@holoscript/core 6.0.3 → 7.0.0

package/dist/chunk-V42NTCFH.js

@@ -1,3645 +0,0 @@
-import { __esm } from './chunk-32TWR3HE.js';
-import * as crypto3 from 'crypto';
-import { promisify } from 'util';
-import jwt from 'jsonwebtoken';
-import path from 'path';
-
-function calculateJwkThumbprint(publicKeyPem) {
-  const keyObject = crypto3.createPublicKey(publicKeyPem);
-  const jwk = keyObject.export({ format: "jwk" });
-  const canonical = buildCanonicalJwk(jwk);
-  const json = JSON.stringify(canonical);
-  return crypto3.createHash("sha256").update(json).digest("base64url");
-}
-function buildCanonicalJwk(jwk) {
-  const kty = jwk.kty;
-  switch (kty) {
-    case "RSA": {
-      const e = jwk.e;
-      const n = jwk.n;
-      if (!e || !n) {
-        throw new Error("RSA JWK missing required members: e, n");
-      }
-      return { e, kty: "RSA", n };
-    }
-    case "EC": {
-      const crv = jwk.crv;
-      const x = jwk.x;
-      const y = jwk.y;
-      if (!crv || !x || !y) {
-        throw new Error("EC JWK missing required members: crv, x, y");
-      }
-      return { crv, kty: "EC", x, y };
-    }
-    case "OKP": {
-      const crv = jwk.crv;
-      const x = jwk.x;
-      if (!crv || !x) {
-        throw new Error("OKP JWK missing required members: crv, x");
-      }
-      return { crv, kty: "OKP", x };
-    }
-    default:
-      throw new Error(`Unsupported JWK key type: ${kty ?? "(undefined)"}`);
-  }
-}
-var init_JwkThumbprint = __esm({
-  "src/compiler/identity/JwkThumbprint.ts"() {
-  }
-});
-function calculateAgentChecksum(config) {
-  const canonical = {
-    role: config.role,
-    name: config.name,
-    version: config.version,
-    prompt: config.prompt || "",
-    tools: (config.tools || []).sort(),
-    // Sort for determinism
-    configuration: config.configuration || {},
-    culturalProfile: config.culturalProfile || null
-  };
-  const serialized = JSON.stringify(canonical);
-  const hash = crypto3.createHash("sha256").update(serialized).digest("hex");
-  return {
-    hash,
-    algorithm: "sha256",
-    calculatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    label: `${config.role}:${config.name}:${config.version}`
-  };
-}
-async function generateAgentKeyPair(agentRole, timestamp) {
-  if (!generateKeyPairAsync) {
-    throw new Error(
-      "crypto.generateKeyPair is unavailable in this environment (browser). Key pair generation requires a Node.js runtime."
-    );
-  }
-  const { publicKey, privateKey } = await generateKeyPairAsync("ed25519", {
-    publicKeyEncoding: {
-      type: "spki",
-      format: "pem"
-    },
-    privateKeyEncoding: {
-      type: "pkcs8",
-      format: "pem"
-    }
-  });
-  const ts = /* @__PURE__ */ new Date();
-  const kid = `agent:${agentRole}#${ts.toISOString()}`;
-  const thumbprint = calculateJwkThumbprint(publicKey);
-  return {
-    publicKey,
-    privateKey,
-    kid,
-    thumbprint
-  };
-}
-function isValidWorkflowTransition(currentStep, nextStep) {
-  const validNextSteps = WORKFLOW_SEQUENCES[currentStep];
-  return validNextSteps.includes(nextStep);
-}
-function getDefaultPermissions(role) {
-  return [...ROLE_PERMISSIONS[role]];
-}
-var generateKeyPairAsync, AgentPermission, WorkflowStep, ROLE_PERMISSIONS, WORKFLOW_SEQUENCES;
-var init_AgentIdentity = __esm({
-  "src/compiler/identity/AgentIdentity.ts"() {
-    init_JwkThumbprint();
-    generateKeyPairAsync = typeof crypto3.generateKeyPair === "function" ? promisify(crypto3.generateKeyPair) : null;
-    AgentPermission = /* @__PURE__ */ ((AgentPermission4) => {
-      AgentPermission4["READ_SOURCE"] = "read:source";
-      AgentPermission4["READ_CONFIG"] = "read:config";
-      AgentPermission4["READ_AST"] = "read:ast";
-      AgentPermission4["READ_IR"] = "read:ir";
-      AgentPermission4["READ_CODE"] = "read:code";
-      AgentPermission4["WRITE_AST"] = "write:ast";
-      AgentPermission4["WRITE_IR"] = "write:ir";
-      AgentPermission4["WRITE_CODE"] = "write:code";
-      AgentPermission4["WRITE_OUTPUT"] = "write:output";
-      AgentPermission4["TRANSFORM_AST"] = "transform:ast";
-      AgentPermission4["TRANSFORM_IR"] = "transform:ir";
-      AgentPermission4["EXECUTE_OPTIMIZATION"] = "execute:optimization";
-      AgentPermission4["EXECUTE_CODEGEN"] = "execute:codegen";
-      AgentPermission4["EXECUTE_EXPORT"] = "execute:export";
-      return AgentPermission4;
-    })(AgentPermission || {});
-    WorkflowStep = /* @__PURE__ */ ((WorkflowStep3) => {
-      WorkflowStep3["PARSE_TOKENS"] = "parse_tokens";
-      WorkflowStep3["BUILD_AST"] = "build_ast";
-      WorkflowStep3["ANALYZE_AST"] = "analyze_ast";
-      WorkflowStep3["APPLY_TRANSFORMS"] = "apply_transforms";
-      WorkflowStep3["SELECT_INSTRUCTIONS"] = "select_instructions";
-      WorkflowStep3["GENERATE_ASSEMBLY"] = "generate_assembly";
-      WorkflowStep3["FORMAT_OUTPUT"] = "format_output";
-      WorkflowStep3["SERIALIZE"] = "serialize";
-      return WorkflowStep3;
-    })(WorkflowStep || {});
-    ROLE_PERMISSIONS = {
-      ["syntax_analyzer" /* SYNTAX_ANALYZER */]: [
-        "read:source" /* READ_SOURCE */,
-        "read:config" /* READ_CONFIG */,
-        "write:ast" /* WRITE_AST */
-      ],
-      ["ast_optimizer" /* AST_OPTIMIZER */]: [
-        "read:ast" /* READ_AST */,
-        "read:config" /* READ_CONFIG */,
-        "write:ast" /* WRITE_AST */,
-        "transform:ast" /* TRANSFORM_AST */,
-        "execute:optimization" /* EXECUTE_OPTIMIZATION */
-      ],
-      ["code_generator" /* CODE_GENERATOR */]: [
-        "read:ast" /* READ_AST */,
-        "read:ir" /* READ_IR */,
-        "read:config" /* READ_CONFIG */,
-        "write:ir" /* WRITE_IR */,
-        "write:code" /* WRITE_CODE */,
-        "transform:ir" /* TRANSFORM_IR */,
-        "execute:codegen" /* EXECUTE_CODEGEN */
-      ],
-      ["exporter" /* EXPORTER */]: [
-        "read:code" /* READ_CODE */,
-        "read:config" /* READ_CONFIG */,
-        "write:output" /* WRITE_OUTPUT */,
-        "execute:export" /* EXECUTE_EXPORT */
-      ],
-      ["orchestrator" /* ORCHESTRATOR */]: [
-        // Orchestrator has all permissions
-        ...Object.values(AgentPermission)
-      ]
-    };
-    WORKFLOW_SEQUENCES = {
-      ["parse_tokens" /* PARSE_TOKENS */]: ["build_ast" /* BUILD_AST */],
-      ["build_ast" /* BUILD_AST */]: ["analyze_ast" /* ANALYZE_AST */],
-      ["analyze_ast" /* ANALYZE_AST */]: ["apply_transforms" /* APPLY_TRANSFORMS */],
-      ["apply_transforms" /* APPLY_TRANSFORMS */]: ["select_instructions" /* SELECT_INSTRUCTIONS */],
-      ["select_instructions" /* SELECT_INSTRUCTIONS */]: ["generate_assembly" /* GENERATE_ASSEMBLY */],
-      ["generate_assembly" /* GENERATE_ASSEMBLY */]: ["format_output" /* FORMAT_OUTPUT */],
-      ["format_output" /* FORMAT_OUTPUT */]: ["serialize" /* SERIALIZE */],
-      ["serialize" /* SERIALIZE */]: []
-      // Terminal step
-    };
-  }
-});
-
-// src/traits/CultureTraits.ts
-function getBuiltinNorm(id) {
-  return BUILTIN_NORMS.find((n) => n.id === id);
-}
-function normsByCategory(category) {
-  return BUILTIN_NORMS.filter((n) => n.category === category);
-}
-function criticalMassForChange(norm, populationSize) {
-  const percentages = { weak: 0.02, moderate: 0.25, strong: 0.5 };
-  return Math.ceil(populationSize * percentages[norm.strength]);
-}
-function getAllContradictoryNorms() {
-  return [...CONTRADICTORY_NORM_PAIRS, ...customContradictoryNorms];
-}
-function getFamilyCompatibility(familyA, familyB) {
-  if (familyA === familyB) {
-    return { rating: "compatible", reason: "Same cultural family." };
-  }
-  for (const entry of CULTURAL_FAMILY_COMPATIBILITY) {
-    if (entry.familyA === familyA && entry.familyB === familyB || entry.familyA === familyB && entry.familyB === familyA) {
-      return { rating: entry.rating, reason: entry.reason };
-    }
-  }
-  return { rating: "compatible", reason: "No known incompatibility between these families." };
-}
-var BUILTIN_NORMS, CULTURAL_FAMILY_COMPATIBILITY, CONTRADICTORY_NORM_PAIRS, customContradictoryNorms;
-var init_CultureTraits = __esm({
-  "src/traits/CultureTraits.ts"() {
-    BUILTIN_NORMS = [
-      // Safety norms
-      {
-        id: "no_griefing",
-        name: "No Griefing",
-        category: "safety",
-        description: "Agents must not intentionally harm or obstruct others",
-        enforcement: "hard",
-        scope: "world",
-        activationThreshold: 0,
-        strength: "strong",
-        forbiddenEffects: ["agent:kill", "inventory:destroy", "physics:teleport"]
-      },
-      {
-        id: "resource_sharing",
-        name: "Resource Sharing",
-        category: "cooperation",
-        description: "Agents should share resources when others are in need",
-        enforcement: "soft",
-        scope: "zone",
-        activationThreshold: 0.5,
-        strength: "moderate",
-        requiredEffects: ["inventory:give"]
-      },
-      {
-        id: "zone_respect",
-        name: "Zone Respect",
-        category: "territory",
-        description: "Agents must request permission before entering owned zones",
-        enforcement: "soft",
-        scope: "zone",
-        activationThreshold: 0.3,
-        strength: "moderate",
-        requiredEffects: ["agent:communicate"],
-        forbiddenEffects: ["authority:zone"]
-      },
-      {
-        id: "fair_trade",
-        name: "Fair Trade",
-        category: "exchange",
-        description: "Trade exchanges must be mutually agreed upon",
-        enforcement: "hard",
-        scope: "world",
-        activationThreshold: 0,
-        strength: "strong",
-        requiredEffects: ["inventory:trade", "agent:communicate"]
-      },
-      {
-        id: "greeting_convention",
-        name: "Greeting Convention",
-        category: "communication",
-        description: "Agents should acknowledge each other when first meeting in a session",
-        enforcement: "advisory",
-        scope: "session",
-        activationThreshold: 0.6,
-        strength: "weak",
-        requiredEffects: ["agent:communicate"]
-      },
-      {
-        id: "noise_courtesy",
-        name: "Noise Courtesy",
-        category: "safety",
-        description: "Agents should not play global audio without zone permission",
-        enforcement: "soft",
-        scope: "zone",
-        activationThreshold: 0.4,
-        strength: "moderate",
-        forbiddenEffects: ["audio:global"]
-      },
-      {
-        id: "spawn_limits",
-        name: "Spawn Limits",
-        category: "cooperation",
-        description: "Agents should not spawn excessive objects in shared spaces",
-        enforcement: "hard",
-        scope: "zone",
-        activationThreshold: 0,
-        strength: "strong",
-        forbiddenEffects: ["render:spawn"]
-        // Catches excessive spawning via budget
-      },
-      {
-        id: "metanorm_enforcement",
-        name: "Meta-Norm: Enforce Norms",
-        category: "authority",
-        description: "Agents who witness norm violations should report them (norm about enforcing norms)",
-        enforcement: "advisory",
-        scope: "world",
-        activationThreshold: 0.7,
-        strength: "weak",
-        requiredEffects: ["agent:communicate", "agent:observe"]
-      }
-    ];
-    CULTURAL_FAMILY_COMPATIBILITY = [
-      // Incompatible pairs
-      {
-        familyA: "competitive",
-        familyB: "cooperative",
-        rating: "incompatible",
-        reason: "Competitive agents pursue individual gain, cooperative agents pursue shared goals. Fundamental goal misalignment."
-      },
-      {
-        familyA: "hierarchical",
-        familyB: "egalitarian",
-        rating: "incompatible",
-        reason: "Hierarchical agents expect chain of command, egalitarian agents reject authority structures."
-      },
-      {
-        familyA: "isolationist",
-        familyB: "cooperative",
-        rating: "incompatible",
-        reason: "Isolationist agents refuse interaction, cooperative agents require mutual engagement."
-      },
-      // Cautious pairs (can work with mediation)
-      {
-        familyA: "competitive",
-        familyB: "egalitarian",
-        rating: "cautious",
-        reason: "Competitive ranking conflicts with equal-voice principles. Needs mediation."
-      },
-      {
-        familyA: "isolationist",
-        familyB: "ritualistic",
-        rating: "cautious",
-        reason: "Isolationist independence conflicts with group ceremony requirements. Needs mediation."
-      },
-      {
-        familyA: "mercantile",
-        familyB: "cooperative",
-        rating: "cautious",
-        reason: "Mercantile agents expect value exchange, cooperative agents share freely. Needs mediation."
-      },
-      {
-        familyA: "competitive",
-        familyB: "hierarchical",
-        rating: "cautious",
-        reason: "Competitive agents may challenge authority. Needs clear ranking rules."
-      },
-      {
-        familyA: "isolationist",
-        familyB: "hierarchical",
-        rating: "cautious",
-        reason: "Isolationist agents resist authority. Needs minimal supervision protocols."
-      }
-    ];
-    CONTRADICTORY_NORM_PAIRS = [
-      {
-        normA: "resource_sharing",
-        normB: "spawn_limits",
-        reason: "Resource sharing may require spawning items, but spawn limits restrict it."
-      }
-      // Users can extend this set via registerContradictoryNorms()
-    ];
-    customContradictoryNorms = [];
-  }
-});
-function getKeystore(config) {
-  if (!globalKeystore) {
-    const masterKeyHex = process.env.AGENT_KEYSTORE_MASTER_KEY;
-    const masterKey = masterKeyHex ? Buffer.from(masterKeyHex, "hex") : void 0;
-    globalKeystore = new AgentKeystore({
-      ...config,
-      masterKey
-    });
-  }
-  return globalKeystore;
-}
-var DEFAULT_TOKEN_LIFETIME, ENCRYPTION_ALGORITHM, KEY_LENGTH, IV_LENGTH, SALT_LENGTH, AgentKeystore, globalKeystore;
-var init_AgentKeystore = __esm({
-  "src/compiler/identity/AgentKeystore.ts"() {
-    init_AgentIdentity();
-    DEFAULT_TOKEN_LIFETIME = 24 * 60 * 60 * 1e3;
-    ENCRYPTION_ALGORITHM = "aes-256-gcm";
-    KEY_LENGTH = 32;
-    IV_LENGTH = 16;
-    SALT_LENGTH = 64;
-    AgentKeystore = class {
-      constructor(config = {}) {
-        /** In-memory credential cache (ephemeral, cleared on restart) */
-        this.credentialCache = /* @__PURE__ */ new Map();
-        /** Persistent encrypted storage (simulated with Map, replace with file/db in production) */
-        this.encryptedStorage = /* @__PURE__ */ new Map();
-        /** Secondary index: JWK thumbprint → AgentRole, for fast PoP key lookup */
-        this.thumbprintIndex = /* @__PURE__ */ new Map();
-        /** Audit log buffer */
-        this.auditLog = [];
-        this.masterKey = config.masterKey || crypto3.randomBytes(KEY_LENGTH);
-        this.tokenLifetime = config.tokenLifetime || DEFAULT_TOKEN_LIFETIME;
-        this.enableAuditLog = config.enableAuditLog ?? true;
-        this.auditLogPath = config.auditLogPath || "./agent-keystore.audit.log";
-        if (!config.masterKey && process.env.NODE_ENV === "production") {
-          console.warn(
-            "[KEYSTORE] Using generated master key. Set AGENT_KEYSTORE_MASTER_KEY environment variable in production."
-          );
-        }
-      }
-      /**
-       * Encrypt sensitive data using AES-256-GCM
-       */
-      encrypt(plaintext) {
-        const iv = crypto3.randomBytes(IV_LENGTH);
-        const salt = crypto3.randomBytes(SALT_LENGTH);
-        const key = crypto3.pbkdf2Sync(this.masterKey, salt, 1e5, KEY_LENGTH, "sha256");
-        const cipher = crypto3.createCipheriv(ENCRYPTION_ALGORITHM, key, iv);
-        let ciphertext = cipher.update(plaintext, "utf8", "hex");
-        ciphertext += cipher.final("hex");
-        const authTag = cipher.getAuthTag();
-        return {
-          ciphertext,
-          iv: iv.toString("hex"),
-          authTag: authTag.toString("hex"),
-          salt: salt.toString("hex"),
-          algorithm: ENCRYPTION_ALGORITHM,
-          createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-          expiresAt: new Date(Date.now() + this.tokenLifetime).toISOString()
-        };
-      }
-      /**
-       * Decrypt sensitive data
-       */
-      decrypt(encrypted) {
-        const iv = Buffer.from(encrypted.iv, "hex");
-        const salt = Buffer.from(encrypted.salt, "hex");
-        const authTag = Buffer.from(encrypted.authTag, "hex");
-        const key = crypto3.pbkdf2Sync(this.masterKey, salt, 1e5, KEY_LENGTH, "sha256");
-        const decipher = crypto3.createDecipheriv(ENCRYPTION_ALGORITHM, key, iv);
-        decipher.setAuthTag(authTag);
-        let plaintext = decipher.update(encrypted.ciphertext, "hex", "utf8");
-        plaintext += decipher.final("utf8");
-        return plaintext;
-      }
-      /**
-       * Log audit event
-       */
-      logAudit(entry) {
-        if (!this.enableAuditLog) return;
-        this.auditLog.push(entry);
-        if (process.env.NODE_ENV === "production") {
-          console.info(`[AUDIT] ${entry.event} - ${entry.agentRole} - ${entry.timestamp}`);
-        }
-      }
-      /**
-       * Store agent credential securely
-       */
-      async storeCredential(credential) {
-        const existing = this.credentialCache.get(credential.role);
-        if (existing) {
-          this.thumbprintIndex.delete(existing.keyPair.thumbprint);
-        }
-        this.credentialCache.set(credential.role, credential);
-        this.thumbprintIndex.set(credential.keyPair.thumbprint, credential.role);
-        const serialized = JSON.stringify({
-          role: credential.role,
-          token: credential.token,
-          keyPair: credential.keyPair,
-          createdAt: credential.createdAt.toISOString(),
-          expiresAt: credential.expiresAt.toISOString()
-        });
-        const encrypted = this.encrypt(serialized);
-        this.encryptedStorage.set(credential.role, encrypted);
-        this.logAudit({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          event: "key_generated",
-          agentRole: credential.role,
-          details: {
-            kid: credential.keyPair.kid,
-            expiresAt: credential.expiresAt.toISOString()
-          }
-        });
-      }
-      /**
-       * Retrieve agent credential
-       *
-       * Returns cached credential if valid, otherwise decrypts from storage.
-       * Automatically rotates if expired.
-       */
-      async getCredential(role) {
-        const cached = this.credentialCache.get(role);
-        if (cached && cached.expiresAt > /* @__PURE__ */ new Date()) {
-          this.logAudit({
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            event: "key_accessed",
-            agentRole: role,
-            details: { source: "cache" }
-          });
-          return cached;
-        }
-        const encrypted = this.encryptedStorage.get(role);
-        if (!encrypted) {
-          return null;
-        }
-        if (new Date(encrypted.expiresAt) < /* @__PURE__ */ new Date()) {
-          this.logAudit({
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            event: "key_expired",
-            agentRole: role
-          });
-          await this.rotateCredential(role);
-          return this.getCredential(role);
-        }
-        const decrypted = this.decrypt(encrypted);
-        const parsed = JSON.parse(decrypted);
-        const credential = {
-          role: parsed.role,
-          token: parsed.token,
-          keyPair: parsed.keyPair,
-          createdAt: new Date(parsed.createdAt),
-          expiresAt: new Date(parsed.expiresAt)
-        };
-        this.credentialCache.set(role, credential);
-        this.logAudit({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          event: "key_accessed",
-          agentRole: role,
-          details: { source: "storage" }
-        });
-        return credential;
-      }
-      /**
-       * Rotate agent credential (generate new keys and token)
-       */
-      async rotateCredential(role) {
-        const keyPair = await generateAgentKeyPair(role);
-        const credential = {
-          role,
-          token: "",
-          // Placeholder, will be set by token issuer
-          keyPair,
-          createdAt: /* @__PURE__ */ new Date(),
-          expiresAt: new Date(Date.now() + this.tokenLifetime)
-        };
-        await this.storeCredential(credential);
-        this.logAudit({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          event: "key_rotated",
-          agentRole: role,
-          details: {
-            oldKid: this.credentialCache.get(role)?.keyPair.kid,
-            newKid: keyPair.kid
-          }
-        });
-        return credential;
-      }
-      /**
-       * Retrieve credential by JWK thumbprint (for PoP token verification).
-       *
-       * Returns the credential whose key pair matches the given JWK SHA-256
-       * thumbprint, or null if no matching credential is found.
-       *
-       * Primary lookup uses the in-memory index; falls back to decrypting all
-       * stored credentials when the index doesn't contain the thumbprint (e.g.
-       * credentials stored before the index was introduced).
-       */
-      async getCredentialByThumbprint(thumbprint) {
-        const role = this.thumbprintIndex.get(thumbprint);
-        if (role) {
-          return this.getCredential(role);
-        }
-        for (const [storedRole, encrypted] of this.encryptedStorage.entries()) {
-          if (new Date(encrypted.expiresAt) < /* @__PURE__ */ new Date()) {
-            continue;
-          }
-          const credential = await this.getCredential(storedRole);
-          if (credential) {
-            this.thumbprintIndex.set(credential.keyPair.thumbprint, storedRole);
-            if (credential.keyPair.thumbprint === thumbprint) {
-              return credential;
-            }
-          }
-        }
-        return null;
-      }
-      /**
-       * Delete agent credential
-       */
-      async deleteCredential(role) {
-        const credential = this.credentialCache.get(role);
-        if (credential) {
-          this.thumbprintIndex.delete(credential.keyPair.thumbprint);
-        }
-        this.credentialCache.delete(role);
-        this.encryptedStorage.delete(role);
-        this.logAudit({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          event: "key_deleted",
-          agentRole: role
-        });
-      }
-      /**
-       * List all stored credentials (metadata only)
-       */
-      listCredentials() {
-        return Array.from(this.encryptedStorage.entries()).map(([role, encrypted]) => ({
-          role,
-          createdAt: encrypted.createdAt,
-          expiresAt: encrypted.expiresAt,
-          isExpired: new Date(encrypted.expiresAt) < /* @__PURE__ */ new Date()
-        }));
-      }
-      /**
-       * Get audit log
-       */
-      getAuditLog() {
-        return [...this.auditLog];
-      }
-      /**
-       * Clear all credentials (use with caution)
-       */
-      clearAll() {
-        this.credentialCache.clear();
-        this.encryptedStorage.clear();
-        this.thumbprintIndex.clear();
-        this.logAudit({
-          timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-          event: "key_deleted",
-          agentRole: "orchestrator" /* ORCHESTRATOR */,
-          details: { action: "clear_all" }
-        });
-      }
-    };
-    globalKeystore = null;
-  }
-});
-
-// src/compiler/identity/CapabilityToken.ts
-var HOLOSCRIPT_RESOURCE_SCHEME, HOLOSCRIPT_RESOURCE_ALL, CapabilityActions, PERMISSION_TO_ACTION;
-var init_CapabilityToken = __esm({
-  "src/compiler/identity/CapabilityToken.ts"() {
-    HOLOSCRIPT_RESOURCE_SCHEME = "holoscript://";
-    HOLOSCRIPT_RESOURCE_ALL = "holoscript://*";
-    CapabilityActions = {
-      // Source
-      SOURCE_READ: "source/read",
-      // Config
-      CONFIG_READ: "config/read",
-      // AST
-      AST_READ: "ast/read",
-      AST_WRITE: "ast/write",
-      AST_TRANSFORM: "ast/transform",
-      // IR
-      IR_READ: "ir/read",
-      IR_WRITE: "ir/write",
-      IR_TRANSFORM: "ir/transform",
-      // Code
-      CODE_READ: "code/read",
-      CODE_WRITE: "code/write",
-      // Output
-      OUTPUT_WRITE: "output/write",
-      // Execution
-      EXECUTE_OPTIMIZATION: "execute/optimization",
-      EXECUTE_CODEGEN: "execute/codegen",
-      EXECUTE_EXPORT: "execute/export",
-      // Proof-of-Play (computation attestation)
-      PROOF_OF_PLAY_WRITE: "proof_of_play/write",
-      PROOF_OF_PLAY_READ: "proof_of_play/read",
-      PROOF_OF_PLAY_VERIFY: "proof_of_play/verify",
-      // Wildcard (orchestrator only)
-      ALL: "*"
-    };
-    PERMISSION_TO_ACTION = {
-      ["read:source" /* READ_SOURCE */]: CapabilityActions.SOURCE_READ,
-      ["read:config" /* READ_CONFIG */]: CapabilityActions.CONFIG_READ,
-      ["read:ast" /* READ_AST */]: CapabilityActions.AST_READ,
-      ["read:ir" /* READ_IR */]: CapabilityActions.IR_READ,
-      ["read:code" /* READ_CODE */]: CapabilityActions.CODE_READ,
-      ["write:ast" /* WRITE_AST */]: CapabilityActions.AST_WRITE,
-      ["write:ir" /* WRITE_IR */]: CapabilityActions.IR_WRITE,
-      ["write:code" /* WRITE_CODE */]: CapabilityActions.CODE_WRITE,
-      ["write:output" /* WRITE_OUTPUT */]: CapabilityActions.OUTPUT_WRITE,
-      ["transform:ast" /* TRANSFORM_AST */]: CapabilityActions.AST_TRANSFORM,
-      ["transform:ir" /* TRANSFORM_IR */]: CapabilityActions.IR_TRANSFORM,
-      ["execute:optimization" /* EXECUTE_OPTIMIZATION */]: CapabilityActions.EXECUTE_OPTIMIZATION,
-      ["execute:codegen" /* EXECUTE_CODEGEN */]: CapabilityActions.EXECUTE_CODEGEN,
-      ["execute:export" /* EXECUTE_EXPORT */]: CapabilityActions.EXECUTE_EXPORT
-    };
-    Object.fromEntries(
-      Object.entries(PERMISSION_TO_ACTION).map(([perm, action]) => [action, perm])
-    );
-  }
-});
-function base64urlEncode(data) {
-  const buf = typeof data === "string" ? Buffer.from(data, "utf-8") : data;
-  return buf.toString("base64url");
-}
-function base64urlDecode(str) {
-  return Buffer.from(str, "base64url");
-}
-function getCapabilityTokenIssuer(config) {
-  if (!globalCapabilityIssuer) {
-    globalCapabilityIssuer = new CapabilityTokenIssuer(config);
-  }
-  return globalCapabilityIssuer;
-}
-var HoloScriptCapabilitySemantics, CapabilityTokenIssuer, globalCapabilityIssuer;
-var init_CapabilityTokenIssuer = __esm({
-  "src/compiler/identity/CapabilityTokenIssuer.ts"() {
-    init_AgentIdentity();
-    init_CapabilityToken();
-    HoloScriptCapabilitySemantics = class {
-      /**
-       * Check whether `child` is a valid attenuation (subset) of `parent`.
-       */
-      isSubsetOf(child, parent) {
-        if (parent.can !== CapabilityActions.ALL && parent.can !== child.can) {
-          return false;
-        }
-        if (parent.with === HOLOSCRIPT_RESOURCE_ALL) {
-          return child.with.startsWith(HOLOSCRIPT_RESOURCE_SCHEME);
-        }
-        if (child.with === parent.with) {
-          return true;
-        }
-        const parentNormalized = parent.with.endsWith("/") ? parent.with : parent.with + "/";
-        if (child.with.startsWith(parentNormalized)) {
-          return true;
-        }
-        return false;
-      }
-      /**
-       * Check if `capability` authorises the given resource + action.
-       */
-      canAccess(capability, resource, action) {
-        if (capability.can !== CapabilityActions.ALL && capability.can !== action) {
-          return false;
-        }
-        if (capability.with === HOLOSCRIPT_RESOURCE_ALL) {
-          return resource.startsWith(HOLOSCRIPT_RESOURCE_SCHEME);
-        }
-        if (capability.with === resource) {
-          return true;
-        }
-        const capNormalized = capability.with.endsWith("/") ? capability.with : capability.with + "/";
-        return resource.startsWith(capNormalized);
-      }
-      /**
-       * Convert a legacy AgentPermission into a Capability.
-       */
-      fromPermission(permission, scope) {
-        const action = PERMISSION_TO_ACTION[permission] || permission;
-        const resource = scope ? `${HOLOSCRIPT_RESOURCE_SCHEME}${scope}` : HOLOSCRIPT_RESOURCE_ALL;
-        return {
-          with: resource,
-          can: action
-        };
-      }
-    };
-    CapabilityTokenIssuer = class {
-      constructor(config = {}) {
-        /** Token store for proof resolution */
-        this.tokenStore = /* @__PURE__ */ new Map();
-        /** Nonce set for replay detection */
-        this.usedNonces = /* @__PURE__ */ new Set();
-        this.defaultLifetimeSec = config.defaultLifetimeSec ?? 86400;
-        this.maxDelegationDepth = config.maxDelegationDepth ?? 10;
-        this.semantics = config.semantics ?? new HoloScriptCapabilitySemantics();
-        this.strictExpiration = config.strictExpiration ?? true;
-      }
-      // -----------------------------------------------------------------------
-      // Root token issuance
-      // -----------------------------------------------------------------------
-      /**
-       * Issue a root capability token (no parent proofs).
-       *
-       * Root tokens are typically issued by the orchestrator or a top-level
-       * identity provider to grant initial capabilities.
-       *
-       * @param options  Token creation options
-       * @param keyPair  Ed25519 key pair of the issuer (used for signing)
-       * @returns        Signed CapabilityToken
-       */
-      async issueRoot(options, keyPair) {
-        const now = Math.floor(Date.now() / 1e3);
-        const lifetime = options.lifetimeSec ?? this.defaultLifetimeSec;
-        const nonce = crypto3.randomUUID();
-        const payload = {
-          iss: options.issuer,
-          aud: options.audience,
-          att: options.capabilities,
-          prf: [],
-          // root — no proofs
-          exp: now + lifetime,
-          nbf: options.notBeforeOffsetSec != null ? now + options.notBeforeOffsetSec : void 0,
-          nnc: nonce,
-          fct: options.facts
-        };
-        const token = this.sign(payload, keyPair);
-        this.tokenStore.set(nonce, token);
-        return token;
-      }
-      // -----------------------------------------------------------------------
-      // Delegation with attenuation
-      // -----------------------------------------------------------------------
-      /**
-       * Delegate (attenuate) an existing capability token to a new audience.
-       *
-       * Enforces:
-       * 1. Every capability in the child MUST be a subset of at least one
-       *    capability in the parent.
-       * 2. Child expiration MUST NOT exceed parent expiration.
-       * 3. Delegation depth MUST NOT exceed `maxDelegationDepth`.
-       *
-       * @param options  Delegation options including the parent token
-       * @param keyPair  Ed25519 key pair of the delegator (current holder)
-       * @returns        New signed CapabilityToken
-       * @throws         Error if attenuation invariants are violated
-       */
-      async delegate(options, keyPair) {
-        const { parentToken, audience, capabilities, lifetimeSec, facts } = options;
-        const parentPayload = parentToken.payload;
-        for (const childCap of capabilities) {
-          const covered = parentPayload.att.some(
-            (parentCap) => this.semantics.isSubsetOf(childCap, parentCap)
-          );
-          if (!covered) {
-            throw new Error(
-              `Attenuation violation: capability {with: "${childCap.with}", can: "${childCap.can}"} is not a subset of any parent capability. Delegations can only narrow scope.`
-            );
-          }
-        }
-        const now = Math.floor(Date.now() / 1e3);
-        const requestedLifetime = lifetimeSec ?? this.defaultLifetimeSec;
-        const childExp = now + requestedLifetime;
-        if (this.strictExpiration && childExp > parentPayload.exp) {
-          throw new Error(
-            `Expiration violation: delegated token expires at ${childExp} but parent expires at ${parentPayload.exp}. Child tokens cannot outlive their parents.`
-          );
-        }
-        const effectiveExp = Math.min(childExp, parentPayload.exp);
-        const currentDepth = parentPayload.prf.length + 1;
-        if (currentDepth > this.maxDelegationDepth) {
-          throw new Error(
-            `Delegation depth ${currentDepth} exceeds maximum of ${this.maxDelegationDepth}.`
-          );
-        }
-        const proofs = [...parentPayload.prf, parentPayload.nnc];
-        const nonce = crypto3.randomUUID();
-        const payload = {
-          iss: parentPayload.aud,
-          // delegator is the audience of the parent
-          aud: audience,
-          att: capabilities,
-          prf: proofs,
-          exp: effectiveExp,
-          nbf: now,
-          nnc: nonce,
-          fct: facts
-        };
-        const token = this.sign(payload, keyPair);
-        this.tokenStore.set(nonce, token);
-        return token;
-      }
-      // -----------------------------------------------------------------------
-      // Signing
-      // -----------------------------------------------------------------------
-      /**
-       * Sign a capability token payload with an Ed25519 key pair.
-       *
-       * Produces a JWT-like structure: base64url(header).base64url(payload).base64url(sig)
-       */
-      sign(payload, keyPair) {
-        const header = {
-          alg: "EdDSA",
-          typ: "JWT",
-          ucv: "0.10.0"
-        };
-        const headerB64 = base64urlEncode(JSON.stringify(header));
-        const payloadB64 = base64urlEncode(JSON.stringify(payload));
-        const signingInput = `${headerB64}.${payloadB64}`;
-        const privateKeyObj = crypto3.createPrivateKey(keyPair.privateKey);
-        const signatureBuffer = crypto3.sign(null, Buffer.from(signingInput, "utf-8"), privateKeyObj);
-        const signatureB64 = signatureBuffer.toString("base64url");
-        const raw = `${headerB64}.${payloadB64}.${signatureB64}`;
-        return {
-          header,
-          payload,
-          signature: signatureB64,
-          raw
-        };
-      }
-      // -----------------------------------------------------------------------
-      // Verification
-      // -----------------------------------------------------------------------
-      /**
-       * Verify a capability token.
-       *
-       * Checks:
-       * 1. Structural validity (three-part JWT)
-       * 2. Ed25519 signature
-       * 3. Expiration / not-before
-       * 4. Replay (nonce uniqueness)
-       * 5. Proof chain integrity (attenuation invariants)
-       *
-       * @param raw       The raw JWT string (or a CapabilityToken object)
-       * @param publicKey PEM-encoded Ed25519 public key of the issuer
-       * @returns         Verification result
-       */
-      verify(raw, publicKey) {
-        const rawStr = typeof raw === "string" ? raw : raw.raw;
-        const parts = rawStr.split(".");
-        if (parts.length !== 3) {
-          return {
-            valid: false,
-            error: "Malformed token: expected 3 parts",
-            errorCode: "INVALID_SIGNATURE"
-          };
-        }
-        const [headerB64, payloadB64, signatureB64] = parts;
-        try {
-          const pubKeyObj = crypto3.createPublicKey(publicKey);
-          const signingInput = `${headerB64}.${payloadB64}`;
-          const signatureBuffer = base64urlDecode(signatureB64);
-          const isValid = crypto3.verify(
-            null,
-            Buffer.from(signingInput, "utf-8"),
-            pubKeyObj,
-            signatureBuffer
-          );
-          if (!isValid) {
-            return {
-              valid: false,
-              error: "Invalid Ed25519 signature",
-              errorCode: "INVALID_SIGNATURE"
-            };
-          }
-        } catch {
-          return {
-            valid: false,
-            error: "Signature verification failed",
-            errorCode: "INVALID_SIGNATURE"
-          };
-        }
-        let payload;
-        try {
-          payload = JSON.parse(base64urlDecode(payloadB64).toString("utf-8"));
-        } catch {
-          return {
-            valid: false,
-            error: "Malformed payload",
-            errorCode: "INVALID_SIGNATURE"
-          };
-        }
-        const now = Math.floor(Date.now() / 1e3);
-        if (payload.exp <= now) {
-          return {
-            valid: false,
-            payload,
-            error: "Token expired",
-            errorCode: "EXPIRED"
-          };
-        }
-        if (payload.nbf != null && payload.nbf > now) {
-          return {
-            valid: false,
-            payload,
-            error: `Token not yet valid (nbf: ${payload.nbf}, now: ${now})`,
-            errorCode: "NOT_YET_VALID"
-          };
-        }
-        if (this.usedNonces.has(payload.nnc)) {
-          return {
-            valid: false,
-            payload,
-            error: "Nonce already used (replay detected)",
-            errorCode: "REPLAY_DETECTED"
-          };
-        }
-        this.usedNonces.add(payload.nnc);
-        const chainResult = this.resolveChain(payload);
-        return {
-          valid: true,
-          payload,
-          chain: chainResult
-        };
-      }
-      // -----------------------------------------------------------------------
-      // Proof chain resolution
-      // -----------------------------------------------------------------------
-      /**
-       * Resolve and verify the proof chain for a token payload.
-       *
-       * Walks back through `prf` references, checking attenuation invariants
-       * at each step.
-       */
-      resolveChain(payload) {
-        if (payload.prf.length === 0) {
-          return {
-            links: [
-              {
-                tokenId: payload.nnc,
-                issuer: payload.iss,
-                audience: payload.aud,
-                capabilities: payload.att,
-                issuedAt: payload.nbf ?? Math.floor(Date.now() / 1e3),
-                expiresAt: payload.exp
-              }
-            ],
-            rootAuthority: payload.iss,
-            verified: true,
-            verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
-          };
-        }
-        const links = [];
-        for (const proofNonce of payload.prf) {
-          const parentToken = this.tokenStore.get(proofNonce);
-          if (!parentToken) {
-            return {
-              links,
-              rootAuthority: links.length > 0 ? links[0].issuer : payload.iss,
-              verified: false
-            };
-          }
-          links.push({
-            tokenId: parentToken.payload.nnc,
-            issuer: parentToken.payload.iss,
-            audience: parentToken.payload.aud,
-            capabilities: parentToken.payload.att,
-            issuedAt: parentToken.payload.nbf ?? 0,
-            expiresAt: parentToken.payload.exp
-          });
-        }
-        links.push({
-          tokenId: payload.nnc,
-          issuer: payload.iss,
-          audience: payload.aud,
-          capabilities: payload.att,
-          issuedAt: payload.nbf ?? 0,
-          expiresAt: payload.exp
-        });
-        let chainValid = true;
-        for (let i = 1; i < links.length; i++) {
-          const parent = links[i - 1];
-          const child = links[i];
-          if (child.issuer !== parent.audience) {
-            chainValid = false;
-            break;
-          }
-          for (const childCap of child.capabilities) {
-            const covered = parent.capabilities.some(
-              (parentCap) => this.semantics.isSubsetOf(childCap, parentCap)
-            );
-            if (!covered) {
-              chainValid = false;
-              break;
-            }
-          }
-          if (!chainValid) break;
-          if (child.expiresAt > parent.expiresAt) {
-            chainValid = false;
-            break;
-          }
-        }
-        return {
-          links,
-          rootAuthority: links[0].issuer,
-          verified: chainValid,
-          verifiedAt: chainValid ? (/* @__PURE__ */ new Date()).toISOString() : void 0
-        };
-      }
-      // -----------------------------------------------------------------------
-      // Convenience: issue from AgentRole
-      // -----------------------------------------------------------------------
-      /**
-       * Issue a root capability token for a given AgentRole.
-       *
-       * Automatically maps role permissions to capabilities using the bridge
-       * mappings defined in CapabilityToken.ts.
-       *
-       * @param role      Agent role
-       * @param audience  Audience identifier
-       * @param keyPair   Ed25519 key pair
-       * @param scope     Optional resource scope restriction
-       * @returns         Signed root CapabilityToken
-       */
-      async issueForRole(role, audience, keyPair, scope) {
-        const permissions = getDefaultPermissions(role);
-        const capabilities = permissions.map((perm) => this.semantics.fromPermission(perm, scope));
-        const issuer = `agent:${role}`;
-        return this.issueRoot(
-          {
-            issuer,
-            audience,
-            capabilities
-          },
-          keyPair
-        );
-      }
-      // -----------------------------------------------------------------------
-      // Capability query
-      // -----------------------------------------------------------------------
-      /**
-       * Check whether a token grants access to a specific resource + action.
-       *
-       * Does NOT verify the signature — call `verify()` first if the token
-       * has not been verified yet.
-       */
-      hasCapability(token, resource, action) {
-        return token.payload.att.some((cap) => this.semantics.canAccess(cap, resource, action));
-      }
-      // -----------------------------------------------------------------------
-      // Store management
-      // -----------------------------------------------------------------------
-      /**
-       * Retrieve a stored token by its nonce (for proof resolution).
-       */
-      getStoredToken(nonce) {
-        return this.tokenStore.get(nonce);
-      }
-      /**
-       * Store an externally-created token (e.g. received from another agent).
-       */
-      storeToken(token) {
-        this.tokenStore.set(token.payload.nnc, token);
-      }
-      /**
-       * Clear all stored tokens and nonces (for testing).
-       */
-      reset() {
-        this.tokenStore.clear();
-        this.usedNonces.clear();
-      }
-      /**
-       * Get the semantics engine used by this issuer.
-       */
-      getSemantics() {
-        return this.semantics;
-      }
-    };
-    globalCapabilityIssuer = null;
-  }
-});
-function getTokenIssuer(config) {
-  if (!globalIssuer) {
-    globalIssuer = new AgentTokenIssuer({
-      ...config,
-      jwtSecret: process.env.AGENT_JWT_SECRET
-    });
-  }
-  return globalIssuer;
-}
-var DEFAULT_ISSUER, DEFAULT_JWT_SECRET, DEFAULT_TOKEN_EXPIRATION, AgentTokenIssuer, globalIssuer;
-var init_AgentTokenIssuer = __esm({
-  "src/compiler/identity/AgentTokenIssuer.ts"() {
-    init_AgentIdentity();
-    init_AgentKeystore();
-    init_CapabilityToken();
-    init_CapabilityTokenIssuer();
-    DEFAULT_ISSUER = "holoscript-orchestrator";
-    DEFAULT_JWT_SECRET = process.env.AGENT_JWT_SECRET || "dev-secret-change-in-production";
-    DEFAULT_TOKEN_EXPIRATION = "24h";
-    AgentTokenIssuer = class {
-      constructor(config = {}) {
-        /** Active workflow state (for validation) */
-        this.workflowState = /* @__PURE__ */ new Map();
-        this.issuer = config.issuer || DEFAULT_ISSUER;
-        this.jwtSecret = config.jwtSecret || DEFAULT_JWT_SECRET;
-        this.tokenExpiration = config.tokenExpiration || DEFAULT_TOKEN_EXPIRATION;
-        this.strictWorkflowValidation = config.strictWorkflowValidation ?? true;
-        if (this.jwtSecret === DEFAULT_JWT_SECRET && process.env.NODE_ENV === "production") {
-          console.error(
-            "[TOKEN_ISSUER] Using default JWT secret in production! Set AGENT_JWT_SECRET environment variable."
-          );
-        }
-      }
-      /**
-       * Issue intent token for agent
-       *
-       * Creates a signed JWT with:
-       * - Standard claims (iss, sub, aud, exp, iat, jti)
-       * - Agent identity (role, checksum)
-       * - Permissions (RBAC)
-       * - Intent metadata (workflow context)
-       * - PoP binding (JWK thumbprint)
-       */
-      async issueToken(request) {
-        const {
-          agentConfig,
-          workflowStep,
-          workflowId,
-          initiatedBy,
-          delegationChain = [],
-          executionContext = {},
-          keyPair
-        } = request;
-        if (this.strictWorkflowValidation) {
-          const currentStep = this.workflowState.get(workflowId);
-          if (currentStep && !isValidWorkflowTransition(currentStep, workflowStep)) {
-            throw new Error(
-              `Invalid workflow transition: ${currentStep} \u2192 ${workflowStep} in workflow ${workflowId}`
-            );
-          }
-        }
-        const agentChecksum = calculateAgentChecksum(agentConfig);
-        const permissions = getDefaultPermissions(agentConfig.role);
-        const updatedDelegationChain = [...delegationChain, agentConfig.role];
-        const now = Math.floor(Date.now() / 1e3);
-        const payload = {
-          // Standard JWT claims
-          iss: this.issuer,
-          sub: `agent:${agentConfig.role}:${agentConfig.name}`,
-          aud: "holoscript-compiler",
-          exp: typeof this.tokenExpiration === "string" ? now + this.parseExpiration(this.tokenExpiration) : now + this.tokenExpiration,
-          iat: now,
-          jti: crypto3.randomUUID(),
-          // Agent-specific claims
-          agent_role: agentConfig.role,
-          agent_checksum: agentChecksum,
-          permissions,
-          scope: agentConfig.scope,
-          // Intent claims
-          intent: {
-            workflow_id: workflowId,
-            workflow_step: workflowStep,
-            executed_by: agentConfig.role,
-            initiated_by: initiatedBy,
-            delegation_chain: updatedDelegationChain,
-            execution_context: executionContext
-          },
-          // Proof-of-Possession (PoP) confirmation
-          cnf: {
-            jkt: keyPair.thumbprint
-          },
-          // Ed25519 public key for HTTP Message Signature verification
-          publicKey: keyPair.publicKey
-        };
-        const token = jwt.sign(payload, this.jwtSecret, {
-          algorithm: "HS256"
-        });
-        this.workflowState.set(workflowId, workflowStep);
-        const keystore = getKeystore();
-        await keystore.storeCredential({
-          role: agentConfig.role,
-          token,
-          keyPair,
-          createdAt: new Date(now * 1e3),
-          expiresAt: new Date(payload.exp * 1e3)
-        });
-        return token;
-      }
-      /**
-       * Verify agent token
-       *
-       * Validates:
-       * - Signature authenticity
-       * - Token expiration
-       * - Claims structure
-       * - Workflow step sequence (if strict mode)
-       */
-      verifyToken(token) {
-        try {
-          const decoded = jwt.verify(token, this.jwtSecret, {
-            issuer: this.issuer,
-            audience: "holoscript-compiler"
-          });
-          if (!decoded.agent_role || !decoded.agent_checksum || !decoded.intent) {
-            return {
-              valid: false,
-              error: "Missing required claims",
-              errorCode: "INVALID_CLAIMS"
-            };
-          }
-          if (this.strictWorkflowValidation) {
-            const currentStep = this.workflowState.get(decoded.intent.workflow_id);
-            if (currentStep && currentStep !== decoded.intent.workflow_step) {
-              return {
-                valid: false,
-                error: `Workflow step mismatch: expected ${currentStep}, got ${decoded.intent.workflow_step}`,
-                errorCode: "WORKFLOW_VIOLATION"
-              };
-            }
-          }
-          return {
-            valid: true,
-            payload: decoded
-          };
-        } catch (error) {
-          if (error instanceof Error && error.name === "TokenExpiredError") {
-            return {
-              valid: false,
-              error: "Token expired",
-              errorCode: "EXPIRED"
-            };
-          } else if (error instanceof Error && error.name === "JsonWebTokenError") {
-            return {
-              valid: false,
-              error: "Invalid signature or malformed token",
-              errorCode: "INVALID_SIGNATURE"
-            };
-          }
-          return {
-            valid: false,
-            error: error instanceof Error ? error.message : String(error),
-            errorCode: "INVALID_CLAIMS"
-          };
-        }
-      }
-      /**
-       * Extract token from Authorization header
-       */
-      extractToken(authHeader) {
-        if (!authHeader) return null;
-        if (authHeader.startsWith("Bearer ")) {
-          return authHeader.substring(7);
-        }
-        return authHeader;
-      }
-      /**
-       * Verify agent has required permission
-       */
-      hasPermission(token, required) {
-        const result = this.verifyToken(token);
-        if (!result.valid || !result.payload) return false;
-        return result.payload.permissions.includes(required);
-      }
-      /**
-       * Check if agent can perform operation
-       */
-      canPerformOperation(token, requiredPermission, expectedWorkflowStep) {
-        const result = this.verifyToken(token);
-        if (!result.valid || !result.payload) return false;
-        if (!result.payload.permissions.includes(requiredPermission)) {
-          return false;
-        }
-        if (expectedWorkflowStep && result.payload.intent.workflow_step !== expectedWorkflowStep) {
-          return false;
-        }
-        return true;
-      }
-      // ---------------------------------------------------------------------------
-      // UCAN Capability Token Methods (migration bridge)
-      // ---------------------------------------------------------------------------
-      /**
-       * Issue a UCAN capability token for an agent.
-       *
-       * Maps the agent's role to capabilities using the PERMISSION_TO_ACTION bridge
-       * constants defined in CapabilityToken.ts. This enables agents that currently
-       * use JWT tokens to obtain equivalent UCAN capability tokens for the gradual
-       * migration to capability-based authorization.
-       *
-       * @param options  Capability token issuance options
-       * @returns        Signed UCAN CapabilityToken
-       */
-      async issueCapabilityToken(options) {
-        const { agentConfig, audience, keyPair, scope, lifetimeSec, facts } = options;
-        const capIssuer = this.getCapabilityTokenIssuer();
-        const permissions = getDefaultPermissions(agentConfig.role);
-        const capabilities = permissions.map((perm) => {
-          const action = PERMISSION_TO_ACTION[perm] || perm;
-          const resource = scope ? `${HOLOSCRIPT_RESOURCE_SCHEME}${scope}` : HOLOSCRIPT_RESOURCE_ALL;
-          return { with: resource, can: action };
-        });
-        const issuer = `agent:${agentConfig.role}:${agentConfig.name}`;
-        return capIssuer.issueRoot(
-          {
-            issuer,
-            audience,
-            capabilities,
-            lifetimeSec,
-            facts: {
-              ...facts,
-              agent_version: agentConfig.version,
-              agent_role: agentConfig.role
-            }
-          },
-          keyPair
-        );
-      }
-      /**
-       * Issue both a JWT token and a UCAN capability token for the same agent
-       * and intent context.
-       *
-       * This method enables gradual migration from JWT-only authorization to
-       * UCAN capability-based authorization. Consuming services can validate
-       * either token during the transition period.
-       *
-       * @param request          Standard JWT token request parameters
-       * @param capabilityOptions  Additional options for the capability token
-       *                           (audience defaults to 'holoscript-compiler')
-       * @returns                 HybridTokenResult with both tokens
-       */
-      async issueHybridToken(request, capabilityOptions) {
-        const jwtToken = await this.issueToken(request);
-        const audience = capabilityOptions?.audience ?? "holoscript-compiler";
-        const capabilityToken = await this.issueCapabilityToken({
-          agentConfig: request.agentConfig,
-          audience,
-          keyPair: request.keyPair,
-          scope: capabilityOptions?.scope ?? request.agentConfig.scope,
-          lifetimeSec: capabilityOptions?.lifetimeSec,
-          facts: {
-            ...capabilityOptions?.facts,
-            workflow_id: request.workflowId,
-            workflow_step: request.workflowStep,
-            initiated_by: request.initiatedBy
-          }
-        });
-        const permissions = getDefaultPermissions(request.agentConfig.role);
-        const scope = capabilityOptions?.scope ?? request.agentConfig.scope;
-        const capabilities = permissions.map((perm) => {
-          const action = PERMISSION_TO_ACTION[perm] || perm;
-          const resource = scope ? `${HOLOSCRIPT_RESOURCE_SCHEME}${scope}` : HOLOSCRIPT_RESOURCE_ALL;
-          return { with: resource, can: action };
-        });
-        return {
-          jwt: jwtToken,
-          capabilityToken,
-          agentRole: request.agentConfig.role,
-          capabilities,
-          issuedAt: Math.floor(Date.now() / 1e3)
-        };
-      }
-      /**
-       * Delegate (attenuate) an existing UCAN capability token to a target agent.
-       *
-       * Creates a new UCAN token with a subset of the parent token's capabilities,
-       * enforcing UCAN attenuation invariants:
-       * - Every capability in the child MUST be a subset of the parent's capabilities
-       * - Child expiration MUST NOT exceed parent expiration
-       * - Delegation depth MUST NOT exceed the configured maximum
-       *
-       * @param parentToken             The parent UCAN capability token to delegate from
-       * @param targetDID               DID or agent identifier of the delegatee
-       * @param attenuatedCapabilities  Capabilities to grant (must be subsets of parent)
-       * @param keyPair                 Delegator's Ed25519 key pair for signing
-       * @param lifetimeSec             Optional lifetime in seconds
-       * @param facts                   Optional metadata
-       * @returns                       New signed CapabilityToken (attenuated delegation)
-       * @throws                        Error if attenuation invariants are violated
-       */
-      async delegateCapability(parentToken, targetDID, attenuatedCapabilities, keyPair, lifetimeSec, facts) {
-        const capIssuer = this.getCapabilityTokenIssuer();
-        capIssuer.storeToken(parentToken);
-        if (!keyPair) {
-          throw new Error(
-            "A key pair is required to sign the delegated capability token. Pass the delegator's AgentKeyPair."
-          );
-        }
-        return capIssuer.delegate(
-          {
-            parentToken,
-            audience: targetDID,
-            capabilities: attenuatedCapabilities,
-            lifetimeSec,
-            facts
-          },
-          keyPair
-        );
-      }
-      // ---------------------------------------------------------------------------
-      // Internal helpers
-      // ---------------------------------------------------------------------------
-      /**
-       * Get or create the CapabilityTokenIssuer instance used by this issuer.
-       * @internal
-       */
-      getCapabilityTokenIssuer() {
-        return getCapabilityTokenIssuer();
-      }
-      /**
-       * Get workflow state
-       */
-      getWorkflowState(workflowId) {
-        return this.workflowState.get(workflowId);
-      }
-      /**
-       * Reset workflow state (for testing)
-       */
-      resetWorkflowState(workflowId) {
-        if (workflowId) {
-          this.workflowState.delete(workflowId);
-        } else {
-          this.workflowState.clear();
-        }
-      }
-      /**
-       * Parse expiration string (e.g., '24h', '7d')
-       */
-      parseExpiration(exp) {
-        const match = exp.match(/^(\d+)([smhd])$/);
-        if (!match) {
-          throw new Error(`Invalid expiration format: ${exp}`);
-        }
-        const value = parseInt(match[1], 10);
-        const unit = match[2];
-        const multipliers = {
-          s: 1,
-          m: 60,
-          h: 60 * 60,
-          d: 60 * 60 * 24
-        };
-        return value * multipliers[unit];
-      }
-    };
-    globalIssuer = null;
-  }
-});
-
-// src/compiler/CulturalCompatibilityChecker.ts
-var DEFAULT_CONFIG, CODES, CulturalCompatibilityChecker;
-var init_CulturalCompatibilityChecker = __esm({
-  "src/compiler/CulturalCompatibilityChecker.ts"() {
-    init_CultureTraits();
-    DEFAULT_CONFIG = {
-      cooperationThreshold: 0.5,
-      checkDialects: true,
-      validateNormReferences: true,
-      warnOnCautious: true
-    };
-    CODES = {
-      COOPERATION_OUT_OF_RANGE: "CULT001",
-      COOPERATION_MISMATCH: "CULT002",
-      FAMILY_INCOMPATIBLE: "CULT003",
-      FAMILY_CAUTIOUS: "CULT004",
-      DIALECT_MISMATCH: "CULT005",
-      NORM_CONTRADICTION: "CULT006",
-      NORM_UNKNOWN: "CULT007"
-    };
-    CulturalCompatibilityChecker = class {
-      constructor(config) {
-        this.config = { ...DEFAULT_CONFIG, ...config };
-      }
-      /**
-       * Update checker configuration.
-       */
-      setConfig(config) {
-        this.config = { ...this.config, ...config };
-      }
-      /**
-       * Get current checker configuration.
-       */
-      getConfig() {
-        return { ...this.config };
-      }
-      /**
-       * Check cultural compatibility of a set of agents in a composition.
-       *
-       * Performs pairwise checks across all four dimensions:
-       * 1. Validates individual profiles (cooperation_index range, norm references)
-       * 2. Checks cooperation_index deltas between all pairs
-       * 3. Checks cultural_family compatibility between all pairs
-       * 4. Checks prompt_dialect compatibility between all pairs
-       * 5. Checks for contradictory norms across the full composition
-       *
-       * @param agents Array of agent entries with their cultural profiles
-       * @returns Complete compatibility result with diagnostics
-       */
-      check(agents) {
-        const diagnostics = [];
-        for (const agent of agents) {
-          diagnostics.push(...this.validateProfile(agent));
-        }
-        let pairsChecked = 0;
-        for (let i = 0; i < agents.length; i++) {
-          for (let j = i + 1; j < agents.length; j++) {
-            const a = agents[i];
-            const b = agents[j];
-            pairsChecked++;
-            diagnostics.push(...this.checkCooperationIndex(a, b));
-            diagnostics.push(...this.checkCulturalFamily(a, b));
-            if (this.config.checkDialects) {
-              diagnostics.push(...this.checkPromptDialect(a, b));
-            }
-          }
-        }
-        diagnostics.push(...this.checkNormContradictions(agents));
-        const errors = diagnostics.filter((d) => d.severity === "error");
-        const warnings = diagnostics.filter((d) => d.severity === "warning");
-        return {
-          compatible: errors.length === 0,
-          diagnostics,
-          errors,
-          warnings,
-          pairsChecked
-        };
-      }
-      /**
-       * Quick check — returns true if the composition is compatible (no errors).
-       * Use `check()` for full diagnostics.
-       */
-      isCompatible(agents) {
-        return this.check(agents).compatible;
-      }
-      // ===========================================================================
-      // INDIVIDUAL PROFILE VALIDATION
-      // ===========================================================================
-      validateProfile(agent) {
-        const diagnostics = [];
-        const { profile, name } = agent;
-        if (profile.cooperation_index < 0 || profile.cooperation_index > 1) {
-          diagnostics.push({
-            code: CODES.COOPERATION_OUT_OF_RANGE,
-            severity: "error",
-            category: "cooperation_out_of_range",
-            message: `Agent "${name}" has cooperation_index ${profile.cooperation_index} which is outside the valid range [0, 1].`,
-            agents: [name, name],
-            suggestion: "Set cooperation_index to a value between 0.0 and 1.0."
-          });
-        }
-        if (this.config.validateNormReferences) {
-          const builtinIds = new Set(BUILTIN_NORMS.map((n) => n.id));
-          for (const normId of profile.norm_set) {
-            if (!builtinIds.has(normId)) {
-              diagnostics.push({
-                code: CODES.NORM_UNKNOWN,
-                severity: "warning",
-                category: "norm_unknown",
-                message: `Agent "${name}" references unknown norm "${normId}". It may be a custom norm not yet registered.`,
-                agents: [name, name],
-                suggestion: `Register the norm "${normId}" via BUILTIN_NORMS or ensure it exists in your custom norm registry.`
-              });
-            }
-          }
-        }
-        return diagnostics;
-      }
-      // ===========================================================================
-      // COOPERATION INDEX CHECK
-      // ===========================================================================
-      checkCooperationIndex(a, b) {
-        const delta = Math.abs(a.profile.cooperation_index - b.profile.cooperation_index);
-        if (delta > this.config.cooperationThreshold) {
-          return [
-            {
-              code: CODES.COOPERATION_MISMATCH,
-              severity: "error",
-              category: "cooperation_mismatch",
-              message: `Agents "${a.name}" (cooperation_index: ${a.profile.cooperation_index}) and "${b.name}" (cooperation_index: ${b.profile.cooperation_index}) have a cooperation delta of ${delta.toFixed(2)} which exceeds the threshold of ${this.config.cooperationThreshold}. These agents are unlikely to cooperate effectively.`,
-              agents: [a.name, b.name],
-              suggestion: `Adjust cooperation_index values to be within ${this.config.cooperationThreshold} of each other, or add a mediator agent with a middle cooperation_index.`
-            }
-          ];
-        }
-        return [];
-      }
-      // ===========================================================================
-      // CULTURAL FAMILY CHECK
-      // ===========================================================================
-      checkCulturalFamily(a, b) {
-        const { rating, reason } = getFamilyCompatibility(
-          a.profile.cultural_family,
-          b.profile.cultural_family
-        );
-        if (rating === "incompatible") {
-          return [
-            {
-              code: CODES.FAMILY_INCOMPATIBLE,
-              severity: "error",
-              category: "family_incompatible",
-              message: `Agents "${a.name}" (family: ${a.profile.cultural_family}) and "${b.name}" (family: ${b.profile.cultural_family}) belong to incompatible cultural families. ` + reason,
-              agents: [a.name, b.name],
-              suggestion: `Change one agent's cultural_family to a compatible type, or separate them into different compositions/zones.`
-            }
-          ];
-        }
-        if (rating === "cautious" && this.config.warnOnCautious) {
-          return [
-            {
-              code: CODES.FAMILY_CAUTIOUS,
-              severity: "warning",
-              category: "family_cautious",
-              message: `Agents "${a.name}" (family: ${a.profile.cultural_family}) and "${b.name}" (family: ${b.profile.cultural_family}) have cautious cultural compatibility. ` + reason,
-              agents: [a.name, b.name],
-              suggestion: "Consider adding a mediator agent or defining explicit interaction protocols."
-            }
-          ];
-        }
-        return [];
-      }
-      // ===========================================================================
-      // PROMPT DIALECT CHECK
-      // ===========================================================================
-      checkPromptDialect(a, b) {
-        if (a.profile.prompt_dialect !== b.profile.prompt_dialect) {
-          return [
-            {
-              code: CODES.DIALECT_MISMATCH,
-              severity: "warning",
-              category: "dialect_mismatch",
-              message: `Agents "${a.name}" (dialect: ${a.profile.prompt_dialect}) and "${b.name}" (dialect: ${b.profile.prompt_dialect}) use different prompt dialects. Inter-agent communication may be less efficient.`,
-              agents: [a.name, b.name],
-              suggestion: "Align prompt_dialect values for agents that need frequent communication, or add a translator agent that bridges both dialects."
-            }
-          ];
-        }
-        return [];
-      }
-      // ===========================================================================
-      // NORM CONTRADICTION CHECK
-      // ===========================================================================
-      /**
-       * Check for contradictory norms across the entire composition.
-       * This is an N-way check (not just pairwise) because norms from
-       * different agents can contradict each other.
-       */
-      checkNormContradictions(agents) {
-        const diagnostics = [];
-        const contradictions = getAllContradictoryNorms();
-        const normAgentMap = /* @__PURE__ */ new Map();
-        for (const agent of agents) {
-          for (const normId of agent.profile.norm_set) {
-            if (!normAgentMap.has(normId)) {
-              normAgentMap.set(normId, []);
-            }
-            normAgentMap.get(normId).push(agent.name);
-          }
-        }
-        for (const { normA, normB, reason } of contradictions) {
-          const agentsWithA = normAgentMap.get(normA) || [];
-          const agentsWithB = normAgentMap.get(normB) || [];
-          if (agentsWithA.length > 0 && agentsWithB.length > 0) {
-            for (const agentA of agentsWithA) {
-              for (const agentB of agentsWithB) {
-                if (agentA !== agentB) {
-                  diagnostics.push({
-                    code: CODES.NORM_CONTRADICTION,
-                    severity: "error",
-                    category: "norm_contradiction",
-                    message: `Norm contradiction: agent "${agentA}" subscribes to "${normA}" and agent "${agentB}" subscribes to "${normB}". ${reason}`,
-                    agents: [agentA, agentB],
-                    suggestion: `Remove one of the contradictory norms, or separate agents "${agentA}" and "${agentB}" into different compositions.`
-                  });
-                }
-                if (agentA === agentB) {
-                  diagnostics.push({
-                    code: CODES.NORM_CONTRADICTION,
-                    severity: "error",
-                    category: "norm_contradiction",
-                    message: `Agent "${agentA}" subscribes to contradictory norms "${normA}" and "${normB}". ${reason}`,
-                    agents: [agentA, agentA],
-                    suggestion: `Remove one of the contradictory norms from agent "${agentA}".`
-                  });
-                }
-              }
-            }
-          }
-        }
-        return diagnostics;
-      }
-    };
-  }
-});
-
-// src/compiler/identity/ConfabulationValidator.ts
-function getConfabulationValidator(config) {
-  if (!globalConfabulationValidator) {
-    globalConfabulationValidator = new ConfabulationValidator(config);
-  }
-  return globalConfabulationValidator;
-}
-var BUILT_IN_TRAIT_SCHEMAS, ConfabulationValidator, globalConfabulationValidator;
-var init_ConfabulationValidator = __esm({
-  "src/compiler/identity/ConfabulationValidator.ts"() {
-    BUILT_IN_TRAIT_SCHEMAS = [
-      // =========================================================================
-      // INTERACTION TRAITS
-      // =========================================================================
-      {
-        name: "grabbable",
-        category: "interaction",
-        properties: [
-          {
-            name: "snap_to_hand",
-            type: "boolean",
-            defaultValue: true,
-            description: "Snap object to hand when grabbed"
-          },
-          {
-            name: "two_handed",
-            type: "boolean",
-            defaultValue: false,
-            description: "Require two hands to grab"
-          },
-          {
-            name: "haptic_on_grab",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Haptic intensity on grab"
-          },
-          {
-            name: "grab_points",
-            type: "array",
-            defaultValue: [],
-            description: "Specific grab point positions"
-          },
-          {
-            name: "preserve_rotation",
-            type: "boolean",
-            defaultValue: false,
-            description: "Preserve rotation on grab"
-          },
-          {
-            name: "highlight",
-            type: "boolean",
-            defaultValue: true,
-            description: "Highlight when in grab range"
-          }
-        ]
-      },
-      {
-        name: "throwable",
-        category: "interaction",
-        requires: ["grabbable"],
-        properties: [
-          {
-            name: "velocity_multiplier",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            max: 100,
-            description: "Multiplier for throw velocity"
-          },
-          {
-            name: "gravity",
-            type: "boolean",
-            defaultValue: true,
-            description: "Apply gravity after throw"
-          },
-          {
-            name: "max_velocity",
-            type: "number",
-            defaultValue: 50,
-            min: 0,
-            description: "Maximum throw velocity"
-          },
-          { name: "spin", type: "boolean", defaultValue: true, description: "Apply spin on throw" },
-          { name: "bounce", type: "boolean", defaultValue: false, description: "Bounce on impact" }
-        ]
-      },
-      {
-        name: "holdable",
-        category: "interaction",
-        requires: ["grabbable"],
-        properties: [
-          {
-            name: "offset",
-            type: "array",
-            defaultValue: [0, 0, 0],
-            description: "Position offset when held"
-          },
-          {
-            name: "rotation",
-            type: "array",
-            defaultValue: [0, 0, 0],
-            description: "Rotation offset when held"
-          }
-        ]
-      },
-      {
-        name: "clickable",
-        category: "interaction",
-        properties: [
-          { name: "highlight", type: "boolean", defaultValue: true, description: "Highlight on hover" },
-          {
-            name: "debounce",
-            type: "number",
-            defaultValue: 200,
-            min: 0,
-            description: "Debounce time in ms"
-          }
-        ]
-      },
-      {
-        name: "hoverable",
-        category: "interaction",
-        properties: [
-          {
-            name: "highlight_color",
-            type: "string",
-            defaultValue: "#ffffff",
-            description: "Color when hovered"
-          },
-          {
-            name: "scale_on_hover",
-            type: "number",
-            defaultValue: 1.1,
-            min: 0,
-            description: "Scale multiplier on hover"
-          },
-          {
-            name: "show_tooltip",
-            type: "boolean",
-            defaultValue: false,
-            description: "Show tooltip on hover"
-          },
-          {
-            name: "tooltip_offset",
-            type: "array",
-            defaultValue: [0, 0.2, 0],
-            description: "Tooltip offset from object"
-          },
-          { name: "glow", type: "boolean", defaultValue: false, description: "Glow effect on hover" }
-        ]
-      },
-      {
-        name: "draggable",
-        category: "interaction",
-        properties: [
-          {
-            name: "axis",
-            type: "enum",
-            enumValues: ["x", "y", "z", "xy", "xz", "yz", "all"],
-            defaultValue: "all",
-            description: "Constrain to axis"
-          },
-          { name: "bounds", type: "object", description: "Movement bounds" }
-        ]
-      },
-      {
-        name: "pointable",
-        category: "interaction",
-        properties: [
-          {
-            name: "highlight_on_point",
-            type: "boolean",
-            defaultValue: true,
-            description: "Highlight when pointed at"
-          },
-          {
-            name: "highlight_color",
-            type: "string",
-            defaultValue: "#00ff00",
-            description: "Highlight color"
-          },
-          {
-            name: "cursor_style",
-            type: "enum",
-            enumValues: ["pointer", "crosshair", "grab", "default"],
-            defaultValue: "pointer",
-            description: "Cursor style"
-          }
-        ]
-      },
-      {
-        name: "scalable",
-        category: "interaction",
-        properties: [
-          {
-            name: "min_scale",
-            type: "number",
-            defaultValue: 0.1,
-            min: 0,
-            description: "Minimum scale"
-          },
-          { name: "max_scale", type: "number", defaultValue: 10, min: 0, description: "Maximum scale" },
-          { name: "uniform", type: "boolean", defaultValue: true, description: "Uniform scaling" },
-          { name: "pivot", type: "array", defaultValue: [0, 0, 0], description: "Scale pivot point" }
-        ]
-      },
-      {
-        name: "rotatable",
-        category: "interaction",
-        properties: [
-          {
-            name: "axis",
-            type: "enum",
-            enumValues: ["x", "y", "z", "all"],
-            defaultValue: "all",
-            description: "Rotation axis constraint"
-          },
-          { name: "snap_angles", type: "array", defaultValue: [], description: "Snap rotation angles" },
-          {
-            name: "speed",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            description: "Rotation speed multiplier"
-          }
-        ]
-      },
-      {
-        name: "snappable",
-        category: "interaction",
-        properties: [
-          {
-            name: "snap_points",
-            type: "array",
-            defaultValue: [],
-            description: "Snap target positions"
-          },
-          {
-            name: "snap_distance",
-            type: "number",
-            defaultValue: 0.3,
-            min: 0,
-            description: "Snap activation distance"
-          },
-          {
-            name: "snap_rotation",
-            type: "boolean",
-            defaultValue: false,
-            description: "Snap rotation as well"
-          },
-          {
-            name: "magnetic",
-            type: "boolean",
-            defaultValue: false,
-            description: "Magnetic snap effect"
-          }
-        ]
-      },
-      // =========================================================================
-      // PHYSICS TRAITS
-      // =========================================================================
-      {
-        name: "collidable",
-        category: "physics",
-        properties: [
-          {
-            name: "shape",
-            type: "enum",
-            enumValues: ["box", "sphere", "capsule", "mesh", "auto"],
-            defaultValue: "auto",
-            description: "Collision shape"
-          },
-          { name: "layer", type: "string", defaultValue: "default", description: "Collision layer" },
-          { name: "trigger", type: "boolean", defaultValue: false, description: "Is trigger collider" }
-        ]
-      },
-      {
-        name: "physics",
-        category: "physics",
-        properties: [
-          { name: "mass", type: "number", defaultValue: 1, min: 0, description: "Object mass in kg" },
-          {
-            name: "restitution",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Bounciness (0-1)"
-          },
-          {
-            name: "friction",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Surface friction (0-1)"
-          },
-          { name: "gravity", type: "boolean", defaultValue: true, description: "Affected by gravity" },
-          {
-            name: "linear_damping",
-            type: "number",
-            defaultValue: 0,
-            min: 0,
-            max: 1,
-            description: "Linear velocity damping"
-          },
-          {
-            name: "angular_damping",
-            type: "number",
-            defaultValue: 0.05,
-            min: 0,
-            max: 1,
-            description: "Angular velocity damping"
-          }
-        ]
-      },
-      {
-        name: "rigid",
-        category: "physics",
-        properties: [
-          {
-            name: "type",
-            type: "enum",
-            enumValues: ["dynamic", "static", "kinematic"],
-            defaultValue: "dynamic",
-            description: "Rigid body type"
-          },
-          { name: "mass", type: "number", defaultValue: 1, min: 0, description: "Mass in kg" }
-        ]
-      },
-      {
-        name: "kinematic",
-        category: "physics",
-        properties: [
-          {
-            name: "interpolation",
-            type: "boolean",
-            defaultValue: true,
-            description: "Interpolate movement"
-          }
-        ]
-      },
-      {
-        name: "trigger",
-        category: "physics",
-        properties: [
-          {
-            name: "shape",
-            type: "enum",
-            enumValues: ["box", "sphere", "capsule"],
-            defaultValue: "box",
-            description: "Trigger zone shape"
-          },
-          { name: "size", type: "array", description: "Trigger zone size" }
-        ]
-      },
-      {
-        name: "gravity",
-        category: "physics",
-        properties: [
-          { name: "strength", type: "number", defaultValue: 9.81, description: "Gravity strength" },
-          {
-            name: "direction",
-            type: "array",
-            defaultValue: [0, -1, 0],
-            description: "Gravity direction vector"
-          }
-        ]
-      },
-      // =========================================================================
-      // VISUAL TRAITS
-      // =========================================================================
-      {
-        name: "glowing",
-        category: "visual",
-        properties: [
-          { name: "color", type: "string", defaultValue: "#ffffff", description: "Glow color" },
-          { name: "intensity", type: "number", defaultValue: 1, min: 0, description: "Glow intensity" },
-          { name: "radius", type: "number", defaultValue: 1, min: 0, description: "Glow radius" }
-        ]
-      },
-      {
-        name: "emissive",
-        category: "visual",
-        properties: [
-          { name: "color", type: "string", defaultValue: "#ffffff", description: "Emissive color" },
-          {
-            name: "intensity",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            description: "Emission intensity"
-          }
-        ]
-      },
-      {
-        name: "transparent",
-        category: "visual",
-        properties: [
-          {
-            name: "opacity",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Opacity value (0-1)"
-          }
-        ]
-      },
-      {
-        name: "reflective",
-        category: "visual",
-        properties: [
-          {
-            name: "roughness",
-            type: "number",
-            defaultValue: 0.1,
-            min: 0,
-            max: 1,
-            description: "Surface roughness (0-1)"
-          },
-          {
-            name: "metalness",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            max: 1,
-            description: "Metalness (0-1)"
-          }
-        ]
-      },
-      {
-        name: "animated",
-        category: "visual",
-        properties: [
-          { name: "clip", type: "string", description: "Animation clip name" },
-          { name: "loop", type: "boolean", defaultValue: true, description: "Loop animation" },
-          { name: "speed", type: "number", defaultValue: 1, min: 0, description: "Playback speed" },
-          { name: "autoplay", type: "boolean", defaultValue: true, description: "Auto-play on load" }
-        ]
-      },
-      {
-        name: "billboard",
-        category: "visual",
-        properties: [
-          {
-            name: "axis",
-            type: "enum",
-            enumValues: ["all", "y"],
-            defaultValue: "all",
-            description: "Billboard axis constraint"
-          }
-        ]
-      },
-      {
-        name: "color",
-        category: "visual",
-        properties: [
-          { name: "value", type: "string", description: "Color value (hex, named, or rgb)" }
-        ]
-      },
-      {
-        name: "material",
-        category: "visual",
-        properties: [
-          {
-            name: "type",
-            type: "enum",
-            enumValues: ["pbr", "standard", "unlit", "transparent", "volumetric", "custom", "neural"],
-            defaultValue: "pbr",
-            description: "Material type"
-          },
-          { name: "color", type: "string", description: "Base color" },
-          {
-            name: "metallic",
-            type: "number",
-            defaultValue: 0,
-            min: 0,
-            max: 1,
-            description: "Metalness (0-1)"
-          },
-          {
-            name: "roughness",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Roughness (0-1)"
-          },
-          {
-            name: "opacity",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            max: 1,
-            description: "Opacity (0-1)"
-          },
-          { name: "emissive", type: "string", description: "Emissive color" },
-          {
-            name: "emissive_intensity",
-            type: "number",
-            defaultValue: 0,
-            min: 0,
-            description: "Emissive intensity"
-          }
-        ]
-      },
-      {
-        name: "texture",
-        category: "visual",
-        properties: [
-          { name: "path", type: "string", required: true, description: "Texture file path or URL" },
-          {
-            name: "channel",
-            type: "enum",
-            enumValues: [
-              "baseColor",
-              "normalMap",
-              "roughnessMap",
-              "metallicMap",
-              "ambientOcclusionMap",
-              "emissionMap",
-              "heightMap",
-              "displacementMap"
-            ],
-            defaultValue: "baseColor",
-            description: "Texture channel"
-          },
-          { name: "scale", type: "object", description: "UV tiling scale" },
-          { name: "offset", type: "object", description: "UV offset" }
-        ]
-      },
-      // =========================================================================
-      // NETWORKING TRAITS
-      // =========================================================================
-      {
-        name: "networked",
-        category: "networking",
-        properties: [
-          {
-            name: "mode",
-            type: "enum",
-            enumValues: ["owner", "shared", "server"],
-            defaultValue: "owner",
-            description: "Sync authority mode"
-          },
-          { name: "syncProperties", type: "array", description: "Properties to synchronize" },
-          {
-            name: "syncRate",
-            type: "number",
-            defaultValue: 20,
-            min: 1,
-            max: 120,
-            description: "Sync rate in Hz"
-          },
-          {
-            name: "interpolation",
-            type: "boolean",
-            defaultValue: true,
-            description: "Enable interpolation"
-          },
-          {
-            name: "channel",
-            type: "enum",
-            enumValues: ["reliable", "unreliable", "ordered"],
-            defaultValue: "reliable",
-            description: "Network channel"
-          }
-        ]
-      },
-      {
-        name: "synced",
-        category: "networking",
-        properties: [
-          { name: "properties", type: "array", description: "Properties to sync" },
-          { name: "rate", type: "number", defaultValue: 30, min: 1, description: "Sync rate" }
-        ]
-      },
-      {
-        name: "persistent",
-        category: "networking",
-        properties: [
-          {
-            name: "storage",
-            type: "enum",
-            enumValues: ["local", "cloud", "blockchain"],
-            defaultValue: "local",
-            description: "Persistence backend"
-          },
-          { name: "key", type: "string", description: "Storage key" }
-        ]
-      },
-      {
-        name: "owned",
-        category: "networking",
-        properties: [
-          {
-            name: "transferable",
-            type: "boolean",
-            defaultValue: true,
-            description: "Can ownership be transferred"
-          }
-        ]
-      },
-      {
-        name: "host_only",
-        category: "networking",
-        properties: []
-      },
-      // =========================================================================
-      // BEHAVIOR TRAITS
-      // =========================================================================
-      {
-        name: "stackable",
-        category: "behavior",
-        properties: [
-          {
-            name: "stack_axis",
-            type: "enum",
-            enumValues: ["x", "y", "z"],
-            defaultValue: "y",
-            description: "Stacking axis"
-          },
-          {
-            name: "stack_offset",
-            type: "number",
-            defaultValue: 0,
-            description: "Offset between stacked objects"
-          },
-          {
-            name: "max_stack",
-            type: "number",
-            defaultValue: 10,
-            min: 1,
-            description: "Maximum stack height"
-          },
-          {
-            name: "snap_distance",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            description: "Snap distance for stacking"
-          }
-        ]
-      },
-      {
-        name: "attachable",
-        category: "behavior",
-        properties: [
-          { name: "attach_point", type: "string", description: "Named attachment point" },
-          { name: "detachable", type: "boolean", defaultValue: true, description: "Can be detached" }
-        ]
-      },
-      {
-        name: "equippable",
-        category: "behavior",
-        requires: ["grabbable"],
-        properties: [
-          {
-            name: "slot",
-            type: "enum",
-            enumValues: ["head", "hand_left", "hand_right", "body", "back", "hip"],
-            description: "Equipment slot"
-          },
-          { name: "offset", type: "array", description: "Position offset when equipped" },
-          { name: "rotation", type: "array", description: "Rotation offset when equipped" }
-        ]
-      },
-      {
-        name: "consumable",
-        category: "behavior",
-        properties: [
-          { name: "uses", type: "number", defaultValue: 1, min: 1, description: "Number of uses" },
-          {
-            name: "destroy_on_use",
-            type: "boolean",
-            defaultValue: true,
-            description: "Destroy after last use"
-          }
-        ]
-      },
-      {
-        name: "destructible",
-        category: "behavior",
-        properties: [
-          { name: "health", type: "number", defaultValue: 100, min: 0, description: "Hit points" },
-          {
-            name: "fragments",
-            type: "number",
-            defaultValue: 8,
-            min: 1,
-            description: "Number of fragments"
-          }
-        ]
-      },
-      {
-        name: "breakable",
-        category: "behavior",
-        properties: [
-          {
-            name: "break_velocity",
-            type: "number",
-            defaultValue: 5,
-            min: 0,
-            description: "Velocity threshold to break"
-          },
-          {
-            name: "fragments",
-            type: "number",
-            defaultValue: 8,
-            min: 1,
-            description: "Number of fragments"
-          },
-          { name: "fragment_mesh", type: "string", description: "Custom fragment mesh" },
-          { name: "sound_on_break", type: "string", description: "Sound effect on break" },
-          { name: "respawn", type: "boolean", defaultValue: false, description: "Respawn after break" },
-          {
-            name: "respawn_time",
-            type: "number",
-            defaultValue: 5,
-            min: 0,
-            description: "Respawn delay in seconds"
-          }
-        ]
-      },
-      {
-        name: "character",
-        category: "behavior",
-        properties: [
-          {
-            name: "height",
-            type: "number",
-            defaultValue: 1.8,
-            min: 0,
-            description: "Character height"
-          },
-          { name: "speed", type: "number", defaultValue: 5, min: 0, description: "Movement speed" }
-        ]
-      },
-      // =========================================================================
-      // SPATIAL TRAITS
-      // =========================================================================
-      {
-        name: "anchor",
-        category: "spatial",
-        properties: [
-          {
-            name: "type",
-            type: "enum",
-            enumValues: ["plane", "point", "image", "face", "body"],
-            defaultValue: "plane",
-            description: "Anchor type"
-          },
-          {
-            name: "tracking",
-            type: "boolean",
-            defaultValue: true,
-            description: "Enable tracking updates"
-          }
-        ]
-      },
-      {
-        name: "tracked",
-        category: "spatial",
-        properties: [
-          {
-            name: "source",
-            type: "enum",
-            enumValues: ["hand", "head", "controller", "eye", "body"],
-            description: "Tracking source"
-          }
-        ]
-      },
-      {
-        name: "world_locked",
-        category: "spatial",
-        properties: [
-          {
-            name: "drift_correction",
-            type: "boolean",
-            defaultValue: true,
-            description: "Correct tracking drift"
-          }
-        ]
-      },
-      {
-        name: "hand_tracked",
-        category: "spatial",
-        properties: [
-          {
-            name: "hand",
-            type: "enum",
-            enumValues: ["left", "right", "both"],
-            defaultValue: "both",
-            description: "Which hand to track"
-          },
-          { name: "joint", type: "string", description: "Specific hand joint to track" }
-        ]
-      },
-      {
-        name: "eye_tracked",
-        category: "spatial",
-        properties: [
-          {
-            name: "dwell_time",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            description: "Dwell activation time in seconds"
-          },
-          { name: "highlight", type: "boolean", defaultValue: true, description: "Highlight on gaze" }
-        ]
-      },
-      {
-        name: "position",
-        category: "spatial",
-        properties: [
-          { name: "x", type: "number", defaultValue: 0, description: "X position" },
-          { name: "y", type: "number", defaultValue: 0, description: "Y position" },
-          { name: "z", type: "number", defaultValue: 0, description: "Z position" }
-        ]
-      },
-      {
-        name: "rotation",
-        category: "spatial",
-        properties: [
-          { name: "x", type: "number", defaultValue: 0, description: "X rotation (degrees)" },
-          { name: "y", type: "number", defaultValue: 0, description: "Y rotation (degrees)" },
-          { name: "z", type: "number", defaultValue: 0, description: "Z rotation (degrees)" }
-        ]
-      },
-      {
-        name: "scale",
-        category: "spatial",
-        properties: [
-          { name: "x", type: "number", defaultValue: 1, min: 0, description: "X scale" },
-          { name: "y", type: "number", defaultValue: 1, min: 0, description: "Y scale" },
-          { name: "z", type: "number", defaultValue: 1, min: 0, description: "Z scale" }
-        ]
-      },
-      // =========================================================================
-      // AUDIO TRAITS
-      // =========================================================================
-      {
-        name: "spatial_audio",
-        category: "audio",
-        properties: [
-          { name: "src", type: "string", description: "Audio source file" },
-          {
-            name: "volume",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            max: 1,
-            description: "Volume (0-1)"
-          },
-          {
-            name: "rolloff",
-            type: "enum",
-            enumValues: ["linear", "logarithmic", "inverse"],
-            defaultValue: "logarithmic",
-            description: "Distance rolloff model"
-          },
-          {
-            name: "refDistance",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            description: "Reference distance"
-          },
-          {
-            name: "maxDistance",
-            type: "number",
-            defaultValue: 100,
-            min: 0,
-            description: "Max audible distance"
-          }
-        ]
-      },
-      {
-        name: "ambient",
-        category: "audio",
-        properties: [
-          { name: "src", type: "string", description: "Audio source file" },
-          {
-            name: "volume",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Volume (0-1)"
-          },
-          { name: "loop", type: "boolean", defaultValue: true, description: "Loop playback" }
-        ]
-      },
-      {
-        name: "voice_activated",
-        category: "audio",
-        properties: [
-          {
-            name: "threshold",
-            type: "number",
-            defaultValue: 0.3,
-            min: 0,
-            max: 1,
-            description: "Voice activation threshold"
-          },
-          { name: "keyword", type: "string", description: "Activation keyword" }
-        ]
-      },
-      {
-        name: "sound",
-        category: "audio",
-        properties: [
-          { name: "src", type: "string", description: "Sound file path" },
-          { name: "volume", type: "number", defaultValue: 1, min: 0, max: 1, description: "Volume" },
-          { name: "loop", type: "boolean", defaultValue: false, description: "Loop playback" }
-        ]
-      },
-      // =========================================================================
-      // STATE TRAITS
-      // =========================================================================
-      {
-        name: "state",
-        category: "state",
-        properties: [{ name: "initial", type: "object", description: "Initial state values" }]
-      },
-      {
-        name: "reactive",
-        category: "state",
-        properties: [{ name: "bindings", type: "array", description: "Data bindings" }]
-      },
-      {
-        name: "observable",
-        category: "state",
-        properties: [{ name: "properties", type: "array", description: "Observable property names" }]
-      },
-      {
-        name: "computed",
-        category: "state",
-        properties: [
-          { name: "expression", type: "string", description: "Computed expression" },
-          { name: "dependencies", type: "array", description: "Dependency property names" }
-        ]
-      },
-      // =========================================================================
-      // ADVANCED TRAITS
-      // =========================================================================
-      {
-        name: "teleport",
-        category: "advanced",
-        properties: [
-          { name: "target", type: "string", description: "Teleport target position/name" },
-          {
-            name: "fade_duration",
-            type: "number",
-            defaultValue: 0.3,
-            min: 0,
-            description: "Fade transition duration"
-          }
-        ]
-      },
-      {
-        name: "ui_panel",
-        category: "advanced",
-        properties: [
-          {
-            name: "width",
-            type: "number",
-            defaultValue: 1,
-            min: 0,
-            description: "Panel width in meters"
-          },
-          {
-            name: "height",
-            type: "number",
-            defaultValue: 0.75,
-            min: 0,
-            description: "Panel height in meters"
-          },
-          { name: "curved", type: "boolean", defaultValue: false, description: "Curved panel" }
-        ]
-      },
-      {
-        name: "particle_system",
-        category: "advanced",
-        properties: [
-          { name: "count", type: "number", defaultValue: 100, min: 1, description: "Particle count" },
-          {
-            name: "lifetime",
-            type: "number",
-            defaultValue: 2,
-            min: 0,
-            description: "Particle lifetime in seconds"
-          },
-          { name: "speed", type: "number", defaultValue: 1, min: 0, description: "Emission speed" },
-          { name: "color", type: "string", defaultValue: "#ffffff", description: "Particle color" },
-          {
-            name: "shape",
-            type: "enum",
-            enumValues: ["point", "sphere", "cone", "box"],
-            defaultValue: "point",
-            description: "Emitter shape"
-          }
-        ]
-      },
-      {
-        name: "weather",
-        category: "advanced",
-        properties: [
-          {
-            name: "type",
-            type: "enum",
-            enumValues: ["rain", "snow", "fog", "wind", "storm"],
-            description: "Weather type"
-          },
-          {
-            name: "intensity",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Weather intensity (0-1)"
-          }
-        ]
-      },
-      {
-        name: "day_night",
-        category: "advanced",
-        properties: [
-          {
-            name: "cycle_duration",
-            type: "number",
-            defaultValue: 300,
-            min: 1,
-            description: "Full cycle duration in seconds"
-          },
-          {
-            name: "start_time",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Start time (0=midnight, 0.5=noon)"
-          }
-        ]
-      },
-      {
-        name: "lod",
-        category: "advanced",
-        properties: [
-          { name: "distances", type: "array", description: "LOD distance thresholds" },
-          { name: "meshes", type: "array", description: "Mesh paths for each LOD level" }
-        ]
-      },
-      {
-        name: "hand_tracking",
-        category: "advanced",
-        properties: [
-          {
-            name: "gesture_recognition",
-            type: "boolean",
-            defaultValue: true,
-            description: "Enable gesture recognition"
-          },
-          {
-            name: "mesh_visualization",
-            type: "boolean",
-            defaultValue: false,
-            description: "Show hand mesh"
-          }
-        ]
-      },
-      {
-        name: "haptic",
-        category: "advanced",
-        properties: [
-          {
-            name: "intensity",
-            type: "number",
-            defaultValue: 0.5,
-            min: 0,
-            max: 1,
-            description: "Haptic intensity (0-1)"
-          },
-          {
-            name: "duration",
-            type: "number",
-            defaultValue: 100,
-            min: 0,
-            description: "Duration in milliseconds"
-          },
-          {
-            name: "pattern",
-            type: "enum",
-            enumValues: ["pulse", "buzz", "click", "custom"],
-            defaultValue: "pulse",
-            description: "Haptic pattern"
-          }
-        ]
-      },
-      {
-        name: "portal",
-        category: "advanced",
-        properties: [
-          {
-            name: "destination",
-            type: "string",
-            required: true,
-            description: "Target scene/composition"
-          },
-          {
-            name: "size",
-            type: "number",
-            defaultValue: 2,
-            min: 0,
-            description: "Portal size in meters"
-          },
-          {
-            name: "shape",
-            type: "enum",
-            enumValues: ["circle", "rectangle"],
-            defaultValue: "circle",
-            description: "Portal shape"
-          }
-        ]
-      },
-      {
-        name: "mirror",
-        category: "advanced",
-        properties: [
-          { name: "size", type: "number", defaultValue: 2, min: 0, description: "Mirror plane size" },
-          { name: "tint", type: "string", defaultValue: "#ffffff", description: "Reflection tint" },
-          {
-            name: "orientation",
-            type: "enum",
-            enumValues: ["vertical", "horizontal", "face_camera"],
-            defaultValue: "vertical",
-            description: "Mirror orientation"
-          }
-        ]
-      }
-    ];
-    ConfabulationValidator = class {
-      constructor(config = {}) {
-        this.config = {
-          riskThreshold: config.riskThreshold ?? 50,
-          unknownPropertySeverity: config.unknownPropertySeverity ?? "warning",
-          validatePrerequisites: config.validatePrerequisites ?? true,
-          validateConflicts: config.validateConflicts ?? true,
-          validateRanges: config.validateRanges ?? true,
-          customSchemas: config.customSchemas ?? [],
-          strict: config.strict ?? false
-        };
-        this.schemaRegistry = /* @__PURE__ */ new Map();
-        for (const schema of BUILT_IN_TRAIT_SCHEMAS) {
-          this.schemaRegistry.set(schema.name, schema);
-        }
-        for (const schema of this.config.customSchemas) {
-          this.schemaRegistry.set(schema.name, schema);
-        }
-      }
-      // =========================================================================
-      // PUBLIC API
-      // =========================================================================
-      /**
-       * Validate an entire HoloComposition against trait schemas.
-       *
-       * Iterates over all objects in the composition, extracts their traits
-       * and properties, and validates against the schema registry.
-       */
-      validateComposition(composition) {
-        const startTime = Date.now();
-        const errors = [];
-        const warnings = [];
-        let traitsChecked = 0;
-        let propertiesChecked = 0;
-        for (const obj of composition.objects || []) {
-          const objResult = this.validateObject(obj);
-          errors.push(...objResult.errors);
-          warnings.push(...objResult.warnings);
-          traitsChecked += objResult.traitsChecked;
-          propertiesChecked += objResult.propertiesChecked;
-        }
-        if (composition.traitDefinitions) {
-          for (const traitDef of composition.traitDefinitions) {
-            if (traitDef.base) {
-              const baseSchema = this.schemaRegistry.get(traitDef.base);
-              if (!baseSchema) {
-                warnings.push({
-                  code: "CONFAB_UNKNOWN_BASE_TRAIT",
-                  message: `Trait "${traitDef.name}" extends unknown base trait "${traitDef.base}"`,
-                  traitName: traitDef.name,
-                  riskContribution: 10
-                });
-              }
-            }
-          }
-        }
-        const riskScore = this.calculateRiskScore(errors, warnings);
-        const valid = this.config.strict ? errors.length === 0 && warnings.length === 0 && riskScore <= this.config.riskThreshold : errors.length === 0 && riskScore <= this.config.riskThreshold;
-        return {
-          valid,
-          riskScore,
-          errors,
-          warnings,
-          traitsChecked,
-          propertiesChecked,
-          validationTimeMs: Date.now() - startTime
-        };
-      }
-      /**
-       * Validate a single trait's properties against its schema.
-       *
-       * @param traitName - Trait name (without @ prefix)
-       * @param properties - Property key-value pairs to validate
-       * @param objectName - Optional object context for error messages
-       */
-      validateTraitProperties(traitName, properties, objectName) {
-        const errors = [];
-        const warnings = [];
-        const normalizedName = traitName.startsWith("@") ? traitName.slice(1) : traitName;
-        const schema = this.schemaRegistry.get(normalizedName);
-        if (!schema) {
-          warnings.push({
-            code: "CONFAB_UNKNOWN_TRAIT" /* UNKNOWN_TRAIT */,
-            message: `Trait "@${normalizedName}" not found in schema registry (${this.schemaRegistry.size} schemas loaded)`,
-            objectName,
-            traitName: normalizedName,
-            riskContribution: 5
-          });
-          return { errors, warnings };
-        }
-        for (const [key, value] of Object.entries(properties)) {
-          const propSchema = schema.properties.find((p) => p.name === key);
-          if (!propSchema) {
-            const entry = {
-              code: "CONFAB_UNKNOWN_PROPERTY" /* UNKNOWN_PROPERTY */,
-              message: `Unknown property "${key}" on trait "@${normalizedName}". Known properties: ${schema.properties.map((p) => p.name).join(", ")}`,
-              objectName,
-              traitName: normalizedName,
-              propertyName: key,
-              riskContribution: 15
-            };
-            if (this.config.unknownPropertySeverity === "error") {
-              errors.push({ ...entry, suggestion: `Remove "${key}" or check spelling` });
-            } else {
-              warnings.push(entry);
-            }
-            continue;
-          }
-          const typeError = this.validatePropertyType(propSchema, value, normalizedName, objectName);
-          if (typeError) {
-            errors.push(typeError);
-            continue;
-          }
-          if (this.config.validateRanges) {
-            const rangeError = this.validatePropertyRange(
-              propSchema,
-              value,
-              normalizedName,
-              objectName
-            );
-            if (rangeError) {
-              errors.push(rangeError);
-            }
-          }
-          if (propSchema.type === "enum" && propSchema.enumValues) {
-            if (typeof value === "string" && !propSchema.enumValues.includes(value)) {
-              errors.push({
-                code: "CONFAB_INVALID_ENUM_VALUE" /* INVALID_ENUM_VALUE */,
-                message: `Invalid value "${value}" for property "${key}" on trait "@${normalizedName}". Allowed values: ${propSchema.enumValues.join(", ")}`,
-                objectName,
-                traitName: normalizedName,
-                propertyName: key,
-                suggestion: `Use one of: ${propSchema.enumValues.join(", ")}`,
-                riskContribution: 20
-              });
-            }
-          }
-        }
-        for (const propSchema of schema.properties) {
-          if (propSchema.required && !(propSchema.name in properties)) {
-            errors.push({
-              code: "CONFAB_MISSING_REQUIRED_PROPERTY" /* MISSING_REQUIRED_PROPERTY */,
-              message: `Missing required property "${propSchema.name}" on trait "@${normalizedName}"`,
-              objectName,
-              traitName: normalizedName,
-              propertyName: propSchema.name,
-              suggestion: `Add property "${propSchema.name}" (${propSchema.type})`,
-              riskContribution: 20
-            });
-          }
-        }
-        return { errors, warnings };
-      }
-      /**
-       * Check if a trait name is in the schema registry.
-       */
-      isKnownTrait(traitName) {
-        const normalized = traitName.startsWith("@") ? traitName.slice(1) : traitName;
-        return this.schemaRegistry.has(normalized);
-      }
-      /**
-       * Get the schema for a trait.
-       */
-      getTraitSchema(traitName) {
-        const normalized = traitName.startsWith("@") ? traitName.slice(1) : traitName;
-        return this.schemaRegistry.get(normalized);
-      }
-      /**
-       * Get all registered trait names.
-       */
-      getRegisteredTraits() {
-        return Array.from(this.schemaRegistry.keys());
-      }
-      /**
-       * Get the number of registered schemas.
-       */
-      get schemaCount() {
-        return this.schemaRegistry.size;
-      }
-      /**
-       * Register additional trait schemas at runtime.
-       */
-      registerSchema(schema) {
-        this.schemaRegistry.set(schema.name, schema);
-      }
-      /**
-       * Register multiple trait schemas at runtime.
-       */
-      registerSchemas(schemas) {
-        for (const schema of schemas) {
-          this.schemaRegistry.set(schema.name, schema);
-        }
-      }
-      // =========================================================================
-      // PRIVATE METHODS
-      // =========================================================================
-      /**
-       * Validate a single object's traits.
-       */
-      validateObject(obj) {
-        const errors = [];
-        const warnings = [];
-        let traitsChecked = 0;
-        let propertiesChecked = 0;
-        const objectTraitNames = [];
-        const authority = obj.provenance?.context?.authority;
-        if (authority === "system" || authority === "verified") {
-          return { errors, warnings, traitsChecked: 0, propertiesChecked: 0 };
-        }
-        if (obj.traits) {
-          for (const trait of obj.traits) {
-            traitsChecked++;
-            const traitName = trait.name.startsWith("@") ? trait.name.slice(1) : trait.name;
-            objectTraitNames.push(traitName);
-            const properties = {};
-            const traitExt = trait;
-            if (traitExt.args) {
-              for (const arg of traitExt.args) {
-                properties[arg.key] = arg.value;
-                propertiesChecked++;
-              }
-            } else if (trait.config) {
-              for (const [key, value] of Object.entries(trait.config)) {
-                properties[key] = value;
-                propertiesChecked++;
-              }
-            }
-            const result = this.validateTraitProperties(traitName, properties, obj.name);
-            errors.push(...result.errors);
-            warnings.push(...result.warnings);
-          }
-        }
-        if (this.config.validatePrerequisites) {
-          for (const traitName of objectTraitNames) {
-            const schema = this.schemaRegistry.get(traitName);
-            if (schema?.requires) {
-              for (const req of schema.requires) {
-                if (!objectTraitNames.includes(req)) {
-                  errors.push({
-                    code: "CONFAB_MISSING_REQUIRED_TRAIT" /* MISSING_REQUIRED_TRAIT */,
-                    message: `Trait "@${traitName}" requires "@${req}" but it is not present on object "${obj.name}"`,
-                    objectName: obj.name,
-                    traitName,
-                    suggestion: `Add @${req} to object "${obj.name}"`,
-                    riskContribution: 15
-                  });
-                }
-              }
-            }
-          }
-        }
-        if (this.config.validateConflicts) {
-          for (const traitName of objectTraitNames) {
-            const schema = this.schemaRegistry.get(traitName);
-            if (schema?.conflictsWith) {
-              for (const conflict of schema.conflictsWith) {
-                if (objectTraitNames.includes(conflict)) {
-                  errors.push({
-                    code: "CONFAB_CONFLICTING_TRAITS" /* CONFLICTING_TRAITS */,
-                    message: `Traits "@${traitName}" and "@${conflict}" are mutually exclusive on object "${obj.name}"`,
-                    objectName: obj.name,
-                    traitName,
-                    suggestion: `Remove either @${traitName} or @${conflict}`,
-                    riskContribution: 25
-                  });
-                }
-              }
-            }
-          }
-        }
-        if (obj.children) {
-          for (const child of obj.children) {
-            const childResult = this.validateObject(child);
-            errors.push(...childResult.errors);
-            warnings.push(...childResult.warnings);
-            traitsChecked += childResult.traitsChecked;
-            propertiesChecked += childResult.propertiesChecked;
-          }
-        }
-        return { errors, warnings, traitsChecked, propertiesChecked };
-      }
-      /**
-       * Validate that a property value matches its expected type.
-       */
-      validatePropertyType(propSchema, value, traitName, objectName) {
-        if (value === null || value === void 0) return null;
-        if (propSchema.type === "any") return null;
-        const actualType = typeof value;
-        switch (propSchema.type) {
-          case "string":
-          case "color":
-            if (actualType !== "string") {
-              return {
-                code: "CONFAB_TYPE_MISMATCH" /* TYPE_MISMATCH */,
-                message: `Property "${propSchema.name}" on "@${traitName}" expects ${propSchema.type} but got ${actualType}`,
-                objectName,
-                traitName,
-                propertyName: propSchema.name,
-                suggestion: `Convert value to a string`,
-                riskContribution: 20
-              };
-            }
-            break;
-          case "number":
-            if (actualType !== "number") {
-              return {
-                code: "CONFAB_TYPE_MISMATCH" /* TYPE_MISMATCH */,
-                message: `Property "${propSchema.name}" on "@${traitName}" expects number but got ${actualType}`,
-                objectName,
-                traitName,
-                propertyName: propSchema.name,
-                suggestion: `Use a numeric value`,
-                riskContribution: 20
-              };
-            }
-            break;
-          case "boolean":
-            if (actualType !== "boolean") {
-              return {
-                code: "CONFAB_TYPE_MISMATCH" /* TYPE_MISMATCH */,
-                message: `Property "${propSchema.name}" on "@${traitName}" expects boolean but got ${actualType}`,
-                objectName,
-                traitName,
-                propertyName: propSchema.name,
-                suggestion: `Use true or false`,
-                riskContribution: 20
-              };
-            }
-            break;
-          case "array":
-          case "vector3":
-            if (!Array.isArray(value)) {
-              return {
-                code: "CONFAB_TYPE_MISMATCH" /* TYPE_MISMATCH */,
-                message: `Property "${propSchema.name}" on "@${traitName}" expects ${propSchema.type} but got ${actualType}`,
-                objectName,
-                traitName,
-                propertyName: propSchema.name,
-                suggestion: `Use an array value, e.g., [0, 0, 0]`,
-                riskContribution: 20
-              };
-            }
-            break;
-          case "object":
-            if (actualType !== "object" || Array.isArray(value)) {
-              return {
-                code: "CONFAB_TYPE_MISMATCH" /* TYPE_MISMATCH */,
-                message: `Property "${propSchema.name}" on "@${traitName}" expects object but got ${Array.isArray(value) ? "array" : actualType}`,
-                objectName,
-                traitName,
-                propertyName: propSchema.name,
-                suggestion: `Use an object value, e.g., { key: value }`,
-                riskContribution: 20
-              };
-            }
-            break;
-          case "enum":
-            if (actualType !== "string") {
-              return {
-                code: "CONFAB_TYPE_MISMATCH" /* TYPE_MISMATCH */,
-                message: `Property "${propSchema.name}" on "@${traitName}" expects enum (string) but got ${actualType}`,
-                objectName,
-                traitName,
-                propertyName: propSchema.name,
-                suggestion: propSchema.enumValues ? `Use one of: ${propSchema.enumValues.join(", ")}` : `Use a string value`,
-                riskContribution: 20
-              };
-            }
-            break;
-        }
-        return null;
-      }
-      /**
-       * Validate that a numeric property value is within its allowed range.
-       */
-      validatePropertyRange(propSchema, value, traitName, objectName) {
-        if (typeof value !== "number") return null;
-        if (propSchema.min !== void 0 && value < propSchema.min) {
-          return {
-            code: "CONFAB_VALUE_OUT_OF_RANGE" /* VALUE_OUT_OF_RANGE */,
-            message: `Property "${propSchema.name}" on "@${traitName}" has value ${value} but minimum is ${propSchema.min}`,
-            objectName,
-            traitName,
-            propertyName: propSchema.name,
-            suggestion: `Use a value >= ${propSchema.min}`,
-            riskContribution: 15
-          };
-        }
-        if (propSchema.max !== void 0 && value > propSchema.max) {
-          return {
-            code: "CONFAB_VALUE_OUT_OF_RANGE" /* VALUE_OUT_OF_RANGE */,
-            message: `Property "${propSchema.name}" on "@${traitName}" has value ${value} but maximum is ${propSchema.max}`,
-            objectName,
-            traitName,
-            propertyName: propSchema.name,
-            suggestion: `Use a value <= ${propSchema.max}`,
-            riskContribution: 15
-          };
-        }
-        return null;
-      }
-      /**
-       * Calculate the overall confabulation risk score.
-       */
-      calculateRiskScore(errors, warnings) {
-        let score = 0;
-        for (const error of errors) {
-          score += error.riskContribution;
-        }
-        for (const warning of warnings) {
-          score += warning.riskContribution;
-        }
-        return Math.min(100, score);
-      }
-    };
-    globalConfabulationValidator = null;
-  }
-});
-function getRBAC(tokenIssuer) {
-  if (!globalRBAC) {
-    globalRBAC = new AgentRBAC(tokenIssuer);
-  }
-  return globalRBAC;
-}
-var RESOURCE_PERMISSION_MAP, AgentRBAC, globalRBAC;
-var init_AgentRBAC = __esm({
-  "src/compiler/identity/AgentRBAC.ts"() {
-    init_AgentIdentity();
-    init_AgentTokenIssuer();
-    init_CulturalCompatibilityChecker();
-    init_ConfabulationValidator();
-    RESOURCE_PERMISSION_MAP = {
-      ["source_file" /* SOURCE_FILE */]: {
-        read: "read:source" /* READ_SOURCE */,
-        write: "write:ast" /* WRITE_AST */,
-        // Source modification creates AST
-        execute: "execute:optimization" /* EXECUTE_OPTIMIZATION */,
-        // Not applicable
-        transform: "transform:ast" /* TRANSFORM_AST */
-        // Not applicable
-      },
-      ["ast" /* AST */]: {
-        read: "read:ast" /* READ_AST */,
-        write: "write:ast" /* WRITE_AST */,
-        execute: "execute:optimization" /* EXECUTE_OPTIMIZATION */,
-        transform: "transform:ast" /* TRANSFORM_AST */
-      },
-      ["ir" /* IR */]: {
-        read: "read:ir" /* READ_IR */,
-        write: "write:ir" /* WRITE_IR */,
-        execute: "execute:codegen" /* EXECUTE_CODEGEN */,
-        transform: "transform:ir" /* TRANSFORM_IR */
-      },
-      ["code" /* CODE */]: {
-        read: "read:code" /* READ_CODE */,
-        write: "write:code" /* WRITE_CODE */,
-        execute: "execute:codegen" /* EXECUTE_CODEGEN */,
-        transform: "transform:ir" /* TRANSFORM_IR */
-        // Not applicable
-      },
-      ["output" /* OUTPUT */]: {
-        read: "read:code" /* READ_CODE */,
-        write: "write:output" /* WRITE_OUTPUT */,
-        execute: "execute:export" /* EXECUTE_EXPORT */,
-        transform: "write:output" /* WRITE_OUTPUT */
-        // Not applicable
-      },
-      ["config" /* CONFIG */]: {
-        read: "read:config" /* READ_CONFIG */,
-        write: "write:ast" /* WRITE_AST */,
-        // Config changes trigger rebuild
-        execute: "execute:optimization" /* EXECUTE_OPTIMIZATION */,
-        // Not applicable
-        transform: "transform:ast" /* TRANSFORM_AST */
-        // Not applicable
-      }
-    };
-    AgentRBAC = class {
-      constructor(tokenIssuer) {
-        /** Package scope restrictions (role → allowed paths) */
-        this.scopeRestrictions = /* @__PURE__ */ new Map();
-        /** Workflow step restrictions (role → allowed steps) */
-        this.workflowRestrictions = /* @__PURE__ */ new Map();
-        this.tokenIssuer = tokenIssuer || getTokenIssuer();
-        this.initializeWorkflowRestrictions();
-      }
-      /**
-       * Initialize default workflow step restrictions for each role
-       */
-      initializeWorkflowRestrictions() {
-        this.workflowRestrictions.set("syntax_analyzer" /* SYNTAX_ANALYZER */, [
-          "parse_tokens" /* PARSE_TOKENS */,
-          "build_ast" /* BUILD_AST */
-        ]);
-        this.workflowRestrictions.set("ast_optimizer" /* AST_OPTIMIZER */, [
-          "analyze_ast" /* ANALYZE_AST */,
-          "apply_transforms" /* APPLY_TRANSFORMS */
-        ]);
-        this.workflowRestrictions.set("code_generator" /* CODE_GENERATOR */, [
-          "select_instructions" /* SELECT_INSTRUCTIONS */,
-          "generate_assembly" /* GENERATE_ASSEMBLY */
-        ]);
-        this.workflowRestrictions.set("exporter" /* EXPORTER */, [
-          "format_output" /* FORMAT_OUTPUT */,
-          "serialize" /* SERIALIZE */
-        ]);
-        this.workflowRestrictions.set("orchestrator" /* ORCHESTRATOR */, Object.values(WorkflowStep));
-      }
-      /**
-       * Set scope restriction for an agent role
-       *
-       * Example: Restrict syntax analyzer to only process files in 'packages/core'
-       */
-      setScopeRestriction(role, allowedPaths) {
-        this.scopeRestrictions.set(role, allowedPaths);
-      }
-      /**
-       * Check if agent can access resource
-       */
-      checkAccess(request) {
-        const { token, resourceType, operation, resourcePath, expectedWorkflowStep } = request;
-        const verificationResult = this.tokenIssuer.verifyToken(token);
-        if (!verificationResult.valid) {
-          return {
-            allowed: false,
-            reason: `Token verification failed: ${verificationResult.error}`
-          };
-        }
-        const payload = verificationResult.payload;
-        const requiredPermission = RESOURCE_PERMISSION_MAP[resourceType][operation];
-        if (!payload.permissions.includes(requiredPermission)) {
-          return {
-            allowed: false,
-            reason: `Missing required permission: ${requiredPermission}`,
-            requiredPermission,
-            agentRole: payload.agent_role
-          };
-        }
-        if (resourcePath) {
-          const scopeAllowed = this.validateScope(payload, resourcePath);
-          if (!scopeAllowed) {
-            return {
-              allowed: false,
-              reason: `Resource path '${resourcePath}' is outside agent scope: ${payload.scope || "unrestricted"}`,
-              agentRole: payload.agent_role
-            };
-          }
-        }
-        if (expectedWorkflowStep) {
-          const currentStep = payload.intent.workflow_step;
-          if (currentStep !== expectedWorkflowStep) {
-            return {
-              allowed: false,
-              reason: `Workflow step mismatch: expected ${expectedWorkflowStep}, agent is at ${currentStep}`,
-              agentRole: payload.agent_role
-            };
-          }
-        }
-        const allowedSteps = this.workflowRestrictions.get(payload.agent_role);
-        if (allowedSteps && !allowedSteps.includes(payload.intent.workflow_step)) {
-          return {
-            allowed: false,
-            reason: `Role ${payload.agent_role} cannot execute workflow step ${payload.intent.workflow_step}`,
-            agentRole: payload.agent_role
-          };
-        }
-        return {
-          allowed: true,
-          agentRole: payload.agent_role
-        };
-      }
-      /**
-       * Validate resource path is within agent's scope
-       */
-      validateScope(payload, resourcePath) {
-        if (!payload.scope) {
-          return true;
-        }
-        const normalizedResource = path.normalize(resourcePath);
-        const normalizedScope = path.normalize(payload.scope);
-        return normalizedResource.startsWith(normalizedScope);
-      }
-      /**
-       * Convenience method: Check if agent can read source file
-       */
-      canReadSource(token, filePath) {
-        return this.checkAccess({
-          token,
-          resourceType: "source_file" /* SOURCE_FILE */,
-          operation: "read",
-          resourcePath: filePath
-        });
-      }
-      /**
-       * Convenience method: Check if agent can modify AST
-       */
-      canModifyAST(token, expectedWorkflowStep) {
-        return this.checkAccess({
-          token,
-          resourceType: "ast" /* AST */,
-          operation: "write",
-          expectedWorkflowStep
-        });
-      }
-      /**
-       * Convenience method: Check if agent can generate code
-       */
-      canGenerateCode(token) {
-        return this.checkAccess({
-          token,
-          resourceType: "code" /* CODE */,
-          operation: "write",
-          expectedWorkflowStep: "generate_assembly" /* GENERATE_ASSEMBLY */
-        });
-      }
-      /**
-       * Convenience method: Check if agent can export to output path
-       */
-      canExport(token, outputPath) {
-        return this.checkAccess({
-          token,
-          resourceType: "output" /* OUTPUT */,
-          operation: "write",
-          resourcePath: outputPath,
-          expectedWorkflowStep: "serialize" /* SERIALIZE */
-        });
-      }
-      /**
-       * Extract agent role from token (without full verification)
-       */
-      extractRole(token) {
-        const result = this.tokenIssuer.verifyToken(token);
-        return result.valid && result.payload ? result.payload.agent_role : null;
-      }
-      /**
-       * Get agent's current workflow step
-       */
-      getWorkflowStep(token) {
-        const result = this.tokenIssuer.verifyToken(token);
-        return result.valid && result.payload ? result.payload.intent.workflow_step : null;
-      }
-      // ===========================================================================
-      // CONFABULATION RISK LAYER (v1.1.0)
-      // ===========================================================================
-      /**
-       * Check access with confabulation gate.
-       *
-       * This is the primary enforcement point for AI-generated content. It chains:
-       * 1. Standard RBAC permission check (token, role, scope, workflow)
-       * 2. Confabulation schema validation (trait properties against 1,800+ schemas)
-       *
-       * If the RBAC check fails, the confabulation check is skipped (no point
-       * validating content from an unauthorized agent).
-       *
-       * @param request - Standard resource access request
-       * @param composition - The HoloComposition to validate for confabulation
-       * @param confabConfig - Optional confabulation validator configuration
-       * @returns Extended access decision with confabulation validation results
-       */
-      checkAccessWithConfabulationGate(request, composition, confabConfig) {
-        const rbacDecision = this.checkAccess(request);
-        if (!rbacDecision.allowed) {
-          return rbacDecision;
-        }
-        const validator = confabConfig ? new ConfabulationValidator(confabConfig) : getConfabulationValidator();
-        const confabResult = validator.validateComposition(composition);
-        if (!confabResult.valid) {
-          return {
-            allowed: false,
-            reason: `Confabulation detected (risk score: ${confabResult.riskScore}/100, ${confabResult.errors.length} error(s)): ` + confabResult.errors.map((e) => e.message).join("; "),
-            agentRole: rbacDecision.agentRole,
-            confabulation: confabResult
-          };
-        }
-        return {
-          ...rbacDecision,
-          confabulation: confabResult
-        };
-      }
-      /**
-       * Validate a composition for confabulation risk WITHOUT requiring an RBAC token.
-       *
-       * This is useful for the validate_holoscript MCP tool and the ai-validator
-       * package which may not have an agent token but still need to check for
-       * confabulated trait properties.
-       *
-       * @param composition - The HoloComposition to validate
-       * @param confabConfig - Optional confabulation validator configuration
-       * @returns Confabulation validation result
-       */
-      validateConfabulation(composition, confabConfig) {
-        const validator = confabConfig ? new ConfabulationValidator(confabConfig) : getConfabulationValidator();
-        return validator.validateComposition(composition);
-      }
-      // ===========================================================================
-      // CULTURAL PROFILE INTEGRATION
-      // ===========================================================================
-      /**
-       * Extract cultural profile metadata from an agent's JWT token.
-       *
-       * @param token - Agent JWT token
-       * @returns The cultural profile if present, or null
-       */
-      extractCulturalProfile(token) {
-        const result = this.tokenIssuer.verifyToken(token);
-        if (!result.valid || !result.payload) return null;
-        return result.payload.cultural_profile ?? null;
-      }
-      /**
-       * Validate cultural compatibility across multiple agent tokens.
-       *
-       * Extracts cultural profiles from each provided token and runs them
-       * through the CulturalCompatibilityChecker.  Agents whose tokens
-       * do not contain cultural profiles are silently skipped.
-       *
-       * @param agentTokens - Map of agent name to JWT token
-       * @param normSets    - Optional map of agent name to norm_set arrays
-       *                      (norms are composition-level, not token-level)
-       * @returns Cultural compatibility result, or null if fewer than 2 agents
-       *          have cultural profiles
-       */
-      validateCulturalCompatibility(agentTokens, normSets) {
-        const entries = [];
-        for (const [name, token] of agentTokens) {
-          const profile = this.extractCulturalProfile(token);
-          if (profile) {
-            entries.push({
-              name,
-              profile: {
-                cooperation_index: profile.cooperation_index,
-                cultural_family: profile.cultural_family,
-                prompt_dialect: profile.prompt_dialect,
-                norm_set: normSets?.get(name) ?? []
-              }
-            });
-          }
-        }
-        if (entries.length < 2) return null;
-        const checker = new CulturalCompatibilityChecker();
-        return checker.check(entries);
-      }
-    };
-    globalRBAC = null;
-  }
-});
-
-export { BUILTIN_NORMS, HOLOSCRIPT_RESOURCE_SCHEME, HoloScriptCapabilitySemantics, criticalMassForChange, getBuiltinNorm, getCapabilityTokenIssuer, getRBAC, getTokenIssuer, init_AgentRBAC, init_AgentTokenIssuer, init_CapabilityToken, init_CapabilityTokenIssuer, init_CultureTraits, normsByCategory };
-//# sourceMappingURL=chunk-V42NTCFH.js.map
-//# sourceMappingURL=chunk-V42NTCFH.js.map