@mcp-index/sdk 0.1.0

package/dist/src/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * mcpindex — the TypeScript/JS SDK port of the pre-flight drift interceptor.
+ *
+ * One line wraps an already-authenticated MCP client session and HOLDs a tool
+ * call before your agent runs it if the tool's contract drifted from your pin.
+ * The wrapper never holds a credential and never opens a connection — it reuses
+ * the wrapped session's own authenticated transport.
+ */
+export { wrap, repin, PreflightHold } from "./wrap.js";
+export type { Wrapped, WrapOptions } from "./wrap.js";
+export { PreflightPin, Decision, isProceed, renderVerdict, safetyRelevantDrift, hashTool, } from "./preflight.js";
+export type { PinnedTool, PreflightVerdict, ToolDef } from "./preflight.js";
+export { Gate, Posture, Ownership, BehavioralMethod, BehavioralOutcome, chooseBehavioralMethod, renderHoldBanner, isInternalErrorVerdict, } from "./gate.js";
+export type { BehavioralVerifier, BehavioralResult, GateOptions } from "./gate.js";
+export { ChangeKind, classifyChange, isSafetyRelevant, MAX_DEPTH } from "./schemaDiff.js";
+export type { Change } from "./schemaDiff.js";
+export { canonicalBytes, toolHash } from "./canonical.js";
+export { assess, BlastRadius, DomainClass, blastRank } from "./risk.js";
+export type { RiskAssessment } from "./risk.js";
+export { scanSchemaHasMarker } from "./scan.js";
+export { mdText } from "./render.js";
+export { VerdictScope, HonestFraming, GuardrailError, requireProvenance, surfaceProvenance, fromVerdict, isComplete, renderProvenance, assertNoGreenWords, } from "./provenance.js";
+export type { Provenance, Subject, WhatFired, EvidenceField } from "./provenance.js";
+export { ErrorStore, Operation, CLIENT_VERSION, ERROR_RECORD_KEYS } from "./errors.js";
+export { OutcomeStore, LocalStats, Action, OverrideReason, AGGREGATE_ROW_KEYS, verdictHash, } from "./outcomes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACvD,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAE5E,OAAO,EACL,IAAI,EACJ,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEnF,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC1F,YAAY,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACxE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEvF,OAAO,EACL,YAAY,EACZ,UAAU,EACV,MAAM,EACN,cAAc,EACd,kBAAkB,EAClB,WAAW,GACZ,MAAM,eAAe,CAAC"}

package/dist/src/index.js

@@ -0,0 +1,20 @@
+/**
+ * mcpindex — the TypeScript/JS SDK port of the pre-flight drift interceptor.
+ *
+ * One line wraps an already-authenticated MCP client session and HOLDs a tool
+ * call before your agent runs it if the tool's contract drifted from your pin.
+ * The wrapper never holds a credential and never opens a connection — it reuses
+ * the wrapped session's own authenticated transport.
+ */
+export { wrap, repin, PreflightHold } from "./wrap.js";
+export { PreflightPin, Decision, isProceed, renderVerdict, safetyRelevantDrift, hashTool, } from "./preflight.js";
+export { Gate, Posture, Ownership, BehavioralMethod, BehavioralOutcome, chooseBehavioralMethod, renderHoldBanner, isInternalErrorVerdict, } from "./gate.js";
+export { ChangeKind, classifyChange, isSafetyRelevant, MAX_DEPTH } from "./schemaDiff.js";
+export { canonicalBytes, toolHash } from "./canonical.js";
+export { assess, BlastRadius, DomainClass, blastRank } from "./risk.js";
+export { scanSchemaHasMarker } from "./scan.js";
+export { mdText } from "./render.js";
+export { VerdictScope, HonestFraming, GuardrailError, requireProvenance, surfaceProvenance, fromVerdict, isComplete, renderProvenance, assertNoGreenWords, } from "./provenance.js";
+export { ErrorStore, Operation, CLIENT_VERSION, ERROR_RECORD_KEYS } from "./errors.js";
+export { OutcomeStore, LocalStats, Action, OverrideReason, AGGREGATE_ROW_KEYS, verdictHash, } from "./outcomes.js";
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGvD,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,QAAQ,GACT,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,IAAI,EACJ,OAAO,EACP,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAG1F,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEvF,OAAO,EACL,YAAY,EACZ,UAAU,EACV,MAAM,EACN,cAAc,EACd,kBAAkB,EAClB,WAAW,GACZ,MAAM,eAAe,CAAC"}

package/dist/src/lexicon.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Pure side-effect / read-only NAME lexicon — a port of Python
+ * `tooling/lexicon.py`. Stdlib-only, no I/O. Reused by `risk.ts`.
+ */
+/** snake_case + camelCase -> lowercase tokens (port of `_name_tokens`). */
+export declare function nameTokens(name: string): Set<string>;
+/** Third-person-singular -s/-es stems of a token (port of `_side_effect_stems`). */
+export declare function sideEffectStems(word: string): Set<string>;
+/** True iff name/description carries a side-effecting/financial intent token
+ * (base form or -s/-es inflection). Port of `_has_side_effect_intent`. */
+export declare function hasSideEffectIntent(name: string, description: string): boolean;
+/** True iff the tool NAME carries a clearly-mutating verb. Port of
+ * `_name_is_writeish` (name-only by design). */
+export declare function nameIsWriteish(name: string): boolean;
+//# sourceMappingURL=lexicon.d.ts.map

package/dist/src/lexicon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexicon.d.ts","sourceRoot":"","sources":["../../src/lexicon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8BH,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASpD;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAUzD;AAOD;0EAC0E;AAC1E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAO9E;AAED;gDACgD;AAChD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/src/lexicon.js

@@ -0,0 +1,70 @@
+/**
+ * Pure side-effect / read-only NAME lexicon — a port of Python
+ * `tooling/lexicon.py`. Stdlib-only, no I/O. Reused by `risk.ts`.
+ */
+const MUTATING_VERBS = new Set(("write delete remove create update exec execute run post put patch " +
+    "send drop destroy modify upload insert merge purge kill " +
+    "authorize pay charge transfer refund withdraw deposit debit credit " +
+    "settle fund purchase checkout subscribe cancel issue grant revoke " +
+    "provision deploy set").split(" "));
+const WORD_TOKEN_RE = /[a-z0-9]+/g;
+const SIDE_EFFECT_INTENT = new Set([
+    "authorize", "payment", "pay", "charge", "transfer", "refund", "withdraw",
+    "deposit", "mandate", "wallet", "checkout", "purchase", "order", "billing",
+    "invoice", "subscribe", "fund", "settle", "debit", "credit", "transaction",
+    "send", "create", "delete", "update", "write", "modify", "execute", "set",
+    "remove", "cancel", "issue", "grant", "revoke", "provision", "deploy",
+    "book", "reserve", "lock", "commit", "publish", "consume", "redeem",
+    "dispatch", "release", "claim", "approve", "reject", "confirm", "submit",
+    "schedule", "assign", "trigger", "archive", "terminate", "disable",
+    "enable", "reset", "mark", "acknowledge", "ack", "sign", "escrow",
+    "disburse", "wire", "place", "mint", "burn", "swap", "stake", "void",
+    "purge", "truncate", "overwrite", "wipe", "prune",
+]);
+/** snake_case + camelCase -> lowercase tokens (port of `_name_tokens`). */
+export function nameTokens(name) {
+    const out = new Set();
+    for (const part of name.split(/[^A-Za-z0-9]+/)) {
+        const matches = part.match(/[A-Z]+(?=[A-Z][a-z])|[A-Z]?[a-z]+|[A-Z]+|[0-9]+/g);
+        if (matches) {
+            for (const m of matches)
+                out.add(m.toLowerCase());
+        }
+    }
+    return out;
+}
+/** Third-person-singular -s/-es stems of a token (port of `_side_effect_stems`). */
+export function sideEffectStems(word) {
+    const cands = new Set([word]);
+    for (const suf of ["es", "s"]) {
+        if (word.endsWith(suf) && word.length - suf.length >= 3) {
+            const root = word.slice(0, word.length - suf.length);
+            cands.add(root);
+            cands.add(root + "e");
+        }
+    }
+    return cands;
+}
+function intersects(a, b) {
+    for (const x of a)
+        if (b.has(x))
+            return true;
+    return false;
+}
+/** True iff name/description carries a side-effecting/financial intent token
+ * (base form or -s/-es inflection). Port of `_has_side_effect_intent`. */
+export function hasSideEffectIntent(name, description) {
+    const text = `${name} ${description}`.toLowerCase();
+    const words = new Set(text.match(WORD_TOKEN_RE) ?? []);
+    for (const word of words) {
+        if (intersects(sideEffectStems(word), SIDE_EFFECT_INTENT))
+            return true;
+    }
+    return false;
+}
+/** True iff the tool NAME carries a clearly-mutating verb. Port of
+ * `_name_is_writeish` (name-only by design). */
+export function nameIsWriteish(name) {
+    return intersects(nameTokens(name), MUTATING_VERBS) || hasSideEffectIntent(name, "");
+}
+//# sourceMappingURL=lexicon.js.map

package/dist/src/lexicon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexicon.js","sourceRoot":"","sources":["../../src/lexicon.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CACE,oEAAoE;IACpE,0DAA0D;IAC1D,qEAAqE;IACrE,oEAAoE;IACpE,sBAAsB,CACvB,CAAC,KAAK,CAAC,GAAG,CAAC,CACb,CAAC;AAEF,MAAM,aAAa,GAAG,YAAY,CAAC;AAEnC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC;IACE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU;IACzE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS;IAC1E,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa;IAC1E,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK;IACzE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ;IACrE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;IACnE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;IACxE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS;IAClE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ;IACjE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACpE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO;CAClD,CACF,CAAC;AAEF,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC/E,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChB,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,CAAc,EAAE,CAAsB;IACxD,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAmB;IACnE,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;gDACgD;AAChD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/src/outcomes.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Outcomes — the local capture substrate (surface + response tracking). A port
+ * of the in-memory core of Python `tooling/cse/outcomes.py`. Local FULL detail;
+ * the ONLY projection that may ever leave is `aggregateRows()`:
+ * `{verdict_hash, action, reason_class}` per response — NEVER a tool name, an
+ * argument, data, or a credential.
+ */
+import type { Provenance } from "./provenance.js";
+export declare enum Action {
+    OVERRIDE = "override",
+    HONOR = "honor",
+    REPIN = "repin",
+    ESCALATE = "escalate",
+    DISABLE = "disable",
+    LOWER_POSTURE = "lower_posture",
+    UNINSTALL = "uninstall",
+    IGNORE = "ignore"
+}
+export declare enum OverrideReason {
+    FALSE_ALARM = "false_alarm",
+    REVIEWED_FINE = "reviewed_fine",
+    NEED_NOW = "need_now",
+    OTHER = "other"
+}
+export declare const AGGREGATE_ROW_KEYS: ReadonlySet<string>;
+/** SHA-256 over the provenance reproduce-handle, hex-truncated to 16. Identifies
+ * the JUDGMENT (public contract), not the tool args. Port of `verdict_hash`. */
+export declare function verdictHash(provenance: Provenance): string;
+/** On-device append-only capture store; ZERO egress of detail. */
+export declare class OutcomeStore {
+    private readonly now;
+    private readonly surfaces;
+    private responses;
+    constructor(now?: () => string);
+    recordSurface(provenance: Provenance, posture: string): string;
+    recordResponse(surfaceId: string, action: Action, reason?: OverrideReason | null): void;
+    /** Bound the store so a long-lived session cannot grow it without limit (port of Python
+     * `OutcomeStore._prune_locked`). Two passes on the SURFACE store, both anchored on the
+     * LATEST surface timestamp so a deterministic test/replay does not depend on wall-clock
+     * now: (1) DATE-PRUNE drops surfaces older than `RETENTION_DAYS` (an unparseable stamp is
+     * KEPT — only the hard cap can evict it); (2) RING-BUFFER enforces the `MAX_EVENTS` cap,
+     * oldest-first. Responses linked to an evicted surface are then dropped (a response that
+     * can no longer be anonymize-linked carries no signal — `aggregateRows` would drop it
+     * anyway); the response list is independently hard-capped so a flood of externally-minted
+     * ids cannot grow the store either. */
+    private prune;
+    surfaceCount(): number;
+    responseCount(): number;
+    /** The ONLY projection that may ever leave the device. One row per response,
+     * `{verdict_hash, action, reason_class}` only; a response with no resolvable
+     * surface is DROPPED (fail-closed). Port of `aggregate_rows`. */
+    aggregateRows(): Array<Record<string, string>>;
+}
+/** Local on-device counters — the analog of Python `LocalStats`, narrowed to what
+ * the wrapper records (gate calls + a 30-day HOLD tally for the banner). */
+export declare class LocalStats {
+    private holds;
+    private repins;
+    private overCap;
+    recordHold(): void;
+    recordRepin(): void;
+    recordOverCap(): void;
+    holdsThisMonth(): number;
+    repinCount(): number;
+    overCapCount(): number;
+}
+//# sourceMappingURL=outcomes.d.ts.map

package/dist/src/outcomes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomes.d.ts","sourceRoot":"","sources":["../../src/outcomes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,oBAAY,MAAM;IAChB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,KAAK,UAAU;IACf,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,aAAa,kBAAkB;IAC/B,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,oBAAY,cAAc;IACxB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAuD,CAAC;AAE3G;gFACgF;AAChF,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAE1D;AAgCD,kEAAkE;AAClE,qBAAa,YAAY;IAIX,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHhC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,SAAS,CAAwB;gBAEZ,GAAG,GAAE,MAAM,MAAkB;IAE1D,aAAa,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAO9D,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAE,cAAc,GAAG,IAAW,GAAG,IAAI;IAK7F;;;;;;;;2CAQuC;IACvC,OAAO,CAAC,KAAK;IAkCb,YAAY,IAAI,MAAM;IAItB,aAAa,IAAI,MAAM;IAIvB;;qEAEiE;IACjE,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAa/C;AAED;4EAC4E;AAC5E,qBAAa,UAAU;IACrB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,MAAM,CAAK;IACnB,OAAO,CAAC,OAAO,CAAK;IAEpB,UAAU,IAAI,IAAI;IAIlB,WAAW,IAAI,IAAI;IAInB,aAAa,IAAI,IAAI;IAIrB,cAAc,IAAI,MAAM;IAIxB,UAAU,IAAI,MAAM;IAIpB,YAAY,IAAI,MAAM;CAGvB"}

package/dist/src/outcomes.js

@@ -0,0 +1,159 @@
+/**
+ * Outcomes — the local capture substrate (surface + response tracking). A port
+ * of the in-memory core of Python `tooling/cse/outcomes.py`. Local FULL detail;
+ * the ONLY projection that may ever leave is `aggregateRows()`:
+ * `{verdict_hash, action, reason_class}` per response — NEVER a tool name, an
+ * argument, data, or a credential.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { utcNowIso } from "./preflight.js";
+export var Action;
+(function (Action) {
+    Action["OVERRIDE"] = "override";
+    Action["HONOR"] = "honor";
+    Action["REPIN"] = "repin";
+    Action["ESCALATE"] = "escalate";
+    Action["DISABLE"] = "disable";
+    Action["LOWER_POSTURE"] = "lower_posture";
+    Action["UNINSTALL"] = "uninstall";
+    Action["IGNORE"] = "ignore";
+})(Action || (Action = {}));
+export var OverrideReason;
+(function (OverrideReason) {
+    OverrideReason["FALSE_ALARM"] = "false_alarm";
+    OverrideReason["REVIEWED_FINE"] = "reviewed_fine";
+    OverrideReason["NEED_NOW"] = "need_now";
+    OverrideReason["OTHER"] = "other";
+})(OverrideReason || (OverrideReason = {}));
+export const AGGREGATE_ROW_KEYS = new Set(["verdict_hash", "action", "reason_class"]);
+/** SHA-256 over the provenance reproduce-handle, hex-truncated to 16. Identifies
+ * the JUDGMENT (public contract), not the tool args. Port of `verdict_hash`. */
+export function verdictHash(provenance) {
+    return createHash("sha256").update(provenance.reproduceHandle, "utf-8").digest("hex").slice(0, 16);
+}
+const MAX_EVENTS = 50_000;
+// Retention window in days (mirrors Python `outcomes._RETENTION_DAYS`). The card reads a
+// 30-day summary; we keep a generous trailing window so an offline replay over the recent
+// past still has its events, then the hard `MAX_EVENTS` cap backstops a same-day burst.
+const RETENTION_DAYS = 62;
+const DAY_SECONDS = 86_400;
+/** Best-effort ISO-8601 → epoch seconds for the retention window (port of Python
+ * `outcomes._parse_iso`). Tolerant of a trailing `Z`. Returns null on an unparseable
+ * stamp — kept in-window by the date prune (only the hard cap can evict it), never
+ * silently dropped. */
+function parseIsoSeconds(s) {
+    const ms = Date.parse(s.replace(/Z$/, "+00:00"));
+    return Number.isNaN(ms) ? null : ms / 1000;
+}
+/** On-device append-only capture store; ZERO egress of detail. */
+export class OutcomeStore {
+    now;
+    surfaces = new Map();
+    responses = [];
+    constructor(now = utcNowIso) {
+        this.now = now;
+    }
+    recordSurface(provenance, posture) {
+        const surfaceId = randomUUID().replace(/-/g, "");
+        this.surfaces.set(surfaceId, { surfaceId, at: this.now(), posture, provenance });
+        this.prune();
+        return surfaceId;
+    }
+    recordResponse(surfaceId, action, reason = null) {
+        this.responses.push({ surfaceId, at: this.now(), action, reason });
+        this.prune();
+    }
+    /** Bound the store so a long-lived session cannot grow it without limit (port of Python
+     * `OutcomeStore._prune_locked`). Two passes on the SURFACE store, both anchored on the
+     * LATEST surface timestamp so a deterministic test/replay does not depend on wall-clock
+     * now: (1) DATE-PRUNE drops surfaces older than `RETENTION_DAYS` (an unparseable stamp is
+     * KEPT — only the hard cap can evict it); (2) RING-BUFFER enforces the `MAX_EVENTS` cap,
+     * oldest-first. Responses linked to an evicted surface are then dropped (a response that
+     * can no longer be anonymize-linked carries no signal — `aggregateRows` would drop it
+     * anyway); the response list is independently hard-capped so a flood of externally-minted
+     * ids cannot grow the store either. */
+    prune() {
+        const keys = [...this.surfaces.keys()];
+        let keptIds = keys;
+        // (1) Date-prune, anchored on the latest parseable surface stamp.
+        const stamps = [];
+        for (const s of this.surfaces.values()) {
+            const t = parseIsoSeconds(s.at);
+            if (t !== null)
+                stamps.push(t);
+        }
+        if (stamps.length > 0) {
+            const cutoff = Math.max(...stamps) - RETENTION_DAYS * DAY_SECONDS;
+            keptIds = keys.filter((k) => {
+                const t = parseIsoSeconds(this.surfaces.get(k).at);
+                return t === null || t >= cutoff; // unparseable kept; only the hard cap evicts it
+            });
+        }
+        // (2) Ring-buffer hard cap (oldest-first; Map preserves insertion order).
+        if (keptIds.length > MAX_EVENTS) {
+            keptIds = keptIds.slice(-MAX_EVENTS);
+        }
+        if (keptIds.length !== this.surfaces.size) {
+            const keepSet = new Set(keptIds);
+            const evicted = new Set(keys.filter((k) => !keepSet.has(k)));
+            for (const k of evicted)
+                this.surfaces.delete(k);
+            // Drop ONLY responses linked to an evicted surface; a response against an
+            // externally-minted id never in-store is preserved (it was never evicted).
+            this.responses = this.responses.filter((r) => !evicted.has(r.surfaceId));
+        }
+        // (3) Independently hard-cap the response list (oldest-first).
+        if (this.responses.length > MAX_EVENTS) {
+            this.responses = this.responses.slice(-MAX_EVENTS);
+        }
+    }
+    surfaceCount() {
+        return this.surfaces.size;
+    }
+    responseCount() {
+        return this.responses.length;
+    }
+    /** The ONLY projection that may ever leave the device. One row per response,
+     * `{verdict_hash, action, reason_class}` only; a response with no resolvable
+     * surface is DROPPED (fail-closed). Port of `aggregate_rows`. */
+    aggregateRows() {
+        const rows = [];
+        for (const r of this.responses) {
+            const surf = this.surfaces.get(r.surfaceId);
+            if (surf === undefined)
+                continue;
+            rows.push({
+                verdict_hash: verdictHash(surf.provenance),
+                action: r.action,
+                reason_class: r.reason !== null ? r.reason : "",
+            });
+        }
+        return rows;
+    }
+}
+/** Local on-device counters — the analog of Python `LocalStats`, narrowed to what
+ * the wrapper records (gate calls + a 30-day HOLD tally for the banner). */
+export class LocalStats {
+    holds = 0;
+    repins = 0;
+    overCap = 0;
+    recordHold() {
+        this.holds += 1;
+    }
+    recordRepin() {
+        this.repins += 1;
+    }
+    recordOverCap() {
+        this.overCap += 1;
+    }
+    holdsThisMonth() {
+        return this.holds;
+    }
+    repinCount() {
+        return this.repins;
+    }
+    overCapCount() {
+        return this.overCap;
+    }
+}
+//# sourceMappingURL=outcomes.js.map

package/dist/src/outcomes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcomes.js","sourceRoot":"","sources":["../../src/outcomes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,MAAM,CAAN,IAAY,MASX;AATD,WAAY,MAAM;IAChB,+BAAqB,CAAA;IACrB,yBAAe,CAAA;IACf,yBAAe,CAAA;IACf,+BAAqB,CAAA;IACrB,6BAAmB,CAAA;IACnB,yCAA+B,CAAA;IAC/B,iCAAuB,CAAA;IACvB,2BAAiB,CAAA;AACnB,CAAC,EATW,MAAM,KAAN,MAAM,QASjB;AAED,MAAM,CAAN,IAAY,cAKX;AALD,WAAY,cAAc;IACxB,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,uCAAqB,CAAA;IACrB,iCAAe,CAAA;AACjB,CAAC,EALW,cAAc,KAAd,cAAc,QAKzB;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;AAE3G;gFACgF;AAChF,MAAM,UAAU,WAAW,CAAC,UAAsB;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC;AAgBD,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,yFAAyF;AACzF,0FAA0F;AAC1F,wFAAwF;AACxF,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B;;;uBAGuB;AACvB,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;AAC7C,CAAC;AAED,kEAAkE;AAClE,MAAM,OAAO,YAAY;IAIM;IAHZ,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IACrD,SAAS,GAAqB,EAAE,CAAC;IAEzC,YAA6B,MAAoB,SAAS;QAA7B,QAAG,GAAH,GAAG,CAA0B;IAAG,CAAC;IAE9D,aAAa,CAAC,UAAsB,EAAE,OAAe;QACnD,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,cAAc,CAAC,SAAiB,EAAE,MAAc,EAAE,SAAgC,IAAI;QACpF,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;;;;;;;2CAQuC;IAC/B,KAAK;QACX,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,kEAAkE;QAClE,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,cAAc,GAAG,WAAW,CAAC;YAClE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC1B,MAAM,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,gDAAgD;YACpF,CAAC,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YAChC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjD,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,+DAA+D;QAC/D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;YACvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,aAAa;QACX,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED;;qEAEiE;IACjE,aAAa;QACX,MAAM,IAAI,GAAkC,EAAE,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACjC,IAAI,CAAC,IAAI,CAAC;gBACR,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC1C,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED;4EAC4E;AAC5E,MAAM,OAAO,UAAU;IACb,KAAK,GAAG,CAAC,CAAC;IACV,MAAM,GAAG,CAAC,CAAC;IACX,OAAO,GAAG,CAAC,CAAC;IAEpB,UAAU;QACR,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,WAAW;QACT,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,aAAa;QACX,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF"}

package/dist/src/preflight.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Pin store + verdict types — a port of the load-bearing primitives from Python
+ * `tooling/cse/preflight.py` (`PinnedTool`, `PreflightPin`, `Decision`,
+ * `PreflightVerdict`). The pin stores ONLY the public-contract hash (+ optional
+ * PUBLIC schema for diff detail) — NEVER a token, by construction.
+ */
+import { hashTool } from "./canonical.js";
+import type { Change } from "./schemaDiff.js";
+export type ToolDef = Record<string, unknown>;
+export declare enum Decision {
+    PROCEED = "PROCEED",
+    HOLD = "HOLD",
+    INCONCLUSIVE = "INCONCLUSIVE"
+}
+export interface PinnedTool {
+    readonly serverId: string;
+    readonly toolName: string;
+    readonly definitionHash: string;
+    readonly pinnedAt: string;
+    readonly schema: ToolDef | null;
+}
+export declare function utcNowIso(): string;
+/** A structured, honest pre-flight result. A verdict is a CONTRACT DIFF, never a
+ * "this is unsafe" claim (AD-6). Mirrors `PreflightVerdict`. */
+export interface PreflightVerdict {
+    readonly serverId: string;
+    readonly toolName: string;
+    readonly decision: Decision;
+    readonly reason: string;
+    readonly drift: readonly Change[];
+    readonly failOpenWarning: boolean;
+    readonly isContractDiff: boolean;
+    readonly descBefore: string | null;
+    readonly descAfter: string | null;
+}
+export declare function makeVerdict(v: Pick<PreflightVerdict, "serverId" | "toolName" | "decision" | "reason"> & Partial<PreflightVerdict>): PreflightVerdict;
+export declare function isProceed(v: PreflightVerdict): boolean;
+export declare function safetyRelevantDrift(v: PreflightVerdict): Change[];
+/** A human one-liner, render-safe (attacker-derived ids/detail escaped). Honest
+ * voice: no safe/verified/clean/pass words. Port of `PreflightVerdict.render`. */
+export declare function renderVerdict(v: PreflightVerdict): string;
+/** In-memory pin store (the TS port keeps it in-memory: the SDK wrapper pins a
+ * live session; durable JSON persistence is out of scope for the wrapper). Keyed
+ * by `(serverId, toolName)`. Stores ONLY hashes (+ optional PUBLIC schema). */
+export declare class PreflightPin {
+    private readonly index;
+    private key;
+    get(serverId: string, toolName: string): PinnedTool | null;
+    put(pin: PinnedTool): void;
+    toolsFor(serverId: string): PinnedTool[];
+    allPins(): PinnedTool[];
+}
+export { hashTool };
+//# sourceMappingURL=preflight.d.ts.map

package/dist/src/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,oBAAY,QAAQ;IAClB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,YAAY,iBAAiB;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;CACjC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED;gEACgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,wBAAgB,WAAW,CACzB,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC,GACxE,OAAO,CAAC,gBAAgB,CAAC,GAC1B,gBAAgB,CAYlB;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAEtD;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAEjE;AAED;kFACkF;AAClF,wBAAgB,aAAa,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAsCzD;AAED;;+EAE+E;AAC/E,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,OAAO,CAAC,GAAG;IAIX,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAI1D,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAI1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE;IAIxC,OAAO,IAAI,UAAU,EAAE;CAGxB;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/src/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK1C,MAAM,CAAN,IAAY,QAIX;AAJD,WAAY,QAAQ;IAClB,+BAAmB,CAAA;IACnB,yBAAa,CAAA;IACb,yCAA6B,CAAA;AAC/B,CAAC,EAJW,QAAQ,KAAR,QAAQ,QAInB;AAUD,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACxF,CAAC;AAgBD,MAAM,UAAU,WAAW,CACzB,CAC2B;IAE3B,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;QACpB,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,KAAK;QAC3C,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACxC,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAmB;IAC3C,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAmB;IACrD,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;AACjD,CAAC;AAED;kFACkF;AAClF,MAAM,UAAU,aAAa,CAAC,CAAmB;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO,WAAW,GAAG,IAAI,IAAI,+BAA+B,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC,eAAe,EAAE,CAAC;QACzD,OAAO,WAAW,GAAG,IAAI,IAAI,yBAAyB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,IAAI,GACN,gBAAgB,GAAG,IAAI,IAAI,mCAAmC;YAC9D,4CAA4C,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,SAAS,IAAI,GAAG,CAAC,CAAC,IAAI,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9C,IAAI,IAAI,GACN,QAAQ,GAAG,IAAI,IAAI,2BAA2B;YAC9C,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,eAAe,OAAO,qBAAqB;YAC7D,gFAAgF,CAAC;QACnF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,SAAS,IAAI,GAAG,CAAC,CAAC,IAAI,MAAM,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAClD,IAAI;gBACF,2BAA2B,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE;oBACvD,2BAA2B,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,GAAG,IAAI,IAAI,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;+EAE+E;AAC/E,MAAM,OAAO,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE/C,GAAG,CAAC,QAAgB,EAAE,QAAgB;QAC5C,OAAO,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,QAAgB,EAAE,QAAgB;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9D,CAAC;IAED,GAAG,CAAC,GAAe;QACjB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAED,QAAQ,CAAC,QAAgB;QACvB,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;CACF;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC"}

package/dist/src/provenance.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Provenance — the immutable record attached to EVERY surfaced finding, and the
+ * load-bearing `requireProvenance` choke. A port of Python
+ * `tooling/cse/provenance.py` + `guardrails.require_provenance`. NOTHING surfaces
+ * without a COMPLETE provenance record (the over-claim guard, fail-closed).
+ */
+import { Decision } from "./preflight.js";
+import type { PreflightVerdict, ToolDef } from "./preflight.js";
+import { ChangeKind } from "./schemaDiff.js";
+export declare enum VerdictScope {
+    STRUCTURAL_ONLY = "structural_only",
+    SEMANTIC_ONLY = "semantic_only",
+    BEHAVIORAL = "behavioral"
+}
+export declare enum HonestFraming {
+    CONTRACT_DIFF_NOT_SAFETY = "contract-diff not a safety verdict",
+    BEHAVIORAL_NEEDED = "static inconclusive; behavioral validation needed",
+    VISIBILITY_NOT_BLAME = "consumer-visibility not maintainer-blame",
+    HEALTHY = ""
+}
+export interface Subject {
+    readonly serverId: string;
+    readonly tool: string;
+    readonly definitionHashOld: string | null;
+    readonly definitionHashNew: string | null;
+    readonly capturedAt: string;
+    readonly source: string;
+}
+export interface WhatFired {
+    readonly changeKinds: readonly ChangeKind[];
+    readonly classifierId: string;
+    readonly tierReached: number;
+    readonly verdict: Decision;
+    readonly verdictScope: VerdictScope;
+}
+export interface EvidenceField {
+    readonly path: string;
+    readonly kind: ChangeKind;
+    readonly before: string | null;
+    readonly after: string | null;
+}
+export interface Provenance {
+    readonly subject: Subject;
+    readonly whatFired: WhatFired;
+    readonly evidence: readonly EvidenceField[];
+    readonly honestFraming: HonestFraming;
+    readonly reproduceHandle: string;
+}
+/** The completeness predicate the load-bearing choke gates on (port of
+ * `Provenance.is_complete`). Each string field is trimmed before the check, so a
+ * whitespace-only value is rejected as empty. Evidence MAY be empty. */
+export declare function isComplete(p: Provenance): boolean;
+/** Render-safe one-line summary (does NOT emit raw evidence values). */
+export declare function renderProvenance(p: Provenance): string;
+export declare function provenanceAsDict(p: Provenance): Record<string, unknown>;
+/** Build a COMPLETE Provenance from a verdict + the contracts that produced it.
+ * Port of `provenance.from_verdict`. */
+export declare function fromVerdict(verdict: PreflightVerdict, opts: {
+    serverId: string;
+    tool: string;
+    oldSchema: ToolDef | null;
+    newSchema: ToolDef | null;
+    tierReached: number;
+    classifierId?: string;
+    source?: string;
+    capturedAt?: string;
+}): Provenance;
+export declare class GuardrailError extends Error {
+}
+/** THE choke every surface path passes through. Returns the COMPLETE Provenance,
+ * or THROWS `GuardrailError` (fail-closed -> nothing surfaces). Port of
+ * `guardrails.require_provenance`. */
+export declare function requireProvenance(prov: Provenance | null | undefined): Provenance;
+/** Build provenance for a USER-FACING surface and run it through the choke.
+ * Returns the COMPLETE record, or null when it cannot be built / the choke
+ * refuses (fail-closed). Port of `provenance.surface_provenance`. */
+export declare function surfaceProvenance(verdict: PreflightVerdict, opts: {
+    serverId: string;
+    tool: string;
+    oldSchema: ToolDef | null;
+    newSchema: ToolDef | null;
+    tierReached: number;
+    source: string;
+}): Provenance | null;
+/** Fail-closed honest-voice check: throw if a consumer string uses a banned
+ * green word. Port of `guardrails.assert_no_green_words`. */
+export declare function assertNoGreenWords(text: string): void;
+/** Replace every banned green word in a consumer-facing string with a neutral
+ * placeholder, so an ATTACKER-DERIVED token (a tool name interpolated into a HOLD
+ * banner) cannot surface banned reassurance verbatim (M3). Whole-word,
+ * case-insensitive — reuses the SAME word-list as `assertNoGreenWords`, so the two
+ * can never disagree. The output passes `assertNoGreenWords`. Port of
+ * `gate.redact_green_words`. */
+export declare function redactGreenWords(text: string): string;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/src/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../src/provenance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG7C,oBAAY,YAAY;IACtB,eAAe,oBAAoB;IACnC,aAAa,kBAAkB;IAC/B,UAAU,eAAe;CAC1B;AAED,oBAAY,aAAa;IACvB,wBAAwB,uCAAuC;IAC/D,iBAAiB,sDAAsD;IACvE,oBAAoB,6CAA6C;IACjE,OAAO,KAAK;CACb;AAUD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,WAAW,EAAE,SAAS,UAAU,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;wEAEwE;AACxE,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAWjD;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAUtD;AAED,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0BvE;AAsDD;wCACwC;AACxC,wBAAgB,WAAW,CACzB,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,UAAU,CAiCZ;AAED,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAE5C;;sCAEsC;AACtC,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,CAYjF;AAED;;qEAEqE;AACrE,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE;IACJ,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,GACA,UAAU,GAAG,IAAI,CAOnB;AAQD;6DAC6D;AAC7D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAKrD;AAeD;;;;;gCAKgC;AAChC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD"}