@holoscript/core 8.0.14 → 8.0.15

package/dist/{chunk-CHIZSMWD.js → chunk-PLK3DLTF.js}

@@ -1,4 +1,4 @@
-import { init_CompilerBase, CompilerBase } from './chunk-YDSNDCV3.js';
+import { init_CompilerBase, CompilerBase } from './chunk-QC3CAVFN.js';
 import { __export, __esm } from './chunk-W4GABFCR.js';
 import { ANSCapabilityPath } from '@holoscript/core-types/ans';
 
@@ -417,5 +417,5 @@ var init_DTDLCompiler = __esm({
 });
 
 export { DTDLCompiler, DTDLCompiler_default, DTDLCompiler_exports, DTDL_TRAIT_COMPONENTS, init_DTDLCompiler };
-//# sourceMappingURL=chunk-CHIZSMWD.js.map
-//# sourceMappingURL=chunk-CHIZSMWD.js.map
+//# sourceMappingURL=chunk-PLK3DLTF.js.map
+//# sourceMappingURL=chunk-PLK3DLTF.js.map

package/dist/{chunk-4NEPHK2K.js → chunk-PMACVMHL.js}

@@ -1,5 +1,5 @@
 import { init_jsonLogic, matchesRule, evaluateJsonLogic } from './chunk-JBQXZIWB.js';
-import { init_CompilerBase, CompilerBase } from './chunk-YDSNDCV3.js';
+import { init_CompilerBase, CompilerBase } from './chunk-QC3CAVFN.js';
 import { __export, __esm } from './chunk-W4GABFCR.js';
 import { createHash } from 'crypto';
 import { ANSCapabilityPath } from '@holoscript/core-types/ans';
@@ -277,5 +277,5 @@ var init_DaimonSeedCompiler = __esm({
 });
 
 export { DaimonSeedCompiler, DaimonSeedCompiler_default, DaimonSeedCompiler_exports, computeExportFidelity, createDaimonSeedCompiler, init_DaimonSeedCompiler, runHysteresisExp2 };
-//# sourceMappingURL=chunk-4NEPHK2K.js.map
-//# sourceMappingURL=chunk-4NEPHK2K.js.map
+//# sourceMappingURL=chunk-PMACVMHL.js.map
+//# sourceMappingURL=chunk-PMACVMHL.js.map

package/dist/{chunk-EYHPTJ3F.js → chunk-PV2OXNP5.js}

@@ -1,26 +1,26 @@
 import { MATERIAL_PRESETS } from './chunk-3F7ZZWIN.js';
-import { init_DaimonSeedCompiler, DaimonSeedCompiler_exports } from './chunk-4NEPHK2K.js';
-import { init_AgentInferenceExportTarget, AgentInferenceExportTarget_exports } from './chunk-KOGPVAP6.js';
-import { init_SDFCompiler, SDFCompiler_exports } from './chunk-IXFNA5TT.js';
-import { init_StateCompiler, StateCompiler_exports } from './chunk-62OYZT6Q.js';
-import { init_AndroidCompiler, AndroidCompiler_exports } from './chunk-3KHRZTNW.js';
-import { init_AndroidXRCompiler, AndroidXRCompiler_exports } from './chunk-JCVSCKUH.js';
-import { init_IOSCompiler, IOSCompiler_exports } from './chunk-73EDVY5D.js';
-import { init_VisionOSCompiler, VisionOSCompiler_exports } from './chunk-VMCR5QVI.js';
-import { init_WASMCompiler, WASMCompiler_exports } from './chunk-5T6BWIB7.js';
-import { init_geometry_registry, init_geometry_purpose, init_skybox_registry, init_WebGPUCompiler, WebGPUCompiler_exports, resolveGeometryRole, resolveGeometry, resolveSkyboxColor } from './chunk-QLPRI3QW.js';
-import { init_DTDLCompiler, DTDLCompiler_exports } from './chunk-CHIZSMWD.js';
-import { init_URDFCompiler, URDFCompiler_exports } from './chunk-Q4J2K7FI.js';
-import { init_OpenXRCompiler, OpenXRCompiler_exports } from './chunk-R5VKLUMR.js';
-import { init_VRChatCompiler, VRChatCompiler_exports } from './chunk-6FCNMTL5.js';
-import { init_UnityCompiler, UnityCompiler_exports } from './chunk-KYJD2UMV.js';
-import { init_UnrealCompiler, UnrealCompiler_exports } from './chunk-M7XR3F53.js';
+import { init_DaimonSeedCompiler, DaimonSeedCompiler_exports } from './chunk-PMACVMHL.js';
+import { init_AgentInferenceExportTarget, AgentInferenceExportTarget_exports } from './chunk-FT4FGTR6.js';
+import { init_SDFCompiler, SDFCompiler_exports } from './chunk-YBIHSN55.js';
+import { init_StateCompiler, StateCompiler_exports } from './chunk-EKNWUSGW.js';
+import { init_AndroidCompiler, AndroidCompiler_exports } from './chunk-3AUYBQ5I.js';
+import { init_AndroidXRCompiler, AndroidXRCompiler_exports } from './chunk-LJVVOVA6.js';
+import { init_IOSCompiler, IOSCompiler_exports } from './chunk-7AY66PZP.js';
+import { init_VisionOSCompiler, VisionOSCompiler_exports } from './chunk-ULT2QAV5.js';
+import { init_WASMCompiler, WASMCompiler_exports } from './chunk-PFZ5WLIP.js';
+import { init_geometry_registry, init_geometry_purpose, init_skybox_registry, init_WebGPUCompiler, WebGPUCompiler_exports, resolveGeometryRole, resolveGeometry, resolveSkyboxColor } from './chunk-WQJMSSJT.js';
+import { init_DTDLCompiler, DTDLCompiler_exports } from './chunk-PLK3DLTF.js';
+import { init_URDFCompiler, URDFCompiler_exports } from './chunk-TZM6DKSJ.js';
+import { init_OpenXRCompiler, OpenXRCompiler_exports } from './chunk-AAUQTR7I.js';
+import { init_VRChatCompiler, VRChatCompiler_exports } from './chunk-7HDRN5BW.js';
+import { init_UnityCompiler, UnityCompiler_exports } from './chunk-ZPHCTPR6.js';
+import { init_UnrealCompiler, UnrealCompiler_exports } from './chunk-2UP2J3OK.js';
 import { init_PlatformConditional, platformCategory, PLATFORM_CAPABILITIES, PLATFORM_CATEGORIES } from './chunk-DJNH4HFW.js';
-import { init_GodotCompiler, GodotCompiler_exports } from './chunk-RVN7OPCP.js';
-import { init_DomainBlockCompilerMixin, compileDomainBlocks, inputToUSDA, compileInputBlock, navigationToUSDA, compileNavigationBlock, renderingToUSDA, compileRenderingBlock, proceduralToUSDA, compileProceduralBlock, web3ToUSDA, compileWeb3Block, architectureToUSDA, compileArchitectureBlock, musicToUSDA, compileMusicBlock, educationToUSDA, compileEducationBlock, datavizToUSDA, compileDataVizBlock, iotToUSDA, compileIoTBlock, compileRoboticsBlock, roboticsToUSDA, compileHealthcareBlock, healthcareToUSDA, compilePaymentBlock, paymentToUSDA, compileNarrativeBlock, narrativeToUSDA, compileWeatherBlock, weatherToUSD, compileAudioSourceBlock, audioSourceToUSD, compilePostProcessingBlock, postProcessingToUSD, compileParticleBlock, particlesToUSD, compilePhysicsBlock, compileMaterialBlock, materialToUSD } from './chunk-TZQKJOPC.js';
-import { init_CompilerBase, CompilerBase, createTestCompilerToken, init_ANSNamespace, ANSCapabilityPath as ANSCapabilityPath$1 } from './chunk-YDSNDCV3.js';
+import { init_GodotCompiler, GodotCompiler_exports } from './chunk-ETIJOUIO.js';
+import { init_DomainBlockCompilerMixin, compileDomainBlocks, inputToUSDA, compileInputBlock, navigationToUSDA, compileNavigationBlock, renderingToUSDA, compileRenderingBlock, proceduralToUSDA, compileProceduralBlock, web3ToUSDA, compileWeb3Block, architectureToUSDA, compileArchitectureBlock, musicToUSDA, compileMusicBlock, educationToUSDA, compileEducationBlock, datavizToUSDA, compileDataVizBlock, iotToUSDA, compileIoTBlock, compileRoboticsBlock, roboticsToUSDA, compileHealthcareBlock, healthcareToUSDA, compilePaymentBlock, paymentToUSDA, compileNarrativeBlock, narrativeToUSDA, compileWeatherBlock, weatherToUSD, compileAudioSourceBlock, audioSourceToUSD, compilePostProcessingBlock, postProcessingToUSD, compileParticleBlock, particlesToUSD, compilePhysicsBlock, compileMaterialBlock, materialToUSD } from './chunk-TW2AH2ZS.js';
+import { init_CompilerBase, CompilerBase, createTestCompilerToken, init_ANSNamespace, ANSCapabilityPath as ANSCapabilityPath$1 } from './chunk-QC3CAVFN.js';
 import { parsePipeline } from './chunk-SYTRBGDS.js';
-import { init_constants, CONNECTOR_PACKAGES, CONNECTOR_ENV_REQUIREMENTS, KNOWN_CONNECTORS } from './chunk-2EGGAZT3.js';
+import { init_constants, CONNECTOR_PACKAGES, CONNECTOR_ENV_REQUIREMENTS, KNOWN_CONNECTORS } from './chunk-QS27OYBU.js';
 import { init_effects, init_EffectChecker, EFFECTS_BY_CATEGORY, EffectChecker, EffectRow, createEffectChecker, dangerLevel } from './chunk-ZVFHPMC5.js';
 import { __export, __esm, __toCommonJS } from './chunk-W4GABFCR.js';
 import { createHash } from 'crypto';
@@ -1487,8 +1487,15 @@ var init_LlamaServerCompiler = __esm({
         if (grammarFile) files.unshift(grammarFile);
         if (cfg.traceCapture) {
           files.push(
-            { path: "holo-inference-proxy.mjs", content: this.genInferenceProxyScript(cfg), executable: true },
-            { path: `holo-inference-proxy-${this.slug(cfg.registerAs)}.service`, content: this.genInferenceProxyUnit(cfg) }
+            {
+              path: "holo-inference-proxy.mjs",
+              content: this.genInferenceProxyScript(cfg),
+              executable: true
+            },
+            {
+              path: `holo-inference-proxy-${this.slug(cfg.registerAs)}.service`,
+              content: this.genInferenceProxyUnit(cfg)
+            }
           );
         }
         const warnings = foundTrait ? [] : ["No @llama_serve trait found; used compiler options/defaults."];
@@ -1502,6 +1509,11 @@ var init_LlamaServerCompiler = __esm({
             `trace_capture requires trace_upstream_port (${cfg.traceUpstreamPort}) to differ from the public port (${cfg.port}).`
           );
         }
+        if (cfg.cacheRamMiB !== void 0 && (!Number.isFinite(cfg.cacheRamMiB) || !Number.isInteger(cfg.cacheRamMiB) || cfg.cacheRamMiB < 0)) {
+          throw new Error(
+            `cache_ram must be a non-negative integer MiB value; received ${cfg.cacheRamMiB}.`
+          );
+        }
         if (cfg.grammarPath && cfg.grammar) {
           warnings.push(
             "Both a grammar file and an inline grammar were supplied; using --grammar-file and ignoring the inline grammar."
@@ -1592,6 +1604,7 @@ var init_LlamaServerCompiler = __esm({
           imageMinTokens: this.opts.imageMinTokens ?? this.numberValue(raw, DEFAULTS.imageMinTokens, "imageMinTokens", "image_min_tokens"),
           imageMaxTokens: this.opts.imageMaxTokens ?? this.numberValue(raw, DEFAULTS.imageMaxTokens, "imageMaxTokens", "image_max_tokens"),
           parallel: this.opts.parallel ?? this.numberValue(raw, DEFAULTS.parallel, "parallel"),
+          cacheRamMiB: this.opts.cacheRamMiB ?? this.optionalNumberValue(raw, "cacheRamMiB", "cache_ram", "cache-ram"),
           metrics: this.opts.metrics ?? this.booleanValue(raw, DEFAULTS.metrics, "metrics"),
           traceCapture: this.booleanValue(raw, false, "traceCapture", "trace_capture"),
           traceUpstreamPort: this.numberValue(
@@ -1683,6 +1696,7 @@ var init_LlamaServerCompiler = __esm({
           );
         }
         argv.push("--parallel", String(cfg.parallel));
+        if (cfg.cacheRamMiB !== void 0) argv.push("--cache-ram", String(cfg.cacheRamMiB));
         if (cfg.metrics) argv.push("--metrics");
         if (cfg.grammarPath) argv.push("--grammar-file", cfg.grammarPath);
         else if (cfg.grammar) argv.push("--grammar", cfg.grammar);
@@ -16120,8 +16134,8 @@ var CompilerBridge = class {
     if (this.initialized) return;
     try {
       const [parserModule, compilerModule] = await Promise.all([
-        import('./HoloScriptPlusParser-ZP53ECSL.js'),
-        import('./SceneIRCompiler-VX75RB6H.js')
+        import('./HoloScriptPlusParser-YCV6L7GI.js'),
+        import('./SceneIRCompiler-BJQMKLWL.js')
       ]);
       this.modules = {
         Parser: parserModule.HoloScriptPlusParser,
@@ -16744,5 +16758,5 @@ function compilePipelineSource(source, options = {}) {
 }
 
 export { A2AAgentCardCompiler, BUILTIN_RESOURCES, CAPABILITY_HIERARCHY, CATEGORY_DEFAULT_EMBODIMENT, CodeEditorCompiler, CompileTimeAuthorityEffectError, CompilerBridge, ComputePhysicsCompiler, CpuPathTracer, CrossRealityTraitRegistry, DEFAULT_MATERIAL_KEYWORDS, DEFAULT_OBJECT_KEYWORDS, DEFAULT_PRIMITIVE_SHAPES, DesktopGPUCompiler, DialectRegistry, EFFECT_TO_CAPABILITY, EdgeCompiler, EmbodiedDatasetCompiler, FMUCompiler, GaussianSplattingCompiler, GaussianTrainCompiler, GaussianTrainConfigError, HANDOFF_PATH_RULES, HOLOMAP_CAPTURE_DEFAULT_PROVENANCE, HOLOSCRIPT_GRAMMAR_PRESETS, HoloMCPCompiler, LinearTypeChecker, LlamaServerCompiler, MJCFCompiler, MJXCompiler, MVC_BUDGET_CONSTRAINTS, MediaPipelineCompiler, NIRCompiler, NextJSAPICompiler, NodeServiceCompiler, OmnigentAgentYamlCompiler, PCGGraphCompiler, PCG_GRAPH_SCHEMA, PLATFORM_BUDGETS, PLATFORM_EMBODIMENT_OVERRIDES, POINT_PROVENANCE_CLASS_BY_CODE, POINT_PROVENANCE_CODE, PROVENANCE_RECEIPT_VERSION, PathTracerCompiler, PhysicsColliderCompiler, REMOTE_TRAIN_EXECUTOR, REQUIRED_SANDBOX_AUTHORITY_EFFECT, ResourceBudgetAnalyzer, SANDBOX_AUTHORITY_TRAIT, SCMCompiler, SDKCompiler, SHARED_SORT_SHADER_PATH, SOVEREIGN_TRAIN_EXECUTOR, SVGCompiler, SpatialAudioCompiler, SpatialPartitionPass, TRAIT_RESOURCE_COSTS, TRAIT_RESOURCE_MAP, TRUST_LEVEL_CAPABILITIES, ThreeDTilesCompiler, USDZPipeline, absorbFMU, assertAuthorityEffects, bestCategoryForTraits, buildProvenanceReceipt, buildSafetyReport, checkAuthorityEffects, checkCapabilities, collectAuthorityEffectNodes, compileAllToNextJSAPI, compilePCGGraphFromBlocks, compilePipelineSource, compilePipelineSourceToNode, compilePipelineSourceToPython, compilePipelineToNode, compilePipelineToPython, compileTo3DTiles, compileToFMU, compileToNextJSAPI, compileToPCGGraph, createCrossRealityTraitRegistry, createGaussianSplattingCompiler, createGaussianTrainCompiler, createOmnigentAgentYamlCompiler, createThreeDTilesCompiler, densifyByInterpolation, deriveRequirements, detectMultiUserSharedSort, ensureDialectsBooted, expandCapabilities, formatReport, generateCertificate, generateHoloScriptGbnf, getCompilerBridge, getCrossRealityTraitRegistry, init_A2AAgentCardCompiler, init_DialectRegistry, init_EmbodiedDatasetCompiler, init_HoloMCPCompiler, init_LlamaServerCompiler, init_MJCFCompiler, init_MJXCompiler, init_NIRCompiler, init_NextJSAPICompiler, init_NodeServiceCompiler, init_OmnigentAgentYamlCompiler, init_PCGGraphCompiler, init_SDKCompiler, init_holoscript_gbnf, init_registerBuiltinDialects, isHoloScriptGrammarPreset, pcgGraphToUnrealXml, provenanceClassToCode, provenanceCodeToClass, provenanceHistogram, quickSafetyCheck, registerBuiltinDialects, resetCrossRealityTraitRegistry, runSafetyPass, selectModality, selectModalityForAll, spatialPartition, streamWorldTiles, uniformProvenance };
-//# sourceMappingURL=chunk-EYHPTJ3F.js.map
-//# sourceMappingURL=chunk-EYHPTJ3F.js.map
+//# sourceMappingURL=chunk-PV2OXNP5.js.map
+//# sourceMappingURL=chunk-PV2OXNP5.js.map

package/dist/{chunk-KLM6QD6D.cjs → chunk-Q6VW7MGX.cjs}

@@ -1,7 +1,7 @@
 'use strict';
 
-var chunkP65OIMJT_cjs = require('./chunk-P65OIMJT.cjs');
-var chunkSE2Y5BSL_cjs = require('./chunk-SE2Y5BSL.cjs');
+var chunkIYK6LMQ7_cjs = require('./chunk-IYK6LMQ7.cjs');
+var chunkCMEINO5I_cjs = require('./chunk-CMEINO5I.cjs');
 var chunkZHPMP447_cjs = require('./chunk-ZHPMP447.cjs');
 var ans = require('@holoscript/core-types/ans');
 
@@ -14,9 +14,9 @@ chunkZHPMP447_cjs.__export(SDFCompiler_exports, {
 exports.SDFCompiler = void 0; exports.SDFCompiler_default = void 0;
 var init_SDFCompiler = chunkZHPMP447_cjs.__esm({
   "src/compiler/SDFCompiler.ts"() {
-    chunkSE2Y5BSL_cjs.init_CompilerBase();
-    chunkP65OIMJT_cjs.init_DomainBlockCompilerMixin();
-    exports.SDFCompiler = class extends chunkSE2Y5BSL_cjs.CompilerBase {
+    chunkCMEINO5I_cjs.init_CompilerBase();
+    chunkIYK6LMQ7_cjs.init_DomainBlockCompilerMixin();
+    exports.SDFCompiler = class extends chunkCMEINO5I_cjs.CompilerBase {
       constructor(options = {}) {
         super();
         this.compilerName = "SDFCompiler";
@@ -96,23 +96,23 @@ var init_SDFCompiler = chunkZHPMP447_cjs.__esm({
         if (domainBlocks.length === 0) return;
         this.emit("");
         this.emit("<!-- v4.2 Domain Blocks -->");
-        const compiled = chunkP65OIMJT_cjs.compileDomainBlocks(
+        const compiled = chunkIYK6LMQ7_cjs.compileDomainBlocks(
           domainBlocks,
           {
             material: (block) => {
-              const mat = chunkP65OIMJT_cjs.compileMaterialBlock(block);
-              return chunkP65OIMJT_cjs.materialToSDF(mat);
+              const mat = chunkIYK6LMQ7_cjs.compileMaterialBlock(block);
+              return chunkIYK6LMQ7_cjs.materialToSDF(mat);
             },
             physics: (block) => {
-              const phys = chunkP65OIMJT_cjs.compilePhysicsBlock(block);
-              return chunkP65OIMJT_cjs.physicsToSDF(phys);
+              const phys = chunkIYK6LMQ7_cjs.compilePhysicsBlock(block);
+              return chunkIYK6LMQ7_cjs.physicsToSDF(phys);
             },
             audio: (block) => {
-              const audio = chunkP65OIMJT_cjs.compileAudioSourceBlock(block);
+              const audio = chunkIYK6LMQ7_cjs.compileAudioSourceBlock(block);
               return `<!-- Audio: ${this.escapeStringValue(audio.name, "TypeScript")} (${audio.keyword}) clip="${audio.properties.clip || ""}" -->`;
             },
             weather: (block) => {
-              const weather = chunkP65OIMJT_cjs.compileWeatherBlock(block);
+              const weather = chunkIYK6LMQ7_cjs.compileWeatherBlock(block);
               const layers = weather.layers.map((l) => `<!-- ${l.type}: ${JSON.stringify(l.properties)} -->`).join("\n");
               return `<!-- Weather: ${weather.keyword} "${weather.name || ""}" -->
 ${layers}`;
@@ -611,5 +611,5 @@ ${layers}`;
 
 exports.SDFCompiler_exports = SDFCompiler_exports;
 exports.init_SDFCompiler = init_SDFCompiler;
-//# sourceMappingURL=chunk-KLM6QD6D.cjs.map
-//# sourceMappingURL=chunk-KLM6QD6D.cjs.map
+//# sourceMappingURL=chunk-Q6VW7MGX.cjs.map
+//# sourceMappingURL=chunk-Q6VW7MGX.cjs.map

package/dist/{chunk-YDSNDCV3.js → chunk-QC3CAVFN.js}

@@ -6,7 +6,6 @@ import * as crypto3 from 'crypto';
 import { createHash } from 'crypto';
 import { promisify } from 'util';
 import { z } from 'zod';
-import jwt from 'jsonwebtoken';
 import path from 'path';
 
 function calculateJwkThumbprint(publicKeyPem) {
@@ -1237,16 +1236,42 @@ var init_CapabilityTokenIssuer = __esm({
     globalCapabilityIssuer = null;
   }
 });
+function sha256Hex(value) {
+  return crypto3.createHash("sha256").update(value, "utf8").digest("hex");
+}
+function decodeJsonSegment(segment) {
+  try {
+    const parsed = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function asRecord(value) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    return value;
+  }
+  return void 0;
+}
+function asString(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function isIntentTokenPayload(value) {
+  const record = asRecord(value);
+  if (!record) return false;
+  const intent = asRecord(record.intent);
+  return typeof record.iss === "string" && typeof record.sub === "string" && typeof record.aud === "string" && typeof record.exp === "number" && typeof record.agent_role === "string" && asRecord(record.agent_checksum) !== void 0 && Array.isArray(record.permissions) && intent !== void 0 && typeof intent.workflow_id === "string" && typeof intent.workflow_step === "string";
+}
 function getTokenIssuer(config) {
   if (!globalIssuer) {
-    globalIssuer = new AgentTokenIssuer({
-      ...config,
-      jwtSecret: process.env.AGENT_JWT_SECRET
-    });
+    globalIssuer = new AgentTokenIssuer(config);
   }
   return globalIssuer;
 }
-var DEFAULT_ISSUER, DEFAULT_JWT_SECRET, DEFAULT_TOKEN_EXPIRATION, AgentTokenIssuer, globalIssuer;
+var DEFAULT_ISSUER, DEFAULT_TOKEN_EXPIRATION, LEGACY_AUDIENCE, intentPresentationCache, AgentTokenIssuer, globalIssuer;
 var init_AgentTokenIssuer = __esm({
   "src/compiler/identity/AgentTokenIssuer.ts"() {
     init_AgentIdentity();
@@ -1254,31 +1279,25 @@ var init_AgentTokenIssuer = __esm({
     init_CapabilityToken();
     init_CapabilityTokenIssuer();
     DEFAULT_ISSUER = "holoscript-orchestrator";
-    DEFAULT_JWT_SECRET = process.env.AGENT_JWT_SECRET || "dev-secret-change-in-production";
     DEFAULT_TOKEN_EXPIRATION = "24h";
+    LEGACY_AUDIENCE = "holoscript-compiler";
+    intentPresentationCache = /* @__PURE__ */ new Map();
     AgentTokenIssuer = class {
       constructor(config = {}) {
         /** Active workflow state (for validation) */
         this.workflowState = /* @__PURE__ */ new Map();
         this.issuer = config.issuer || DEFAULT_ISSUER;
-        this.jwtSecret = config.jwtSecret || DEFAULT_JWT_SECRET;
         this.tokenExpiration = config.tokenExpiration || DEFAULT_TOKEN_EXPIRATION;
         this.strictWorkflowValidation = config.strictWorkflowValidation ?? true;
-        if (this.jwtSecret === DEFAULT_JWT_SECRET && process.env.NODE_ENV === "production") {
-          console.error(
-            "[TOKEN_ISSUER] Using default JWT secret in production! Set AGENT_JWT_SECRET environment variable."
-          );
-        }
       }
       /**
-       * Issue intent token for agent
+       * Issue an intent token for an agent.
        *
-       * Creates a signed JWT with:
-       * - Standard claims (iss, sub, aud, exp, iat, jti)
-       * - Agent identity (role, checksum)
-       * - Permissions (RBAC)
-       * - Intent metadata (workflow context)
-       * - PoP binding (JWK thumbprint)
+       * SOVEREIGN PATH: the token on the wire is an EdDSA UCAN capability token
+       * signed with the request's Ed25519 key pair via `CapabilityTokenIssuer`.
+       * The full legacy `IntentTokenPayload` view (standard claims, agent
+       * identity/checksum, permissions, intent metadata, PoP binding) travels in
+       * the token facts and is reconstructed verbatim by `verifyToken`.
        */
       async issueToken(request) {
         const {
@@ -1302,12 +1321,13 @@ var init_AgentTokenIssuer = __esm({
         const permissions = getDefaultPermissions(agentConfig.role);
         const updatedDelegationChain = [...delegationChain, agentConfig.role];
         const now = Math.floor(Date.now() / 1e3);
+        const lifetimeSec = typeof this.tokenExpiration === "string" ? this.parseExpiration(this.tokenExpiration) : this.tokenExpiration;
         const payload = {
-          // Standard JWT claims
+          // Standard claims
           iss: this.issuer,
           sub: `agent:${agentConfig.role}:${agentConfig.name}`,
-          aud: "holoscript-compiler",
-          exp: typeof this.tokenExpiration === "string" ? now + this.parseExpiration(this.tokenExpiration) : now + this.tokenExpiration,
+          aud: LEGACY_AUDIENCE,
+          exp: now + lifetimeSec,
           iat: now,
           jti: crypto3.randomUUID(),
           // Agent-specific claims
@@ -1331,70 +1351,131 @@ var init_AgentTokenIssuer = __esm({
           // Ed25519 public key for HTTP Message Signature verification
           publicKey: keyPair.publicKey
         };
-        const token = jwt.sign(payload, this.jwtSecret, {
-          algorithm: "HS256"
-        });
+        const resource = agentConfig.scope ? `${HOLOSCRIPT_RESOURCE_SCHEME}${agentConfig.scope}` : HOLOSCRIPT_RESOURCE_ALL;
+        const capabilities = permissions.map((perm) => ({
+          with: resource,
+          can: PERMISSION_TO_ACTION[perm] || perm
+        }));
+        const capToken = await this.getCapabilityTokenIssuer().issueRoot(
+          {
+            issuer: payload.sub,
+            audience: LEGACY_AUDIENCE,
+            capabilities,
+            lifetimeSec,
+            facts: {
+              intent_payload: payload,
+              publicKey: keyPair.publicKey
+            }
+          },
+          keyPair
+        );
         this.workflowState.set(workflowId, workflowStep);
         const keystore = getKeystore();
         await keystore.storeCredential({
           role: agentConfig.role,
-          token,
+          token: capToken.raw,
           keyPair,
           createdAt: new Date(now * 1e3),
-          expiresAt: new Date(payload.exp * 1e3)
+          expiresAt: new Date(capToken.payload.exp * 1e3)
         });
-        return token;
+        return capToken.raw;
       }
       /**
-       * Verify agent token
+       * Verify an agent token — FAIL CLOSED.
        *
        * Validates:
-       * - Signature authenticity
-       * - Token expiration
-       * - Claims structure
+       * - EdDSA capability-token structure (legacy HS256 jsonwebtoken envelopes
+       *   are rejected with `LEGACY_JWT_REJECTED`, never verified)
+       * - Ed25519 signature against the embedded verification key
+       * - Expiration
+       * - Issuer / audience claims
+       * - Required legacy claims structure
        * - Workflow step sequence (if strict mode)
+       *
+       * Never throws — every failure mode maps to a rejected result.
        */
       verifyToken(token) {
         try {
-          const decoded = jwt.verify(token, this.jwtSecret, {
-            issuer: this.issuer,
-            audience: "holoscript-compiler"
-          });
-          if (!decoded.agent_role || !decoded.agent_checksum || !decoded.intent) {
+          if (typeof token !== "string" || token.length === 0) {
             return {
               valid: false,
-              error: "Missing required claims",
-              errorCode: "INVALID_CLAIMS"
+              error: "Invalid signature or malformed token",
+              errorCode: "INVALID_SIGNATURE"
             };
           }
-          if (this.strictWorkflowValidation) {
-            const currentStep = this.workflowState.get(decoded.intent.workflow_id);
-            if (currentStep && currentStep !== decoded.intent.workflow_step) {
-              return {
-                valid: false,
-                error: `Workflow step mismatch: expected ${currentStep}, got ${decoded.intent.workflow_step}`,
-                errorCode: "WORKFLOW_VIOLATION"
-              };
+          const tokenSha256 = sha256Hex(token);
+          const cached = intentPresentationCache.get(tokenSha256);
+          if (cached) {
+            const now = Math.floor(Date.now() / 1e3);
+            if (cached.exp <= now) {
+              intentPresentationCache.delete(tokenSha256);
+              return { valid: false, error: "Token expired", errorCode: "EXPIRED" };
             }
+            return this.checkClaimsAndWorkflow(structuredClone(cached));
           }
-          return {
-            valid: true,
-            payload: decoded
-          };
-        } catch (error) {
-          if (error instanceof Error && error.name === "TokenExpiredError") {
+          const parts = token.split(".");
+          if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
             return {
               valid: false,
-              error: "Token expired",
-              errorCode: "EXPIRED"
+              error: "Invalid signature or malformed token",
+              errorCode: "INVALID_SIGNATURE"
             };
-          } else if (error instanceof Error && error.name === "JsonWebTokenError") {
+          }
+          const header = decodeJsonSegment(parts[0]);
+          if (!header || typeof header.alg !== "string") {
             return {
               valid: false,
-              error: "Invalid signature or malformed token",
+              error: "Malformed token: header segment is not decodable JSON with an alg claim.",
+              errorCode: "INVALID_SIGNATURE"
+            };
+          }
+          if (header.alg !== "EdDSA") {
+            return {
+              valid: false,
+              error: `Legacy ${header.alg} jsonwebtoken envelope is no longer accepted. Reissue a sovereign capability token via issueToken.`,
+              errorCode: "LEGACY_JWT_REJECTED"
+            };
+          }
+          const rawPayload = decodeJsonSegment(parts[1]);
+          if (!rawPayload) {
+            return {
+              valid: false,
+              error: "Malformed token: payload segment is not decodable JSON.",
+              errorCode: "INVALID_SIGNATURE"
+            };
+          }
+          const facts = asRecord(rawPayload.fct);
+          const verificationKey = asString(facts?.publicKey);
+          if (!verificationKey) {
+            return {
+              valid: false,
+              error: "Capability token does not embed its Ed25519 verification key (fct.publicKey). Fail closed.",
+              errorCode: "INVALID_CLAIMS"
+            };
+          }
+          const verification = this.getCapabilityTokenIssuer().verify(token, verificationKey);
+          if (!verification.valid || !verification.payload) {
+            if (verification.errorCode === "EXPIRED") {
+              return { valid: false, error: "Token expired", errorCode: "EXPIRED" };
+            }
+            return {
+              valid: false,
+              error: verification.error ?? "Invalid signature or malformed token",
               errorCode: "INVALID_SIGNATURE"
             };
           }
+          const verifiedFacts = asRecord(verification.payload.fct);
+          const intentPayload = verifiedFacts?.intent_payload;
+          if (!isIntentTokenPayload(intentPayload)) {
+            return {
+              valid: false,
+              error: "Missing required claims",
+              errorCode: "INVALID_CLAIMS"
+            };
+          }
+          intentPresentationCache.set(tokenSha256, intentPayload);
+          return this.checkClaimsAndWorkflow(structuredClone(intentPayload));
+        } catch (error) {
           return {
             valid: false,
             error: error instanceof Error ? error.message : String(error),
@@ -1402,6 +1483,37 @@ var init_AgentTokenIssuer = __esm({
           };
         }
       }
+      /**
+       * Issuer/audience claim checks + strict workflow sequencing — run on both
+       * the fresh-verification and presentation-cache paths.
+       */
+      checkClaimsAndWorkflow(payload) {
+        if (payload.iss !== this.issuer || payload.aud !== LEGACY_AUDIENCE) {
+          return {
+            valid: false,
+            error: `Token issuer/audience mismatch: expected ${this.issuer}/${LEGACY_AUDIENCE}`,
+            errorCode: "INVALID_CLAIMS"
+          };
+        }
+        if (!payload.agent_role || !payload.agent_checksum || !payload.intent) {
+          return {
+            valid: false,
+            error: "Missing required claims",
+            errorCode: "INVALID_CLAIMS"
+          };
+        }
+        if (this.strictWorkflowValidation) {
+          const currentStep = this.workflowState.get(payload.intent.workflow_id);
+          if (currentStep && currentStep !== payload.intent.workflow_step) {
+            return {
+              valid: false,
+              error: `Workflow step mismatch: expected ${currentStep}, got ${payload.intent.workflow_step}`,
+              errorCode: "WORKFLOW_VIOLATION"
+            };
+          }
+        }
+        return { valid: true, payload };
+      }
       /**
        * Extract token from Authorization header
        */
@@ -1442,8 +1554,8 @@ var init_AgentTokenIssuer = __esm({
        *
        * Maps the agent's role to capabilities using the PERMISSION_TO_ACTION bridge
        * constants defined in CapabilityToken.ts. This enables agents that currently
-       * use JWT tokens to obtain equivalent UCAN capability tokens for the gradual
-       * migration to capability-based authorization.
+       * use legacy tokens to obtain equivalent UCAN capability tokens for the
+       * gradual migration to capability-based authorization.
        *
        * @param options  Capability token issuance options
        * @returns        Signed UCAN CapabilityToken
@@ -1474,21 +1586,22 @@ var init_AgentTokenIssuer = __esm({
         );
       }
       /**
-       * Issue both a JWT token and a UCAN capability token for the same agent
-       * and intent context.
+       * Issue both a legacy-view token and a UCAN capability token for the same
+       * agent and intent context.
        *
-       * This method enables gradual migration from JWT-only authorization to
-       * UCAN capability-based authorization. Consuming services can validate
-       * either token during the transition period.
+       * This method enables gradual migration from `IntentTokenPayload`-view
+       * authorization to UCAN capability-based authorization. Consuming services
+       * can validate either token during the transition period. Both members are
+       * EdDSA-signed on the sovereign path.
        *
-       * @param request          Standard JWT token request parameters
+       * @param request          Standard token request parameters
        * @param capabilityOptions  Additional options for the capability token
        *                           (audience defaults to 'holoscript-compiler')
        * @returns                 HybridTokenResult with both tokens
        */
       async issueHybridToken(request, capabilityOptions) {
         const jwtToken = await this.issueToken(request);
-        const audience = capabilityOptions?.audience ?? "holoscript-compiler";
+        const audience = capabilityOptions?.audience ?? LEGACY_AUDIENCE;
         const capabilityToken = await this.issueCapabilityToken({
           agentConfig: request.agentConfig,
           audience,
@@ -3953,6 +4066,7 @@ var init_ANSNamespace = __esm({
       AGENT_INFERENCE: "/compile/ai/agent-inference",
       OMNIGENT_AGENT_YAML: "/compile/ai/omnigent-agent-yaml",
       DAIMON_SEED: "/compile/ai/daimon-seed",
+      HSI_IR: "/compile/ai/hsi-ir",
       MCP_CONFIG: "/compile/ai/mcp-config",
       MCP_SERVER: "/compile/ai/mcp-server",
       // ── neuromorphic ─────────────────────────────────────────────────────
@@ -4017,6 +4131,7 @@ var init_ANSNamespace = __esm({
       "agent-inference": ANSDomain.AI,
       "omnigent-agent-yaml": ANSDomain.AI,
       "daimon-seed": ANSDomain.AI,
+      "hsi-ir": ANSDomain.AI,
       "mcp-config": ANSDomain.AI,
       "mcp-server": ANSDomain.AI,
       // neuromorphic
@@ -4072,6 +4187,7 @@ var init_ANSNamespace = __esm({
       "agent-inference": ANSCapabilityPath.AGENT_INFERENCE,
       "omnigent-agent-yaml": ANSCapabilityPath.OMNIGENT_AGENT_YAML,
       "daimon-seed": ANSCapabilityPath.DAIMON_SEED,
+      "hsi-ir": ANSCapabilityPath.HSI_IR,
       "mcp-config": ANSCapabilityPath.MCP_CONFIG,
       "mcp-server": ANSCapabilityPath.MCP_SERVER,
       nir: ANSCapabilityPath.NIR,
@@ -5530,6 +5646,7 @@ var init_CompilerBase = __esm({
       AgentInferenceCompiler: "agent-inference",
       OmnigentAgentYamlCompiler: "omnigent-agent-yaml",
       DaimonSeedCompiler: "daimon-seed",
+      HSIIRCompiler: "hsi-ir",
       CodeEditorCompiler: "code-editor",
       SVGCompiler: "svg"
     };
@@ -6028,5 +6145,5 @@ Required Permission: ${decision.requiredPermission || "unknown"}`
 });
 
 export { ANSCapabilityPath, BUILTIN_NORMS, BUILTIN_NORM_PROVENANCE, CompilerBase, CompilerDocumentationGenerator, UNKNOWN_NORM_PROVENANCE, UnauthorizedCompilerAccessError, createTestCompilerToken, criticalMassForChange, deserializeNormProvenance, escapeStringValue, getBuiltinNorm, getRBAC, init_ANSNamespace, init_AgentRBAC, init_CompilerBase, init_CompilerDocumentationGenerator, init_CultureTraits, isCapabilityTokenCredential, normalizeNormProvenance, normsByCategory, serializeNormProvenance };
-//# sourceMappingURL=chunk-YDSNDCV3.js.map
-//# sourceMappingURL=chunk-YDSNDCV3.js.map
+//# sourceMappingURL=chunk-QC3CAVFN.js.map
+//# sourceMappingURL=chunk-QC3CAVFN.js.map