@mnemopay/sdk 0.9.3 → 1.0.0

package/dist/integrity.js

@@ -0,0 +1,401 @@
+"use strict";
+/**
+ * Merkle Tree Memory Integrity — Tamper-Evident Agent Memory
+ *
+ * Protects against MemoryGraft attacks (injecting false memories into agent
+ * context) by maintaining a Merkle hash tree over all memory writes.
+ *
+ * How it works:
+ *   1. Every memory write produces a leaf hash: SHA-256(id + content + timestamp)
+ *   2. Leaf hashes build a binary Merkle tree
+ *   3. The root hash represents the entire memory state
+ *   4. Any modification to any memory changes the root
+ *   5. Merkle proofs verify individual memories without full tree traversal
+ *
+ * Attack vectors defended:
+ *   - MemoryGraft: Injecting fabricated memories → root changes, detected
+ *   - Memory tampering: Modifying existing memory content → leaf hash changes
+ *   - Memory deletion: Removing memories silently → tree structure changes
+ *   - Replay attacks: Re-inserting old memories → duplicate leaf detection
+ *   - Reordering attacks: Changing memory chronology → position-dependent hashing
+ *
+ * References:
+ *   - Merkle, R. (1987). "A Digital Signature Based on a Conventional Encryption Function"
+ *   - OWASP Agentic AI Top 10 2026: A03 — Memory Poisoning
+ *   - MnemoPay Master Strategy, Part 2.1 — Merkle tree memory integrity
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MerkleTree = void 0;
+// ─── SHA-256 Hashing ────────────────────────────────────────────────────────
+let _crypto;
+function getHash(data) {
+    if (!_crypto) {
+        try {
+            _crypto = require("crypto");
+        }
+        catch {
+            // Browser fallback: use SubtleCrypto synchronously is not possible,
+            // so we use a simple non-cryptographic hash for environments without Node crypto.
+            // This should never happen in production (Node.js always has crypto).
+            throw new Error("MerkleTree requires Node.js crypto module");
+        }
+    }
+    return _crypto.createHash("sha256").update(data).digest("hex");
+}
+// ─── Merkle Tree ────────────────────────────────────────────────────────────
+class MerkleTree {
+    leaves = [];
+    leafMap = new Map(); // memoryId → index
+    hashSet = new Set(); // duplicate detection
+    auditLog = [];
+    /** Max audit log entries to prevent unbounded growth */
+    static MAX_AUDIT_LOG = 1000;
+    /** Max leaves before requiring compaction */
+    static MAX_LEAVES = 100_000;
+    /**
+     * Add a memory entry to the tree.
+     * Returns the leaf hash.
+     */
+    /** Max content size per leaf (100KB, matching memory limit) */
+    static MAX_CONTENT_SIZE = 102_400;
+    addLeaf(memoryId, content, timestamp) {
+        if (!memoryId || typeof memoryId !== "string")
+            throw new Error("memoryId is required");
+        if (!content || typeof content !== "string")
+            throw new Error("content is required");
+        if (memoryId.length > 256)
+            throw new Error("memoryId exceeds 256 characters");
+        if (content.length > MerkleTree.MAX_CONTENT_SIZE)
+            throw new Error(`Content exceeds ${MerkleTree.MAX_CONTENT_SIZE} bytes`);
+        if (this.leaves.length >= MerkleTree.MAX_LEAVES) {
+            throw new Error(`Merkle tree leaf limit reached (${MerkleTree.MAX_LEAVES}). Compact old memories first.`);
+        }
+        // Compute leaf hash: H(index || memoryId || content || timestamp)
+        // Including index prevents reordering attacks
+        const ts = timestamp ?? new Date().toISOString();
+        const index = this.leaves.length;
+        const leafData = `${index}:${memoryId}:${content}:${ts}`;
+        const hash = getHash(leafData);
+        // Duplicate detection: same hash means identical content at same position
+        if (this.hashSet.has(hash)) {
+            throw new Error(`Duplicate leaf detected for memory ${memoryId}`);
+        }
+        // If this memoryId was already added (memory update), remove the old leaf
+        if (this.leafMap.has(memoryId)) {
+            this._removeLeafByMemoryId(memoryId);
+        }
+        const leaf = { hash, memoryId, index };
+        this.leaves.push(leaf);
+        this.leafMap.set(memoryId, this.leaves.length - 1);
+        this.hashSet.add(hash);
+        this._audit("leaf_added", memoryId);
+        return hash;
+    }
+    /**
+     * Remove a memory from the tree (when memory is forgotten).
+     */
+    removeLeaf(memoryId) {
+        if (!this.leafMap.has(memoryId))
+            return false;
+        this._removeLeafByMemoryId(memoryId);
+        this._audit("leaf_removed", memoryId);
+        return true;
+    }
+    _removeLeafByMemoryId(memoryId) {
+        const idx = this.leafMap.get(memoryId);
+        if (idx === undefined)
+            return;
+        const leaf = this.leaves[idx];
+        if (leaf) {
+            this.hashSet.delete(leaf.hash);
+        }
+        // Mark as removed (null-ify) rather than splicing to preserve indices
+        // This avoids O(n) shifts and keeps proofs stable
+        this.leaves[idx] = null;
+        this.leafMap.delete(memoryId);
+    }
+    /**
+     * Compute the Merkle root from all current leaves.
+     * Uses standard binary tree construction: H(left || right).
+     */
+    getRoot() {
+        const activeLeaves = this.leaves.filter(l => l !== null);
+        if (activeLeaves.length === 0)
+            return getHash("empty");
+        let level = activeLeaves.map(l => l.hash);
+        // Build tree bottom-up
+        while (level.length > 1) {
+            const nextLevel = [];
+            for (let i = 0; i < level.length; i += 2) {
+                const left = level[i];
+                const right = i + 1 < level.length ? level[i + 1] : left; // Duplicate last if odd
+                // Canonical ordering: always hash(smaller || larger) to prevent order-dependent roots
+                // when reconstructing from unordered sets. But for Merkle trees, positional ordering
+                // is correct (left child is always the lower index).
+                nextLevel.push(getHash(left + right));
+            }
+            level = nextLevel;
+        }
+        return level[0];
+    }
+    /**
+     * Generate a Merkle proof for a specific memory.
+     * The proof allows verifying this memory is in the tree without the full tree.
+     */
+    getProof(memoryId) {
+        const idx = this.leafMap.get(memoryId);
+        if (idx === undefined)
+            throw new Error(`Memory ${memoryId} not in tree`);
+        const leaf = this.leaves[idx];
+        if (!leaf)
+            throw new Error(`Memory ${memoryId} has been removed`);
+        const activeLeaves = this.leaves.filter(l => l !== null);
+        const activeIndex = activeLeaves.findIndex(l => l.memoryId === memoryId);
+        if (activeIndex === -1)
+            throw new Error(`Memory ${memoryId} not found in active leaves`);
+        // Build proof path
+        let level = activeLeaves.map(l => l.hash);
+        const path = [];
+        let currentIdx = activeIndex;
+        while (level.length > 1) {
+            const nextLevel = [];
+            for (let i = 0; i < level.length; i += 2) {
+                const left = level[i];
+                const right = i + 1 < level.length ? level[i + 1] : left;
+                if (i === currentIdx || i + 1 === currentIdx) {
+                    // This pair contains our node
+                    if (currentIdx % 2 === 0) {
+                        // Our node is left child, sibling is right
+                        const siblingHash = i + 1 < level.length ? level[i + 1] : level[i];
+                        path.push({ hash: siblingHash, direction: "right" });
+                    }
+                    else {
+                        // Our node is right child, sibling is left
+                        path.push({ hash: level[i], direction: "left" });
+                    }
+                }
+                nextLevel.push(getHash(left + right));
+            }
+            currentIdx = Math.floor(currentIdx / 2);
+            level = nextLevel;
+        }
+        return {
+            leafHash: leaf.hash,
+            memoryId,
+            path,
+            rootHash: this.getRoot(),
+        };
+    }
+    /**
+     * Verify a Merkle proof is valid.
+     * Returns true if the proof correctly links the leaf to the root.
+     */
+    static verifyProof(proof) {
+        if (!proof || !proof.leafHash || !proof.rootHash || !Array.isArray(proof.path)) {
+            return false;
+        }
+        let currentHash = proof.leafHash;
+        for (const step of proof.path) {
+            if (step.direction === "left") {
+                currentHash = getHash(step.hash + currentHash);
+            }
+            else {
+                currentHash = getHash(currentHash + step.hash);
+            }
+        }
+        return currentHash === proof.rootHash;
+    }
+    /**
+     * Verify a specific memory's content against the tree.
+     * Re-computes the leaf hash and checks it matches the stored hash.
+     */
+    verifyMemory(memoryId, content, timestamp) {
+        const idx = this.leafMap.get(memoryId);
+        if (idx === undefined)
+            return false;
+        const leaf = this.leaves[idx];
+        if (!leaf)
+            return false;
+        // Recompute the hash
+        const leafData = `${leaf.index}:${memoryId}:${content}:${timestamp}`;
+        const expectedHash = getHash(leafData);
+        const match = expectedHash === leaf.hash;
+        this._audit(match ? "verification_pass" : "verification_fail", memoryId);
+        return match;
+    }
+    /**
+     * Take a snapshot of current tree state.
+     * Used for periodic checkpointing and tamper detection.
+     */
+    snapshot() {
+        const rootHash = this.getRoot();
+        const leafCount = this.leaves.filter(l => l !== null).length;
+        const timestamp = new Date().toISOString();
+        const snapshotData = `${rootHash}:${leafCount}:${timestamp}`;
+        const snapshotHash = getHash(snapshotData);
+        this._audit("snapshot_created");
+        return { rootHash, leafCount, timestamp, snapshotHash };
+    }
+    /**
+     * Detect tampering by comparing current root to a previous snapshot.
+     * Also validates snapshot integrity (the snapshot itself wasn't tampered).
+     */
+    detectTampering(previousSnapshot) {
+        // First, verify the snapshot itself wasn't tampered
+        const expectedSnapshotHash = getHash(`${previousSnapshot.rootHash}:${previousSnapshot.leafCount}:${previousSnapshot.timestamp}`);
+        if (expectedSnapshotHash !== previousSnapshot.snapshotHash) {
+            return {
+                tampered: true,
+                failedMemories: [],
+                currentRoot: this.getRoot(),
+                expectedRoot: previousSnapshot.rootHash,
+                summary: "CRITICAL: The snapshot itself has been tampered with. Cannot trust any comparison.",
+            };
+        }
+        const currentRoot = this.getRoot();
+        const currentLeafCount = this.leaves.filter(l => l !== null).length;
+        if (currentRoot === previousSnapshot.rootHash) {
+            return {
+                tampered: false,
+                failedMemories: [],
+                currentRoot,
+                expectedRoot: previousSnapshot.rootHash,
+                summary: `Integrity verified. ${currentLeafCount} memories, root matches snapshot.`,
+            };
+        }
+        // Root changed — determine what changed
+        const leafDiff = currentLeafCount - previousSnapshot.leafCount;
+        let summary = `Root hash mismatch. Leaves: ${previousSnapshot.leafCount} → ${currentLeafCount} (${leafDiff >= 0 ? "+" : ""}${leafDiff}).`;
+        if (leafDiff > 0) {
+            summary += ` ${leafDiff} new memories added since snapshot.`;
+        }
+        else if (leafDiff < 0) {
+            summary += ` ${Math.abs(leafDiff)} memories removed since snapshot.`;
+        }
+        else {
+            summary += " Same leaf count but content changed — possible memory modification.";
+            this._audit("tamper_detected");
+        }
+        return {
+            tampered: true,
+            failedMemories: [], // Would need per-memory tracking to identify specific changes
+            currentRoot,
+            expectedRoot: previousSnapshot.rootHash,
+            summary,
+        };
+    }
+    /**
+     * Full tree verification: recompute root from all leaves and verify
+     * internal consistency (no corrupted nodes).
+     */
+    verifyTreeIntegrity() {
+        const activeLeaves = this.leaves.filter(l => l !== null);
+        const computedRoot = this.getRoot();
+        // Verify no hash collisions in leaf set
+        const uniqueHashes = new Set(activeLeaves.map(l => l.hash));
+        if (uniqueHashes.size !== activeLeaves.length) {
+            return { valid: false, leafCount: activeLeaves.length, rootHash: computedRoot };
+        }
+        // Verify leaf map consistency
+        for (const [memId, idx] of this.leafMap) {
+            const leaf = this.leaves[idx];
+            if (!leaf || leaf.memoryId !== memId) {
+                return { valid: false, leafCount: activeLeaves.length, rootHash: computedRoot };
+            }
+        }
+        return { valid: true, leafCount: activeLeaves.length, rootHash: computedRoot };
+    }
+    /** Number of active (non-removed) leaves */
+    get size() {
+        return this.leaves.filter(l => l !== null).length;
+    }
+    /** Get the audit log */
+    getAuditLog() {
+        return [...this.auditLog];
+    }
+    /**
+     * Compact the tree by removing null entries and re-indexing.
+     * This is a heavy operation — call during maintenance windows only.
+     * WARNING: This invalidates all existing proofs.
+     */
+    compact() {
+        const before = this.leaves.length;
+        const activeLeaves = this.leaves.filter(l => l !== null);
+        // Re-index
+        this.leaves = [];
+        this.leafMap.clear();
+        this.hashSet.clear();
+        for (let i = 0; i < activeLeaves.length; i++) {
+            const leaf = { ...activeLeaves[i], index: i };
+            this.leaves.push(leaf);
+            this.leafMap.set(leaf.memoryId, i);
+            this.hashSet.add(leaf.hash);
+        }
+        return { removed: before - activeLeaves.length, remaining: activeLeaves.length };
+    }
+    /**
+     * Serialize tree state for persistence.
+     */
+    serialize() {
+        const activeLeaves = this.leaves.filter(l => l !== null);
+        return {
+            leaves: activeLeaves,
+            rootHash: this.getRoot(),
+        };
+    }
+    /**
+     * Deserialize from persisted state with validation.
+     */
+    static deserialize(data) {
+        if (!data || !Array.isArray(data.leaves)) {
+            throw new Error("Invalid MerkleTree data");
+        }
+        const tree = new MerkleTree();
+        const seenIds = new Set();
+        const seenHashes = new Set();
+        for (const leaf of data.leaves) {
+            // Validate each leaf
+            if (!leaf.hash || typeof leaf.hash !== "string" || leaf.hash.length !== 64) {
+                throw new Error(`Invalid leaf hash for memory ${leaf.memoryId}`);
+            }
+            if (!leaf.memoryId || typeof leaf.memoryId !== "string") {
+                throw new Error("Invalid leaf memoryId");
+            }
+            if (seenIds.has(leaf.memoryId)) {
+                throw new Error(`Duplicate memoryId in tree: ${leaf.memoryId}`);
+            }
+            if (seenHashes.has(leaf.hash)) {
+                throw new Error(`Duplicate hash in tree: ${leaf.hash}`);
+            }
+            seenIds.add(leaf.memoryId);
+            seenHashes.add(leaf.hash);
+            tree.leaves.push({ ...leaf, index: tree.leaves.length });
+            tree.leafMap.set(leaf.memoryId, tree.leaves.length - 1);
+            tree.hashSet.add(leaf.hash);
+        }
+        // Verify root matches if provided
+        if (data.rootHash) {
+            const computedRoot = tree.getRoot();
+            if (computedRoot !== data.rootHash) {
+                throw new Error(`Root hash mismatch on deserialize: computed ${computedRoot}, expected ${data.rootHash}. Tree may be corrupted.`);
+            }
+        }
+        return tree;
+    }
+    _audit(event, memoryId) {
+        // Root hash is computed lazily — only include it for verification/snapshot events
+        // to avoid O(n) cost on every leaf add/remove
+        const needsRoot = event === "verification_pass" || event === "verification_fail" || event === "tamper_detected" || event === "snapshot_created";
+        this.auditLog.push({
+            event,
+            memoryId,
+            rootHash: needsRoot ? this.getRoot() : "",
+            timestamp: new Date().toISOString(),
+        });
+        if (this.auditLog.length > MerkleTree.MAX_AUDIT_LOG) {
+            this.auditLog.splice(0, this.auditLog.length - (MerkleTree.MAX_AUDIT_LOG / 2));
+        }
+    }
+}
+exports.MerkleTree = MerkleTree;
+//# sourceMappingURL=integrity.js.map

package/dist/integrity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrity.js","sourceRoot":"","sources":["../src/integrity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AA0DH,+EAA+E;AAE/E,IAAI,OAAY,CAAC;AAEjB,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC;YACH,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,kFAAkF;YAClF,sEAAsE;YACtE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,+EAA+E;AAE/E,MAAa,UAAU;IACb,MAAM,GAAiB,EAAE,CAAC;IAC1B,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,mBAAmB;IAC7D,OAAO,GAAgB,IAAI,GAAG,EAAE,CAAC,CAAC,sBAAsB;IACxD,QAAQ,GAA0B,EAAE,CAAC;IAC7C,wDAAwD;IAChD,MAAM,CAAU,aAAa,GAAG,IAAI,CAAC;IAC7C,6CAA6C;IAC7C,MAAM,CAAU,UAAU,GAAG,OAAO,CAAC;IAErC;;;OAGG;IACH,+DAA+D;IAC/D,MAAM,CAAU,gBAAgB,GAAG,OAAO,CAAC;IAE3C,OAAO,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAkB;QAC3D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACvF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACpF,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,UAAU,CAAC,gBAAgB,QAAQ,CAAC,CAAC;QAC1H,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,CAAC,UAAU,gCAAgC,CAAC,CAAC;QAC5G,CAAC;QAED,kEAAkE;QAClE,8CAA8C;QAC9C,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,MAAM,QAAQ,GAAG,GAAG,KAAK,IAAI,QAAQ,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE/B,0EAA0E;QAC1E,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,0EAA0E;QAC1E,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEvB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,QAAgB;QACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,qBAAqB,CAAC,QAAgB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO;QAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,sEAAsE;QACtE,kDAAkD;QACjD,IAAI,CAAC,MAAc,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,OAAO;QACL,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAiB,CAAC;QACzE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QAEvD,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE1C,uBAAuB;QACvB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,wBAAwB;gBAClF,sFAAsF;gBACtF,qFAAqF;gBACrF,qDAAqD;gBACrD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,QAAgB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,cAAc,CAAC,CAAC;QAEzE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,mBAAmB,CAAC,CAAC;QAElE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAiB,CAAC;QACzE,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;QACzE,IAAI,WAAW,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,6BAA6B,CAAC,CAAC;QAEzF,mBAAmB;QACnB,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAwB,EAAE,CAAC;QACrC,IAAI,UAAU,GAAG,WAAW,CAAC;QAE7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAEzD,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC7C,8BAA8B;oBAC9B,IAAI,UAAU,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzB,2CAA2C;wBAC3C,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBACnE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;oBACvD,CAAC;yBAAM,CAAC;wBACN,2CAA2C;wBAC3C,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;oBACnD,CAAC;gBACH,CAAC;gBAED,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC;YACxC,CAAC;YACD,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YACxC,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,QAAQ;YACR,IAAI;YACJ,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,KAAkB;QACnC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC;QAEjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC9B,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,OAAO,WAAW,KAAK,KAAK,CAAC,QAAQ,CAAC;IACxC,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,QAAgB,EAAE,OAAe,EAAE,SAAiB;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAEpC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,qBAAqB;QACrB,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;QACrE,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEvC,MAAM,KAAK,GAAG,YAAY,KAAK,IAAI,CAAC,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,YAAY,GAAG,GAAG,QAAQ,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAEhC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IAC1D,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,gBAAmC;QACjD,oDAAoD;QACpD,MAAM,oBAAoB,GAAG,OAAO,CAClC,GAAG,gBAAgB,CAAC,QAAQ,IAAI,gBAAgB,CAAC,SAAS,IAAI,gBAAgB,CAAC,SAAS,EAAE,CAC3F,CAAC;QACF,IAAI,oBAAoB,KAAK,gBAAgB,CAAC,YAAY,EAAE,CAAC;YAC3D,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,cAAc,EAAE,EAAE;gBAClB,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;gBAC3B,YAAY,EAAE,gBAAgB,CAAC,QAAQ;gBACvC,OAAO,EAAE,oFAAoF;aAC9F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;QAEpE,IAAI,WAAW,KAAK,gBAAgB,CAAC,QAAQ,EAAE,CAAC;YAC9C,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,cAAc,EAAE,EAAE;gBAClB,WAAW;gBACX,YAAY,EAAE,gBAAgB,CAAC,QAAQ;gBACvC,OAAO,EAAE,uBAAuB,gBAAgB,mCAAmC;aACpF,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,MAAM,QAAQ,GAAG,gBAAgB,GAAG,gBAAgB,CAAC,SAAS,CAAC;QAC/D,IAAI,OAAO,GAAG,+BAA+B,gBAAgB,CAAC,SAAS,MAAM,gBAAgB,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,IAAI,CAAC;QAE1I,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjB,OAAO,IAAI,IAAI,QAAQ,qCAAqC,CAAC;QAC/D,CAAC;aAAM,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mCAAmC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,OAAO,IAAI,sEAAsE,CAAC;YAClF,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACjC,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,cAAc,EAAE,EAAE,EAAE,8DAA8D;YAClF,WAAW;YACX,YAAY,EAAE,gBAAgB,CAAC,QAAQ;YACvC,OAAO;SACR,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAiB,CAAC;QACzE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAEpC,wCAAwC;QACxC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,IAAI,YAAY,CAAC,IAAI,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QAClF,CAAC;QAED,8BAA8B;QAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;YAClF,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IACjF,CAAC;IAED,4CAA4C;IAC5C,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IACpD,CAAC;IAED,wBAAwB;IACxB,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,OAAO;QACL,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAiB,CAAC;QAEzE,WAAW;QACX,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,SAAS;QACP,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAiB,CAAC;QACzE,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE;SACzB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,WAAW,CAAC,IAAgD;QACjE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,qBAAqB;YACrB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3B,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,YAAY,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,+CAA+C,YAAY,cAAc,IAAI,CAAC,QAAQ,0BAA0B,CAAC,CAAC;YACpI,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,KAAmC,EAAE,QAAiB;QACnE,kFAAkF;QAClF,8CAA8C;QAC9C,MAAM,SAAS,GAAG,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,iBAAiB,IAAI,KAAK,KAAK,kBAAkB,CAAC;QAChJ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,KAAK;YACL,QAAQ;YACR,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;YACzC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;;AA7YH,gCA8YC"}

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAmiBnE,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAmfjD;AAID,MAAM,CAAC,OAAO,UAAU,mBAAmB,IAAI,MAAM,CAgBpD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AA4sBnE,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAmfjD;AAID,MAAM,CAAC,OAAO,UAAU,mBAAmB,IAAI,MAAM,CAgBpD"}

package/dist/mcp/server.js

@@ -338,6 +338,80 @@ const TOOLS = [
             },
         },
     },
+    // ── Agent FICO ─────────────────────────────────────────────────────────────
+    {
+        name: "agent_fico_score",
+        description: "Compute the agent's FICO credit score (300-850). Uses payment history, " +
+            "credit utilization, account age, behavior diversity, and fraud record. " +
+            "Returns score, rating, fee rate, trust level, and HITL requirement.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                budgetCap: {
+                    type: "number",
+                    minimum: 1,
+                    description: "Agent's budget cap for utilization calculation (default: 10000)",
+                },
+                fraudFlags: { type: "number", minimum: 0, description: "Number of fraud flags (default: 0)" },
+                disputeCount: { type: "number", minimum: 0, description: "Total disputes filed (default: 0)" },
+                disputesLost: { type: "number", minimum: 0, description: "Disputes lost (default: 0)" },
+                warnings: { type: "number", minimum: 0, description: "Fraud warnings (default: 0)" },
+            },
+        },
+    },
+    // ── Behavioral Finance ─────────────────────────────────────────────────────
+    {
+        name: "behavioral_analysis",
+        description: "Run behavioral finance analysis on a proposed spending amount. " +
+            "Returns prospect theory value, cooling-off recommendation, and loss framing. " +
+            "Based on Kahneman & Tversky (1992) and Thaler & Benartzi (2004).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                amount: { type: "number", description: "The spending amount to analyze" },
+                monthlyIncome: {
+                    type: "number",
+                    minimum: 1,
+                    description: "Agent's monthly income/budget for cooling-off calculation",
+                },
+                goalName: { type: "string", description: "Savings goal name for loss framing" },
+                goalTarget: { type: "number", description: "Savings goal target amount" },
+                goalCurrent: { type: "number", description: "Current savings toward goal" },
+                goalMonthlySavings: { type: "number", description: "Monthly savings rate" },
+            },
+            required: ["amount"],
+        },
+    },
+    // ── Memory Integrity ───────────────────────────────────────────────────────
+    {
+        name: "memory_integrity_check",
+        description: "Check the integrity of the agent's memory store using SHA-256 Merkle trees. " +
+            "Detects tampering, injection, deletion, replay, and reordering attacks. " +
+            "Returns root hash, leaf count, and tampering status.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                snapshotHash: {
+                    type: "string",
+                    description: "Previous snapshot hash to compare against (optional — omit for first check)",
+                },
+            },
+        },
+    },
+    // ── Anomaly Detection ──────────────────────────────────────────────────────
+    {
+        name: "anomaly_check",
+        description: "Check if a transaction amount is anomalous using EWMA streaming detection. " +
+            "Returns whether the value is normal, a warning, or a critical anomaly. " +
+            "Based on Roberts (1959) and Lucas & Saccucci (1990).",
+        inputSchema: {
+            type: "object",
+            properties: {
+                amount: { type: "number", description: "Transaction amount to check" },
+            },
+            required: ["amount"],
+        },
+    },
 ];
 // ─── Tool execution ─────────────────────────────────────────────────────────
 async function executeTool(agent, name, args) {
@@ -494,10 +568,88 @@ async function executeTool(agent, name, args) {
                 (o.trackingUrl ? ` Track: ${o.trackingUrl}` : "")).join("\n");
             return `${list}\n\nSpent: $${summary.totalSpent.toFixed(2)} | Remaining: $${summary.remainingBudget.toFixed(2)} | Orders: ${summary.orderCount}`;
         }
+        // ── Agent FICO ─────────────────────────────────────────────────────────
+        case "agent_fico_score": {
+            const fico = new index_js_2.AgentFICO();
+            const txHistory = await agent.history(1000);
+            const profile = await agent.profile();
+            const result = fico.compute({
+                transactions: txHistory.map((tx) => ({
+                    id: tx.id,
+                    amount: tx.amount,
+                    status: tx.status,
+                    reason: tx.reason || "",
+                    createdAt: new Date(tx.createdAt),
+                    settledAt: tx.settledAt ? new Date(tx.settledAt) : undefined,
+                    counterparty: tx.counterparty,
+                })),
+                createdAt: new Date(Date.now() - 86400000 * 30),
+                fraudFlags: args.fraudFlags ?? 0,
+                disputeCount: args.disputeCount ?? 0,
+                disputesLost: args.disputesLost ?? 0,
+                warnings: args.warnings ?? 0,
+                budgetCap: args.budgetCap ?? 10000,
+                memoriesCount: profile.memoriesCount ?? 0,
+            });
+            return JSON.stringify(result, null, 2);
+        }
+        // ── Behavioral Finance ─────────────────────────────────────────────────
+        case "behavioral_analysis": {
+            const behavioral = new index_js_2.BehavioralEngine();
+            const prospect = behavioral.prospectValue(args.amount);
+            const analysis = { prospect };
+            if (args.monthlyIncome) {
+                analysis.coolingOff = behavioral.coolingOff(args.amount, args.monthlyIncome);
+            }
+            if (args.goalName && args.goalTarget && args.goalCurrent !== undefined && args.goalMonthlySavings) {
+                analysis.lossFrame = behavioral.lossFrame(args.amount, {
+                    name: args.goalName,
+                    target: args.goalTarget,
+                    current: args.goalCurrent,
+                    monthlySavings: args.goalMonthlySavings,
+                });
+            }
+            return JSON.stringify(analysis, null, 2);
+        }
+        // ── Memory Integrity ─────────────────────────────────────────────────
+        case "memory_integrity_check": {
+            const tree = _merkleTree;
+            if (!tree || tree.size === 0) {
+                // Build tree from current memories
+                const memories = await agent.recall(50);
+                for (const m of memories) {
+                    tree.addLeaf(m.id, m.content);
+                }
+            }
+            const snapshot = tree.snapshot();
+            const result = {
+                rootHash: snapshot.rootHash,
+                leafCount: snapshot.leafCount,
+                snapshotHash: snapshot.snapshotHash,
+            };
+            if (args.snapshotHash) {
+                const check = tree.detectTampering({
+                    rootHash: args.snapshotHash,
+                    leafCount: snapshot.leafCount,
+                    snapshotHash: args.snapshotHash,
+                    timestamp: new Date().toISOString(),
+                });
+                result.tampering = check;
+            }
+            return JSON.stringify(result, null, 2);
+        }
+        // ── Anomaly Detection ────────────────────────────────────────────────
+        case "anomaly_check": {
+            const result = _ewmaDetector.update(args.amount);
+            return JSON.stringify(result, null, 2);
+        }
         default:
             throw new Error(`Unknown tool: ${name}`);
     }
 }
+// ── Module singletons ────────────────────────────────────────────────────────
+const _merkleTree = new index_js_2.MerkleTree();
+const _ewmaDetector = new index_js_2.EWMADetector(0.15, 2.5, 3.5, 10);
 // ── Commerce singleton ──────────────────────────────────────────────────────
 let _commerceEngine = null;
 async function getCommerceEngine(agent) {
@@ -510,7 +662,7 @@ async function getCommerceEngine(agent) {
 // ─── Server setup ───────────────────────────────────────────────────────────
 async function startServer() {
     const agent = createAgent();
-    const server = new index_js_1.Server({ name: "mnemopay", version: "0.9.3" }, { capabilities: { tools: {}, resources: {}, prompts: {} } });
+    const server = new index_js_1.Server({ name: "mnemopay", version: "1.0.0-beta.1" }, { capabilities: { tools: {}, resources: {}, prompts: {} } });
     // ── Tools ───────────────────────────────────────────────────────────────
     server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
         tools: TOOLS,
@@ -967,7 +1119,7 @@ async function startServer() {
 // ─── Smithery sandbox — allows tool scanning without real credentials ──────
 function createSandboxServer() {
     const agent = index_js_2.MnemoPay.quick("smithery-sandbox");
-    const server = new index_js_1.Server({ name: "mnemopay", version: "0.9.3" }, { capabilities: { tools: {}, resources: {}, prompts: {} } });
+    const server = new index_js_1.Server({ name: "mnemopay", version: "1.0.0-beta.1" }, { capabilities: { tools: {}, resources: {}, prompts: {} } });
     server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({ tools: TOOLS }));
     server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
         const { name, arguments: args } = request.params;