@kashscript/hudhud 0.1.0

package/LICENSE

@@ -0,0 +1,133 @@
+KashScript Sovereign Software License Agreement (SSLA) v1.0
+Schedule B — Commercial Package
+
+Copyright (c) 2026 KashScript Studio. All rights reserved.
+
+This package is a Commercial Package under the SSLA. Production Use
+requires an active paid Plan (`paid`, `team`, or `enterprise`) on the
+Kash-Registry and a Seat covering your deployment.
+
+  • Evaluation / local development:  permitted on the `free` Plan
+  • Production Use:                  requires a paid Plan + Seat
+  • Redistribution / re-hosting:     prohibited (see §3)
+  • Removing license-verification:   prohibited (see §3)
+
+──────────────────────────────────────────────────────────────────────
+QUICK SUMMARY (non-binding — the full SSLA controls)
+
+  WHAT YOU MAY DO
+
+    • Install, run, and modify this package on hardware you control.
+    • Use it in production once you hold a covering paid Plan +
+      Seat issued by the Kash-Registry.
+    • Build derivative works for your own internal use, provided the
+      license-verification code paths remain intact.
+    • Distribute compiled artifacts produced by this package (e.g.
+      a deployed Solidity contract is yours; the SDK code stays ours).
+
+  WHAT YOU MAY NOT DO
+
+    • Use this package in production without a covering Plan.
+    • Redistribute the package itself (no mirroring the .tgz, no
+      forking onto your own registry, no bundling into a competing
+      product under the @kashscript/ namespace).
+    • Operate a marketplace, registry, or SaaS that competes with the
+      Kash-Registry using this code.
+    • Remove or alter the license-verification code paths in any
+      production deployment.
+
+  WHAT YOU GET FROM US
+
+    • The package source, published openly for inspection.
+    • Bug fixes and security patches via the package's normal release
+      channel for the term of your Plan.
+    • The right to a 30-day cure window if your Plan lapses.
+
+  WHAT YOU DO NOT GET
+
+    • Any warranty, fitness-for-purpose, or non-infringement
+      guarantee (see §8 of the full SSLA).
+    • Indemnification (subject to the cap in §8).
+    • Continued production use after your Plan lapses for >14 days
+      and is not cured within 30 days.
+
+──────────────────────────────────────────────────────────────────────
+FULL SSLA
+
+The above is a summary. The legally binding terms are in the SSLA v1.0,
+which governs your use of this package in its entirety. The full text is
+published at:
+
+    https://kashscript.dev/legal/SSLA
+
+and in the source repository at:
+
+    https://github.com/kashscript/kashscript/blob/main/docs/legal/SSLA.md
+
+A snapshot of §0–§10 of the SSLA is reproduced below for offline review.
+
+──────────────────────────────────────────────────────────────────────
+SSLA v1.0 — KEY CLAUSES (snapshot, reproduced verbatim)
+
+§3. Commercial licence — Schedule B packages
+
+  For every package in Schedule B, we grant you a time-limited,
+  non-sublicensable, non-transferable licence to use the package,
+  conditional on:
+
+    1. You hold an active Plan (`paid`, `team`, or `enterprise`) with
+       a Seat count covering your deployment.
+    2. You have completed at least one successful /verify-license
+       challenge-response within the last 24 hours OR you hold a valid
+       Access Token issued by the Kash-Registry license server.
+    3. You use the package in a manner consistent with the Permitted
+       Use clause for that package in Schedule B.
+
+  The Commercial grant covers Production Use for the term of your Plan
+  and trial use during a 14-day evaluation window after first install
+  (the `trial` tier). It does NOT cover:
+
+    • Redistribution of the package to third parties (you may not host
+      the package's .tgz on your own registry mirror).
+    • Use of the package to compete with the Kash-Registry (operating
+      a marketplace under the @kashscript/ namespace, or selling a
+      fork as a substitute).
+    • Removal or alteration of the license-verification code paths.
+
+  Your Commercial licence terminates automatically if (i) your Plan
+  lapses for more than 14 days, (ii) you breach §3.1 or §3.2 in writing
+  or in conduct, or (iii) your DID is revoked by the Kash-Registry for
+  fraud, chargeback, or violation of the Acceptable Use Policy.
+
+  After termination, you have 30 days to either renew the Plan or stop
+  running the Commercial Package in Production.
+
+§8. Warranty disclaimer + limitation of liability
+
+  THE PACKAGES ARE PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND. WE
+  DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
+
+  OUR AGGREGATE LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATED TO
+  THIS AGREEMENT WILL NOT EXCEED THE GREATER OF (i) THE AMOUNT YOU PAID
+  US IN THE 12 MONTHS PRECEDING THE CLAIM, OR (ii) USD 100.
+
+  NEITHER PARTY IS LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, OR
+  CONSEQUENTIAL DAMAGES.
+
+§9. Governing law + venue
+
+  This Agreement is governed by the laws of the Islamic Republic of
+  Pakistan, without regard to conflict-of-laws rules. Disputes are
+  resolved exclusively in the courts of Islamabad — except that we may
+  seek injunctive relief in any court of competent jurisdiction to
+  protect our intellectual property or the integrity of the
+  Kash-Registry.
+
+──────────────────────────────────────────────────────────────────────
+CONTACT
+
+  Licensing questions:    studio@kashscript.dev
+  Security disclosures:   security@kashscript.dev
+                          (see SECURITY.md for GPG fingerprint)
+  Plan management:        https://kashscript.dev/account

package/README.md

@@ -0,0 +1,67 @@
+# @kashscript/hudhud — the Agent Protocol (accountable runtime)
+
+**Where agents act, ventures consume Hudhud and never reach for raw `neuron`.** Commercial (SSLA
+Schedule B). Built in phase **M5** — the final protocol — of the Manifestation
+([ADR-0016](../../docs/adr/0016-protocol-manifestation.md)).
+
+The generic accountable agent runtime, lifted from the `oreoasis-core-host` engine: SOP compilation, MCP
+governance (allowlist + fail-closed circuit breaker + PII redaction), scope-gating, a signed action
+**ledger** + forensic scan and chain **anchor** on [`@kashscript/attest`](../attest), **exception
+classification**, AIUC-1 **work certificates** (DSSE), a DID registry, an **identity gate**
+([`@kashscript/identity-server`](../identity-server) agent tokens, MCP OAuth 2.1), and a
+[`@kashscript/neuron`](../neuron)-backed execution runtime. Everything an agent does is Ed25519-signed
+into an append-only, hash-chained ledger; restricted actions suspend for a two-key human sign-off. SOP
+**content**, fixtures, storage schemas, and text UIs stay venture-side. Full contract:
+[`specs/hudhud.md`](../../specs/hudhud.md).
+
+## The signed run loop
+
+```ts
+import { WorkItemRunner } from "@kashscript/hudhud/runtime";
+import { ForensicLedgerService, InMemoryLedgerStore, SessionMutex, createEd25519HostSigner } from "@kashscript/hudhud/ledger";
+import { McpClientPoolManager } from "@kashscript/hudhud/mcp";
+
+const forensicLedger = new ForensicLedgerService({
+  ledger: new InMemoryLedgerStore(),
+  sessionMutex: new SessionMutex(),
+  didRegistry,                       // resolves the agent DID → Ed25519 key
+  hostSigner: createEd25519HostSigner({ actorDid, actorClass: "AGENT", privateKey }),
+});
+
+const runner = new WorkItemRunner({ mcpClientPool: new McpClientPoolManager(), forensicLedger });
+const result = await runner.run({ sessionId, dag, bindings });   // DELIVERED | ESCALATED | FAILED
+// one Ed25519-signed ledger row per tool dispatch; a restricted tool with no
+// approval envelope SUSPENDS the run to ESCALATED.
+```
+
+## Modules (subpath exports)
+
+- **`./sop`** — `compileSopStructural` (numbered/bulleted → content-addressable `TaskDag`) + `SopCompilerService` (goto back-edges + DFS cycle detection). Pure.
+- **`./mcp`** — `validateToolArgs` / `decomposeToolName` / `McpAllowlistStore`; `McpClientPoolManager` — JSON-RPC 2.0 client + **fail-closed circuit breaker** (a transport failure trips it; a JSON-RPC application error does not), injectable `fetchImpl`.
+- **`./privacy`** — `scanAndRedact` + 15 builtin PII/secret patterns; recall-biased, category tags never raw values.
+- **`./scope`** — `assertScopeAllowsTool` — a `RESTRICTED` session cannot dispatch administrative tools.
+- **`./ledger`** — `ForensicLedgerService` (self-signing + caller-signed append under a per-session mutex; gap-free hash chain; `forensicConsistencyScan` throws on tamper), `LedgerEventSchema` (closed vocab). Signing / chain-hash / scan are **attest's** (M1 seed), re-exported.
+- **`./anchor`** — `computeAnchorMerkleRoot` + `ChainAnchor` / `AnchorReceiptStore` — out-of-band chain-tip publication so a full-ledger rewrite is still detectable.
+- **`./exception`** — signed exception-classification dataset; `failureClass` is **mandatory** (no default), each record Ed25519-signed over its exact bytes; class-mix + per-workflow stats.
+- **`./certificate`** — `buildWorkCertificate` (DSSE) + `verifyWorkCertificate` (signature **and** count re-derivation from the enumerated outcomes) + AIUC-1 (A–F) coverage + HTML renderer (brand hook).
+- **`./identity`** — `verifyAccountableIdentity(token, {expectedAudience})` → `{ok, actor:{owner,agent}, scope}` over identity-server agent tokens.
+- **`./runtime`** — `NeuronToolDispatcher` (neuron `ToolDispatcher` SPI; inline signed ledger append per dispatch), `WorkItemRunner`, two-key escalation (`buildHumanApprovalEnvelope` / `appendOperatorSignoff` / `ResumeGuard`).
+- **`./did-registry`** — `DidRegistry` + `InMemoryDidRegistry` (attest's M1 seed).
+- **`./adapters/prisma`** — structural-delegate `PrismaLedgerStore` / `PrismaAnchorReceiptStore` / `PrismaExceptionClassificationStore` / `PrismaDidRegistry`. **No `@prisma/client` dependency** — pass a client model that satisfies the narrow `{ create, findFirst, findMany, count }` delegate; the schema is venture-side.
+
+## Two-key escalation
+
+An autonomous run that reaches a restricted tool **suspends**; a human must sign off before it resumes.
+The guarantee is literal: the approval envelope's two signatures use **distinct keys** (the host holds the
+agent key but cannot mint the separate operator key), the sign-off is a signed `OPERATOR_ADMIN` ledger row
+plus a mandatory exception classification, and a resume key can be claimed at most once (`ResumeGuard`).
+
+## Status
+
+`0.x` — the API stays `0.x` until `oreoasis-core-host` becomes a thin host on the published package with
+its full test suite green (consumer-as-acceptance, ADR-0016; the atomic swap is a **separate** venture
+session per the hudhud-last guard). The runtime license assertion + registry tier mapping land in M6.
+Depends on [`@kashscript/identity-core`](../identity-core), [`@kashscript/attest`](../attest),
+[`@kashscript/identity-server`](../identity-server), and [`@kashscript/neuron`](../neuron).
+
+Commercial — SSLA Schedule B; see `LICENSE`.

package/dist/adapters/prisma.d.ts

@@ -0,0 +1,170 @@
+import type { LedgerBlockInput, LedgerBlockRecord, LedgerStore } from "../ledger/store";
+import type { AnchorRecord, AnchorReceiptRecord, AnchorReceiptStore } from "../anchor";
+import type { ExceptionClassificationRecord, ExceptionClassificationStore } from "../exception";
+import type { DidPublicKey, DidRegistry } from "../did-registry";
+/** A JSON scalar as Prisma surfaces it (`Json` column). */
+type Json = unknown;
+/** Prisma's model methods return `PrismaPromise<T>` (a `Promise<T>`); the
+ *  narrow delegates below type only the arg subset hudhud passes + a `Promise`
+ *  return, so a generated delegate is assignable. */
+export interface LedgerBlockRow {
+    readonly sessionId: string;
+    readonly stepIndex: number;
+    readonly previousBlockHash: string;
+    readonly currentTransactionBlockHash: string;
+    readonly actorDid: string;
+    readonly payloadMutation: Json;
+    readonly signature: string;
+    readonly emittedAt: string;
+    readonly localId: number;
+}
+/** The subset of `PrismaClient.ledgerBlock` hudhud calls. `localId`/`emittedAt`
+ *  are DB-assigned (autoincrement + default now()), so `create` omits them and
+ *  the created row carries them back. */
+export interface PrismaLedgerDelegate {
+    create(args: {
+        data: Omit<LedgerBlockRow, "localId" | "emittedAt"> & {
+            emittedAt?: string;
+        };
+    }): Promise<LedgerBlockRow>;
+    findFirst(args: {
+        where: {
+            sessionId: string;
+        };
+        orderBy: {
+            stepIndex: "asc" | "desc";
+        };
+    }): Promise<LedgerBlockRow | null>;
+    findMany(args: {
+        where: {
+            sessionId: string;
+        };
+        orderBy: {
+            stepIndex: "asc" | "desc";
+        };
+    }): Promise<ReadonlyArray<LedgerBlockRow>>;
+    count(args: {
+        where: {
+            sessionId: string;
+        };
+    }): Promise<number>;
+}
+/** {@link LedgerStore} over a Prisma `ledgerBlock` delegate. Append-only; the
+ *  DB's `(sessionId, stepIndex)` UNIQUE constraint is what enforces the gap-free
+ *  chain under concurrency (the in-memory store checks it in JS). */
+export declare class PrismaLedgerStore implements LedgerStore {
+    private readonly delegate;
+    constructor(delegate: PrismaLedgerDelegate);
+    appendBlock(input: LedgerBlockInput): Promise<LedgerBlockRecord>;
+    latestBlockForSession(sessionId: string): Promise<LedgerBlockRecord | null>;
+    countBlocksForSession(sessionId: string): Promise<number>;
+    listBlocksForSession(sessionId: string): Promise<ReadonlyArray<LedgerBlockRecord>>;
+}
+export interface AnchorReceiptRow {
+    readonly id: string;
+    readonly publishedAt: string;
+    readonly merkleRoot: string;
+    readonly tipCount: number;
+    readonly tips: Json;
+    readonly witness: Json;
+    readonly createdAt: string;
+}
+export interface PrismaAnchorReceiptDelegate {
+    create(args: {
+        data: Omit<AnchorReceiptRow, "id" | "createdAt"> & {
+            id?: string;
+            createdAt?: string;
+        };
+    }): Promise<AnchorReceiptRow>;
+    findFirst(args: {
+        where?: {
+            merkleRoot?: string;
+        };
+        orderBy: {
+            createdAt: "asc" | "desc";
+        };
+    }): Promise<AnchorReceiptRow | null>;
+    findMany(args: {
+        orderBy: {
+            createdAt: "asc" | "desc";
+        };
+    }): Promise<ReadonlyArray<AnchorReceiptRow>>;
+}
+/** {@link AnchorReceiptStore} over a Prisma `anchorReceipt` delegate. */
+export declare class PrismaAnchorReceiptStore implements AnchorReceiptStore {
+    private readonly delegate;
+    constructor(delegate: PrismaAnchorReceiptDelegate);
+    append(record: AnchorRecord): Promise<AnchorReceiptRecord>;
+    latest(): Promise<AnchorReceiptRecord | null>;
+    history(): Promise<ReadonlyArray<AnchorReceiptRecord>>;
+    latestForRoot(merkleRoot: string): Promise<AnchorReceiptRecord | null>;
+}
+export interface ExceptionClassificationRow {
+    readonly id: string;
+    readonly schemaVersion: string;
+    readonly timestampIso: string;
+    readonly workflowId: string;
+    readonly sopVersion: string;
+    readonly inputRef: string;
+    readonly contentHash: string;
+    readonly model: string;
+    readonly modelVersion: string;
+    readonly failureClass: string;
+    readonly failureTag: string;
+    readonly operatorDid: string;
+    readonly resolutionSummary: string;
+    readonly resolutionActionRefs: Json;
+    readonly escalationId: string | null;
+    readonly signoffLedgerStepIndex: number | null;
+    readonly signedEnvelope: Json;
+}
+export interface PrismaExceptionClassificationDelegate {
+    create(args: {
+        data: ExceptionClassificationRow;
+    }): Promise<unknown>;
+    findMany(args: {
+        where?: {
+            workflowId?: string;
+        };
+        orderBy: {
+            timestampIso: "asc" | "desc";
+        };
+    }): Promise<ReadonlyArray<ExceptionClassificationRow>>;
+    findFirst(args: {
+        orderBy: {
+            timestampIso: "asc" | "desc";
+        };
+    }): Promise<ExceptionClassificationRow | null>;
+}
+/** {@link ExceptionClassificationStore} over a Prisma delegate. Signatures live
+ *  in the row (`signedEnvelope` JSON), so verification survives the round-trip. */
+export declare class PrismaExceptionClassificationStore implements ExceptionClassificationStore {
+    private readonly delegate;
+    constructor(delegate: PrismaExceptionClassificationDelegate);
+    append(record: ExceptionClassificationRecord): Promise<void>;
+    history(): Promise<ReadonlyArray<ExceptionClassificationRecord>>;
+    latest(): Promise<ExceptionClassificationRecord | null>;
+    byWorkflow(workflowId: string): Promise<ReadonlyArray<ExceptionClassificationRecord>>;
+}
+export interface DidKeyRow {
+    readonly did: string;
+    /** 32-byte Ed25519 public key. Prisma `Bytes` surfaces as a `Uint8Array`. */
+    readonly publicKeyBytes: Uint8Array;
+    readonly algorithm: string;
+}
+export interface PrismaDidKeyDelegate {
+    findUnique(args: {
+        where: {
+            did: string;
+        };
+    }): Promise<DidKeyRow | null>;
+}
+/** {@link DidRegistry} over a Prisma `didKey` delegate — resolve-only (the ledger
+ *  needs only the read side; registration/PDS resolution is venture-side). */
+export declare class PrismaDidRegistry implements DidRegistry {
+    private readonly delegate;
+    constructor(delegate: PrismaDidKeyDelegate);
+    resolve(did: string): Promise<DidPublicKey | null>;
+}
+export {};
+//# sourceMappingURL=prisma.d.ts.map

package/dist/adapters/prisma.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.d.ts","sourceRoot":"","sources":["../../src/adapters/prisma.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAGnB,MAAM,WAAW,CAAC;AACnB,OAAO,KAAK,EACV,6BAA6B,EAC7B,4BAA4B,EAE7B,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEjE,2DAA2D;AAC3D,KAAK,IAAI,GAAG,OAAO,CAAC;AAEpB;;qDAEqD;AAIrD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;yCAEyC;AACzC,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,IAAI,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;YAAE,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC9E,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,SAAS,CAAC,IAAI,EAAE;QACd,KAAK,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7B,OAAO,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAC;KACxC,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7B,OAAO,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAC;KACxC,GAAG,OAAO,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE;AAgBD;;qEAEqE;AACrE,qBAAa,iBAAkB,YAAW,WAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,oBAAoB;IAErD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAehE,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAK3E,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIzD,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAIzF;AAID,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,IAAI,GAAG,WAAW,CAAC,GAAG;YAAE,EAAE,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpI,SAAS,CAAC,IAAI,EAAE;QACd,KAAK,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAChC,OAAO,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAC;KACxC,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE;YAAE,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC;CACtG;AAcD,yEAAyE;AACzE,qBAAa,wBAAyB,YAAW,kBAAkB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,2BAA2B;IAE5D,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAa1D,MAAM,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAK7C,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAKtD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAI7E;AAID,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,EAAE,IAAI,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,qCAAqC;IACpD,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,0BAA0B,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,CAAC,EAAE;YAAE,UAAU,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAChC,OAAO,EAAE;YAAE,YAAY,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAC;KAC3C,GAAG,OAAO,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE;YAAE,YAAY,EAAE,KAAK,GAAG,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAAC;CAC5G;AAwBD;mFACmF;AACnF,qBAAa,kCAAmC,YAAW,4BAA4B;IACzE,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,qCAAqC;IAEtE,MAAM,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB5D,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,6BAA6B,CAAC,CAAC;IAKhE,MAAM,IAAI,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC;IAKvD,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,6BAA6B,CAAC,CAAC;CAI5F;AAID,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;CACzE;AAED;8EAC8E;AAC9E,qBAAa,iBAAkB,YAAW,WAAW;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,oBAAoB;IAErD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAKzD"}

package/dist/adapters/prisma.js

@@ -0,0 +1,185 @@
+// ============================================================================
+// @kashscript/hudhud/adapters/prisma — durable store adapters (schema-free)
+// ----------------------------------------------------------------------------
+// hudhud ships the STORE INTERFACES (ledger, anchor-receipt, exception, DID);
+// the in-memory references live beside them. This subpath ships the DURABLE
+// adapters WITHOUT a `@prisma/client` dependency: each adapter is constructed
+// over a NARROW STRUCTURAL DELEGATE — the small `{ create, findFirst, findMany,
+// count }` surface hudhud actually calls, typed over the row shape hudhud
+// needs. A venture's generated `PrismaClient.<model>` (with matching columns +
+// a `Json` payload column) satisfies the delegate, so the venture wires:
+//
+//     new PrismaLedgerStore(prisma.ledgerBlock)
+//
+// The concrete Prisma SCHEMA (migrations, indexes, column types) is venture-side
+// and lands at the swap. Keeping hudhud schema-free is deliberate (guard b):
+// the protocol owns the CONTRACT; the venture owns the storage.
+// ============================================================================
+function rowToLedgerRecord(row) {
+    return {
+        sessionId: row.sessionId,
+        stepIndex: row.stepIndex,
+        previousBlockHash: row.previousBlockHash,
+        currentTransactionBlockHash: row.currentTransactionBlockHash,
+        actorDid: row.actorDid,
+        payloadMutation: (row.payloadMutation ?? {}),
+        signature: row.signature,
+        emittedAt: row.emittedAt,
+        localId: row.localId,
+    };
+}
+/** {@link LedgerStore} over a Prisma `ledgerBlock` delegate. Append-only; the
+ *  DB's `(sessionId, stepIndex)` UNIQUE constraint is what enforces the gap-free
+ *  chain under concurrency (the in-memory store checks it in JS). */
+export class PrismaLedgerStore {
+    delegate;
+    constructor(delegate) {
+        this.delegate = delegate;
+    }
+    async appendBlock(input) {
+        const row = await this.delegate.create({
+            data: {
+                sessionId: input.sessionId,
+                stepIndex: input.stepIndex,
+                previousBlockHash: input.previousBlockHash,
+                currentTransactionBlockHash: input.currentTransactionBlockHash,
+                actorDid: input.actorDid,
+                payloadMutation: input.payloadMutation,
+                signature: input.signature,
+            },
+        });
+        return rowToLedgerRecord(row);
+    }
+    async latestBlockForSession(sessionId) {
+        const row = await this.delegate.findFirst({ where: { sessionId }, orderBy: { stepIndex: "desc" } });
+        return row === null ? null : rowToLedgerRecord(row);
+    }
+    async countBlocksForSession(sessionId) {
+        return this.delegate.count({ where: { sessionId } });
+    }
+    async listBlocksForSession(sessionId) {
+        const rows = await this.delegate.findMany({ where: { sessionId }, orderBy: { stepIndex: "asc" } });
+        return rows.map(rowToLedgerRecord);
+    }
+}
+function rowToAnchorReceipt(row) {
+    return {
+        id: row.id,
+        publishedAt: row.publishedAt,
+        merkleRoot: row.merkleRoot,
+        tipCount: row.tipCount,
+        tips: (row.tips ?? []),
+        createdAt: row.createdAt,
+        ...(row.witness ? { witness: row.witness } : {}),
+    };
+}
+/** {@link AnchorReceiptStore} over a Prisma `anchorReceipt` delegate. */
+export class PrismaAnchorReceiptStore {
+    delegate;
+    constructor(delegate) {
+        this.delegate = delegate;
+    }
+    async append(record) {
+        const row = await this.delegate.create({
+            data: {
+                publishedAt: record.publishedAt,
+                merkleRoot: record.merkleRoot,
+                tipCount: record.tipCount,
+                tips: record.tips,
+                witness: (record.witness ?? null),
+            },
+        });
+        return rowToAnchorReceipt(row);
+    }
+    async latest() {
+        const row = await this.delegate.findFirst({ orderBy: { createdAt: "desc" } });
+        return row === null ? null : rowToAnchorReceipt(row);
+    }
+    async history() {
+        const rows = await this.delegate.findMany({ orderBy: { createdAt: "asc" } });
+        return rows.map(rowToAnchorReceipt);
+    }
+    async latestForRoot(merkleRoot) {
+        const row = await this.delegate.findFirst({ where: { merkleRoot }, orderBy: { createdAt: "desc" } });
+        return row === null ? null : rowToAnchorReceipt(row);
+    }
+}
+function rowToClassification(row) {
+    return {
+        id: row.id,
+        schemaVersion: row.schemaVersion,
+        timestampIso: row.timestampIso,
+        workflowId: row.workflowId,
+        sopVersion: row.sopVersion,
+        inputRef: row.inputRef,
+        contentHash: row.contentHash,
+        model: row.model,
+        modelVersion: row.modelVersion,
+        failureClass: row.failureClass,
+        failureTag: row.failureTag,
+        operatorDid: row.operatorDid,
+        resolutionSummary: row.resolutionSummary,
+        resolutionActionRefs: (row.resolutionActionRefs ?? []),
+        escalationId: row.escalationId,
+        signoffLedgerStepIndex: row.signoffLedgerStepIndex,
+        signedEnvelope: row.signedEnvelope,
+    };
+}
+/** {@link ExceptionClassificationStore} over a Prisma delegate. Signatures live
+ *  in the row (`signedEnvelope` JSON), so verification survives the round-trip. */
+export class PrismaExceptionClassificationStore {
+    delegate;
+    constructor(delegate) {
+        this.delegate = delegate;
+    }
+    async append(record) {
+        await this.delegate.create({
+            data: {
+                id: record.id,
+                schemaVersion: record.schemaVersion,
+                timestampIso: record.timestampIso,
+                workflowId: record.workflowId,
+                sopVersion: record.sopVersion,
+                inputRef: record.inputRef,
+                contentHash: record.contentHash,
+                model: record.model,
+                modelVersion: record.modelVersion,
+                failureClass: record.failureClass,
+                failureTag: record.failureTag,
+                operatorDid: record.operatorDid,
+                resolutionSummary: record.resolutionSummary,
+                resolutionActionRefs: record.resolutionActionRefs,
+                escalationId: record.escalationId,
+                signoffLedgerStepIndex: record.signoffLedgerStepIndex,
+                signedEnvelope: record.signedEnvelope,
+            },
+        });
+    }
+    async history() {
+        const rows = await this.delegate.findMany({ orderBy: { timestampIso: "asc" } });
+        return rows.map(rowToClassification);
+    }
+    async latest() {
+        const row = await this.delegate.findFirst({ orderBy: { timestampIso: "desc" } });
+        return row === null ? null : rowToClassification(row);
+    }
+    async byWorkflow(workflowId) {
+        const rows = await this.delegate.findMany({ where: { workflowId }, orderBy: { timestampIso: "asc" } });
+        return rows.map(rowToClassification);
+    }
+}
+/** {@link DidRegistry} over a Prisma `didKey` delegate — resolve-only (the ledger
+ *  needs only the read side; registration/PDS resolution is venture-side). */
+export class PrismaDidRegistry {
+    delegate;
+    constructor(delegate) {
+        this.delegate = delegate;
+    }
+    async resolve(did) {
+        const row = await this.delegate.findUnique({ where: { did } });
+        if (row === null)
+            return null;
+        return { did: row.did, publicKeyBytes: new Uint8Array(row.publicKeyBytes), algorithm: "ed25519" };
+    }
+}
+//# sourceMappingURL=prisma.js.map

package/dist/adapters/prisma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.js","sourceRoot":"","sources":["../../src/adapters/prisma.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,gFAAgF;AAChF,0EAA0E;AAC1E,+EAA+E;AAC/E,yEAAyE;AACzE,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,gEAAgE;AAChE,+EAA+E;AAwD/E,SAAS,iBAAiB,CAAC,GAAmB;IAC5C,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,2BAA2B,EAAE,GAAG,CAAC,2BAA2B;QAC5D,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,eAAe,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAsC;QACjF,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;qEAEqE;AACrE,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,QAA8B;QAA9B,aAAQ,GAAR,QAAQ,CAAsB;IAAG,CAAC;IAE/D,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,IAAI,EAAE;gBACJ,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;gBAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,eAAe,EAAE,KAAK,CAAC,eAAuB;gBAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,SAAiB;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpG,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,SAAiB;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,SAAiB;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;CACF;AAuBD,SAAS,kBAAkB,CAAC,GAAqB;IAC/C,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B;QACjD,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,QAAqC;QAArC,aAAQ,GAAR,QAAQ,CAA6B;IAAG,CAAC;IAEtE,KAAK,CAAC,MAAM,CAAC,MAAoB;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,IAAI,EAAE;gBACJ,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAY;gBACzB,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,IAAI,CAAS;aAC1C;SACF,CAAC,CAAC;QACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAkB;QACpC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrG,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;CACF;AAiCD,SAAS,mBAAmB,CAAC,GAA+B;IAC1D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,YAA4B;QAC9C,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,oBAAoB,EAAE,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAA0B;QAC/E,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;QAClD,cAAc,EAAE,GAAG,CAAC,cAAiE;KACtF,CAAC;AACJ,CAAC;AAED;mFACmF;AACnF,MAAM,OAAO,kCAAkC;IAChB;IAA7B,YAA6B,QAA+C;QAA/C,aAAQ,GAAR,QAAQ,CAAuC;IAAG,CAAC;IAEhF,KAAK,CAAC,MAAM,CAAC,MAAqC;QAChD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzB,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,CAAC,EAAE;gBACb,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,oBAAoB,EAAE,MAAM,CAAC,oBAA4B;gBACzD,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;gBACrD,cAAc,EAAE,MAAM,CAAC,cAAsB;aAC9C;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACjF,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACvG,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;CACF;AAeD;8EAC8E;AAC9E,MAAM,OAAO,iBAAiB;IACC;IAA7B,YAA6B,QAA8B;QAA9B,aAAQ,GAAR,QAAQ,CAAsB;IAAG,CAAC;IAE/D,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACpG,CAAC;CACF"}

package/dist/anchor/index.d.ts

@@ -0,0 +1,55 @@
+export interface ChainTip {
+    readonly sessionId: string;
+    readonly latestHash: string;
+    readonly latestStepIndex: number;
+}
+export type AnchorWitnessBackend = "rekor" | "opentimestamps" | "none";
+export interface AnchorWitness {
+    readonly backend: AnchorWitnessBackend;
+    readonly receipt: Readonly<Record<string, unknown>>;
+    readonly witnessedAt: string | null;
+}
+export interface AnchorRecord {
+    readonly publishedAt: string;
+    /** Merkle root over (sessionId, latestHash, stepIndex) triples, sorted by sessionId. */
+    readonly merkleRoot: string;
+    readonly tipCount: number;
+    readonly tips: ReadonlyArray<ChainTip>;
+    readonly witness?: AnchorWitness;
+}
+export interface ChainAnchor {
+    publish(tips: ReadonlyArray<ChainTip>): Promise<AnchorRecord>;
+    history(): Promise<ReadonlyArray<AnchorRecord>>;
+    latest(): Promise<AnchorRecord | null>;
+}
+/** Deterministic SHA-256-over-sorted-tip-triples root. Simpler than a binary
+ *  Merkle tree — the anchor's job is just to be unrewritable; the cross-check
+ *  against the per-session chain hash is what proves tamper. */
+export declare function computeAnchorMerkleRoot(tips: ReadonlyArray<ChainTip>): Promise<string>;
+/** In-memory anchor — records publications for inspection. A legitimate
+ *  dev/test backend (the anchor is then witnessed for the process lifetime). */
+export declare class NullChainAnchor implements ChainAnchor {
+    private readonly records;
+    publish(tips: ReadonlyArray<ChainTip>): Promise<AnchorRecord>;
+    history(): Promise<ReadonlyArray<AnchorRecord>>;
+    latest(): Promise<AnchorRecord | null>;
+}
+export interface AnchorReceiptRecord extends AnchorRecord {
+    readonly id: string;
+    readonly createdAt: string;
+}
+export interface AnchorReceiptStore {
+    append(record: AnchorRecord): Promise<AnchorReceiptRecord>;
+    latest(): Promise<AnchorReceiptRecord | null>;
+    history(): Promise<ReadonlyArray<AnchorReceiptRecord>>;
+    latestForRoot(merkleRoot: string): Promise<AnchorReceiptRecord | null>;
+}
+/** In-memory receipt store — the no-DB / test profile. */
+export declare class InMemoryAnchorReceiptStore implements AnchorReceiptStore {
+    private readonly rows;
+    append(record: AnchorRecord): Promise<AnchorReceiptRecord>;
+    latest(): Promise<AnchorReceiptRecord | null>;
+    history(): Promise<ReadonlyArray<AnchorReceiptRecord>>;
+    latestForRoot(merkleRoot: string): Promise<AnchorReceiptRecord | null>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/anchor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/anchor/index.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAEvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wFAAwF;IACxF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACxC;AAED;;gEAEgE;AAChE,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB5F;AAWD;gFACgF;AAChF,qBAAa,eAAgB,YAAW,WAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsB;IAExC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;IAM7D,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAI/C,MAAM,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAG7C;AAID,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACvD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3D,MAAM,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACvD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;CACxE;AAaD,0DAA0D;AAC1D,qBAAa,0BAA2B,YAAW,kBAAkB;IACnE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAE5C,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAW1D,MAAM,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAI7C,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAItD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAM7E"}