@jungjaehoon/mama-os 0.53.1 → 0.58.0

package/dist/db/migrations/raw-item-revisions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"raw-item-revisions.js","sourceRoot":"","sources":["../../../src/db/migrations/raw-item-revisions.ts"],"names":[],"mappings":";;AAGA,wEAyBC;AA1BD,0FAA0F;AAC1F,SAAgB,8BAA8B,CAAC,EAAkB;IAC/D,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CACpB,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAA8B,CAAC,GAAG,CAC/E,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAClB,CACF,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,eAAe,CAAC,EAAE,CAAC;YAC7E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,oCAAoC,IAAI,OAAO,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAClC,EAAE,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAClC,EAAE,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAC/D,EAAE,CAAC,IAAI,CAAC;;;;KAIP,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/db/migrations/token-usage-agent-version.d.ts

@@ -1,3 +0,0 @@
-import type { SQLiteDatabase } from '../../sqlite.js';
-export declare function applyTokenUsageAgentVersionMigration(db: SQLiteDatabase): void;
-//# sourceMappingURL=token-usage-agent-version.d.ts.map

package/dist/db/migrations/token-usage-agent-version.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-usage-agent-version.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/token-usage-agent-version.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,wBAAgB,oCAAoC,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CAe7E"}

package/dist/db/migrations/token-usage-agent-version.js

@@ -1,16 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyTokenUsageAgentVersionMigration = applyTokenUsageAgentVersionMigration;
-function applyTokenUsageAgentVersionMigration(db) {
-    const tableExists = db
-        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'token_usage'")
-        .get();
-    if (!tableExists?.name) {
-        return;
-    }
-    const columns = db.prepare('PRAGMA table_info(token_usage)').all().map((column) => column.name);
-    if (!columns.includes('agent_version')) {
-        db.exec('ALTER TABLE token_usage ADD COLUMN agent_version INTEGER');
-    }
-}
-//# sourceMappingURL=token-usage-agent-version.js.map

package/dist/db/migrations/token-usage-agent-version.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-usage-agent-version.js","sourceRoot":"","sources":["../../../src/db/migrations/token-usage-agent-version.ts"],"names":[],"mappings":";;AAEA,oFAeC;AAfD,SAAgB,oCAAoC,CAAC,EAAkB;IACrE,MAAM,WAAW,GAAG,EAAE;SACnB,OAAO,CAAC,8EAA8E,CAAC;SACvF,GAAG,EAAmC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GACX,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,EACjD,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,EAAE,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACtE,CAAC;AACH,CAAC"}

package/dist/db/migrations/validation-session-tables.d.ts

@@ -1,3 +0,0 @@
-import type { SQLiteDatabase } from '../../sqlite.js';
-export declare function applyValidationSessionTablesMigration(db: SQLiteDatabase): void;
-//# sourceMappingURL=validation-session-tables.d.ts.map

package/dist/db/migrations/validation-session-tables.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"validation-session-tables.d.ts","sourceRoot":"","sources":["../../../src/db/migrations/validation-session-tables.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,wBAAgB,qCAAqC,CAAC,EAAE,EAAE,cAAc,GAAG,IAAI,CA8D9E"}

package/dist/db/migrations/validation-session-tables.js

@@ -1,59 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.applyValidationSessionTablesMigration = applyValidationSessionTablesMigration;
-function applyValidationSessionTablesMigration(db) {
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS validation_sessions (
-      id                   TEXT PRIMARY KEY,
-      agent_id             TEXT NOT NULL,
-      agent_version        INTEGER NOT NULL,
-      trigger_type         TEXT NOT NULL,
-      goal                 TEXT,
-      metric_profile_json  TEXT NOT NULL,
-      baseline_version     INTEGER,
-      baseline_session_id  TEXT,
-      execution_status     TEXT NOT NULL,
-      validation_outcome   TEXT NOT NULL,
-      summary              TEXT,
-      recommendation       TEXT,
-      before_snapshot_json TEXT,
-      after_snapshot_json  TEXT,
-      report_json          TEXT,
-      schema_version       INTEGER NOT NULL DEFAULT 1,
-      requires_approval    INTEGER DEFAULT 0,
-      started_at           INTEGER NOT NULL,
-      ended_at             INTEGER
-    )
-  `);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_val_sessions_agent_status
-     ON validation_sessions(agent_id, validation_outcome)`);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_val_sessions_agent_trigger
-     ON validation_sessions(agent_id, trigger_type, started_at)`);
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS validation_metrics (
-      id                    INTEGER PRIMARY KEY AUTOINCREMENT,
-      validation_session_id TEXT NOT NULL,
-      name                  TEXT NOT NULL,
-      value                 REAL NOT NULL,
-      baseline_value        REAL,
-      delta_value           REAL,
-      direction             TEXT NOT NULL,
-      created_at            INTEGER NOT NULL
-    )
-  `);
-    db.exec(`CREATE INDEX IF NOT EXISTS idx_val_metrics_session
-     ON validation_metrics(validation_session_id)`);
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS agent_validation_state (
-      agent_id             TEXT NOT NULL,
-      trigger_type         TEXT NOT NULL,
-      approved_version     INTEGER,
-      approved_session_id  TEXT,
-      current_status       TEXT,
-      last_validation_at   INTEGER,
-      updated_at           INTEGER NOT NULL,
-      PRIMARY KEY (agent_id, trigger_type)
-    )
-  `);
-}
-//# sourceMappingURL=validation-session-tables.js.map

package/dist/db/migrations/validation-session-tables.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"validation-session-tables.js","sourceRoot":"","sources":["../../../src/db/migrations/validation-session-tables.ts"],"names":[],"mappings":";;AAEA,sFA8DC;AA9DD,SAAgB,qCAAqC,CAAC,EAAkB;IACtE,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;GAsBP,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CACL;0DACsD,CACvD,CAAC;IACF,EAAE,CAAC,IAAI,CACL;gEAC4D,CAC7D,CAAC;IAEF,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;GAWP,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CACL;kDAC8C,CAC/C,CAAC;IAEF,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;GAWP,CAAC,CAAC;AACL,CAAC"}

package/dist/envelope/authority.d.ts

@@ -1,15 +0,0 @@
-import { type EnvelopeKeyLookup, type EnvelopeSigningKey } from './signature.js';
-import type { Envelope } from './types.js';
-import type { EnvelopeStore } from './store.js';
-export type EnvelopeBuildInput = Omit<Envelope, 'envelope_hash' | 'signature'>;
-export declare class EnvelopeAuthority {
-    private readonly store;
-    private readonly signer;
-    private readonly keyLookup;
-    constructor(store: EnvelopeStore, signer: EnvelopeSigningKey, keyLookup: EnvelopeKeyLookup);
-    build(input: EnvelopeBuildInput): Envelope;
-    persist(env: Envelope): void;
-    buildAndPersist(input: EnvelopeBuildInput): Envelope;
-    loadVerified(envelopeHash: string): Envelope | undefined;
-}
-//# sourceMappingURL=authority.d.ts.map

package/dist/envelope/authority.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../src/envelope/authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGhD,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,GAAG,WAAW,CAAC,CAAC;AAE/E,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,iBAAiB;IAG/C,KAAK,CAAC,KAAK,EAAE,kBAAkB,GAAG,QAAQ;IAY1C,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI;IAO5B,eAAe,CAAC,KAAK,EAAE,kBAAkB,GAAG,QAAQ;IAMpD,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;CAazD"}

package/dist/envelope/authority.js

@@ -1,95 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EnvelopeAuthority = void 0;
-const signature_js_1 = require("./signature.js");
-const expiry_js_1 = require("./expiry.js");
-class EnvelopeAuthority {
-    store;
-    signer;
-    keyLookup;
-    constructor(store, signer, keyLookup) {
-        this.store = store;
-        this.signer = signer;
-        this.keyLookup = keyLookup;
-    }
-    build(input) {
-        validateBuildInput(input);
-        const envelope = { ...input, envelope_hash: '' };
-        if (envelope.parent_instance_id === undefined) {
-            delete envelope.parent_instance_id;
-        }
-        if (envelope.channel_id === undefined) {
-            delete envelope.channel_id;
-        }
-        return (0, signature_js_1.signEnvelope)(envelope, this.signer);
-    }
-    persist(env) {
-        if (!env.signature) {
-            throw new Error('EnvelopeAuthority.persist: envelope must be signed');
-        }
-        this.store.insert(env);
-    }
-    buildAndPersist(input) {
-        const env = this.build(input);
-        this.persist(env);
-        return env;
-    }
-    loadVerified(envelopeHash) {
-        const env = this.store.getByHash(envelopeHash);
-        if (!env) {
-            return undefined;
-        }
-        if (!(0, signature_js_1.verifyEnvelope)(env, this.keyLookup)) {
-            throw new Error(`EnvelopeAuthority.loadVerified: signature mismatch for ${envelopeHash} ` +
-                '(possible key rotation, tampering, or unknown key_id)');
-        }
-        return env;
-    }
-}
-exports.EnvelopeAuthority = EnvelopeAuthority;
-function validateBuildInput(input) {
-    if (!input.agent_id || typeof input.agent_id !== 'string') {
-        throw new Error('EnvelopeAuthority.build: agent_id required');
-    }
-    if (!input.instance_id || typeof input.instance_id !== 'string') {
-        throw new Error('EnvelopeAuthority.build: instance_id required');
-    }
-    if (![1, 2, 3].includes(input.tier)) {
-        throw new Error(`EnvelopeAuthority.build: tier must be 1|2|3, got ${input.tier}`);
-    }
-    if (typeof input.budget?.wall_seconds !== 'number' || input.budget.wall_seconds <= 0) {
-        throw new Error('EnvelopeAuthority.build: budget.wall_seconds must be > 0');
-    }
-    if (input.budget.token_limit !== undefined && input.budget.token_limit < 0) {
-        throw new Error('EnvelopeAuthority.build: budget.token_limit must be >= 0 if set');
-    }
-    if (input.budget.cost_cap !== undefined && input.budget.cost_cap < 0) {
-        throw new Error('EnvelopeAuthority.build: budget.cost_cap must be >= 0 if set');
-    }
-    const expiresMs = parseEnvelopeBuildExpiry(input.expires_at);
-    if (expiresMs <= Date.now()) {
-        throw new Error(`EnvelopeAuthority.build: expires_at already past: ${input.expires_at}`);
-    }
-    if (!input.scope || !Array.isArray(input.scope.project_refs)) {
-        throw new Error('EnvelopeAuthority.build: scope.project_refs required');
-    }
-    if (!Array.isArray(input.scope.raw_connectors)) {
-        throw new Error('EnvelopeAuthority.build: scope.raw_connectors required');
-    }
-    if (!Array.isArray(input.scope.memory_scopes)) {
-        throw new Error('EnvelopeAuthority.build: scope.memory_scopes required');
-    }
-    if (!Array.isArray(input.scope.allowed_destinations)) {
-        throw new Error('EnvelopeAuthority.build: scope.allowed_destinations required');
-    }
-}
-function parseEnvelopeBuildExpiry(expiresAt) {
-    try {
-        return (0, expiry_js_1.parseEnvelopeExpiresAt)(expiresAt);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        throw new Error(`EnvelopeAuthority.build: ${message}`);
-    }
-}
-//# sourceMappingURL=authority.js.map

package/dist/envelope/authority.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authority.js","sourceRoot":"","sources":["../../src/envelope/authority.ts"],"names":[],"mappings":";;;AAAA,iDAKwB;AAGxB,2CAAqD;AAIrD,MAAa,iBAAiB;IAET;IACA;IACA;IAHnB,YACmB,KAAoB,EACpB,MAA0B,EAC1B,SAA4B;QAF5B,UAAK,GAAL,KAAK,CAAe;QACpB,WAAM,GAAN,MAAM,CAAoB;QAC1B,cAAS,GAAT,SAAS,CAAmB;IAC5C,CAAC;IAEJ,KAAK,CAAC,KAAyB;QAC7B,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC1B,MAAM,QAAQ,GAAa,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC3D,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,QAAQ,CAAC,kBAAkB,CAAC;QACrC,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,QAAQ,CAAC,UAAU,CAAC;QAC7B,CAAC;QACD,OAAO,IAAA,2BAAY,EAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,CAAC,GAAa;QACnB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,eAAe,CAAC,KAAyB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,YAAY,CAAC,YAAoB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAA,6BAAc,EAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,0DAA0D,YAAY,GAAG;gBACvE,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AA7CD,8CA6CC;AAED,SAAS,kBAAkB,CAAC,KAAyB;IACnD,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,EAAE,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC7D,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAiB;IACjD,IAAI,CAAC;QACH,OAAO,IAAA,kCAAsB,EAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/envelope/canonical.d.ts

@@ -1,14 +0,0 @@
-import { type Envelope } from './types.js';
-/**
- * Stable canonical JSON for envelope hashing per spec v2.3 section 4.4.
- *
- * Rules:
- * - Exclude `envelope_hash` and `signature` from the hash input.
- * - Sort object keys lexicographically at every nesting level.
- * - Emit no whitespace.
- * - Normalize string values to NFC.
- */
-export declare function canonicalEnvelopeJson(envelope: Envelope): string;
-export declare function canonicalJson(value: unknown): string;
-export declare function computeEnvelopeHash(envelope: Envelope): string;
-//# sourceMappingURL=canonical.d.ts.map

package/dist/envelope/canonical.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/envelope/canonical.ts"],"names":[],"mappings":"AACA,OAAO,EAAiC,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE1E;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAEhE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAE9D"}

package/dist/envelope/canonical.js

@@ -1,68 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.canonicalEnvelopeJson = canonicalEnvelopeJson;
-exports.canonicalJson = canonicalJson;
-exports.computeEnvelopeHash = computeEnvelopeHash;
-const node_crypto_1 = require("node:crypto");
-const types_js_1 = require("./types.js");
-/**
- * Stable canonical JSON for envelope hashing per spec v2.3 section 4.4.
- *
- * Rules:
- * - Exclude `envelope_hash` and `signature` from the hash input.
- * - Sort object keys lexicographically at every nesting level.
- * - Emit no whitespace.
- * - Normalize string values to NFC.
- */
-function canonicalEnvelopeJson(envelope) {
-    return canonicalize(stripExcluded(envelope));
-}
-function canonicalJson(value) {
-    return canonicalize(value);
-}
-function computeEnvelopeHash(envelope) {
-    return (0, node_crypto_1.createHash)('sha256').update(canonicalEnvelopeJson(envelope)).digest('hex');
-}
-function stripExcluded(envelope) {
-    const out = {};
-    for (const [key, value] of Object.entries(envelope)) {
-        if (types_js_1.ENVELOPE_HASH_EXCLUDED_FIELDS.includes(key)) {
-            continue;
-        }
-        out[key] = value;
-    }
-    return out;
-}
-function canonicalize(value) {
-    if (value === null || typeof value === 'boolean') {
-        return JSON.stringify(value);
-    }
-    if (typeof value === 'number') {
-        if (!Number.isFinite(value)) {
-            throw new Error(`Envelope canonical JSON requires finite numbers, got ${String(value)}`);
-        }
-        return JSON.stringify(value);
-    }
-    if (typeof value === 'string') {
-        return JSON.stringify(value.normalize('NFC'));
-    }
-    if (Array.isArray(value)) {
-        return `[${value.map(canonicalize).join(',')}]`;
-    }
-    if (typeof value === 'object') {
-        if (!isPlainObject(value)) {
-            throw new Error('Envelope canonical JSON only supports JSON-safe plain objects');
-        }
-        const obj = value;
-        const parts = Object.keys(obj)
-            .sort()
-            .map((key) => `${JSON.stringify(key)}:${canonicalize(obj[key])}`);
-        return `{${parts.join(',')}}`;
-    }
-    throw new Error(`Envelope canonical JSON received unsupported value type: ${typeof value}`);
-}
-function isPlainObject(value) {
-    const proto = Object.getPrototypeOf(value);
-    return proto === Object.prototype || proto === null;
-}
-//# sourceMappingURL=canonical.js.map

package/dist/envelope/canonical.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/envelope/canonical.ts"],"names":[],"mappings":";;AAYA,sDAEC;AAED,sCAEC;AAED,kDAEC;AAtBD,6CAAyC;AACzC,yCAA0E;AAE1E;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAkB;IACtD,OAAO,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAgB,aAAa,CAAC,KAAc;IAC1C,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAgB,mBAAmB,CAAC,QAAkB;IACpD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB;IACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAK,wCAAmD,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,wDAAwD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aAC3B,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,4DAA4D,OAAO,KAAK,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC"}

package/dist/envelope/enforcer.d.ts

@@ -1,30 +0,0 @@
-import type { Envelope } from './types.js';
-export declare class EnvelopeViolation extends Error {
-    readonly code: string;
-    readonly metadata: Record<string, unknown>;
-    constructor(message: string, code: string, metadata?: Record<string, unknown>);
-}
-/**
- * Memory READ tools may be allowed scopes beyond the envelope's own list via the
- * grant mirror (see mirrorReadScopes in evidence/read.ts): a run allowed to read a
- * channel's raw events may recall the memories extracted from it. WRITES never
- * widen - mama_save's scope binding is permanent, so it answers only to the
- * envelope's identity scopes.
- */
-export declare const MIRROR_READABLE_TOOLS: Set<string>;
-export interface EnvelopeCheckOptions {
-    /** Extra READ-only memory scope allowance, computed by the caller at check time. */
-    readScopeMirror?: ReadonlyArray<{
-        kind: string;
-        id: string;
-    }>;
-}
-export declare class EnvelopeEnforcer {
-    check(envelope: Envelope | null | undefined, toolName: string, args: unknown, options?: EnvelopeCheckOptions): void;
-    private checkExpiry;
-    private checkDestination;
-    private checkRawConnectors;
-    private checkMemoryScopes;
-    private checkTier;
-}
-//# sourceMappingURL=enforcer.d.ts.map

package/dist/envelope/enforcer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"enforcer.d.ts","sourceRoot":"","sources":["../../src/envelope/enforcer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAe,MAAM,YAAY,CAAC;AAIxD,qBAAa,iBAAkB,SAAQ,KAAK;aAGxB,IAAI,EAAE,MAAM;aACZ,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjD,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,QAAQ,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKzD;AAiDD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAKhC,CAAC;AAEH,MAAM,WAAW,oBAAoB;IACnC,oFAAoF;IACpF,eAAe,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,qBAAa,gBAAgB;IAC3B,KAAK,CACH,QAAQ,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,OAAO,CAAC,EAAE,oBAAoB,GAC7B,IAAI;IAYP,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,gBAAgB;IA2BxB,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,iBAAiB;IAoFzB,OAAO,CAAC,SAAS;CAQlB"}

package/dist/envelope/enforcer.js

@@ -1,286 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EnvelopeEnforcer = exports.MIRROR_READABLE_TOOLS = exports.EnvelopeViolation = void 0;
-const expiry_js_1 = require("./expiry.js");
-const tool_connector_scope_js_1 = require("./tool-connector-scope.js");
-class EnvelopeViolation extends Error {
-    code;
-    metadata;
-    constructor(message, code, metadata = {}) {
-        super(`[${code}] ${message}`);
-        this.code = code;
-        this.metadata = metadata;
-        this.name = 'EnvelopeViolation';
-    }
-}
-exports.EnvelopeViolation = EnvelopeViolation;
-const SEND_TOOLS_TO_DESTINATION_KIND = {
-    telegram_send: 'telegram',
-    slack_send: 'slack',
-    chatwork_send: 'chatwork',
-    discord_send: 'discord',
-    webchat_send: 'webchat',
-    drive_upload: 'drive',
-};
-const DESTINATION_ID_FIELD_BY_TOOL = {
-    telegram_send: 'chat_id',
-    slack_send: 'channel_id',
-    chatwork_send: 'channel_id',
-    discord_send: 'channel_id',
-    webchat_send: 'session_id',
-    drive_upload: 'folderId',
-};
-const WRITE_OR_SEND_TOOLS = new Set([
-    'mama_save',
-    'mama_update',
-    'context_compile',
-    'memory.write',
-    'case.create',
-    'case.link',
-    'case.update_state',
-    'entity.write',
-    'telegram_send',
-    'slack_send',
-    'chatwork_send',
-    'discord_send',
-    'webchat_send',
-    'report.publish',
-    'report_publish',
-    'wiki_publish',
-    'human.correction',
-    'drive_upload',
-]);
-const MEMORY_SCOPED_TOOLS = new Set([
-    'mama_save',
-    'mama_search',
-    'mama_recall',
-    'mama_provenance',
-    'context_compile',
-]);
-/**
- * Memory READ tools may be allowed scopes beyond the envelope's own list via the
- * grant mirror (see mirrorReadScopes in evidence/read.ts): a run allowed to read a
- * channel's raw events may recall the memories extracted from it. WRITES never
- * widen - mama_save's scope binding is permanent, so it answers only to the
- * envelope's identity scopes.
- */
-exports.MIRROR_READABLE_TOOLS = new Set([
-    'mama_search',
-    'mama_recall',
-    'mama_provenance',
-    'context_compile',
-]);
-class EnvelopeEnforcer {
-    check(envelope, toolName, args, options) {
-        if (!envelope) {
-            throw new EnvelopeViolation('No envelope bound to this call', 'no_envelope');
-        }
-        this.checkExpiry(envelope);
-        this.checkDestination(envelope, toolName, args);
-        this.checkRawConnectors(envelope, toolName, args);
-        this.checkMemoryScopes(envelope, toolName, args, options);
-        this.checkTier(envelope, toolName);
-    }
-    checkExpiry(envelope) {
-        let expiresAt;
-        try {
-            expiresAt = (0, expiry_js_1.parseEnvelopeExpiresAt)(envelope.expires_at);
-        }
-        catch {
-            throw new EnvelopeViolation('Envelope expiry is invalid', 'invalid_expiry');
-        }
-        if (expiresAt <= Date.now()) {
-            throw new EnvelopeViolation('Envelope has expired', 'expired');
-        }
-    }
-    checkDestination(envelope, toolName, args) {
-        if (!Object.hasOwn(SEND_TOOLS_TO_DESTINATION_KIND, toolName)) {
-            return;
-        }
-        const destinationToolName = toolName;
-        const destinationKind = SEND_TOOLS_TO_DESTINATION_KIND[destinationToolName];
-        const destinationField = DESTINATION_ID_FIELD_BY_TOOL[destinationToolName];
-        const destinationId = getStringArg(args, destinationField);
-        if (!destinationId) {
-            throw new EnvelopeViolation(`Tool ${toolName} called without destination id`, 'missing_destination');
-        }
-        const allowed = envelope.scope.allowed_destinations.some((destination) => destination.kind === destinationKind && destination.id === destinationId);
-        if (!allowed) {
-            throw new EnvelopeViolation('Requested destination is outside envelope.scope.allowed_destinations', 'destination_out_of_scope');
-        }
-    }
-    checkRawConnectors(envelope, toolName, args) {
-        const requestedConnectors = requestedRawConnectorsForTool(toolName, args);
-        if (requestedConnectors.length === 0) {
-            return;
-        }
-        const outOfScope = requestedConnectors.filter((connector) => !envelope.scope.raw_connectors.includes(connector));
-        if (outOfScope.length > 0) {
-            throw new EnvelopeViolation('Requested raw connector is outside envelope.scope.raw_connectors', 'connector_out_of_scope');
-        }
-    }
-    checkMemoryScopes(envelope, toolName, args, options) {
-        if (toolName === 'mama_load_checkpoint') {
-            throw new EnvelopeViolation('Checkpoint reads are not scoped yet; use scoped search for checkpoint queries.', 'scoped_checkpoint_unsupported');
-        }
-        if (!MEMORY_SCOPED_TOOLS.has(toolName)) {
-            return;
-        }
-        if (envelope.tier === 3 && WRITE_OR_SEND_TOOLS.has(toolName)) {
-            return;
-        }
-        const requestedScopes = requestedMemoryScopesForTool(toolName, args);
-        if (requestedScopes.length === 0) {
-            if (toolName === 'mama_save' && isRecord(args)) {
-                const hasContextPacketId = typeof args.context_packet_id === 'string' && args.context_packet_id.trim().length > 0;
-                const packetBackedScopeDelegatesToTrustedValidation = hasContextPacketId &&
-                    (args.scopes === undefined || (Array.isArray(args.scopes) && args.scopes.length === 0));
-                if (packetBackedScopeDelegatesToTrustedValidation) {
-                    return;
-                }
-            }
-            if (toolName === 'context_compile' &&
-                isRecord(args) &&
-                (args.scopes === undefined || Array.isArray(args.scopes))) {
-                // Scope-less compile delegates to the compile service's own read
-                // allowance (envelope + grant mirror) - the service is the single
-                // owner of compile scope semantics and throws its own 403.
-                return;
-            }
-            throw new EnvelopeViolation('Memory tools must execute with an explicit envelope memory scope', 'memory_scope_out_of_scope');
-        }
-        const allowedScopeKeys = new Set(envelope.scope.memory_scopes.map((scope) => `${scope.kind}:${scope.id}`));
-        if (options?.readScopeMirror && exports.MIRROR_READABLE_TOOLS.has(toolName)) {
-            for (const scope of options.readScopeMirror) {
-                allowedScopeKeys.add(`${scope.kind}:${scope.id}`);
-            }
-        }
-        const outOfScope = requestedScopes.filter((scope) => !allowedScopeKeys.has(`${scope.kind}:${scope.id}`));
-        if (outOfScope.length > 0) {
-            // NAME the denied scopes (bounded): 84 denials in one live window were
-            // undiagnosable because this message carried no ids - the whole S2
-            // lesson applied to its own enforcement surface. Agent-visible and
-            // local-log only; the ids are channel keys the agent already holds.
-            const denied = outOfScope
-                .slice(0, 3)
-                .map((scope) => `${scope.kind}:${scope.id}`)
-                .join(', ');
-            const suffix = outOfScope.length > 3 ? ` +${outOfScope.length - 3} more` : '';
-            // TEACH while denying: live capture showed the dominant denial class is
-            // the model GUESSING scope ids (connector prefix dropped, global:global,
-            // user:<email>) - naming what IS allowed turns each denial into a
-            // mid-run correction. Bounded; omitting scopes entirely uses the full
-            // allowance, which is almost always what the caller wants.
-            const allowed = [...allowedScopeKeys].slice(0, 5).join(', ');
-            const allowedSuffix = allowedScopeKeys.size > 5 ? ` +${allowedScopeKeys.size - 5} more` : '';
-            throw new EnvelopeViolation(`Requested memory scope is outside envelope.scope.memory_scopes: ${denied}${suffix}. ` +
-                `Allowed: ${allowed}${allowedSuffix}. Omit scopes to use the full allowance.`, 'memory_scope_out_of_scope');
-        }
-    }
-    checkTier(envelope, toolName) {
-        if (envelope.tier === 3 && WRITE_OR_SEND_TOOLS.has(toolName)) {
-            throw new EnvelopeViolation(`Tool ${toolName} not allowed at tier 3 (read-only)`, 'tier_violation');
-        }
-    }
-}
-exports.EnvelopeEnforcer = EnvelopeEnforcer;
-function requestedRawConnectorsForTool(toolName, args) {
-    if (toolName.startsWith('drive_')) {
-        return ['drive'];
-    }
-    if (toolName === 'context_compile') {
-        return uniqueStrings([
-            ...(getStringArrayArg(args, 'connectors') ?? []),
-            ...rawSeedRefConnectors(args),
-        ]);
-    }
-    if (toolName === 'kagemusha_messages') {
-        const channelId = getStringArg(args, 'channelId');
-        if (!channelId) {
-            throw new EnvelopeViolation('kagemusha_messages requires channelId', 'missing_raw_target');
-        }
-        return ['kagemusha'];
-    }
-    // Direct connector readers answer from a live connector API, so nothing in
-    // their arguments names the connector. Without this, envelope.scope.raw_connectors
-    // never applied to them (tool-connector-scope.ts). Keep the messages target
-    // validation above this generic mapping.
-    const directConnector = (0, tool_connector_scope_js_1.directConnectorReadForTool)(toolName);
-    if (directConnector !== null) {
-        return [directConnector];
-    }
-    if (!toolName.startsWith('raw.')) {
-        return [];
-    }
-    const connectors = getStringArrayArg(args, 'connectors');
-    if (connectors) {
-        return connectors;
-    }
-    const connector = getStringArg(args, 'connector');
-    return connector ? [connector] : [];
-}
-function requestedMemoryScopesForTool(toolName, args) {
-    if (!['mama_save', 'mama_search', 'mama_recall', 'mama_provenance', 'context_compile'].includes(toolName)) {
-        return [];
-    }
-    if (!isRecord(args) || args.scopes === undefined) {
-        return [];
-    }
-    if (!Array.isArray(args.scopes)) {
-        throw new EnvelopeViolation('Tool scopes must be an array', 'invalid_memory_scope');
-    }
-    const scopes = [];
-    for (const item of args.scopes) {
-        if (!isMemoryScope(item)) {
-            throw new EnvelopeViolation('Tool scopes must contain memory scope objects', 'invalid_memory_scope');
-        }
-        scopes.push({ kind: item.kind, id: item.id });
-    }
-    return scopes;
-}
-function rawSeedRefConnectors(args) {
-    if (!isRecord(args) || !Array.isArray(args.seed_refs)) {
-        return [];
-    }
-    const connectors = [];
-    for (const ref of args.seed_refs) {
-        if (!isRecord(ref) || ref.kind !== 'raw') {
-            continue;
-        }
-        if (typeof ref.connector === 'string') {
-            connectors.push(ref.connector);
-        }
-    }
-    return connectors;
-}
-function uniqueStrings(values) {
-    return [...new Set(values.map((value) => value.trim()).filter(Boolean))];
-}
-function getStringArg(args, key) {
-    if (!isRecord(args)) {
-        return undefined;
-    }
-    const value = args[key];
-    return typeof value === 'string' ? value : undefined;
-}
-function getStringArrayArg(args, key) {
-    if (!isRecord(args)) {
-        return undefined;
-    }
-    const value = args[key];
-    return Array.isArray(value) && value.every((item) => typeof item === 'string')
-        ? value
-        : undefined;
-}
-function isRecord(value) {
-    return value !== null && typeof value === 'object';
-}
-function isMemoryScope(value) {
-    if (!isRecord(value)) {
-        return false;
-    }
-    return (['global', 'user', 'channel', 'project'].includes(String(value.kind)) &&
-        typeof value.id === 'string' &&
-        value.id.length > 0);
-}
-//# sourceMappingURL=enforcer.js.map