encoding-decoder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,wDAAwD;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AA6OD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,cAAmB,GAC3B,aAAa,CA2Df;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,IAAI,SAAS,MAAM,EAAE,CAE3D"}