@n2world/orchestrator 1.1.0

package/dist/index.js

@@ -0,0 +1,417 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kakaoOAuth = exports.DEFAULT_CHAT_HISTORY_PATH = exports.ChatStore = exports.activeLlmInfo = exports.llmCompleteUsage = exports.llmComplete = exports.askAgentChat = exports.askAgent = exports.EbpfMapScheduler = exports.pruneActions = exports.MctsEngine = exports.SkillManager = exports.FirecrackerSandbox = exports.LocalSandbox = exports.DEFAULT_SECURITY_POLICY = void 0;
+exports.detectFirecracker = detectFirecracker;
+exports.createSandbox = createSandbox;
+exports.greetCore = greetCore;
+exports.writeMetaTuple = writeMetaTuple;
+exports.getMetaTuple = getMetaTuple;
+const core_1 = require("@n2world/core");
+Object.defineProperty(exports, "MctsEngine", { enumerable: true, get: function () { return core_1.MctsEngine; } });
+Object.defineProperty(exports, "pruneActions", { enumerable: true, get: function () { return core_1.pruneActions; } });
+Object.defineProperty(exports, "EbpfMapScheduler", { enumerable: true, get: function () { return core_1.EbpfMapScheduler; } });
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs/promises"));
+const fssync = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const knowledge_graph_1 = require("./knowledge-graph");
+const command_screen_1 = require("./command-screen");
+exports.DEFAULT_SECURITY_POLICY = {
+    deniedCommandPatterns: [
+        'rm -rf /', 'rm -rf ~', 'rm -rf .', ':(){', 'mkfs', 'dd if=', '> /dev/sd',
+        'shutdown', 'reboot', 'chmod -R 777 /', 'chown -R', 'del /f /s /q', 'format ',
+    ],
+    riskyCommandPatterns: [
+        'rm -rf', 'rm -fr', 'sudo ', 'git push', 'npm publish', 'curl ', 'wget ', 'ssh ', 'scp ',
+    ],
+};
+class LocalSandbox {
+    policy;
+    tempDir = '';
+    constructor(policy = exports.DEFAULT_SECURITY_POLICY) {
+        this.policy = policy;
+    }
+    async init() {
+        this.tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'n2world-sandbox-'));
+    }
+    /** 명령 보안 점검: 차단/위험(승인)/허용. */
+    async checkCommand(cmd) {
+        // H1 — 위험명령 스크린(전 경로 공통, regex denylist). 파괴적/되돌릴 수 없는 패턴은 무조건 차단.
+        const screen = (0, command_screen_1.screenDangerousCommand)(cmd);
+        if (screen.flagged) {
+            return { allowed: false, reason: `위험명령 스크린 차단: ${screen.matched.join(', ')}` };
+        }
+        for (const p of this.policy.deniedCommandPatterns) {
+            if (cmd.includes(p))
+                return { allowed: false, reason: `denied pattern: "${p}"` };
+        }
+        for (const p of this.policy.riskyCommandPatterns) {
+            if (cmd.includes(p)) {
+                if (this.policy.approve) {
+                    const ok = await this.policy.approve({ kind: 'command', detail: cmd });
+                    return { allowed: ok, reason: ok ? 'approved' : 'rejected by approver' };
+                }
+                return { allowed: false, reason: `risky pattern needs approval: "${p}"` };
+            }
+        }
+        return { allowed: true, reason: 'ok' };
+    }
+    /** 경로 탈출 차단: tempDir 밖으로 나가는 경로를 거부. */
+    safePath(filePath) {
+        const root = path.resolve(this.tempDir);
+        const full = path.resolve(this.tempDir, filePath);
+        if (full !== root && !full.startsWith(root + path.sep)) {
+            throw new Error(`[security] 경로 탈출 차단: "${filePath}"`);
+        }
+        return full;
+    }
+    async runCommand(command) {
+        const check = await this.checkCommand(command);
+        if (!check.allowed) {
+            return { stdout: '', stderr: `[security] 명령 차단됨 — ${check.reason}`, code: 126 };
+        }
+        const isWindows = process.platform === 'win32';
+        const finalCommand = isWindows
+            ? `chcp 65001 >nul && ${command}`
+            : command;
+        return new Promise((resolve) => {
+            (0, child_process_1.exec)(finalCommand, { cwd: this.tempDir }, (err, stdout, stderr) => {
+                resolve({
+                    stdout,
+                    stderr,
+                    code: err ? err.code || 1 : 0
+                });
+            });
+        });
+    }
+    async writeFile(filePath, content) {
+        const fullPath = this.safePath(filePath);
+        await fs.mkdir(path.dirname(fullPath), { recursive: true });
+        await fs.writeFile(fullPath, content, 'utf8');
+    }
+    async readFile(filePath) {
+        const fullPath = this.safePath(filePath);
+        return await fs.readFile(fullPath, 'utf8');
+    }
+    async destroy() {
+        if (this.tempDir) {
+            await fs.rm(this.tempDir, { recursive: true, force: true });
+        }
+    }
+}
+exports.LocalSandbox = LocalSandbox;
+/** Firecracker microVM 부팅 가능성을 실제로 탐지한다(거짓 주장 금지). */
+function detectFirecracker() {
+    if (process.platform !== 'linux') {
+        return { kvmPresent: false, kvmWritable: false, firecracker: false, ready: false, reason: '비-Linux(microVM 미지원, 폴백 사용)' };
+    }
+    const kvmPresent = fssync.existsSync('/dev/kvm');
+    let kvmWritable = false;
+    try {
+        fssync.accessSync('/dev/kvm', fssync.constants.R_OK | fssync.constants.W_OK);
+        kvmWritable = true;
+    }
+    catch { /* 권한 없음 */ }
+    let firecracker = false;
+    for (const p of (process.env.PATH || '').split(path.delimiter)) {
+        try {
+            if (p && fssync.existsSync(path.join(p, 'firecracker'))) {
+                firecracker = true;
+                break;
+            }
+        }
+        catch { /* skip */ }
+    }
+    const ready = kvmPresent && kvmWritable && firecracker;
+    const reason = !kvmPresent ? '/dev/kvm 없음'
+        : !kvmWritable ? '/dev/kvm 접근 불가(kvm 그룹/ACL 필요)'
+            : !firecracker ? 'firecracker 바이너리 없음'
+                : 'ready';
+    return { kvmPresent, kvmWritable, firecracker, ready, reason };
+}
+/**
+ * Firecracker microVM 샌드박스(ISandbox). 부팅 전제(KVM 접근·firecracker·커널/rootfs 이미지)가
+ * 갖춰져야 한다. 미충족 시 init()이 명확한 사유로 throw → createSandbox()가 폴백을 선택한다.
+ * (거짓 부팅을 흉내내지 않는다.)
+ */
+class FirecrackerSandbox {
+    kernelImage;
+    rootfsImage;
+    status = detectFirecracker();
+    constructor(kernelImage, rootfsImage) {
+        this.kernelImage = kernelImage;
+        this.rootfsImage = rootfsImage;
+    }
+    async init() {
+        if (!this.status.ready) {
+            throw new Error(`FirecrackerSandbox 사용 불가: ${this.status.reason}. (해결: sudo usermod -aG kvm $USER + 커널/rootfs 이미지)`);
+        }
+        if (!this.kernelImage || !this.rootfsImage) {
+            throw new Error('FirecrackerSandbox: 커널 이미지와 rootfs 경로가 필요합니다.');
+        }
+        // 실제 microVM 생성은 여기서 firecracker API 소켓으로 수행(이미지 준비 시).
+        throw new Error('FirecrackerSandbox 부팅은 커널/rootfs 이미지 준비 후 활성화됩니다(미구성).');
+    }
+    async runCommand() {
+        throw new Error('FirecrackerSandbox 미초기화');
+    }
+    async writeFile() { throw new Error('FirecrackerSandbox 미초기화'); }
+    async readFile() { throw new Error('FirecrackerSandbox 미초기화'); }
+    async destroy() { }
+}
+exports.FirecrackerSandbox = FirecrackerSandbox;
+/**
+ * P4 폴백 팩토리: microVM 부팅 가능하면 Firecracker, 아니면 LocalSandbox(유저스페이스 격리).
+ * "거짓 폴백 금지" — 실제로 동작하는 샌드박스를 반환한다.
+ */
+async function createSandbox(opts) {
+    const status = detectFirecracker();
+    if (status.ready && opts?.kernelImage && opts?.rootfsImage) {
+        try {
+            const fc = new FirecrackerSandbox(opts.kernelImage, opts.rootfsImage);
+            await fc.init();
+            return { sandbox: fc, backend: 'firecracker', reason: 'ready' };
+        }
+        catch { /* 폴백 */ }
+    }
+    const local = new LocalSandbox();
+    await local.init();
+    return { sandbox: local, backend: 'local', reason: status.reason };
+}
+function greetCore(name) {
+    return (0, core_1.helloWorld)(name);
+}
+function writeMetaTuple(buffer, tuple) {
+    const jsonStr = JSON.stringify(tuple);
+    const encoder = new TextEncoder();
+    const payloadBytes = encoder.encode(jsonStr);
+    if (payloadBytes.length > 1012) {
+        throw new Error('Payload too large for metadata slot');
+    }
+    const view = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+    // Write payload length at offset 8 (little endian)
+    view.setUint32(8, payloadBytes.length, true);
+    // Write payload bytes starting at offset 12
+    buffer.set(payloadBytes, 12);
+}
+function getMetaTuple(buffer) {
+    const jsonStr = (0, core_1.readMetaTuple)(buffer);
+    return JSON.parse(jsonStr);
+}
+class SkillManager {
+    skills = [];
+    skillsDir = '';
+    hnsw;
+    // P1: 옵셔널 영속 벡터 저장(부착 시에만 사용). 미부착 시 기존 동작 그대로(하위 호환).
+    vectorStore;
+    constructor(skillsDir) {
+        this.skillsDir = skillsDir;
+        this.hnsw = new core_1.HnswIndex();
+    }
+    /**
+     * P1: PGLite 영속 벡터 저장을 부착한다(선택). 부착하면 createSkill/loadSkills 시
+     * 임베딩이 영속화되고 `searchPersistent`/`persistedStaleWindowMs` 를 쓸 수 있다.
+     * 부착하지 않으면 기존 인메모리 HNSW 경로만 사용한다(공개 API 불변).
+     */
+    attachVectorStore(store) {
+        this.vectorStore = store;
+    }
+    async init() {
+        await fs.mkdir(this.skillsDir, { recursive: true });
+        await this.loadSkills();
+    }
+    async loadSkills() {
+        try {
+            const files = await fs.readdir(this.skillsDir);
+            this.skills = [];
+            this.hnsw = new core_1.HnswIndex();
+            for (const file of files) {
+                if (file.endsWith('.md')) {
+                    const filePath = path.join(this.skillsDir, file);
+                    const content = await fs.readFile(filePath, 'utf8');
+                    const embedding = this.generateMockEmbedding(content);
+                    this.skills.push({ filePath, content, embedding });
+                    this.hnsw.addItem(filePath, embedding);
+                    if (this.vectorStore)
+                        await this.vectorStore.upsert(filePath, content, embedding);
+                }
+            }
+        }
+        catch (err) {
+            // ignore if folder doesn't exist yet
+        }
+    }
+    async createSkill(fileName, content) {
+        const filePath = path.join(this.skillsDir, fileName);
+        await fs.writeFile(filePath, content, 'utf8');
+        const embedding = this.generateMockEmbedding(content);
+        this.skills.push({ filePath, content, embedding });
+        this.hnsw.addItem(filePath, embedding);
+        if (this.vectorStore)
+            await this.vectorStore.upsert(filePath, content, embedding);
+    }
+    /**
+     * P1: 영속 저장(PGLite) 경로의 코사인 검색. vectorStore 부착 시에만 동작.
+     * 기존 routeSkill(SAB+HNSW)과 별개의 추가 경로다(하위 호환 — 기존 경로 불변).
+     */
+    async searchPersistent(query, k = 2) {
+        if (!this.vectorStore)
+            throw new Error('vectorStore 미부착: attachVectorStore() 를 먼저 호출하라');
+        return this.vectorStore.search(this.generateMockEmbedding(query), k);
+    }
+    /** P1: 영속 저장의 경계-staleness 측정값(ms). 미부착 시 null. */
+    persistedStaleWindowMs() {
+        return this.vectorStore ? this.vectorStore.staleWindowMs() : null;
+    }
+    /**
+     * P2: 적재된 스킬(.md) 항목 간 자가연결 지식 그래프를 만든다(참조·의존·유사).
+     * 라우팅/검색을 보조하는 추가 경로 — 기존 공개 API 불변(하위 호환).
+     * 항목 id 는 파일 basename 을 쓴다.
+     */
+    buildKnowledgeGraph(opts) {
+        const items = this.skills.map((s) => ({
+            id: path.basename(s.filePath),
+            content: s.content,
+        }));
+        return (0, knowledge_graph_1.parseKnowledgeGraph)(items, opts);
+    }
+    /**
+     * 7-2: 외부(제3자) 스킬 수용은 반드시 A2A 신뢰 게이트를 통과해야 한다.
+     * 서명+Macaroon 범위(HARD_GATE)와 평판으로 t를 산출하고, 통과한 스킬만 라우팅/색인한다.
+     * 가치 v가 아니라 신뢰 t로 게이팅한다(고가치·저신뢰 스킬은 차단).
+     */
+    async ingestExternalSkill(peerId, fileName, content, macaroonToken, ctx, gate) {
+        const r = gate.evaluate(peerId, macaroonToken, ctx);
+        if (!r.allowed) {
+            return { accepted: false, reason: r.reason, trust: r.trust };
+        }
+        await this.createSkill(fileName, content);
+        gate.ledgerRef().recordSuccess(peerId);
+        return { accepted: true, reason: 'routed', trust: r.trust };
+    }
+    skillCount() {
+        return this.skills.length;
+    }
+    generateMockEmbedding(content) {
+        const words = content.toLowerCase().split(/[^a-z0-9]+/);
+        const embedding = new Array(128).fill(0);
+        for (const word of words) {
+            if (word.length === 0)
+                continue;
+            let hash = 0;
+            for (let i = 0; i < word.length; i++) {
+                hash = (hash * 31 + word.charCodeAt(i)) % 128;
+            }
+            embedding[hash] += 1;
+        }
+        // Normalize
+        const sumSq = embedding.reduce((acc, val) => acc + val * val, 0);
+        const magnitude = Math.sqrt(sumSq);
+        return embedding.map(val => magnitude === 0 ? 0 : val / magnitude);
+    }
+    async routeSkill(query, sharedBuffer) {
+        if (this.skills.length === 0) {
+            await this.loadSkills();
+        }
+        const queryEmbedding = this.generateMockEmbedding(query);
+        // Copy query embedding to SharedArrayBuffer offset 1024
+        const floatView = new Float32Array(sharedBuffer.buffer, sharedBuffer.byteOffset + 1024, 128);
+        floatView.set(queryEmbedding);
+        // Lock buffer via Rust
+        const locked = (0, core_1.lockSharedBuffer)(sharedBuffer);
+        if (!locked) {
+            throw new Error('Failed to lock shared buffer');
+        }
+        const results = this.hnsw.search(queryEmbedding, 2);
+        // Unlock buffer via Rust
+        (0, core_1.unlockSharedBuffer)(sharedBuffer);
+        return results;
+    }
+}
+exports.SkillManager = SkillManager;
+__exportStar(require("./sandbox-controller"), exports);
+__exportStar(require("./worker-agent"), exports);
+__exportStar(require("./gateway"), exports);
+__exportStar(require("./wal-buffer"), exports);
+__exportStar(require("./oracle"), exports);
+__exportStar(require("./prompt-optimizer"), exports);
+__exportStar(require("./agent-os-rd"), exports);
+__exportStar(require("./gpu-bridge"), exports);
+__exportStar(require("./dashboard-server"), exports);
+__exportStar(require("./value-calibration"), exports);
+__exportStar(require("./oracle-anchored-search"), exports);
+__exportStar(require("./predictive-agent"), exports);
+__exportStar(require("./value-head"), exports);
+__exportStar(require("./telemetry"), exports);
+__exportStar(require("./governance"), exports);
+__exportStar(require("./cost-estimator"), exports);
+__exportStar(require("./satisfaction-metrics"), exports);
+__exportStar(require("./governed-executor"), exports);
+__exportStar(require("./rate-limiter"), exports);
+__exportStar(require("./health"), exports);
+__exportStar(require("./text-embedding"), exports);
+__exportStar(require("./personalization"), exports);
+__exportStar(require("./beta"), exports);
+__exportStar(require("./multi-axis-lift"), exports);
+__exportStar(require("./pglite-store"), exports);
+__exportStar(require("./pglite-hnsw-bridge"), exports);
+__exportStar(require("./knowledge-graph"), exports);
+__exportStar(require("./wiki-synthesizer"), exports);
+__exportStar(require("./safety-anneal"), exports);
+__exportStar(require("./mcts-prior"), exports);
+__exportStar(require("./mcts-kernel-bridge"), exports);
+__exportStar(require("./commit-gate"), exports);
+__exportStar(require("./mcp-macaroon"), exports);
+__exportStar(require("./p6-governance"), exports);
+__exportStar(require("./beta-runner"), exports);
+var llm_1 = require("./llm");
+Object.defineProperty(exports, "askAgent", { enumerable: true, get: function () { return llm_1.askAgent; } });
+Object.defineProperty(exports, "askAgentChat", { enumerable: true, get: function () { return llm_1.askAgentChat; } });
+Object.defineProperty(exports, "llmComplete", { enumerable: true, get: function () { return llm_1.llmComplete; } });
+Object.defineProperty(exports, "llmCompleteUsage", { enumerable: true, get: function () { return llm_1.llmCompleteUsage; } });
+Object.defineProperty(exports, "activeLlmInfo", { enumerable: true, get: function () { return llm_1.activeLlmInfo; } });
+var chat_store_1 = require("./chat-store");
+Object.defineProperty(exports, "ChatStore", { enumerable: true, get: function () { return chat_store_1.ChatStore; } });
+Object.defineProperty(exports, "DEFAULT_CHAT_HISTORY_PATH", { enumerable: true, get: function () { return chat_store_1.DEFAULT_CHAT_HISTORY_PATH; } });
+__exportStar(require("./channels"), exports);
+__exportStar(require("./channel-gateway"), exports);
+__exportStar(require("./conversation-graph"), exports);
+__exportStar(require("./browser-agent"), exports);
+exports.kakaoOAuth = __importStar(require("./kakao-oauth"));

package/dist/integrations/emr-adapter.d.ts

@@ -0,0 +1,41 @@
+import { Playbook } from '../playbook';
+type FetchFn = (url: string, init?: any) => Promise<{
+    ok: boolean;
+    status: number;
+    json: () => Promise<any>;
+}>;
+export interface EmrPatient {
+    patientId: string;
+    name: string;
+    dob: string;
+    lastVisit?: string;
+}
+/** EMR 환자 조회 — SSRF/허용목록 가드 + 출력 검증. 결과는 Tier-0. */
+export declare function lookupPatient(baseUrl: string, allowHosts: string[], query: {
+    name: string;
+    dob: string;
+}, fetchFn: FetchFn, resolver?: (host: string) => Promise<string[]>): Promise<{
+    ok: boolean;
+    patient?: EmrPatient;
+    tier: number;
+    reason: string;
+}>;
+export interface Questionnaire {
+    domain: string;
+    jobName: string;
+    fields: {
+        key: string;
+        label: string;
+        required: boolean;
+        sensitive: boolean;
+    }[];
+    clinicalLike: boolean;
+}
+/** 설문 → Playbook 골격. 민감 필드=pii Tier. 임상 유사 직군은 clinicalScope. */
+export declare function authorPlaybook(q: Questionnaire): Playbook;
+/** 마켓 등재 안전 게이트: 임상 직군인데 human-review 없으면 거부 등. */
+export declare function safetyGate(pb: Playbook): {
+    ok: boolean;
+    reasons: string[];
+};
+export {};

package/dist/integrations/emr-adapter.js

@@ -0,0 +1,63 @@
+"use strict";
+// ============================================================================
+// P6 — EMR/보험 연동 어댑터 + 설문→플레이북 저작 (앱 v1.2 §5·§6) — 테스트 가능
+// ----------------------------------------------------------------------------
+// MVP 대조 규칙을 실 EMR/보험 데이터로 확장. 외부 연동은 SSRF/허용목록 가드를 통과해야
+// 하고, 가져온 환자 데이터는 Tier-0(외부 재송신 금지)다.
+//
+// 정직 고지(제1계명): fetch 주입형(테스트 가능). 실 EMR 연동은 파트너 환경 검증.
+// 자동 생성 플레이북도 안전 게이트(Tier 라벨·임상 차단) 통과 후에만 사용.
+// ============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lookupPatient = lookupPatient;
+exports.authorPlaybook = authorPlaybook;
+exports.safetyGate = safetyGate;
+const mcp_client_guard_1 = require("../mcp-client-guard");
+const tier_classifier_1 = require("../tier-classifier");
+/** EMR 환자 조회 — SSRF/허용목록 가드 + 출력 검증. 결과는 Tier-0. */
+async function lookupPatient(baseUrl, allowHosts, query, fetchFn, resolver) {
+    const url = `${baseUrl}/patients?name=${encodeURIComponent(query.name)}&dob=${encodeURIComponent(query.dob)}`;
+    // M2 — 허용목록·프로토콜 1차 + DNS resolve 후 사설 IP 재검사(리바인딩 차단).
+    const safe = await (0, mcp_client_guard_1.isSafeResolvedUrl)(url, allowHosts, resolver);
+    if (!safe.ok)
+        return { ok: false, tier: 0, reason: `연동 차단: ${safe.reason}` };
+    const res = await fetchFn(url, { method: 'GET' });
+    if (!res.ok)
+        return { ok: false, tier: 0, reason: `EMR HTTP ${res.status}` };
+    const raw = JSON.stringify(await res.json());
+    const v = (0, mcp_client_guard_1.sanitizeToolOutput)(raw, (o) => o && typeof o.patientId === 'string' && typeof o.name === 'string');
+    if (!v.ok)
+        return { ok: false, tier: 0, reason: `EMR 응답 검증 실패: ${v.flags.join(',')}` };
+    const p = v.data;
+    // 가져온 환자 데이터는 민감 → Tier-0(외부 재송신 금지).
+    const tier = (0, tier_classifier_1.classifyTier)({ text: `${p.name} ${p.dob}`, kind: 'task' }).tier === 0 ? 0 : 0;
+    return { ok: true, patient: p, tier: 0, reason: 'ok' };
+}
+/** 설문 → Playbook 골격. 민감 필드=pii Tier. 임상 유사 직군은 clinicalScope. */
+function authorPlaybook(q) {
+    return {
+        id: `${q.domain}-authored`,
+        name: q.jobName,
+        domain: q.domain,
+        clinicalScope: q.clinicalLike,
+        fields: q.fields.map((f) => ({ key: f.key, label: f.label, required: f.required, tier: f.sensitive ? 'pii' : 'public' })),
+        crossChecks: [
+            { id: 'REQUIRED', check: ({ record }) => null }, // 필수검증은 런타임이 수행(placeholder)
+        ],
+        llmSteps: [{ id: 'summary', tier: q.fields.some((f) => f.sensitive) ? 'pii' : 'public', prompt: () => '요약' }],
+        needsHumanReview: q.clinicalLike ? () => true : undefined,
+    };
+}
+/** 마켓 등재 안전 게이트: 임상 직군인데 human-review 없으면 거부 등. */
+function safetyGate(pb) {
+    const reasons = [];
+    if (pb.clinicalScope && !pb.needsHumanReview)
+        reasons.push('임상 범위인데 사람 확인(human-in-loop) 없음');
+    if (!pb.fields.length)
+        reasons.push('필드 없음');
+    // 민감 필드가 있는데 LLM 단계가 전부 public(외부)면 위험
+    const hasPii = pb.fields.some((f) => f.tier === 'pii' || f.tier === 'sensitive');
+    if (hasPii && pb.llmSteps.length && pb.llmSteps.every((s) => s.tier === 'public'))
+        reasons.push('민감 데이터인데 모든 LLM 단계가 외부(빠른경로)');
+    return { ok: reasons.length === 0, reasons };
+}

package/dist/kakao-oauth.d.ts

@@ -0,0 +1,16 @@
+import { FetchFn } from './channels';
+export interface KakaoToken {
+    accessToken: string;
+    refreshToken?: string;
+    /** access token 만료(초). */
+    expiresIn?: number;
+    scope?: string;
+}
+/** 동의 화면 URL. scope=talk_message('나에게 보내기' 권한). */
+export declare function authorizeUrl(restApiKey: string, redirectUri: string, scope?: string): string;
+/** redirect 로 받은 전체 URL 또는 code 문자열에서 code 만 추출. */
+export declare function extractCode(input: string): string | null;
+/** authorization code → access/refresh token 교환. */
+export declare function exchangeCode(restApiKey: string, redirectUri: string, code: string, fetchFn?: FetchFn): Promise<KakaoToken>;
+/** refresh token 으로 access token 재발급. */
+export declare function refresh(restApiKey: string, refreshToken: string, fetchFn?: FetchFn): Promise<KakaoToken>;

package/dist/kakao-oauth.js

@@ -0,0 +1,87 @@
+"use strict";
+// ============================================================================
+// Kakao OAuth — '나에게 보내기'(talk_message)용 access token 발급 헬퍼
+// ----------------------------------------------------------------------------
+// KakaoTalk 은 개방형 봇 API 가 없어, 아웃바운드는 OAuth access token 으로 '나에게 보내기'를 쓴다.
+// 토큰 획득 흐름(Authorization Code):
+//   1) authorizeUrl() 을 브라우저로 열어 동의 → redirect_uri 로 ?code=... 수신
+//   2) exchangeCode(code) 로 access_token/refresh_token 발급
+//   3) access_token 을 KAKAO_ACCESS_TOKEN 으로 사용(만료 시 refresh()).
+// 정직: 실제 발급은 사용자의 Kakao 앱 REST 키·동의가 있어야 검증된다(그 전엔 미측정).
+// ============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizeUrl = authorizeUrl;
+exports.extractCode = extractCode;
+exports.exchangeCode = exchangeCode;
+exports.refresh = refresh;
+const AUTH_BASE = 'https://kauth.kakao.com/oauth/authorize';
+const TOKEN_URL = 'https://kauth.kakao.com/oauth/token';
+function getFetch(injected) {
+    if (injected)
+        return injected;
+    const f = globalThis.fetch;
+    if (!f)
+        throw new Error('global fetch 가 없습니다(Node 18+ 필요).');
+    return f;
+}
+/** 동의 화면 URL. scope=talk_message('나에게 보내기' 권한). */
+function authorizeUrl(restApiKey, redirectUri, scope = 'talk_message') {
+    const q = new URLSearchParams({
+        client_id: restApiKey,
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        scope,
+    });
+    return `${AUTH_BASE}?${q.toString()}`;
+}
+/** redirect 로 받은 전체 URL 또는 code 문자열에서 code 만 추출. */
+function extractCode(input) {
+    const s = input.trim();
+    if (!s)
+        return null;
+    const m = s.match(/[?&]code=([^&\s]+)/);
+    if (m)
+        return decodeURIComponent(m[1]);
+    // URL 이 아니면 code 자체로 간주(공백/URL 파편 제거).
+    return /^[\w-]+$/.test(s) ? s : null;
+}
+/** authorization code → access/refresh token 교환. */
+async function exchangeCode(restApiKey, redirectUri, code, fetchFn) {
+    const fetch = getFetch(fetchFn);
+    const body = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: restApiKey,
+        redirect_uri: redirectUri,
+        code,
+    }).toString();
+    const res = await fetch(TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8' },
+        body,
+    });
+    const j = await res.json().catch(() => ({}));
+    if (!res.ok || !j?.access_token) {
+        throw new Error(`Kakao 토큰 교환 실패: ${j?.error_description || j?.error || `HTTP ${res.status}`}`);
+    }
+    return { accessToken: j.access_token, refreshToken: j.refresh_token, expiresIn: j.expires_in, scope: j.scope };
+}
+/** refresh token 으로 access token 재발급. */
+async function refresh(restApiKey, refreshToken, fetchFn) {
+    const fetch = getFetch(fetchFn);
+    const body = new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: restApiKey,
+        refresh_token: refreshToken,
+    }).toString();
+    const res = await fetch(TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=utf-8' },
+        body,
+    });
+    const j = await res.json().catch(() => ({}));
+    if (!res.ok || !j?.access_token) {
+        throw new Error(`Kakao 토큰 갱신 실패: ${j?.error_description || j?.error || `HTTP ${res.status}`}`);
+    }
+    // refresh_token 은 갱신 시 재발급될 수도, 안 될 수도 있다(기존 유지).
+    return { accessToken: j.access_token, refreshToken: j.refresh_token, expiresIn: j.expires_in, scope: j.scope };
+}

package/dist/knowledge-graph.d.ts

@@ -0,0 +1,53 @@
+export type RelationType = 'reference' | 'dependency' | 'similarity';
+export interface KnowledgeItem {
+    id: string;
+    content: string;
+}
+export interface GraphEdge {
+    source: string;
+    target: string;
+    type: RelationType;
+    /** similarity 는 코사인∈[0,1], reference/dependency 는 1(존재). */
+    weight: number;
+}
+export interface KnowledgeGraph {
+    nodes: string[];
+    edges: GraphEdge[];
+}
+export interface ParseOptions {
+    /** similarity 엣지 코사인 임계값(기본 0.5). */
+    similarityThreshold?: number;
+    /** 노드당 similarity 상위 K(기본 3). */
+    similarityTopK?: number;
+    /** similarity 엣지 생성 여부(기본 true). */
+    includeSimilarity?: boolean;
+}
+/**
+ * 지식 항목 배열에서 관계 그래프를 추출한다. 자기참조(X→X)는 제외, 같은 (source,target,type)는 1회.
+ */
+export declare function parseKnowledgeGraph(items: KnowledgeItem[], opts?: ParseOptions): KnowledgeGraph;
+export interface GoldLabel {
+    source: string;
+    target: string;
+    type: RelationType;
+    /** 이 관계가 실제로 존재하는가(인간/문서 검증). */
+    present: boolean;
+}
+export interface EvalResult {
+    type: RelationType | 'all';
+    labeled: number;
+    positives: number;
+    tp: number;
+    fp: number;
+    fn: number;
+    tn: number;
+    precision: number | null;
+    recall: number | null;
+    f1: number | null;
+}
+/**
+ * 예측 엣지 집합을 골드 라벨로 채점. 라벨된 (source,target,type) 쌍만 평가한다
+ * (열린세계 페널티 방지 — 라벨 외 엣지는 무시, 라벨된 음성으로 precision 측정).
+ * @param type 평가할 관계 종류(생략 시 'all' — 라벨 전체).
+ */
+export declare function evaluateRelations(edges: GraphEdge[], gold: GoldLabel[], type?: RelationType): EvalResult;