wunderland 0.72.2 → 0.82.0

package/dist/security/ssrf-guard.d.ts

@@ -0,0 +1,96 @@
+/**
+ * @fileoverview SSRF protection — blocks requests to private/internal IPs
+ * @module wunderland/utils/ssrf-guard
+ *
+ * Validates hostnames and IP addresses to prevent Server-Side Request Forgery
+ * (SSRF) attacks where an agent's tool HTTP requests are redirected to internal
+ * services (localhost, RFC 1918, link-local, etc.).
+ *
+ * Ported from OpenClaw upstream security fixes for SSRF IPv4 hardening.
+ */
+/**
+ * Checks if an IPv4 address falls within any blocked range.
+ */
+export declare function isPrivateIPv4(ip: string): boolean;
+/**
+ * Checks if an IPv6 address is a blocked/private address.
+ */
+export declare function isPrivateIPv6(ip: string): boolean;
+/**
+ * Checks if an IP address (v4 or v6) is private/reserved.
+ */
+export declare function isPrivateIP(ip: string): boolean;
+/**
+ * Checks if a hostname resolves to a blocked address or is in the blocklist.
+ *
+ * Note: This does NOT perform DNS resolution (which would be async).
+ * It checks literal IPs and known-blocked hostnames only.
+ * For full protection, DNS resolution should be checked separately.
+ */
+export declare function isBlockedHost(host: string): boolean;
+/**
+ * Validates a URL for SSRF safety.
+ *
+ * @param urlString - URL to validate
+ * @param options - Validation options
+ * @returns Validation result
+ *
+ * @example
+ * ```typescript
+ * const result = validateURL('http://169.254.169.254/metadata');
+ * // → { safe: false, reason: 'Host resolves to blocked IP: 169.254.169.254' }
+ *
+ * const result2 = validateURL('https://api.example.com/data');
+ * // → { safe: true }
+ * ```
+ */
+export declare function validateURL(urlString: string, options?: {
+    /** Allow HTTP (non-TLS) connections. Default: true */
+    allowHTTP?: boolean;
+    /** Allow non-standard ports. Default: true */
+    allowNonStandardPorts?: boolean;
+    /** Additional blocked hosts */
+    additionalBlockedHosts?: string[];
+}): {
+    safe: boolean;
+    reason?: string;
+};
+/** A DNS resolver returning all addresses for a host (injectable for tests). */
+export type DnsLookupAll = (host: string) => Promise<Array<{
+    address: string;
+    family: number;
+}>>;
+export interface UrlWithDnsResult {
+    safe: boolean;
+    reason?: string;
+    /** Resolved addresses (present when resolution ran and all were public). */
+    resolvedAddresses?: string[];
+}
+/**
+ * SSRF validation that CLOSES the DNS-rebinding gap `validateURL` leaves open:
+ * a public hostname whose A/AAAA records point at a private address
+ * (10.x, 127.x, 169.254.x, ::1, …). The sync `validateURL` runs first (fast
+ * reject on literal IPs / known hosts / suffixes / protocol / custom blocklist);
+ * if the host is a real name it is then RESOLVED and rejected when ANY resolved
+ * address is private. Returns the resolved addresses so a caller can
+ * resolve-then-connect (pin the checked IP) to also close the TOCTOU window.
+ *
+ * Use this — not `validateURL` — for agent-authored outbound targets (cron
+ * webhook jobs, tool-built URLs).
+ */
+export declare function validateUrlWithDns(urlString: string, options?: {
+    allowHTTP?: boolean;
+    additionalBlockedHosts?: string[];
+    /** Injectable resolver (defaults to node:dns lookup, all records). */
+    lookup?: DnsLookupAll;
+}): Promise<UrlWithDnsResult>;
+/**
+ * Validates that a WebSocket URL uses TLS for non-loopback hosts.
+ *
+ * Ported from OpenClaw upstream: block plaintext ws:// to non-loopback.
+ */
+export declare function validateWebSocketURL(wsUrl: string): {
+    safe: boolean;
+    reason?: string;
+};
+//# sourceMappingURL=ssrf-guard.d.ts.map

package/dist/security/ssrf-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.d.ts","sourceRoot":"","sources":["../../src/security/ssrf-guard.ts"],"names":[],"mappings":"AACA;;;;;;;;;GASG;AA6FH;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAejD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAKjD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CA8BnD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IACP,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,8CAA8C;IAC9C,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,+BAA+B;IAC/B,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,GACL;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CA+CpC;AAED,gFAAgF;AAChF,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAAC;AAIjG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE;IACP,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,sEAAsE;IACtE,MAAM,CAAC,EAAE,YAAY,CAAC;CAClB,GACL,OAAO,CAAC,gBAAgB,CAAC,CAsC3B;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAgDtF"}

package/dist/security/ssrf-guard.js

@@ -0,0 +1,293 @@
+// @ts-nocheck
+/**
+ * @fileoverview SSRF protection — blocks requests to private/internal IPs
+ * @module wunderland/utils/ssrf-guard
+ *
+ * Validates hostnames and IP addresses to prevent Server-Side Request Forgery
+ * (SSRF) attacks where an agent's tool HTTP requests are redirected to internal
+ * services (localhost, RFC 1918, link-local, etc.).
+ *
+ * Ported from OpenClaw upstream security fixes for SSRF IPv4 hardening.
+ */
+import { URL } from 'node:url';
+import * as net from 'node:net';
+import { lookup as dnsLookup } from 'node:dns/promises';
+function ipToNum(ip) {
+    const parts = ip.split('.').map(Number);
+    // eslint-disable-next-line no-bitwise
+    return ((parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8) | parts[3]) >>> 0;
+}
+function cidr(ip, prefix) {
+    return {
+        base: ipToNum(ip),
+        // eslint-disable-next-line no-bitwise
+        mask: prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0,
+    };
+}
+const BLOCKED_IPV4_RANGES = [
+    cidr('0.0.0.0', 8), // current network
+    cidr('10.0.0.0', 8), // RFC 1918
+    cidr('100.64.0.0', 10), // carrier-grade NAT
+    cidr('127.0.0.0', 8), // loopback
+    cidr('169.254.0.0', 16), // link-local
+    cidr('172.16.0.0', 12), // RFC 1918
+    cidr('192.0.0.0', 24), // IANA reserved
+    cidr('192.0.2.0', 24), // documentation
+    cidr('192.168.0.0', 16), // RFC 1918
+    cidr('198.18.0.0', 15), // benchmarking
+    cidr('198.51.100.0', 24), // documentation
+    cidr('203.0.113.0', 24), // documentation
+    cidr('224.0.0.0', 4), // multicast
+    cidr('240.0.0.0', 4), // reserved
+];
+/**
+ * IPv6 prefixes that should be blocked.
+ */
+const BLOCKED_IPV6_PREFIXES = [
+    '::1', // loopback
+    'fe80:', // link-local
+    'fc00:', // unique-local (RFC 4193)
+    'fd', // unique-local
+    '::ffff:127.', // IPv4-mapped loopback
+    '::ffff:10.', // IPv4-mapped private
+    '::ffff:172.16.', '::ffff:172.17.', '::ffff:172.18.', '::ffff:172.19.',
+    '::ffff:172.20.', '::ffff:172.21.', '::ffff:172.22.', '::ffff:172.23.',
+    '::ffff:172.24.', '::ffff:172.25.', '::ffff:172.26.', '::ffff:172.27.',
+    '::ffff:172.28.', '::ffff:172.29.', '::ffff:172.30.', '::ffff:172.31.',
+    '::ffff:192.168.', // IPv4-mapped private
+    '::ffff:169.254.', // IPv4-mapped link-local
+    '::ffff:0.', // IPv4-mapped current network
+];
+/**
+ * Hostnames that should always be blocked (case-insensitive).
+ */
+const BLOCKED_HOSTNAMES = new Set([
+    'localhost',
+    'localhost.localdomain',
+    'ip6-localhost',
+    'ip6-loopback',
+    'metadata.google.internal', // GCP metadata
+    'metadata.google.com',
+    '169.254.169.254', // AWS/GCP/Azure metadata
+    'metadata.azure.internal',
+]);
+/**
+ * Checks if an IPv4 address falls within any blocked range.
+ */
+export function isPrivateIPv4(ip) {
+    if (!net.isIPv4(ip))
+        return false;
+    const num = ipToNum(ip);
+    for (const range of BLOCKED_IPV4_RANGES) {
+        // eslint-disable-next-line no-bitwise
+        if ((num & range.mask) === (range.base & range.mask)) {
+            return true;
+        }
+    }
+    // Also check broadcast
+    if (ip === '255.255.255.255')
+        return true;
+    return false;
+}
+/**
+ * Checks if an IPv6 address is a blocked/private address.
+ */
+export function isPrivateIPv6(ip) {
+    if (!net.isIPv6(ip))
+        return false;
+    const lower = ip.toLowerCase();
+    return BLOCKED_IPV6_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}
+/**
+ * Checks if an IP address (v4 or v6) is private/reserved.
+ */
+export function isPrivateIP(ip) {
+    return isPrivateIPv4(ip) || isPrivateIPv6(ip);
+}
+/**
+ * Checks if a hostname resolves to a blocked address or is in the blocklist.
+ *
+ * Note: This does NOT perform DNS resolution (which would be async).
+ * It checks literal IPs and known-blocked hostnames only.
+ * For full protection, DNS resolution should be checked separately.
+ */
+export function isBlockedHost(host) {
+    const lower = host.toLowerCase().trim();
+    // Check blocked hostname list
+    if (BLOCKED_HOSTNAMES.has(lower))
+        return true;
+    // Check if the host is a literal IP
+    if (net.isIP(lower)) {
+        return isPrivateIP(lower);
+    }
+    // Check for IPv6 bracket notation [::1]
+    if (lower.startsWith('[') && lower.endsWith(']')) {
+        const innerIP = lower.slice(1, -1);
+        if (net.isIPv6(innerIP)) {
+            return isPrivateIPv6(innerIP);
+        }
+    }
+    // Hostname ending with common internal suffixes
+    if (lower.endsWith('.local') ||
+        lower.endsWith('.internal') ||
+        lower.endsWith('.localhost') ||
+        lower.endsWith('.intranet')) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Validates a URL for SSRF safety.
+ *
+ * @param urlString - URL to validate
+ * @param options - Validation options
+ * @returns Validation result
+ *
+ * @example
+ * ```typescript
+ * const result = validateURL('http://169.254.169.254/metadata');
+ * // → { safe: false, reason: 'Host resolves to blocked IP: 169.254.169.254' }
+ *
+ * const result2 = validateURL('https://api.example.com/data');
+ * // → { safe: true }
+ * ```
+ */
+export function validateURL(urlString, options = {}) {
+    const { allowHTTP = true, additionalBlockedHosts = [] } = options;
+    let parsed;
+    try {
+        parsed = new URL(urlString);
+    }
+    catch {
+        return { safe: false, reason: `Invalid URL: ${urlString}` };
+    }
+    // Protocol check
+    const allowedProtocols = allowHTTP
+        ? ['http:', 'https:']
+        : ['https:'];
+    if (!allowedProtocols.includes(parsed.protocol)) {
+        return {
+            safe: false,
+            reason: `Blocked protocol: ${parsed.protocol} (allowed: ${allowedProtocols.join(', ')})`,
+        };
+    }
+    // Host check
+    const host = parsed.hostname;
+    if (!host) {
+        return { safe: false, reason: 'URL has no hostname' };
+    }
+    if (isBlockedHost(host)) {
+        return {
+            safe: false,
+            reason: `Blocked host: ${host} (private/reserved address)`,
+        };
+    }
+    // Check additional blocked hosts
+    const lowerHost = host.toLowerCase();
+    for (const blocked of additionalBlockedHosts) {
+        if (lowerHost === blocked.toLowerCase()) {
+            return {
+                safe: false,
+                reason: `Blocked host: ${host} (custom blocklist)`,
+            };
+        }
+    }
+    return { safe: true };
+}
+const defaultLookupAll = (host) => dnsLookup(host, { all: true });
+/**
+ * SSRF validation that CLOSES the DNS-rebinding gap `validateURL` leaves open:
+ * a public hostname whose A/AAAA records point at a private address
+ * (10.x, 127.x, 169.254.x, ::1, …). The sync `validateURL` runs first (fast
+ * reject on literal IPs / known hosts / suffixes / protocol / custom blocklist);
+ * if the host is a real name it is then RESOLVED and rejected when ANY resolved
+ * address is private. Returns the resolved addresses so a caller can
+ * resolve-then-connect (pin the checked IP) to also close the TOCTOU window.
+ *
+ * Use this — not `validateURL` — for agent-authored outbound targets (cron
+ * webhook jobs, tool-built URLs).
+ */
+export async function validateUrlWithDns(urlString, options = {}) {
+    // 1. Sync checks: protocol, literal IPs, known-blocked hosts, suffixes,
+    //    custom blocklist. Catches literal-IP + named-blocklist without any DNS.
+    const sync = validateURL(urlString, {
+        allowHTTP: options.allowHTTP,
+        additionalBlockedHosts: options.additionalBlockedHosts,
+    });
+    if (!sync.safe)
+        return { safe: false, reason: sync.reason };
+    // If the host is a literal IP, validateURL already vetted it — no DNS needed.
+    const host = new URL(urlString).hostname;
+    const literal = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+    if (net.isIP(literal)) {
+        return { safe: true, resolvedAddresses: [literal] };
+    }
+    // 2. Resolve and vet EVERY address.
+    const lookup = options.lookup ?? defaultLookupAll;
+    let records;
+    try {
+        records = await lookup(host);
+    }
+    catch (err) {
+        return {
+            safe: false,
+            reason: `DNS lookup failed for ${host}: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    if (!records || records.length === 0) {
+        return { safe: false, reason: `DNS lookup returned no records for ${host}` };
+    }
+    const addresses = records.map((r) => r.address);
+    const blocked = addresses.find((addr) => isPrivateIP(addr));
+    if (blocked) {
+        return { safe: false, reason: `Host ${host} resolves to a private/reserved address: ${blocked}` };
+    }
+    return { safe: true, resolvedAddresses: addresses };
+}
+/**
+ * Validates that a WebSocket URL uses TLS for non-loopback hosts.
+ *
+ * Ported from OpenClaw upstream: block plaintext ws:// to non-loopback.
+ */
+export function validateWebSocketURL(wsUrl) {
+    let parsed;
+    try {
+        parsed = new URL(wsUrl);
+    }
+    catch {
+        return { safe: false, reason: `Invalid WebSocket URL: ${wsUrl}` };
+    }
+    if (parsed.protocol !== 'ws:' && parsed.protocol !== 'wss:') {
+        return { safe: false, reason: `Not a WebSocket URL: ${parsed.protocol}` };
+    }
+    const host = parsed.hostname.toLowerCase();
+    // ws:// is only allowed for loopback addresses
+    if (parsed.protocol === 'ws:') {
+        const isLoopback = host === 'localhost' ||
+            host === '127.0.0.1' ||
+            host === '::1' ||
+            host === '[::1]';
+        if (!isLoopback) {
+            return {
+                safe: false,
+                reason: `Plaintext ws:// connections are only allowed to loopback addresses. Use wss:// for ${host}`,
+            };
+        }
+    }
+    // For wss://, still block private IPs
+    if (parsed.protocol === 'wss:' && isBlockedHost(host)) {
+        // Allow loopback for local development
+        const isLoopback = host === 'localhost' ||
+            host === '127.0.0.1' ||
+            host === '::1' ||
+            host === '[::1]';
+        if (!isLoopback) {
+            return {
+                safe: false,
+                reason: `Blocked WebSocket host: ${host} (private/reserved address)`,
+            };
+        }
+    }
+    return { safe: true };
+}
+//# sourceMappingURL=ssrf-guard.js.map

package/dist/security/ssrf-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf-guard.js","sourceRoot":"","sources":["../../src/security/ssrf-guard.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;;;;;GASG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAyBxD,SAAS,OAAO,CAAC,EAAU;IACzB,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,IAAI,CAAC,EAAU,EAAE,MAAc;IACtC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QACjB,sCAAsC;QACtC,IAAI,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAgB;IACvC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,EAAQ,kBAAkB;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,EAAO,WAAW;IACrC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,EAAI,oBAAoB;IAC9C,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAM,WAAW;IACrC,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,EAAG,aAAa;IACvC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,EAAI,WAAW;IACrC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,EAAK,gBAAgB;IAC1C,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,EAAK,gBAAgB;IAC1C,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,EAAG,WAAW;IACrC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,EAAI,eAAe;IACzC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,gBAAgB;IAC1C,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,EAAG,gBAAgB;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAM,YAAY;IACtC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,EAAM,WAAW;CACtC,CAAC;AAEF;;GAEG;AACH,MAAM,qBAAqB,GAAG;IAC5B,KAAK,EAAU,WAAW;IAC1B,OAAO,EAAQ,aAAa;IAC5B,OAAO,EAAQ,0BAA0B;IACzC,IAAI,EAAW,eAAe;IAC9B,aAAa,EAAE,uBAAuB;IACtC,YAAY,EAAG,sBAAsB;IACrC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;IACtE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;IACtE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;IACtE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB;IACtE,iBAAiB,EAAE,sBAAsB;IACzC,iBAAiB,EAAE,yBAAyB;IAC5C,WAAW,EAAI,8BAA8B;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,uBAAuB;IACvB,eAAe;IACf,cAAc;IACd,0BAA0B,EAAQ,eAAe;IACjD,qBAAqB;IACrB,iBAAiB,EAAiB,yBAAyB;IAC3D,yBAAyB;CAC1B,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACxB,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACxC,sCAAsC;QACtC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,EAAE,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAE1C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/B,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,aAAa,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAExC,8BAA8B;IAC9B,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9C,oCAAoC;IACpC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,wCAAwC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,IACE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3B,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC5B,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,WAAW,CACzB,SAAiB,EACjB,UAOI,EAAE;IAEN,MAAM,EAAE,SAAS,GAAG,IAAI,EAAE,sBAAsB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IAElE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,SAAS,EAAE,EAAE,CAAC;IAC9D,CAAC;IAED,iBAAiB;IACjB,MAAM,gBAAgB,GAAG,SAAS;QAChC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC;QACrB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEf,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,qBAAqB,MAAM,CAAC,QAAQ,cAAc,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SACzF,CAAC;IACJ,CAAC;IAED,aAAa;IACb,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,iBAAiB,IAAI,6BAA6B;SAC3D,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,IAAI,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YACxC,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,iBAAiB,IAAI,qBAAqB;aACnD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAKD,MAAM,gBAAgB,GAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;AAShF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAiB,EACjB,UAKI,EAAE;IAEN,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,EAAE;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;KACvD,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAE5D,8EAA8E;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtF,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAClD,IAAI,OAAmD,CAAC;IACxD,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,yBAAyB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,IAAI,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,4CAA4C,OAAO,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,KAAK,EAAE,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QAC5D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE3C,+CAA+C;IAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QAC9B,MAAM,UAAU,GACd,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,KAAK;YACd,IAAI,KAAK,OAAO,CAAC;QAEnB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,sFAAsF,IAAI,EAAE;aACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,uCAAuC;QACvC,MAAM,UAAU,GACd,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,KAAK;YACd,IAAI,KAAK,OAAO,CAAC;QAEnB,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,2BAA2B,IAAI,6BAA6B;aACrE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC"}

package/dist/security/types.d.ts

@@ -4,8 +4,8 @@
  */
 import { GuardrailAction } from '@framers/agentos/safety/guardrails';
 export { GuardrailAction };
-import type { SignedAgentOutput } from '../core/types.js';
-export type { IntentChainEntry } from '../core/types.js';
+import type { SignedAgentOutput } from '../types/core-types.js';
+export type { IntentChainEntry } from '../types/core-types.js';
 /**
  * Classification category for pre-LLM analysis.
  */

package/dist/security/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACnC,MAAM,GACN,YAAY,GACZ,WAAW,GACX,iBAAiB,CAAC;AAEtB;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,8BAA8B;IAC9B,QAAQ,EAAE,2BAA2B,CAAC;IAEtC,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAElB,wBAAwB;IACxB,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAEpC,sCAAsC;IACtC,YAAY,EAAE,OAAO,CAAC;IAEtB,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAElB,mBAAmB;IACnB,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,SAAS,GAAG,QAAQ,CAAC;IAE1E,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IAEpB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IAEnB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IAEnB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IAEd,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IAEtB,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,MAAM,EAAE,OAAO,CAAC;IAEhB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAE1D,gCAAgC;IAChC,KAAK,EAAE,SAAS,EAAE,CAAC;IAEnB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IAEpB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IAEnB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IAErB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,gBAAgB;IAChB,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,eAAe,GAAG,WAAW,GAAG,QAAQ,CAAC;IAE3G,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IAEpB,eAAe;IACf,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAEjD,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,6BAA6B;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAE1B,uBAAuB;IACvB,cAAc,EAAE,MAAM,CAAC;IAEvB,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IAEvB,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IAEzB,2CAA2C;IAC3C,uBAAuB,EAAE,OAAO,CAAC;IAEjC,qCAAqC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAE1C,qDAAqD;IACrD,eAAe,EAAE,MAAM,CAAC;IAExB,2CAA2C;IAC3C,kBAAkB,EAAE,OAAO,CAAC;IAE5B,8CAA8C;IAC9C,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,+BAA+B;IAC/B,MAAM,EAAE,eAAe,CAAC;IAExB,oCAAoC;IACpC,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAE3C,4BAA4B;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B,yCAAyC;IACzC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,YAAY,EAAE,OAAO,CAAC;IAEtB,4BAA4B;IAC5B,kBAAkB,EAAE,OAAO,CAAC;IAE5B,4BAA4B;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAE7B,gCAAgC;IAChC,gBAAgB,CAAC,EAAE;QACjB,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC;QACpC,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8BAA8B;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE9C,4BAA4B;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAE7C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mEAAmE;IACnE,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,gBAAgB,EAgExD,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/security/types.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAM/D;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACnC,MAAM,GACN,YAAY,GACZ,WAAW,GACX,iBAAiB,CAAC;AAEtB;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,8BAA8B;IAC9B,QAAQ,EAAE,2BAA2B,CAAC;IAEtC,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAElB,wBAAwB;IACxB,gBAAgB,EAAE,eAAe,EAAE,CAAC;IAEpC,sCAAsC;IACtC,YAAY,EAAE,OAAO,CAAC;IAEtB,0DAA0D;IAC1D,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAElB,mBAAmB;IACnB,IAAI,EAAE,WAAW,GAAG,WAAW,GAAG,gBAAgB,GAAG,SAAS,GAAG,QAAQ,CAAC;IAE1E,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IAEpB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IAEnB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IAEnB,iCAAiC;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yBAAyB;IACzB,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,iCAAiC;IACjC,KAAK,EAAE,MAAM,CAAC;IAEd,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IAEtB,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,sCAAsC;IACtC,MAAM,EAAE,OAAO,CAAC;IAEhB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAE1D,gCAAgC;IAChC,KAAK,EAAE,SAAS,EAAE,CAAC;IAEnB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IAEpB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IAEnB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IAErB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IAEf,gBAAgB;IAChB,IAAI,EAAE,iBAAiB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,eAAe,GAAG,WAAW,GAAG,QAAQ,CAAC;IAE3G,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;IAEpB,eAAe;IACf,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAEjD,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,6BAA6B;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAE1B,uBAAuB;IACvB,cAAc,EAAE,MAAM,CAAC;IAEvB,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IAEvB,4DAA4D;IAC5D,gBAAgB,EAAE,MAAM,CAAC;IAEzB,2CAA2C;IAC3C,uBAAuB,EAAE,OAAO,CAAC;IAEjC,qCAAqC;IACrC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,4BAA4B;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAMD;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,4BAA4B;IAC5B,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAE1C,qDAAqD;IACrD,eAAe,EAAE,MAAM,CAAC;IAExB,2CAA2C;IAC3C,kBAAkB,EAAE,OAAO,CAAC;IAE5B,8CAA8C;IAC9C,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc;IACd,MAAM,EAAE,MAAM,CAAC;IAEf,cAAc;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,iBAAiB;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,+BAA+B;IAC/B,MAAM,EAAE,eAAe,CAAC;IAExB,oCAAoC;IACpC,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAE3C,4BAA4B;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B,yCAAyC;IACzC,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,YAAY,EAAE,OAAO,CAAC;IAEtB,4BAA4B;IAC5B,kBAAkB,EAAE,OAAO,CAAC;IAE5B,4BAA4B;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAE7B,gCAAgC;IAChC,gBAAgB,CAAC,EAAE;QACjB,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC;QACpC,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IAEF,8BAA8B;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE9C,4BAA4B;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAE7C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,mEAAmE;IACnE,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD;;GAEG;AACH,eAAO,MAAM,0BAA0B,EAAE,gBAAgB,EAgExD,CAAC"}

package/dist/skills/index.d.ts

@@ -1,9 +1,7 @@
 /**
- * @fileoverview Skills module exports for Wunderland
- * @module wunderland/skills
- *
- * Wunderland re-exports the canonical SkillRegistry implementation from AgentOS.
- * This keeps `wunderland/skills` stable while avoiding duplicated logic.
+ * Re-export of canonical SkillRegistry implementation from AgentOS.
+ * Kept as a barrel for backwards compatibility with consumers that
+ * import from `wunderland/skills`.
  */
-export * from '@framers/agentos/skills';
+export * from '@framers/agentos/cognition/skills';
 //# sourceMappingURL=index.d.ts.map

package/dist/skills/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAEH,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,mCAAmC,CAAC"}

package/dist/skills/index.js

@@ -1,10 +1,7 @@
-// @ts-nocheck
 /**
- * @fileoverview Skills module exports for Wunderland
- * @module wunderland/skills
- *
- * Wunderland re-exports the canonical SkillRegistry implementation from AgentOS.
- * This keeps `wunderland/skills` stable while avoiding duplicated logic.
+ * Re-export of canonical SkillRegistry implementation from AgentOS.
+ * Kept as a barrel for backwards compatibility with consumers that
+ * import from `wunderland/skills`.
  */
-export * from '@framers/agentos/skills';
+export * from '@framers/agentos/cognition/skills';
 //# sourceMappingURL=index.js.map

package/dist/skills/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA,cAAc;AACd;;;;;;GAMG;AAEH,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,mCAAmC,CAAC"}