@fidacy/mcp 0.1.5 → 0.1.6

package/dist/lib.js

@@ -1,5 +1,527 @@
-export * from "./types.js";
-export * from "./core.js";
-export * from "./executor.js";
-export * from "./signing.js";
-//# sourceMappingURL=lib.js.map
+// ../firewall/dist/util.js
+function stableStringify(obj) {
+  if (obj === null || typeof obj !== "object")
+    return JSON.stringify(obj);
+  if (Array.isArray(obj))
+    return "[" + obj.map(stableStringify).join(",") + "]";
+  const keys = Object.keys(obj).sort();
+  return "{" + keys.map((k) => JSON.stringify(k) + ":" + stableStringify(obj[k])).join(",") + "}";
+}
+
+// ../firewall/dist/signing.js
+import crypto from "node:crypto";
+function loadOrGenerateKeyPair() {
+  const b64 = process.env.FIDACY_SIGNING_KEY_B64;
+  if (b64) {
+    const pem = Buffer.from(b64, "base64").toString("utf8");
+    const privateKey2 = crypto.createPrivateKey(pem);
+    const publicKey2 = crypto.createPublicKey(privateKey2);
+    return { privateKey: privateKey2, publicKey: publicKey2, ephemeral: false };
+  }
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("ed25519");
+  return { privateKey, publicKey, ephemeral: true };
+}
+function publicKeyPem(publicKey) {
+  return publicKey.export({ type: "spki", format: "pem" }).toString();
+}
+function sign(privateKey, message) {
+  return crypto.sign(null, Buffer.from(message, "utf8"), privateKey).toString("base64url");
+}
+function verify(publicKey, message, signatureB64url) {
+  try {
+    return crypto.verify(null, Buffer.from(message, "utf8"), publicKey, Buffer.from(signatureB64url, "base64url"));
+  } catch {
+    return false;
+  }
+}
+function sha256(input) {
+  return crypto.createHash("sha256").update(input).digest("hex");
+}
+
+// ../firewall/dist/grant.js
+import crypto2 from "node:crypto";
+function verifyGrant(publicKeyPem2, grant, expected) {
+  const parts = grant.split(".");
+  if (parts.length !== 2 || !parts[0] || !parts[1])
+    return { valid: false, reason: "malformed_grant" };
+  const [body, sig] = parts;
+  let pub;
+  try {
+    pub = crypto2.createPublicKey(publicKeyPem2);
+  } catch {
+    return { valid: false, reason: "bad_public_key" };
+  }
+  if (!verify(pub, body, sig))
+    return { valid: false, reason: "invalid_signature" };
+  let payload;
+  try {
+    payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return { valid: false, reason: "undecodable_payload" };
+  }
+  if (Date.now() > payload.exp)
+    return { valid: false, reason: "grant_expired" };
+  if (payload.payee !== expected.payee)
+    return { valid: false, reason: `payee_mismatch:${payload.payee}!=${expected.payee}` };
+  if (payload.amount !== expected.amount)
+    return { valid: false, reason: `amount_mismatch:${payload.amount}!=${expected.amount}` };
+  if (payload.currency !== expected.currency)
+    return { valid: false, reason: `currency_mismatch` };
+  if ((payload.invoiceRef ?? null) !== (expected.invoiceRef ?? null))
+    return { valid: false, reason: `invoice_mismatch:${payload.invoiceRef ?? "none"}!=${expected.invoiceRef ?? "none"}` };
+  return { valid: true, payload };
+}
+
+// ../firewall/dist/audit-store.js
+import fs from "node:fs";
+var FileAuditStore = class {
+  path;
+  chain = [];
+  constructor(path) {
+    this.path = path;
+    this.load();
+  }
+  load() {
+    if (!fs.existsSync(this.path))
+      return;
+    try {
+      const raw = fs.readFileSync(this.path, "utf8");
+      const parsed = [];
+      for (const line of raw.split("\n")) {
+        if (!line.trim())
+          continue;
+        parsed.push(JSON.parse(line));
+      }
+      this.chain = parsed;
+      if (!this.intact())
+        throw new Error("audit chain integrity broken");
+    } catch (err) {
+      this.chain = [];
+      try {
+        const quarantine = `${this.path}.corrupt-${Date.now()}`;
+        fs.renameSync(this.path, quarantine);
+        console.error(`[fidacy] audit log at ${this.path} is unreadable/tampered (${err.message}); quarantined to ${quarantine}, starting a fresh chain.`);
+      } catch {
+        console.error(`[fidacy] audit log at ${this.path} is unreadable/tampered and could not be quarantined; starting a fresh in-memory chain.`);
+      }
+    }
+  }
+  head() {
+    return this.chain.length ? this.chain[this.chain.length - 1].hash : "GENESIS";
+  }
+  append(decision) {
+    const prevHash = this.head();
+    const seq = this.chain.length;
+    const ts = decision.ts;
+    const digest = sha256(stableStringify({ decisionId: decision.decisionId, status: decision.status, request: decision.request, violatedRule: decision.violatedRule ?? null }));
+    const hash = sha256(`${prevHash}|${digest}|${seq}|${ts}`);
+    const record2 = { seq, decisionId: decision.decisionId, status: decision.status, subject: decision.subject, digest, prevHash, hash, ts };
+    fs.appendFileSync(this.path, JSON.stringify(record2) + "\n");
+    this.chain.push(record2);
+    return record2;
+  }
+  find(decisionId) {
+    return this.chain.find((r) => r.decisionId === decisionId);
+  }
+  intact() {
+    let prev = "GENESIS";
+    for (const r of this.chain) {
+      const expected = sha256(`${prev}|${r.digest}|${r.seq}|${r.ts}`);
+      if (expected !== r.hash || r.prevHash !== prev)
+        return false;
+      prev = r.hash;
+    }
+    return true;
+  }
+};
+
+// ../firewall/dist/executor.js
+import { createPublicKey } from "node:crypto";
+import { randomUUID } from "node:crypto";
+var ReferenceRail = class {
+  settlements = [];
+  async execute(req) {
+    const railRef = "ref_" + randomUUID();
+    this.settlements.push({ ...req, railRef, at: (/* @__PURE__ */ new Date()).toISOString() });
+    return { railRef };
+  }
+};
+var GrantEnforcingExecutor = class {
+  rail;
+  used = /* @__PURE__ */ new Set();
+  pub;
+  constructor(publicKeyPem2, rail) {
+    this.rail = rail;
+    this.pub = createPublicKey(publicKeyPem2);
+  }
+  async execute(req, grant) {
+    if (!grant)
+      return { status: "REFUSED", reason: "missing_grant" };
+    const dot = grant.indexOf(".");
+    if (dot < 0)
+      return { status: "REFUSED", reason: "malformed_grant" };
+    const body = grant.slice(0, dot);
+    const sig = grant.slice(dot + 1);
+    if (!verify(this.pub, body, sig))
+      return { status: "REFUSED", reason: "invalid_signature" };
+    let p;
+    try {
+      p = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+    } catch {
+      return { status: "REFUSED", reason: "undecodable_grant" };
+    }
+    if (Date.now() > p.exp)
+      return { status: "REFUSED", reason: "grant_expired" };
+    if (this.used.has(p.decisionId))
+      return { status: "REFUSED", reason: "grant_replayed" };
+    if (p.payee !== req.payee)
+      return { status: "REFUSED", reason: "payee_mismatch" };
+    if (p.amount !== req.amount)
+      return { status: "REFUSED", reason: "amount_mismatch" };
+    if (p.currency !== req.currency)
+      return { status: "REFUSED", reason: "currency_mismatch" };
+    if (req.invoiceRef != null && req.invoiceRef !== (p.invoiceRef ?? null)) {
+      return { status: "REFUSED", reason: "invoice_mismatch" };
+    }
+    this.used.add(p.decisionId);
+    const { railRef } = await this.rail.execute(req);
+    return { status: "EXECUTED", railRef, decisionId: p.decisionId };
+  }
+};
+
+// ../firewall/dist/evaluate.js
+function evaluate(mandate, req, spentSoFar) {
+  const now = Date.now();
+  if (mandate.revoked)
+    return "mandate_revoked";
+  if (now < Date.parse(mandate.window.notBefore))
+    return "before_mandate_window";
+  if (now > Date.parse(mandate.window.notAfter))
+    return "after_mandate_window";
+  if (req.currency !== mandate.allow.currency)
+    return `currency_not_allowed:${req.currency}`;
+  if (req.amount <= 0)
+    return "non_positive_amount";
+  if (req.amount > mandate.allow.perTxMax)
+    return `per_tx_cap_exceeded:${req.amount}>${mandate.allow.perTxMax}`;
+  if (spentSoFar + req.amount > mandate.allow.maxTotal)
+    return `total_cap_exceeded:${spentSoFar + req.amount}>${mandate.allow.maxTotal}`;
+  const payeeOk = mandate.allow.payees.includes("*") || mandate.allow.payees.includes(req.payee);
+  if (!payeeOk)
+    return `payee_not_in_allowlist:${req.payee}`;
+  const catOk = mandate.allow.categories.includes("*") || mandate.allow.categories.includes(req.category);
+  if (!catOk)
+    return `category_not_allowed:${req.category}`;
+  return null;
+}
+
+// ../firewall/dist/core.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+function canonInvoice(ref) {
+  if (typeof ref !== "string")
+    return "";
+  return ref.normalize("NFC").replace(/[\s\u200B\u200C\u200D\uFEFF]+/g, "").toLowerCase();
+}
+function validateRequest(req) {
+  if (!req || typeof req !== "object")
+    return "invalid_request";
+  if (typeof req.amount !== "number" || !Number.isFinite(req.amount) || req.amount <= 0)
+    return "invalid_amount";
+  if (typeof req.payee !== "string" || req.payee.length === 0)
+    return "invalid_payee";
+  if (typeof req.currency !== "string" || req.currency.length === 0)
+    return "invalid_currency";
+  return null;
+}
+function requireHttpsBase(raw) {
+  const trimmed = String(raw ?? "").replace(/\/+$/, "");
+  let u;
+  try {
+    u = new URL(trimmed);
+  } catch {
+    throw new Error("FIDACY_API_URL is not a valid URL");
+  }
+  const localHttp = u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]");
+  if (u.protocol !== "https:" && !localHttp) {
+    throw new Error("FIDACY_API_URL must be https:// (the API key is sent to it)");
+  }
+  return trimmed;
+}
+var DevFidacyCore = class {
+  priv;
+  pubPem;
+  mandate;
+  store;
+  spent = 0;
+  claimedInvoices = /* @__PURE__ */ new Set();
+  onDecision;
+  constructor(opts) {
+    const kp = loadOrGenerateKeyPair();
+    this.priv = kp.privateKey;
+    this.pubPem = publicKeyPem(kp.publicKey);
+    if (kp.ephemeral)
+      console.error("[fidacy] dev mode: ephemeral signing key. Production: set FIDACY_SIGNING_KEY_B64, or FIDACY_MODE=http + FIDACY_API_URL + FIDACY_API_KEY to use the live core.");
+    this.mandate = opts.mandate;
+    this.store = new FileAuditStore(opts.auditLogPath ?? "./fidacy-audit.log");
+    this.onDecision = opts.onDecision;
+  }
+  async getMandate() {
+    return this.mandate;
+  }
+  async decide(req, subject) {
+    const decisionId = randomUUID2();
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const invalid = validateRequest(req);
+    if (invalid) {
+      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: invalid, ts };
+      this.store.append(decision2);
+      this.onDecision?.(decision2);
+      return decision2;
+    }
+    const violated = evaluate(this.mandate, req, this.spent);
+    if (violated) {
+      const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: violated, ts };
+      this.store.append(decision2);
+      this.onDecision?.(decision2);
+      return decision2;
+    }
+    const invoice = canonInvoice(req.invoiceRef);
+    if (invoice) {
+      const k = `${subject}|${invoice}`;
+      if (this.claimedInvoices.has(k)) {
+        const decision2 = { decisionId, status: "DENY", subject, mandateId: this.mandate.id, request: req, violatedRule: `duplicate_invoice:${invoice}`, ts };
+        this.store.append(decision2);
+        this.onDecision?.(decision2);
+        return decision2;
+      }
+      this.claimedInvoices.add(k);
+    }
+    const grantPayload = { decisionId, subject, payee: req.payee, amount: req.amount, currency: req.currency, exp: Date.now() + 12e4, ...req.invoiceRef ? { invoiceRef: req.invoiceRef } : {} };
+    const grantBody = Buffer.from(stableStringify(grantPayload), "utf8").toString("base64url");
+    const grant = `${grantBody}.${sign(this.priv, grantBody)}`;
+    const decision = { decisionId, status: "ALLOW", subject, mandateId: this.mandate.id, request: req, grant, ts };
+    this.spent += req.amount;
+    this.store.append(decision);
+    this.onDecision?.(decision);
+    return decision;
+  }
+  async getProof(decisionId) {
+    const record2 = this.store.find(decisionId);
+    if (!record2)
+      return null;
+    return { record: record2, chainIntact: this.store.intact(), verifiedAgainstPublicKey: this.pubPem };
+  }
+  publicKey() {
+    return this.pubPem;
+  }
+};
+var HttpFidacyCore = class {
+  apiKey;
+  subjectPub;
+  baseUrl;
+  // Enforce https before any key-bearing request — a hostile FIDACY_API_URL would
+  // otherwise exfiltrate the API key in the Authorization header.
+  constructor(baseUrl, apiKey, subjectPub = "") {
+    this.apiKey = apiKey;
+    this.subjectPub = subjectPub;
+    this.baseUrl = requireHttpsBase(baseUrl);
+  }
+  async call(path, body) {
+    const res = await fetch(`${this.baseUrl}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${this.apiKey}` },
+      body: JSON.stringify(body)
+    });
+    if (!res.ok)
+      throw new Error(`fidacy core ${path} -> ${res.status}`);
+    return await res.json();
+  }
+  async getMandate(subject) {
+    return this.call("/v1/mandate/get", { subject });
+  }
+  async decide(req, subject) {
+    return this.call("/v1/decide", { req, subject });
+  }
+  async getProof(decisionId) {
+    return this.call("/v1/audit/proof", { decisionId });
+  }
+  publicKey() {
+    return this.subjectPub;
+  }
+};
+
+// src/config.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "node:fs";
+function configDir() {
+  return process.env.FIDACY_CONFIG_DIR ?? join(homedir(), ".fidacy");
+}
+function configPath() {
+  return join(configDir(), "config.json");
+}
+function auditLogPath() {
+  if (process.env.FIDACY_AUDIT_PATH) return process.env.FIDACY_AUDIT_PATH;
+  const dir = join(configDir(), "audit");
+  try {
+    mkdirSync(dir, { recursive: true, mode: 448 });
+  } catch {
+  }
+  return join(dir, "audit.log");
+}
+function readConfig() {
+  const p = configPath();
+  if (!existsSync(p)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(p, "utf8"));
+    if (!raw || typeof raw.anon_id !== "string") return null;
+    return {
+      anon_id: raw.anon_id,
+      tier: raw.tier === "paid" ? "paid" : "free",
+      api_key: typeof raw.api_key === "string" ? raw.api_key : null,
+      mandate: raw.mandate
+    };
+  } catch {
+    return null;
+  }
+}
+function resolveMandateRules(cfg) {
+  const m = cfg?.mandate ?? {};
+  const envList = (v) => v === void 0 ? void 0 : v.split(",").map((s) => s.trim()).filter(Boolean);
+  const envNum = (v) => v === void 0 || v === "" ? void 0 : Number(v);
+  return {
+    payees: envList(process.env.FIDACY_ALLOW_PAYEES) ?? m.payees ?? [],
+    categories: envList(process.env.FIDACY_ALLOW_CATEGORIES) ?? m.categories ?? ["*"],
+    currency: process.env.FIDACY_CURRENCY ?? m.currency ?? "USD",
+    perTxMax: envNum(process.env.FIDACY_PER_TX_MAX) ?? m.perTxMax ?? 2500,
+    maxTotal: envNum(process.env.FIDACY_MAX_TOTAL) ?? m.maxTotal ?? 1e4
+  };
+}
+
+// src/telemetry.ts
+var CLIENT_VERSION = "0.1.5";
+function telemetryEnabled() {
+  const v = (process.env.FIDACY_DISABLE_TELEMETRY ?? "").trim().toLowerCase();
+  return !(v === "1" || v === "true" || v === "yes");
+}
+function endpoint() {
+  const base = (process.env.FIDACY_ENGINE_URL ?? "https://api.fidacy.com").replace(/\/$/, "");
+  return `${base}/v1/telemetry`;
+}
+var anonIdCache = null;
+function anonId() {
+  if (anonIdCache) return anonIdCache;
+  anonIdCache = readConfig()?.anon_id ?? null;
+  return anonIdCache;
+}
+var buffer = [];
+var flushTimer = null;
+function resultOf(status, violatedRule) {
+  if (status === "ALLOW") return "allow";
+  const r = violatedRule ?? "";
+  if (r.startsWith("per_tx_cap") || r.startsWith("total_cap")) return "deny_cap";
+  if (r.startsWith("payee_not_in_allowlist")) return "deny_payee";
+  return "deny_scope";
+}
+function record(type, result) {
+  if (!telemetryEnabled()) return;
+  buffer.push({ type, ts: (/* @__PURE__ */ new Date()).toISOString(), client_version: CLIENT_VERSION, ...result ? { result } : {} });
+  if (!flushTimer) {
+    flushTimer = setTimeout(() => {
+      void flush();
+    }, 2e3);
+    if (typeof flushTimer.unref === "function") flushTimer.unref();
+  }
+}
+var recordDecision = (status, violatedRule) => record("decision", resultOf(status, violatedRule));
+async function flush() {
+  if (flushTimer) {
+    clearTimeout(flushTimer);
+    flushTimer = null;
+  }
+  if (!telemetryEnabled() || buffer.length === 0) return;
+  const id = anonId();
+  if (!id) {
+    buffer = [];
+    return;
+  }
+  const events = buffer;
+  buffer = [];
+  try {
+    await fetch(endpoint(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ anon_id: id, events })
+    });
+  } catch {
+  }
+}
+
+// src/core.ts
+function buildMandate() {
+  if (process.env.FIDACY_MANDATE_JSON) {
+    try {
+      const parsed = JSON.parse(process.env.FIDACY_MANDATE_JSON);
+      if (parsed && typeof parsed === "object" && parsed.allow && parsed.window) return parsed;
+      console.error("[fidacy] FIDACY_MANDATE_JSON is missing allow/window; ignoring it and using the safe default mandate.");
+    } catch (err) {
+      console.error(`[fidacy] FIDACY_MANDATE_JSON is not valid JSON (${err.message}); ignoring it and using the safe default mandate.`);
+    }
+  }
+  const subject = process.env.FIDACY_SUBJECT ?? "agent:demo";
+  const rules = resolveMandateRules(readConfig());
+  return {
+    id: "mandate:local",
+    subject,
+    version: "ap2.v0.2.0",
+    allow: {
+      payees: rules.payees,
+      categories: rules.categories,
+      currency: rules.currency,
+      maxTotal: rules.maxTotal,
+      perTxMax: rules.perTxMax
+    },
+    window: {
+      notBefore: process.env.FIDACY_NOT_BEFORE ?? new Date(Date.now() - 36e5).toISOString(),
+      notAfter: process.env.FIDACY_NOT_AFTER ?? new Date(Date.now() + 30 * 864e5).toISOString()
+    },
+    revoked: false
+  };
+}
+function makeCore() {
+  if ((process.env.FIDACY_MODE ?? "dev") === "http") {
+    const url = process.env.FIDACY_API_URL;
+    const key = process.env.FIDACY_API_KEY;
+    if (!url || !key) throw new Error("FIDACY_MODE=http requires FIDACY_API_URL and FIDACY_API_KEY");
+    return new HttpFidacyCore(url, key, process.env.FIDACY_PUBLIC_KEY_PEM ?? "");
+  }
+  return new DevFidacyCore({
+    mandate: buildMandate(),
+    auditLogPath: auditLogPath(),
+    onDecision: (d) => recordDecision(d.status, d.violatedRule)
+  });
+}
+export {
+  DevFidacyCore,
+  FileAuditStore,
+  GrantEnforcingExecutor,
+  HttpFidacyCore,
+  ReferenceRail,
+  canonInvoice,
+  evaluate,
+  loadOrGenerateKeyPair,
+  makeCore,
+  publicKeyPem,
+  requireHttpsBase,
+  sha256,
+  sign,
+  stableStringify,
+  validateRequest,
+  verify,
+  verifyGrant
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fidacy/mcp",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Fidacy action firewall for AI agents. Mandate-gated payment authorization as an MCP server.",
   "license": "Apache-2.0",
   "homepage": "https://fidacy.com",
@@ -24,12 +24,8 @@
   "exports": {
     ".": "./dist/index.js",
     "./assess": "./dist/assess.js",
-    "./grant": "./dist/grant.js",
-    "./types": "./dist/types.js",
     "./core": "./dist/core.js",
-    "./executor": "./dist/executor.js",
-    "./signing": "./dist/signing.js",
-    "./util": "./dist/util.js"
+    "./lib": "./dist/lib.js"
   },
   "files": [
     "dist",
@@ -41,7 +37,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node scripts/bundle.mjs",
     "dev": "tsx watch src/index.ts",
     "start": "node dist/index.js",
     "prepublishOnly": "npm run build"
@@ -54,6 +50,7 @@
     "zod": "^3.25.0"
   },
   "devDependencies": {
+    "@fidacy/firewall": "workspace:*",
     "@types/node": "^22.10.0",
     "tsx": "^4.19.2",
     "typescript": "^5.7.2"

package/dist/assess.d.ts

@@ -1,78 +0,0 @@
-export type AssessKind = "ap2_payment" | "message_send" | "voice_call" | "custom" | "claim_document";
-export interface AssessParams {
-    /** Action kind. Defaults to `ap2_payment`. */
-    kind?: AssessKind;
-    /** The action/mandate object for this kind. */
-    mandate: unknown;
-    /** Optional explicit mandate type. The engine derives it otherwise. */
-    mandateType?: string;
-    /** Optional A2A correlation block. Adds the `A2A-Version` header when present. */
-    a2a?: {
-        task_id: string;
-    };
-    /** Optional spending mandate. Sent as snake_case `spending_mandate`. */
-    spendingMandate?: unknown;
-    /** Optional idempotency key. Sent as snake_case `idempotency_key`. Enables retry. */
-    idempotencyKey?: string;
-}
-export interface AssessResult {
-    decision: "approve" | "review" | "deny";
-    score: number;
-    assessmentId: string;
-    mandateId: string;
-    riskPayloadJws: string;
-    riskPayload: Record<string, unknown>;
-    signingKeyId: string;
-    signals: Record<string, unknown>;
-    mandate: Record<string, unknown>;
-    outcome: Record<string, unknown>;
-    billing?: Record<string, unknown>;
-    spend_guard?: Record<string, unknown>;
-    a2a?: Record<string, unknown>;
-    [k: string]: unknown;
-}
-export interface RejectionReason {
-    key: string;
-    category?: string;
-    message?: string;
-    description?: string;
-}
-/**
- * Typed error from the engine. `message` is STATIC and never contains the key or
- * request body. `type` is the stable engine error code (or a client code), and
- * `status` is the HTTP status (0 for network/timeout).
- */
-export declare class AssessError extends Error {
-    readonly type: string;
-    readonly status: number;
-    readonly details?: unknown;
-    readonly rejection_reasons?: RejectionReason[];
-    constructor(opts: {
-        type: string;
-        status: number;
-        details?: unknown;
-        rejection_reasons?: RejectionReason[];
-    });
-}
-export interface AssessConfig {
-    /** Base URL of the engine, e.g. `https://api.fidacy.com`. Trailing slashes stripped. */
-    engineUrl: string;
-    /** API key (`fky_live_…`/`fky_test_…`) with scope `assess:write`. Never logged. */
-    apiKey: string;
-    /** Custom fetch (tests, edge runtimes). Default: `globalThis.fetch`. */
-    fetchImpl?: typeof fetch;
-    /** Per-request timeout in ms. Default 10000. */
-    timeoutMs?: number;
-    /** Max retries on transient failures (only when an idempotency key is set). Default 2. */
-    maxRetries?: number;
-    /** Backoff (ms) for attempt n. Default exponential base 200ms cap 2000ms. */
-    backoffMs?: (n: number) => number;
-}
-/**
- * Call the live engine's POST /v1/assess and return the signed trust verdict.
- *
- * Retries ONLY when an idempotency key was supplied, on 5xx/429/network/timeout,
- * with small exponential backoff and a per-request AbortController timeout. This
- * mirrors the @fidacy/sdk request() behavior. Self-contained; no sdk import.
- */
-export declare function assessAction(params: AssessParams, cfg: AssessConfig): Promise<AssessResult>;

package/dist/assess.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"assess.js","sourceRoot":"","sources":["../src/assess.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,gFAAgF;AAChF,uEAAuE;AACvE,EAAE;AACF,6EAA6E;AAC7E,yEAAyE;AAgDzE;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,CAAS;IACb,MAAM,CAAS;IACf,OAAO,CAAW;IAClB,iBAAiB,CAAqB;IAE/C,YAAY,IAKX;QACC,KAAK,CAAC,wBAAwB,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;IAClD,CAAC;CACF;AAiBD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,cAAc,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AAE5E,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAoB,EACpB,GAAiB;IAEjB,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,OAAO,YAAY,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,eAAe,CAAC;IACnD,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,eAAe,CAAC;IACrD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,cAAc,CAAC;IAElD,0EAA0E;IAC1E,MAAM,IAAI,GAA4B;QACpC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,aAAa;QAClC,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;IACF,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5E,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACpD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS;QAAE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,eAAe,CAAC;IACzF,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS;QAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,CAAC;IACtF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAErC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE;KACtC,CAAC;IACF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;QAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IAE/D,kEAAkE;IAClE,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC;IAE9D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,GACf,GAAG,YAAY,WAAW;gBAC1B,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,WAAW,IAAI,iBAAiB,IAAI,OAAO,GAAG,UAAU,CAAC;YAC1E,IAAI,CAAC,QAAQ;gBAAE,MAAM,GAAG,CAAC;YACzB,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,SAAuB,EACvB,GAAW,EACX,OAA+B,EAC/B,OAAe,EACf,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAE9D,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACzB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;QAC1C,kEAAkE;QAClE,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAY,SAAS,CAAC;IAChC,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GACR,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC;YACtE,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,MAAM,iBAAiB,GACrB,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACzD,CAAC,CAAE,MAAM,CAAC,iBAAuC;YACjD,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,MAAsB,CAAC;AAChC,CAAC"}

package/dist/audit-store.d.ts

@@ -1,11 +0,0 @@
-import { AuditRecord, Decision } from "./types.js";
-export declare class FileAuditStore {
-    private path;
-    private chain;
-    constructor(path: string);
-    private load;
-    private head;
-    append(decision: Decision): AuditRecord;
-    find(decisionId: string): AuditRecord | undefined;
-    intact(): boolean;
-}