@proof-holdings/delegation-self-refusal 0.1.0

package/dist/registrar.js

@@ -0,0 +1,106 @@
+import { refusalMessage } from './refusal.js';
+import { errorResult } from './result.js';
+import { currentVerdict } from './verdict.js';
+export const INSTALLED_MARKER = Symbol.for('proof-holdings.delegation-self-refusal.installed');
+export function readInstallKind(server) {
+    const value = server[INSTALLED_MARKER];
+    if (value === 'optout')
+        return 'optout';
+    // ANY other truthy value reads as `gated`, not as absent. The marker key is a `Symbol.for`, so it
+    // is shared with every OTHER copy of this package in the process — and the direction that matters
+    // is FORWARD: a newer copy may write a kind this version has never heard of, and a strict
+    // two-string check would read such a server as untouched and install a second layer over an
+    // existing gate. (An earlier version of this comment justified the widening by a copy written
+    // BEFORE kinds existed. That was false and a reviewer proved it: the marker string appears in no
+    // commit — `git log --all -S` finds nothing — and no version of this package had been published
+    // at the time, so the FIRST installable version already carries kinds. The rule is right; the
+    // story was not.)
+    // Erring toward `gated` errs toward refusing, which is the direction that cannot silently ungate
+    // anything; the cost is a clear error where an exotic combination might have been survivable.
+    if (value)
+        return 'gated';
+    return undefined;
+}
+export function markInstalled(server, kind) {
+    server[INSTALLED_MARKER] = kind;
+}
+/**
+ * Refuses a second call that cannot cover the registrar a first call already handed out.
+ *
+ * The two states fail for OPPOSITE reasons, which is why one summary cannot serve both. After
+ * `gated`, a second call would install over a working gate. After `optout`, the raw registrar stays
+ * perfectly VALID and simply bypasses whatever is installed next — nothing invalidated it. The
+ * message below is picked from the kind for that reason: claiming an installed layer where only a
+ * raw registrar was handed out sends the reader looking for something that does not exist.
+ */
+export function assertNotAlreadyInstalled(server, entryPoint) {
+    const kind = readInstallKind(server);
+    if (kind === undefined)
+        return;
+    if (kind === 'optout') {
+        throw new Error(`${entryPoint}: a previous call with no token already handed out this server's RAW ` +
+            'registrar. Whatever is installed now cannot cover it — tools registered through the ' +
+            'registrar that is already out would bypass it. Configure the token before the first ' +
+            'call, or keep using the un-gated one.');
+    }
+    // No per-case CONSEQUENCE in the text. The previous tail ("running both leaves the showcase
+    // gated by it") held only where a showcase is registered after a gate exists, and was false in
+    // guard→guard (no showcase anywhere) and install→guard (the showcase is already registered,
+    // un-gated, and a later gate cannot retroactively cover it). What IS true in all four gated
+    // cells is only the state and the instruction, so that is all this says.
+    throw new Error(`${entryPoint}: this server already carries the Proof self-refusal layer. Install it exactly ` +
+        'ONCE — call either guardDelegation or installProofLayer, never both (installProofLayer ' +
+        'includes the gate).');
+}
+/**
+ * The shared precondition both entry points check: the SDK must expose `_registeredTools`, and
+ * nothing may be registered yet. Placed late, this package does nothing — `.bind()` snapshots the
+ * function value — so refusing to run is the only honest answer to "installed too late".
+ */
+export function assertInstallableBeforeRegistration(server, entryPoint) {
+    // The entry point is a PARAMETER because this message is read by a publisher staring at a
+    // startup crash: naming `guardDelegation` when they called `installProofLayer` sends them to fix
+    // a function they never invoked — the same ambiguity SC-13 exists to remove at the other
+    // precondition.
+    if (server._registeredTools === undefined) {
+        throw new Error(`${entryPoint}: the installed @modelcontextprotocol/sdk McpServer does not expose ` +
+            '_registeredTools — this package cannot verify no tools were registered before the gate ' +
+            'and refuses to run silently unguarded. Pin a known-compatible SDK version.');
+    }
+    const alreadyRegistered = Object.keys(server._registeredTools);
+    if (alreadyRegistered.length > 0) {
+        throw new Error(`${entryPoint} must run before any server.tool()/registerTool() call — ` +
+            `${alreadyRegistered.length} tool(s) already registered: ${alreadyRegistered.join(', ')}`);
+    }
+}
+/**
+ * Wraps a registrar (`server.tool` or `server.registerTool` — both take the handler as their
+ * final positional argument) so every call through it is gated on `currentVerdict`.
+ *
+ * The dispatch check is a deliberate ALLOW-LIST (`kind === 'valid'` runs the handler; anything
+ * else, including a shape `currentVerdict`'s return type does not admit but that could reach here
+ * through some future bug, refuses) rather than a deny-list keyed on `'refused'` — a security gate
+ * must default to denying what it does not positively recognize as authorized.
+ *
+ * The handler's own arguments are passed through OPAQUELY: never read, indexed, logged or
+ * serialized. This package runs inside someone else's production process, where those arguments
+ * are that publisher's user data — `src/__tests__/drift/mcp-showcase.test.ts` pins the property
+ * behaviourally rather than trusting this comment.
+ */
+export function wrapRegistrar(original, opts) {
+    return (...args) => {
+        const handler = args[args.length - 1];
+        if (typeof handler !== 'function') {
+            return original(...args);
+        }
+        const gatedHandler = async (...handlerArgs) => {
+            const verdict = await currentVerdict(opts);
+            if (verdict.kind === 'valid') {
+                return handler(...handlerArgs);
+            }
+            return errorResult(refusalMessage(opts.principal, verdict.reason));
+        };
+        return original(...args.slice(0, -1), gatedHandler);
+    };
+}
+//# sourceMappingURL=registrar.js.map

package/dist/registrar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registrar.js","sourceRoot":"","sources":["../src/registrar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAwB,MAAM,cAAc,CAAC;AAsBpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;AAE/F,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,KAAK,GAAI,MAAkD,CAAC,gBAAgB,CAAC,CAAC;IACpF,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACxC,kGAAkG;IAClG,kGAAkG;IAClG,0FAA0F;IAC1F,4FAA4F;IAC5F,8FAA8F;IAC9F,iGAAiG;IACjG,gGAAgG;IAChG,8FAA8F;IAC9F,kBAAkB;IAClB,iGAAiG;IACjG,8FAA8F;IAC9F,IAAI,KAAK;QAAE,OAAO,OAAO,CAAC;IAC1B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,IAAiB;IACnE,MAAkD,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAqB,EAAE,UAAkB;IACjF,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO;IAE/B,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,uEAAuE;YAClF,sFAAsF;YACtF,sFAAsF;YACtF,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,+FAA+F;IAC/F,4FAA4F;IAC5F,4FAA4F;IAC5F,yEAAyE;IACzE,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,iFAAiF;QAC5F,yFAAyF;QACzF,qBAAqB,CACxB,CAAC;AACJ,CAAC;AAwBD;;;;GAIG;AACH,MAAM,UAAU,mCAAmC,CAAC,MAAqB,EAAE,UAAkB;IAC3F,0FAA0F;IAC1F,iGAAiG;IACjG,yFAAyF;IACzF,gBAAgB;IAChB,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,sEAAsE;YACjF,yFAAyF;YACzF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC/D,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,2DAA2D;YACtE,GAAG,iBAAiB,CAAC,MAAM,gCAAgC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,QAAuB,EAAE,IAAqB;IAC1E,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtC,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;YAClC,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,EAAE,GAAG,WAAsB,EAAE,EAAE;YACvD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,OAAQ,OAAwC,CAAC,GAAG,WAAW,CAAC,CAAC;YACnE,CAAC;YACD,OAAO,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC;QAEF,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC"}

package/dist/result.d.ts

@@ -0,0 +1,16 @@
+/** Matches the MCP `CallToolResult` shape (content blocks + isError) without a runtime SDK import. */
+export interface ToolResult {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError: boolean;
+}
+export declare function errorResult(message: string): ToolResult;
+/**
+ * A successful result carrying structured data. The MCP content model has no JSON block, so the
+ * repo-wide convention (mcp/src/types.ts `jsonResult`) is a single pretty-printed text block —
+ * mirrored here rather than imported, since this package cannot depend on the MCP server.
+ */
+export declare function jsonResult(data: unknown): ToolResult;
+//# sourceMappingURL=result.d.ts.map

package/dist/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAEpD"}

package/dist/result.js

@@ -0,0 +1,12 @@
+export function errorResult(message) {
+    return { content: [{ type: 'text', text: message }], isError: true };
+}
+/**
+ * A successful result carrying structured data. The MCP content model has no JSON block, so the
+ * repo-wide convention (mcp/src/types.ts `jsonResult`) is a single pretty-printed text block —
+ * mirrored here rather than imported, since this package cannot depend on the MCP server.
+ */
+export function jsonResult(data) {
+    return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }], isError: false };
+}
+//# sourceMappingURL=result.js.map

package/dist/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAa;IACtC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC9F,CAAC"}

package/dist/schedule.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Hard ceiling on how many consecutive unresolved polls may be bridged by serving the last good
+ * verdict before the gate refuses outright. This is a library constant, not a GuardOptions field
+ * — SEC-DLG-02 (b-brainstorm-delegation-revocation) found an unbounded grace window CRITICAL, and
+ * the recorded fix was a bound the caller cannot raise, not a documented recommendation.
+ */
+export declare const MAX_GRACE_FAILURES = 3;
+/**
+ * Returns baseMs plus a jitter in [1, baseMs * JITTER_FRACTION), guaranteeing the result is never
+ * an exact multiple of 60_000 when baseMs is (the default case) — a fleet of installs polling on
+ * the wall-clock minute is a self-inflicted thundering herd against /proofs/validate.
+ */
+export declare function nextIntervalMs(baseMs?: number): number;
+//# sourceMappingURL=schedule.d.ts.map

package/dist/schedule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.d.ts","sourceRoot":"","sources":["../src/schedule.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAKpC;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,GAAE,MAAiC,GAAG,MAAM,CAIhF"}

package/dist/schedule.js

@@ -0,0 +1,20 @@
+/**
+ * Hard ceiling on how many consecutive unresolved polls may be bridged by serving the last good
+ * verdict before the gate refuses outright. This is a library constant, not a GuardOptions field
+ * — SEC-DLG-02 (b-brainstorm-delegation-revocation) found an unbounded grace window CRITICAL, and
+ * the recorded fix was a bound the caller cannot raise, not a documented recommendation.
+ */
+export const MAX_GRACE_FAILURES = 3;
+const DEFAULT_POLL_INTERVAL_MS = 60_000;
+const JITTER_FRACTION = 0.2;
+/**
+ * Returns baseMs plus a jitter in [1, baseMs * JITTER_FRACTION), guaranteeing the result is never
+ * an exact multiple of 60_000 when baseMs is (the default case) — a fleet of installs polling on
+ * the wall-clock minute is a self-inflicted thundering herd against /proofs/validate.
+ */
+export function nextIntervalMs(baseMs = DEFAULT_POLL_INTERVAL_MS) {
+    const jitterCeiling = Math.max(1, Math.floor(baseMs * JITTER_FRACTION));
+    const jitter = 1 + Math.floor(Math.random() * jitterCeiling);
+    return baseMs + jitter;
+}
+//# sourceMappingURL=schedule.js.map

package/dist/schedule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.js","sourceRoot":"","sources":["../src/schedule.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAEpC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,wBAAwB;IACtE,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC;IAC7D,OAAO,MAAM,GAAG,MAAM,CAAC;AACzB,CAAC"}

package/dist/showcase/breaker.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Hard timeout for a whole showcase call — not for each HTTP request inside it.
+ *
+ * Scope, stated because the name does not carry it: this bounds the two showcase tools that call
+ * out on their OWN behalf (`proof_verify_delegation`, `proof_connect`).
+ * `proof_check_this_server` is deliberately outside it — it reads the gate's shared verdict
+ * (SC-3), so its network cost is `poll.ts`'s 10s budget, the same one every gated publisher tool
+ * already pays, and wrapping it would fork the grace state machine `schedule.ts` owns.
+ *
+ * Deliberately BELOW both library defaults it sits in front of — `@proof-holdings/delegation-verifier`
+ * defaults to 5000ms and `poll.ts` to 10000ms — and applied to the ENTIRE operation, because the
+ * verifier's own budget is PER FETCH and one verification walks up to `SHOWCASE_MAX_LEGS` requests
+ * sequentially. Giving both bounds the same number would permit a ~9s user-facing stall, which is
+ * exactly the "our slowness is indistinguishable from the publisher's code" failure this constant
+ * exists to prevent. Pinned by `breaker.test.ts`.
+ */
+export declare const SHOWCASE_TIMEOUT_MS = 4500;
+/**
+ * How many sequential HTTP legs one verification can take: JWKS → status list → status endpoint.
+ *
+ * THREE, not two. `checkDelegationStatus` (packages/delegation-verifier/src/status.ts) falls
+ * through to the status ENDPOINT whenever the status list cannot answer, so the third leg is
+ * reachable on a live issuer. An earlier version of this file derived the per-request budget from
+ * a two-leg walk while the comment above it said three — and at two legs the arithmetic was a
+ * photo finish (2 × 1500 = 3000, exactly the whole-call bound), so any parse or verify time
+ * between them pushed a healthy-but-slow issuer over the deadline and charged it as a failure.
+ */
+export declare const SHOWCASE_MAX_LEGS = 3;
+/**
+ * The budget handed to a LIBRARY that applies it per request, derived from the leg count PLUS ONE
+ * so the whole-call bound is a real ceiling with headroom rather than a photo finish.
+ *
+ * Dividing by the leg count exactly (the first attempt at this fix) reproduced the very defect the
+ * comment above rejects: `3 × 1000 = 3000` IS the whole-call bound, leaving zero milliseconds for
+ * the work BETWEEN the legs — JWKS parsing, JWT signature verification, JSON decoding — all of
+ * which sit inside the same deadline, because the timer starts before `fn` is invoked. The `+ 1`
+ * is that work's share.
+ *
+ * It also matters which way the arithmetic errs. A per-fetch budget squeezed too tight aborts a leg
+ * against a merely-average issuer, the verifier reports `jwks_unavailable`, `isIssuerUnreachable`
+ * charges it to the breaker, and three of those deny verification of EVERY artifact for a cooldown
+ * — a false `issuer_unreachable_cooldown` against a live service. So the total was raised (still
+ * strictly below the verifier's 5000ms and `poll.ts`'s 10000ms, which SC-7 requires) rather than
+ * the per-request budget being cut further.
+ */
+export declare const SHOWCASE_PER_REQUEST_TIMEOUT_MS: number;
+export type BreakerResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    tripped: true;
+} | {
+    ok: false;
+    tripped: false;
+    error: unknown;
+};
+export interface RunOptions<T> {
+    /**
+     * Decides whether a RETURNED value counts as a failure.
+     *
+     * Required because "did it throw" is the wrong question for this package's own dependencies:
+     * `@proof-holdings/delegation-verifier` reports an unreachable issuer by RETURNING
+     * `{valid: false, outcome: 'unconfirmed'}` rather than throwing, so a throw-only breaker read a
+     * dead issuer as a success, reset its counter on every call, and never opened — measured in code
+     * review as 10 outbound attempts with 0 trips. Without this hook SC-7 is unmet for the very tool
+     * that makes the most outbound calls.
+     */
+    isFailure?: (value: T) => boolean;
+}
+export interface Breaker {
+    run<T>(fn: (signal: AbortSignal) => Promise<T>, options?: RunOptions<T>): Promise<BreakerResult<T>>;
+}
+export interface BreakerOptions {
+    failureThreshold?: number;
+    cooldownMs?: number;
+    timeoutMs?: number;
+    /** Injected clock. Tests advance it directly rather than reaching for fake global timers. */
+    now?: () => number;
+}
+/**
+ * A per-installation circuit breaker for the showcase's outbound calls.
+ *
+ * State lives in this closure, NOT on disk: the cache directory belongs to the self-refusal grace
+ * state machine, and writing showcase state into it would move `lastCheckedAtMs` outside the
+ * jittered schedule `schedule.ts` exists to keep (the SEC-DLG-02 fix). The showcase therefore does
+ * not inherit the grace window and needs its own failure accounting — which is exactly what SC-7
+ * asks for.
+ */
+export declare function createBreaker(options?: BreakerOptions): Breaker;
+//# sourceMappingURL=breaker.d.ts.map

package/dist/showcase/breaker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"breaker.d.ts","sourceRoot":"","sources":["../../src/showcase/breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,OAAQ,CAAC;AAEzC;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,+BAA+B,QAA4D,CAAC;AAKzG,MAAM,MAAM,aAAa,CAAC,CAAC,IACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;CACrG;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AASD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CA+EnE"}

package/dist/showcase/breaker.js

@@ -0,0 +1,132 @@
+/**
+ * Hard timeout for a whole showcase call — not for each HTTP request inside it.
+ *
+ * Scope, stated because the name does not carry it: this bounds the two showcase tools that call
+ * out on their OWN behalf (`proof_verify_delegation`, `proof_connect`).
+ * `proof_check_this_server` is deliberately outside it — it reads the gate's shared verdict
+ * (SC-3), so its network cost is `poll.ts`'s 10s budget, the same one every gated publisher tool
+ * already pays, and wrapping it would fork the grace state machine `schedule.ts` owns.
+ *
+ * Deliberately BELOW both library defaults it sits in front of — `@proof-holdings/delegation-verifier`
+ * defaults to 5000ms and `poll.ts` to 10000ms — and applied to the ENTIRE operation, because the
+ * verifier's own budget is PER FETCH and one verification walks up to `SHOWCASE_MAX_LEGS` requests
+ * sequentially. Giving both bounds the same number would permit a ~9s user-facing stall, which is
+ * exactly the "our slowness is indistinguishable from the publisher's code" failure this constant
+ * exists to prevent. Pinned by `breaker.test.ts`.
+ */
+export const SHOWCASE_TIMEOUT_MS = 4_500;
+/**
+ * How many sequential HTTP legs one verification can take: JWKS → status list → status endpoint.
+ *
+ * THREE, not two. `checkDelegationStatus` (packages/delegation-verifier/src/status.ts) falls
+ * through to the status ENDPOINT whenever the status list cannot answer, so the third leg is
+ * reachable on a live issuer. An earlier version of this file derived the per-request budget from
+ * a two-leg walk while the comment above it said three — and at two legs the arithmetic was a
+ * photo finish (2 × 1500 = 3000, exactly the whole-call bound), so any parse or verify time
+ * between them pushed a healthy-but-slow issuer over the deadline and charged it as a failure.
+ */
+export const SHOWCASE_MAX_LEGS = 3;
+/**
+ * The budget handed to a LIBRARY that applies it per request, derived from the leg count PLUS ONE
+ * so the whole-call bound is a real ceiling with headroom rather than a photo finish.
+ *
+ * Dividing by the leg count exactly (the first attempt at this fix) reproduced the very defect the
+ * comment above rejects: `3 × 1000 = 3000` IS the whole-call bound, leaving zero milliseconds for
+ * the work BETWEEN the legs — JWKS parsing, JWT signature verification, JSON decoding — all of
+ * which sit inside the same deadline, because the timer starts before `fn` is invoked. The `+ 1`
+ * is that work's share.
+ *
+ * It also matters which way the arithmetic errs. A per-fetch budget squeezed too tight aborts a leg
+ * against a merely-average issuer, the verifier reports `jwks_unavailable`, `isIssuerUnreachable`
+ * charges it to the breaker, and three of those deny verification of EVERY artifact for a cooldown
+ * — a false `issuer_unreachable_cooldown` against a live service. So the total was raised (still
+ * strictly below the verifier's 5000ms and `poll.ts`'s 10000ms, which SC-7 requires) rather than
+ * the per-request budget being cut further.
+ */
+export const SHOWCASE_PER_REQUEST_TIMEOUT_MS = Math.floor(SHOWCASE_TIMEOUT_MS / (SHOWCASE_MAX_LEGS + 1));
+const DEFAULT_FAILURE_THRESHOLD = 3;
+const DEFAULT_COOLDOWN_MS = 60_000;
+class ShowcaseTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`showcase call exceeded its ${timeoutMs}ms budget`);
+        this.name = 'ShowcaseTimeoutError';
+    }
+}
+/**
+ * A per-installation circuit breaker for the showcase's outbound calls.
+ *
+ * State lives in this closure, NOT on disk: the cache directory belongs to the self-refusal grace
+ * state machine, and writing showcase state into it would move `lastCheckedAtMs` outside the
+ * jittered schedule `schedule.ts` exists to keep (the SEC-DLG-02 fix). The showcase therefore does
+ * not inherit the grace window and needs its own failure accounting — which is exactly what SC-7
+ * asks for.
+ */
+export function createBreaker(options = {}) {
+    const failureThreshold = options.failureThreshold ?? DEFAULT_FAILURE_THRESHOLD;
+    const cooldownMs = options.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+    const timeoutMs = options.timeoutMs ?? SHOWCASE_TIMEOUT_MS;
+    const now = options.now ?? Date.now;
+    let consecutiveFailures = 0;
+    let openUntilMs = 0;
+    function recordFailure() {
+        consecutiveFailures++;
+        if (consecutiveFailures >= failureThreshold) {
+            openUntilMs = now() + cooldownMs;
+        }
+    }
+    return {
+        async run(fn, runOptions = {}) {
+            if (openUntilMs > now()) {
+                return { ok: false, tripped: true };
+            }
+            // The window elapsed: forget the streak that opened it, so one more failure does not
+            // instantly re-open on a stale count.
+            if (openUntilMs !== 0) {
+                openUntilMs = 0;
+                consecutiveFailures = 0;
+            }
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            const deadline = new Promise((_resolve, reject) => {
+                controller.signal.addEventListener('abort', () => reject(new ShowcaseTimeoutError(timeoutMs)), { once: true });
+            });
+            try {
+                // Bounds the WHOLE call, not each request inside it — a callee that ignores the signal
+                // (the verifier applies its own per-fetch budget instead) is still cut off here.
+                const value = await Promise.race([fn(controller.signal), deadline]);
+                // A throwing `isFailure` is a bug in THIS package, so it is neither charged to the issuer
+                // (which would open the breaker against a service that answered fine) nor allowed to CLEAR
+                // the streak — a predicate that threw on exactly the dead-issuer shape would otherwise
+                // erase real failures and hold the breaker closed forever, which is the original defect
+                // wearing a new disguise. It is also logged: `verdict.ts` uses the same channel, and a
+                // silent swallow here would hide the one condition that makes the breaker inert.
+                let predicateThrew = false;
+                let predicateSaysFailure = false;
+                try {
+                    predicateSaysFailure = runOptions.isFailure?.(value) === true;
+                }
+                catch (error) {
+                    predicateThrew = true;
+                    console.error(`delegation-self-refusal: showcase isFailure predicate threw (failure count left ` +
+                        `untouched): ${error instanceof Error ? error.message : String(error)}`);
+                }
+                if (predicateSaysFailure) {
+                    recordFailure();
+                    return { ok: false, tripped: false, error: value };
+                }
+                if (!predicateThrew) {
+                    consecutiveFailures = 0;
+                }
+                return { ok: true, value };
+            }
+            catch (error) {
+                recordFailure();
+                return { ok: false, tripped: false, error };
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+    };
+}
+//# sourceMappingURL=breaker.js.map

package/dist/showcase/breaker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"breaker.js","sourceRoot":"","sources":["../../src/showcase/breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAEzC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC;AAEzG,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAiCnC,MAAM,oBAAqB,SAAQ,KAAK;IACtC,YAAY,SAAiB;QAC3B,KAAK,CAAC,8BAA8B,SAAS,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,UAA0B,EAAE;IACxD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,yBAAyB,CAAC;IAC/E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mBAAmB,CAAC;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEpC,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,SAAS,aAAa;QACpB,mBAAmB,EAAE,CAAC;QACtB,IAAI,mBAAmB,IAAI,gBAAgB,EAAE,CAAC;YAC5C,WAAW,GAAG,GAAG,EAAE,GAAG,UAAU,CAAC;QACnC,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,GAAG,CAAI,EAAuC,EAAE,aAA4B,EAAE;YAClF,IAAI,WAAW,GAAG,GAAG,EAAE,EAAE,CAAC;gBACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YACtC,CAAC;YAED,qFAAqF;YACrF,sCAAsC;YACtC,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;gBACtB,WAAW,GAAG,CAAC,CAAC;gBAChB,mBAAmB,GAAG,CAAC,CAAC;YAC1B,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACvD,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAChC,OAAO,EACP,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC,EACjD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,uFAAuF;gBACvF,iFAAiF;gBACjF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAEpE,0FAA0F;gBAC1F,2FAA2F;gBAC3F,uFAAuF;gBACvF,wFAAwF;gBACxF,uFAAuF;gBACvF,iFAAiF;gBACjF,IAAI,cAAc,GAAG,KAAK,CAAC;gBAC3B,IAAI,oBAAoB,GAAG,KAAK,CAAC;gBACjC,IAAI,CAAC;oBACH,oBAAoB,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;gBAChE,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,cAAc,GAAG,IAAI,CAAC;oBACtB,OAAO,CAAC,KAAK,CACX,kFAAkF;wBAChF,eAAe,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1E,CAAC;gBACJ,CAAC;gBAED,IAAI,oBAAoB,EAAE,CAAC;oBACzB,aAAa,EAAE,CAAC;oBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;gBACrD,CAAC;gBAED,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,mBAAmB,GAAG,CAAC,CAAC;gBAC1B,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,EAAE,CAAC;gBAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/showcase/connect.d.ts

@@ -0,0 +1,39 @@
+import type { Breaker } from './breaker.js';
+import type { FetchLike } from './marked-fetch.js';
+export interface ConnectInfo {
+    message: string;
+    /**
+     * The hosted server's own URL — the route that needs no install and no API key to start. Optional
+     * because an older issuer deployment answers without it; absent must stay absent rather than be
+     * filled in with a guess, since a fabricated URL would point the agent at a host that may serve
+     * nothing.
+     */
+    remote_url?: string;
+    remote_config?: unknown;
+    install_command: string;
+    /** Why the npm route is the second choice while the published build lags the current surface. */
+    install_caveat?: string;
+    docs_url: string;
+    client_config?: unknown;
+    updated_at?: string;
+    source: 'live' | 'offline_fallback';
+}
+/**
+ * The text `proof_connect` falls back to when the issuer cannot be reached.
+ *
+ * It is deliberately marked `offline_fallback` in the payload rather than served silently: this
+ * copy is FROZEN into the publisher's `node_modules` at install time, and the live answer changes
+ * between the parts of the single-MCP plan (a remote server arrives in part 3). An agent reading
+ * a stale instruction with no signal that it is stale would confidently tell a user to do the
+ * wrong thing.
+ */
+export declare const OFFLINE_FALLBACK: ConnectInfo;
+/**
+ * Fetches the current connection instructions at CALL time (SC-6), through the showcase breaker
+ * so a slow or dead issuer costs the publisher's user one bounded wait rather than one per call.
+ *
+ * Never throws and never caches: two calls in a row do exactly the same thing, which is what
+ * "harmless on repeat" means for a tool an agent may call speculatively.
+ */
+export declare function fetchConnectInfo(baseUrl: string, breaker: Breaker, fetchImpl: FetchLike): Promise<ConnectInfo>;
+//# sourceMappingURL=connect.d.ts.map

package/dist/showcase/connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/showcase/connect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iGAAiG;IACjG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACrC;AAoBD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAc9B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,WAAW,CAAC,CAwDtB"}

package/dist/showcase/connect.js

@@ -0,0 +1,98 @@
+/**
+ * Cap on the connect payload this will accept.
+ *
+ * The live payload measures ~800 bytes, so 64 KiB is ~80× headroom. The verifier's own
+ * `MAX_REMOTE_BODY_BYTES` is 512 KiB because it reads artifacts that can legitimately be large (a
+ * JWKS, a status list); nothing here can be, so the cap is tighter. A local constant rather than an
+ * import: it is not exported from the verifier's `index.ts`, and this package must not reach into
+ * another one's internals.
+ *
+ * TWO BOUNDS the name does not carry, both shared verbatim with the verifier's version of this
+ * check and recorded so `_BYTES` is not later read as a guarantee: `body.length` counts UTF-16 code
+ * units, so a 64 Ki-CHARACTER body can be ~192 KiB of UTF-8; and the second check runs after
+ * `response.text()` has already buffered, so it refuses the payload rather than preventing it being
+ * held. The declared-length check above it is the only pre-transfer refusal, and the real bound on
+ * what can be buffered is the breaker's 4.5s deadline.
+ */
+const MAX_CONNECT_BODY_BYTES = 64 * 1024;
+/**
+ * The text `proof_connect` falls back to when the issuer cannot be reached.
+ *
+ * It is deliberately marked `offline_fallback` in the payload rather than served silently: this
+ * copy is FROZEN into the publisher's `node_modules` at install time, and the live answer changes
+ * between the parts of the single-MCP plan (a remote server arrives in part 3). An agent reading
+ * a stale instruction with no signal that it is stale would confidently tell a user to do the
+ * wrong thing.
+ */
+export const OFFLINE_FALLBACK = {
+    message: 'Proof (proof.holdings) verifies real-world control — domains, phone numbers, and human approval — and issues signed proof tokens an agent can check. The full Proof MCP server adds the rest of the platform to this client. The quickest way in is the hosted server at https://api.proof.holdings/mcp — nothing to install and no API key needed to start. This text was packaged with the Proof layer and may be out of date; proof.holdings/docs/mcp always has the current instructions.',
+    // The production address, deliberately: a copy frozen into node_modules cannot know which
+    // deployment it will be read beside, and this is the same posture `docs_url` already takes.
+    remote_url: 'https://api.proof.holdings/mcp',
+    remote_config: {
+        mcpServers: { proof: { type: 'http', url: 'https://api.proof.holdings/mcp' } },
+    },
+    install_command: 'npx -y @proof-holdings/mcp-server',
+    install_caveat: 'The @proof-holdings/mcp-server build currently on npm predates the delegation tools and the keyless public mode, so it exposes an older and smaller surface. Until it is republished, remote_url is the way to reach the current server.',
+    docs_url: 'https://proof.holdings/docs/mcp',
+    source: 'offline_fallback',
+};
+/**
+ * Fetches the current connection instructions at CALL time (SC-6), through the showcase breaker
+ * so a slow or dead issuer costs the publisher's user one bounded wait rather than one per call.
+ *
+ * Never throws and never caches: two calls in a row do exactly the same thing, which is what
+ * "harmless on repeat" means for a tool an agent may call speculatively.
+ */
+export async function fetchConnectInfo(baseUrl, breaker, fetchImpl) {
+    const origin = baseUrl.replace(/\/+$/, '');
+    const outcome = await breaker.run(async (signal) => {
+        const response = await fetchImpl(`${origin}/api/v1/mcp/connect`, {
+            method: 'GET',
+            signal,
+            // The same posture `packages/delegation-verifier/src/status.ts` takes on its remote reads,
+            // adopted here rather than left as an unexplained difference — and the reason is sharper on
+            // this path: what comes back becomes INSTRUCTIONS in the agent's context. `baseUrl` is the
+            // publisher's to configure, so an open redirect on it would carry this read off the origin
+            // they chose, with the answer still presented as ours.
+            redirect: 'error',
+        });
+        if (!response.ok) {
+            throw new Error(`connect info responded ${response.status}`);
+        }
+        // Declared length first (cheap, refuses before the transfer), then the real one, because
+        // `content-length` is absent under chunked encoding and is a claim either way.
+        const declaredLength = Number(response.headers.get('content-length'));
+        if (Number.isFinite(declaredLength) && declaredLength > MAX_CONNECT_BODY_BYTES) {
+            throw new Error('connect info response is too large');
+        }
+        const body = await response.text();
+        if (body.length > MAX_CONNECT_BODY_BYTES) {
+            throw new Error('connect info response is too large');
+        }
+        return JSON.parse(body);
+    });
+    if (!outcome.ok) {
+        return OFFLINE_FALLBACK;
+    }
+    const body = outcome.value;
+    if (typeof body?.message !== 'string' || typeof body?.install_command !== 'string') {
+        return OFFLINE_FALLBACK;
+    }
+    // Field-by-field rather than a spread: what comes back becomes instructions in the agent's
+    // context, so the shape an issuer can put there is the one this package chose to carry. The cost
+    // is that a new issuer-side field is inert until it is added here — which is why the remote
+    // route below had to be added explicitly rather than arriving on its own.
+    return {
+        message: body.message,
+        ...(typeof body.remote_url === 'string' ? { remote_url: body.remote_url } : {}),
+        ...(body.remote_config !== undefined ? { remote_config: body.remote_config } : {}),
+        install_command: body.install_command,
+        ...(typeof body.install_caveat === 'string' ? { install_caveat: body.install_caveat } : {}),
+        docs_url: typeof body.docs_url === 'string' ? body.docs_url : OFFLINE_FALLBACK.docs_url,
+        ...(body.client_config !== undefined ? { client_config: body.client_config } : {}),
+        ...(typeof body.updated_at === 'string' ? { updated_at: body.updated_at } : {}),
+        source: 'live',
+    };
+}
+//# sourceMappingURL=connect.js.map

package/dist/showcase/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/showcase/connect.ts"],"names":[],"mappings":"AAsBA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAgB;IAC3C,OAAO,EACL,+dAA+d;IACje,0FAA0F;IAC1F,4FAA4F;IAC5F,UAAU,EAAE,gCAAgC;IAC5C,aAAa,EAAE;QACb,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gCAAgC,EAAE,EAAE;KAC/E;IACD,eAAe,EAAE,mCAAmC;IACpD,cAAc,EACZ,0OAA0O;IAC5O,QAAQ,EAAE,iCAAiC;IAC3C,MAAM,EAAE,kBAAkB;CAC3B,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,OAAgB,EAChB,SAAoB;IAEpB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,qBAAqB,EAAE;YAC/D,MAAM,EAAE,KAAK;YACb,MAAM;YACN,2FAA2F;YAC3F,4FAA4F;YAC5F,2FAA2F;YAC3F,2FAA2F;YAC3F,uDAAuD;YACvD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,yFAAyF;QACzF,+EAA+E;QAC/E,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,sBAAsB,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;IAC3B,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,EAAE,CAAC;QACnF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,2FAA2F;IAC3F,iGAAiG;IACjG,4FAA4F;IAC5F,0EAA0E;IAC1E,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,GAAG,CAAC,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ;QACvF,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,EAAE,MAAM;KACf,CAAC;AACJ,CAAC"}

package/dist/showcase/descriptions.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The showcase tool descriptions, in their own module with ZERO external imports.
+ *
+ * Separated from `tools.ts` (which pulls in `zod` and the verifier) so the drift suite in the
+ * issuer's repository can import and assert the REAL strings rather than text-scanning for them.
+ * A description is what an agent reads instead of the schema, so it is the part most worth a guard
+ * and the part a text scan checks least honestly.
+ */
+/**
+ * The cross-reference every showcase description carries (SC-5).
+ *
+ * Three tools with different names do not, on their own, tell anyone that a fuller server exists —
+ * they just look like three unrelated tools, which HIDES the duplication rather than resolving it.
+ * Naming the delta is what turns the showcase from a second surface into a doorway.
+ */
+export declare function showcaseFooter(principal: string): string;
+/**
+ * The short form of the consequence measured in `docs/agent-instruction-compliance.md` (Finding
+ * 2): naming what goes wrong for the reader, not explaining the mechanism, is what moved
+ * compliance (`t3` at 9/10 against 3/10 for each softer wording that only explained or instructed).
+ *
+ * That result was measured on the description of `send_email` — a tool the agent was ALREADY
+ * calling for its own task. These three tools are not: an agent busy with an unrelated task has no
+ * reason to call any of them, so this exact configuration — the phrase on a tool the agent's task
+ * never touches — has never been measured. The cost of carrying it anyway is low (our own words in
+ * our own tools, no publisher consent needed, no third party harmed), which is why it ships. But
+ * that cost argument is not a measurement, and this is a hypothesis, not a confirmed result.
+ */
+export declare function showcaseConsequence(principal: string): string;
+export declare function describeCheckThisServer(principal: string): string;
+/**
+ * The identity paragraph states the same three rules as the full server's `verify_delegation`
+ * description (`mcp/src/tools/delegation-verify.ts`), and the issuer's
+ * `src/__tests__/drift/mcp-showcase.test.ts` holds THOSE THREE STATEMENTS across both — not the
+ * paragraph. The wordings are deliberately not identical (this one keeps the positive example
+ * inline), so do not read the guard as pinning equality: what it forbids is either side losing a
+ * rule, not either side rephrasing.
+ *
+ * It is here in full rather than summarised because this is the description an agent reads when it
+ * meets Proof inside a publisher's server, and the shorter version it used to carry is what let a
+ * live agent take the artifact name out of the checked artifact's own `package.json` and accuse a
+ * real publisher of acting without authority.
+ */
+export declare function describeVerifyDelegation(principal: string): string;
+export declare function describeConnect(principal: string): string;
+//# sourceMappingURL=descriptions.d.ts.map

package/dist/showcase/descriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptions.d.ts","sourceRoot":"","sources":["../../src/showcase/descriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAOxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CASjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAqBlE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQzD"}