@soleri/core 2.10.0 → 2.11.0

package/dist/enforcement/adapters/claude-code.js

@@ -0,0 +1,106 @@
+/**
+ * Claude Code host adapter — translates enforcement rules to Claude Code hooks.
+ *
+ * Maps:
+ * - pre-tool-use → PreToolUse hooks in settings.json
+ * - pre-commit → UserPromptSubmit hook checking git commit
+ * - pre-compact → PreCompact hook
+ * - session-start → SessionStart hook
+ */
+const TRIGGER_TO_EVENT = {
+    'pre-tool-use': 'PreToolUse',
+    'post-tool-use': 'PostToolUse',
+    'pre-compact': 'PreCompact',
+    'session-start': 'SessionStart',
+};
+export class ClaudeCodeAdapter {
+    host = 'claude-code';
+    supports(trigger) {
+        return trigger in TRIGGER_TO_EVENT || trigger === 'pre-commit';
+    }
+    translate(config) {
+        const hooks = [];
+        const hookFiles = [];
+        const skipped = [];
+        for (const rule of config.rules) {
+            if (!this.supports(rule.trigger)) {
+                skipped.push({ ruleId: rule.id, reason: `Trigger '${rule.trigger}' not supported` });
+                continue;
+            }
+            if (rule.trigger === 'pre-commit') {
+                // Pre-commit uses a hookify-style .local.md file
+                hookFiles.push({
+                    path: `.claude/hookify.${rule.id}.local.md`,
+                    content: this.generateHookFile(rule.id, rule.description, rule.pattern, rule.message),
+                    ruleId: rule.id,
+                });
+                continue;
+            }
+            const event = TRIGGER_TO_EVENT[rule.trigger];
+            if (!event) {
+                skipped.push({ ruleId: rule.id, reason: `No event mapping for '${rule.trigger}'` });
+                continue;
+            }
+            if (rule.pattern) {
+                // Pattern-based hook
+                hooks.push({
+                    event,
+                    command: this.generatePatternCommand(rule.id, rule.pattern, rule.action, rule.message),
+                    ruleId: rule.id,
+                });
+            }
+            else {
+                // Simple event hook
+                hooks.push({
+                    event,
+                    command: `echo "[${rule.id}] ${rule.message}"`,
+                    ruleId: rule.id,
+                });
+            }
+        }
+        const files = [];
+        // Generate settings.json hooks section
+        if (hooks.length > 0) {
+            const settingsHooks = hooks.map((h) => ({
+                event: h.event,
+                command: h.command,
+            }));
+            files.push({
+                path: '.claude/settings.json',
+                content: JSON.stringify({ hooks: settingsHooks }, null, 2),
+            });
+        }
+        // Add hookify files
+        for (const hf of hookFiles) {
+            files.push({ path: hf.path, content: hf.content });
+        }
+        return { host: this.host, files, skipped };
+    }
+    generatePatternCommand(ruleId, pattern, action, message) {
+        if (action === 'block') {
+            return `grep -rn '${pattern}' "$TOOL_INPUT" 2>/dev/null && echo "BLOCKED [${ruleId}]: ${message}" && exit 1 || exit 0`;
+        }
+        return `grep -rn '${pattern}' "$TOOL_INPUT" 2>/dev/null && echo "WARNING [${ruleId}]: ${message}" || true`;
+    }
+    generateHookFile(id, description, pattern, message) {
+        const lines = [
+            '---',
+            `name: ${id}`,
+            `description: ${description}`,
+            '---',
+            '',
+            `# ${id}`,
+            '',
+            description,
+            '',
+        ];
+        if (pattern) {
+            lines.push(`Pattern: \`${pattern}\``);
+        }
+        if (message) {
+            lines.push('', message);
+        }
+        return lines.join('\n');
+    }
+}
+//# sourceMappingURL=claude-code.js.map

package/dist/enforcement/adapters/claude-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../src/enforcement/adapters/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,MAAM,gBAAgB,GAAgD;IACpE,cAAc,EAAE,YAAY;IAC5B,eAAe,EAAE,aAAa;IAC9B,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,cAAc;CAChC,CAAC;AAEF,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,aAAa,CAAC;IAE9B,QAAQ,CAAC,OAA2B;QAClC,OAAO,OAAO,IAAI,gBAAgB,IAAI,OAAO,KAAK,YAAY,CAAC;IACjE,CAAC;IAED,SAAS,CAAC,MAAyB;QACjC,MAAM,KAAK,GAA8D,EAAE,CAAC;QAC5E,MAAM,SAAS,GAA6D,EAAE,CAAC;QAC/E,MAAM,OAAO,GAA8C,EAAE,CAAC;QAE9D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,OAAO,iBAAiB,EAAE,CAAC,CAAC;gBACrF,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;gBAClC,iDAAiD;gBACjD,SAAS,CAAC,IAAI,CAAC;oBACb,IAAI,EAAE,mBAAmB,IAAI,CAAC,EAAE,WAAW;oBAC3C,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC;oBACrF,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,yBAAyB,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;gBACpF,SAAS;YACX,CAAC;YAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,qBAAqB;gBACrB,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK;oBACL,OAAO,EAAE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC;oBACtF,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,oBAAoB;gBACpB,KAAK,CAAC,IAAI,CAAC;oBACT,KAAK;oBACL,OAAO,EAAE,UAAU,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,OAAO,GAAG;oBAC9C,MAAM,EAAE,IAAI,CAAC,EAAE;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAA6C,EAAE,CAAC;QAE3D,uCAAuC;QACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtC,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC,CAAC;YACJ,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,oBAAoB;QACpB,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IAEO,sBAAsB,CAC5B,MAAc,EACd,OAAe,EACf,MAAc,EACd,OAAe;QAEf,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,OAAO,aAAa,OAAO,iDAAiD,MAAM,MAAM,OAAO,uBAAuB,CAAC;QACzH,CAAC;QACD,OAAO,aAAa,OAAO,iDAAiD,MAAM,MAAM,OAAO,WAAW,CAAC;IAC7G,CAAC;IAEO,gBAAgB,CACtB,EAAU,EACV,WAAmB,EACnB,OAAgB,EAChB,OAAgB;QAEhB,MAAM,KAAK,GAAG;YACZ,KAAK;YACL,SAAS,EAAE,EAAE;YACb,gBAAgB,WAAW,EAAE;YAC7B,KAAK;YACL,EAAE;YACF,KAAK,EAAE,EAAE;YACT,EAAE;YACF,WAAW;YACX,EAAE;SACH,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/enforcement/adapters/index.d.ts

@@ -0,0 +1,2 @@
+export { ClaudeCodeAdapter } from './claude-code.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/enforcement/adapters/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/enforcement/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/enforcement/adapters/index.js

@@ -0,0 +1,2 @@
+export { ClaudeCodeAdapter } from './claude-code.js';
+//# sourceMappingURL=index.js.map

package/dist/enforcement/adapters/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/enforcement/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/enforcement/index.d.ts

@@ -0,0 +1,4 @@
+export { EnforcementRegistry } from './registry.js';
+export { ClaudeCodeAdapter } from './adapters/index.js';
+export type { EnforcementTrigger, EnforcementAction, EnforcementRule, EnforcementConfig, HostAdapterResult, HostAdapter, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/enforcement/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enforcement/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/enforcement/index.js

@@ -0,0 +1,3 @@
+export { EnforcementRegistry } from './registry.js';
+export { ClaudeCodeAdapter } from './adapters/index.js';
+//# sourceMappingURL=index.js.map

package/dist/enforcement/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enforcement/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/enforcement/registry.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Enforcement registry — manages rules and adapters.
+ */
+import type { EnforcementConfig, EnforcementRule, HostAdapter, HostAdapterResult } from './types.js';
+export declare class EnforcementRegistry {
+    private rules;
+    private adapters;
+    addRule(rule: EnforcementRule): void;
+    addRules(rules: EnforcementRule[]): void;
+    removeRule(id: string): boolean;
+    getRule(id: string): EnforcementRule | undefined;
+    getRules(): EnforcementRule[];
+    getEnabledRules(): EnforcementRule[];
+    getConfig(): EnforcementConfig;
+    registerAdapter(adapter: HostAdapter): void;
+    getAdapter(host: string): HostAdapter | undefined;
+    listAdapters(): string[];
+    /** Translate rules for a specific host */
+    translate(host: string): HostAdapterResult;
+    /** Translate rules for all registered adapters */
+    translateAll(): HostAdapterResult[];
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/enforcement/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/enforcement/registry.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,KAAK,CAAyB;IACtC,OAAO,CAAC,QAAQ,CAAkC;IAElD,OAAO,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI;IAMpC,QAAQ,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,IAAI;IAMxC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAM/B,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAIhD,QAAQ,IAAI,eAAe,EAAE;IAI7B,eAAe,IAAI,eAAe,EAAE;IAIpC,SAAS,IAAI,iBAAiB;IAI9B,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAI3C,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS;IAIjD,YAAY,IAAI,MAAM,EAAE;IAIxB,0CAA0C;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB;IAe1C,kDAAkD;IAClD,YAAY,IAAI,iBAAiB,EAAE;CAGpC"}

package/dist/enforcement/registry.js

@@ -0,0 +1,63 @@
+/**
+ * Enforcement registry — manages rules and adapters.
+ */
+export class EnforcementRegistry {
+    rules = [];
+    adapters = new Map();
+    addRule(rule) {
+        // Replace if same ID exists
+        this.rules = this.rules.filter((r) => r.id !== rule.id);
+        this.rules.push(rule);
+    }
+    addRules(rules) {
+        for (const rule of rules) {
+            this.addRule(rule);
+        }
+    }
+    removeRule(id) {
+        const before = this.rules.length;
+        this.rules = this.rules.filter((r) => r.id !== id);
+        return this.rules.length < before;
+    }
+    getRule(id) {
+        return this.rules.find((r) => r.id === id);
+    }
+    getRules() {
+        return [...this.rules];
+    }
+    getEnabledRules() {
+        return this.rules.filter((r) => r.enabled !== false);
+    }
+    getConfig() {
+        return { rules: this.getEnabledRules() };
+    }
+    registerAdapter(adapter) {
+        this.adapters.set(adapter.host, adapter);
+    }
+    getAdapter(host) {
+        return this.adapters.get(host);
+    }
+    listAdapters() {
+        return [...this.adapters.keys()];
+    }
+    /** Translate rules for a specific host */
+    translate(host) {
+        const adapter = this.adapters.get(host);
+        if (!adapter) {
+            return {
+                host,
+                files: [],
+                skipped: this.getEnabledRules().map((r) => ({
+                    ruleId: r.id,
+                    reason: `No adapter registered for host: ${host}`,
+                })),
+            };
+        }
+        return adapter.translate(this.getConfig());
+    }
+    /** Translate rules for all registered adapters */
+    translateAll() {
+        return [...this.adapters.keys()].map((host) => this.translate(host));
+    }
+}
+//# sourceMappingURL=registry.js.map

package/dist/enforcement/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/enforcement/registry.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,OAAO,mBAAmB;IACtB,KAAK,GAAsB,EAAE,CAAC;IAC9B,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;IAElD,OAAO,CAAC,IAAqB;QAC3B,4BAA4B;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,QAAQ,CAAC,KAAwB;QAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,UAAU,CAAC,EAAU;QACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,eAAe;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,SAAS;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,eAAe,CAAC,OAAoB;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,0CAA0C;IAC1C,SAAS,CAAC,IAAY;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,IAAI;gBACJ,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC1C,MAAM,EAAE,CAAC,CAAC,EAAE;oBACZ,MAAM,EAAE,mCAAmC,IAAI,EAAE;iBAClD,CAAC,CAAC;aACJ,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,kDAAkD;IAClD,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;CACF"}

package/dist/enforcement/types.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Host-agnostic enforcement declarations.
+ *
+ * Agents declare rules abstractly; host adapters translate
+ * to platform-specific enforcement (Claude Code hooks, Cursor rules, etc.)
+ */
+/** When the rule should trigger */
+export type EnforcementTrigger = 'pre-tool-use' | 'post-tool-use' | 'pre-commit' | 'pre-compact' | 'session-start' | 'on-save';
+/** What happens when a rule matches */
+export type EnforcementAction = 'block' | 'warn' | 'suggest';
+/** A single enforcement rule declared by the agent */
+export interface EnforcementRule {
+    id: string;
+    description: string;
+    trigger: EnforcementTrigger;
+    /** Regex pattern to match (in file content, tool args, etc.) */
+    pattern?: string;
+    /** Context filter — only applies when this context is active */
+    context?: string;
+    /** What to do on match */
+    action: EnforcementAction;
+    /** Message shown to user/LLM when triggered */
+    message: string;
+    /** Whether this rule is enabled (default: true) */
+    enabled?: boolean;
+}
+/** Complete enforcement config for an agent */
+export interface EnforcementConfig {
+    rules: EnforcementRule[];
+}
+/** Result of translating rules for a specific host */
+export interface HostAdapterResult {
+    host: string;
+    files: Array<{
+        path: string;
+        content: string;
+    }>;
+    skipped: Array<{
+        ruleId: string;
+        reason: string;
+    }>;
+}
+/** Host adapter interface — translates abstract rules to host-specific config */
+export interface HostAdapter {
+    readonly host: string;
+    /** Check if this adapter supports a given trigger type */
+    supports(trigger: EnforcementTrigger): boolean;
+    /** Translate rules to host-specific config files */
+    translate(config: EnforcementConfig): HostAdapterResult;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/enforcement/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/enforcement/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,mCAAmC;AACnC,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,eAAe,GACf,YAAY,GACZ,aAAa,GACb,eAAe,GACf,SAAS,CAAC;AAEd,uCAAuC;AACvC,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0BAA0B;IAC1B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,EAAE,CAAC;CAC1B;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAED,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;IAC/C,oDAAoD;IACpD,SAAS,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAAC;CACzD"}

package/dist/enforcement/types.js

@@ -0,0 +1,8 @@
+/**
+ * Host-agnostic enforcement declarations.
+ *
+ * Agents declare rules abstractly; host adapters translate
+ * to platform-specific enforcement (Claude Code hooks, Cursor rules, etc.)
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/enforcement/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/enforcement/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/facades/facade-factory.d.ts

@@ -1,5 +1,12 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import type { FacadeConfig } from './types.js';
-export declare function registerFacade(server: McpServer, facade: FacadeConfig): void;
-export declare function registerAllFacades(server: McpServer, facades: FacadeConfig[]): void;
+import type { FacadeConfig, AuthPolicy } from './types.js';
+export declare function registerFacade(server: McpServer, facade: FacadeConfig, authPolicy?: () => AuthPolicy): void;
+export interface RegisterOptions {
+    authPolicy?: () => AuthPolicy;
+    /** Agent ID prefix for hot op tool names */
+    agentId?: string;
+    /** Op names to promote to standalone MCP tools (requires agentId) */
+    hotOps?: Set<string> | string[];
+}
+export declare function registerAllFacades(server: McpServer, facades: FacadeConfig[], authPolicyOrOptions?: (() => AuthPolicy) | RegisterOptions): void;
 //# sourceMappingURL=facade-factory.d.ts.map

package/dist/facades/facade-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facade-factory.d.ts","sourceRoot":"","sources":["../../src/facades/facade-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAkB,MAAM,YAAY,CAAC;AAE/D,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAe5E;AAwCD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,IAAI,CAInF"}
+{"version":3,"file":"facade-factory.d.ts","sourceRoot":"","sources":["../../src/facades/facade-factory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEpE,OAAO,KAAK,EAAE,YAAY,EAAkB,UAAU,EAAgB,MAAM,YAAY,CAAC;AAGzF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,UAAU,CAAC,EAAE,MAAM,UAAU,GAC5B,IAAI,CAeN;AA2ID,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,MAAM,UAAU,CAAC;IAC9B,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;CACjC;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE,YAAY,EAAE,EACvB,mBAAmB,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,GAAG,eAAe,GACzD,IAAI,CAqBN"}

package/dist/facades/facade-factory.js

@@ -1,15 +1,37 @@
 import { z } from 'zod';
-export function registerFacade(server, facade) {
+import { AUTH_LEVEL_RANK } from './types.js';
+export function registerFacade(server, facade, authPolicy) {
     const opNames = facade.ops.map((o) => o.name);
     server.tool(facade.name, facade.description, {
         op: z.string().describe(`Operation: ${opNames.join(' | ')}`),
         params: z.record(z.unknown()).optional().default({}).describe('Operation parameters'),
     }, async ({ op, params }) => {
-        const response = await dispatchOp(facade, op, params);
+        const response = await dispatchOp(facade, op, params, authPolicy?.());
         return { content: [{ type: 'text', text: JSON.stringify(response, null, 2) }] };
     });
 }
-async function dispatchOp(facade, opName, params) {
+function checkAuth(opName, opAuth, facadeName, policy) {
+    if (!policy || policy.mode === 'permissive')
+        return null;
+    const requiredLevel = policy.overrides?.[opName] ?? opAuth;
+    const callerRank = AUTH_LEVEL_RANK[policy.callerLevel] ?? 0;
+    const requiredRank = AUTH_LEVEL_RANK[requiredLevel] ?? 0;
+    if (callerRank >= requiredRank)
+        return null;
+    const message = `Auth denied: "${opName}" requires ${requiredLevel}, caller has ${policy.callerLevel}`;
+    if (policy.mode === 'warn') {
+        console.error(`[auth-warn] ${message}`);
+        return null; // warn but allow
+    }
+    // enforce mode — block
+    return {
+        success: false,
+        error: message,
+        op: opName,
+        facade: facadeName,
+    };
+}
+async function dispatchOp(facade, opName, params, authPolicy) {
     const op = facade.ops.find((o) => o.name === opName);
     if (!op) {
         return {
@@ -19,6 +41,10 @@ async function dispatchOp(facade, opName, params) {
             facade: facade.name,
         };
     }
+    // Auth check — before validation or execution
+    const authResult = checkAuth(opName, op.auth, facade.name, authPolicy);
+    if (authResult)
+        return authResult;
     try {
         let validatedParams = params;
         if (op.schema) {
@@ -41,9 +67,72 @@ async function dispatchOp(facade, opName, params) {
         return { success: false, error: message, op: opName, facade: facade.name };
     }
 }
-export function registerAllFacades(server, facades) {
+/**
+ * Register a single hot op as a standalone MCP tool with full schema discovery.
+ * The op remains in its facade too — this is additive, not a move.
+ */
+function registerHotOp(server, agentId, facadeName, op, authPolicy) {
+    const toolName = `${agentId}_${op.name}`;
+    const schema = op.schema
+        ? op.schema.shape
+            ? op.schema
+            : z.object({ params: op.schema })
+        : z.object({});
+    server.tool(toolName, op.description, schema instanceof z.ZodObject ? schema.shape : {}, async (params) => {
+        const policy = authPolicy?.();
+        const authResult = checkAuth(op.name, op.auth, facadeName, policy);
+        if (authResult) {
+            return { content: [{ type: 'text', text: JSON.stringify(authResult, null, 2) }] };
+        }
+        try {
+            let validatedParams = params;
+            if (op.schema) {
+                const result = op.schema.safeParse(params);
+                if (!result.success) {
+                    const response = {
+                        success: false,
+                        error: `Invalid params: ${result.error.message}`,
+                        op: op.name,
+                        facade: facadeName,
+                    };
+                    return {
+                        content: [{ type: 'text', text: JSON.stringify(response, null, 2) }],
+                    };
+                }
+                validatedParams = result.data;
+            }
+            const data = await op.handler(validatedParams);
+            const response = { success: true, data, op: op.name, facade: facadeName };
+            return { content: [{ type: 'text', text: JSON.stringify(response, null, 2) }] };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const response = {
+                success: false,
+                error: message,
+                op: op.name,
+                facade: facadeName,
+            };
+            return { content: [{ type: 'text', text: JSON.stringify(response, null, 2) }] };
+        }
+    });
+}
+export function registerAllFacades(server, facades, authPolicyOrOptions) {
+    // Support both legacy signature and new options
+    const opts = typeof authPolicyOrOptions === 'function'
+        ? { authPolicy: authPolicyOrOptions }
+        : (authPolicyOrOptions ?? {});
+    const hotSet = opts.hotOps instanceof Set ? opts.hotOps : new Set(opts.hotOps ?? []);
     for (const facade of facades) {
-        registerFacade(server, facade);
+        registerFacade(server, facade, opts.authPolicy);
+        // Promote hot ops to standalone tools
+        if (opts.agentId) {
+            for (const op of facade.ops) {
+                if (op.hot || hotSet.has(op.name)) {
+                    registerHotOp(server, opts.agentId, facade.name, op, opts.authPolicy);
+                }
+            }
+        }
     }
 }
 //# sourceMappingURL=facade-factory.js.map

package/dist/facades/facade-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"facade-factory.js","sourceRoot":"","sources":["../../src/facades/facade-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,UAAU,cAAc,CAAC,MAAiB,EAAE,MAAoB;IACpE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,WAAW,EAClB;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACtF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAA+D,EAAE;QACpF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3F,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAoB,EACpB,MAAc,EACd,MAA+B;IAE/B,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB,MAAM,QAAQ,MAAM,CAAC,IAAI,gBAAgB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChH,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,MAAM,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,IAAI,eAAe,GAAG,MAAM,CAAC;QAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,sBAAsB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;oBAC9D,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,MAAM,CAAC,IAAI;iBACpB,CAAC;YACJ,CAAC;YACD,eAAe,GAAG,MAAM,CAAC,IAA+B,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,OAAuB;IAC3E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}
+{"version":3,"file":"facade-factory.js","sourceRoot":"","sources":["../../src/facades/facade-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,UAAU,cAAc,CAC5B,MAAiB,EACjB,MAAoB,EACpB,UAA6B;IAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,WAAW,EAClB;QACE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC;KACtF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAA+D,EAAE;QACpF,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3F,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,MAAc,EACd,MAAc,EACd,UAAkB,EAClB,MAA8B;IAE9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,IAAK,MAAuC,CAAC;IAC7F,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,eAAe,CAAC,aAA6C,CAAC,IAAI,CAAC,CAAC;IAEzF,IAAI,UAAU,IAAI,YAAY;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,OAAO,GAAG,iBAAiB,MAAM,cAAc,aAAa,gBAAgB,MAAM,CAAC,WAAW,EAAE,CAAC;IAEvG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAChC,CAAC;IAED,uBAAuB;IACvB,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,OAAO;QACd,EAAE,EAAE,MAAM;QACV,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,MAAoB,EACpB,MAAc,EACd,MAA+B,EAC/B,UAAuB;IAEvB,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB,MAAM,QAAQ,MAAM,CAAC,IAAI,gBAAgB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChH,EAAE,EAAE,MAAM;YACV,MAAM,EAAE,MAAM,CAAC,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvE,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAElC,IAAI,CAAC;QACH,IAAI,eAAe,GAAG,MAAM,CAAC;QAC7B,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,sBAAsB,MAAM,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;oBAC9D,EAAE,EAAE,MAAM;oBACV,MAAM,EAAE,MAAM,CAAC,IAAI;iBACpB,CAAC;YACJ,CAAC;YACD,eAAe,GAAG,MAAM,CAAC,IAA+B,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,MAAiB,EACjB,OAAe,EACf,UAAkB,EAClB,EAAgB,EAChB,UAA6B;IAE7B,MAAM,QAAQ,GAAG,GAAG,OAAO,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM;QACtB,CAAC,CAAE,EAAE,CAAC,MAAqC,CAAC,KAAK;YAC/C,CAAC,CAAE,EAAE,CAAC,MAAqC;YAC3C,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAEjB,MAAM,CAAC,IAAI,CACT,QAAQ,EACR,EAAE,CAAC,WAAW,EACd,MAAM,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EACjD,KAAK,EAAE,MAAM,EAA+D,EAAE;QAC5E,MAAM,MAAM,GAAG,UAAU,EAAE,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7F,CAAC;QAED,IAAI,CAAC;YACH,IAAI,eAAe,GAAG,MAAiC,CAAC;YACxD,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAmB;wBAC/B,OAAO,EAAE,KAAK;wBACd,KAAK,EAAE,mBAAmB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;wBAChD,EAAE,EAAE,EAAE,CAAC,IAAI;wBACX,MAAM,EAAE,UAAU;qBACnB,CAAC;oBACF,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;qBAC9E,CAAC;gBACJ,CAAC;gBACD,eAAe,GAAG,MAAM,CAAC,IAA+B,CAAC;YAC3D,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAC1F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAmB;gBAC/B,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,OAAO;gBACd,EAAE,EAAE,EAAE,CAAC,IAAI;gBACX,MAAM,EAAE,UAAU;aACnB,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,OAAuB,EACvB,mBAA0D;IAE1D,gDAAgD;IAChD,MAAM,IAAI,GACR,OAAO,mBAAmB,KAAK,UAAU;QACvC,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE;QACrC,CAAC,CAAC,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAErF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAEhD,sCAAsC;QACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC5B,IAAI,EAAE,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/facades/types.d.ts

@@ -3,6 +3,18 @@ import { z } from 'zod';
 export type OpHandler = (params: Record<string, unknown>) => Promise<unknown>;
 /** Auth level required for an operation */
 export type AuthLevel = 'read' | 'write' | 'admin';
+/** Auth enforcement mode */
+export type AuthMode = 'permissive' | 'warn' | 'enforce';
+/** Auth policy for facade dispatch */
+export interface AuthPolicy {
+    mode: AuthMode;
+    /** Caller's auth level — ops requiring a higher level are blocked/warned */
+    callerLevel: AuthLevel;
+    /** Per-op overrides: opName → required level */
+    overrides?: Record<string, AuthLevel>;
+}
+/** Numeric auth level for comparison: read=0, write=1, admin=2 */
+export declare const AUTH_LEVEL_RANK: Record<AuthLevel, number>;
 /** Operation definition within a facade */
 export interface OpDefinition {
     name: string;
@@ -10,6 +22,8 @@ export interface OpDefinition {
     auth: AuthLevel;
     handler: OpHandler;
     schema?: z.ZodType;
+    /** Promote to a first-class MCP tool with full schema discovery. */
+    hot?: boolean;
 }
 /** Facade configuration — one MCP tool */
 export interface FacadeConfig {
@@ -32,8 +46,8 @@ export declare const facadeInputSchema: z.ZodObject<{
     op: z.ZodString;
     params: z.ZodDefault<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
 }, "strip", z.ZodTypeAny, {
-    op: string;
     params: Record<string, unknown>;
+    op: string;
 }, {
     op: string;
     params?: Record<string, unknown> | undefined;

package/dist/facades/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/facades/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qDAAqD;AACrD,MAAM,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9E,2CAA2C;AAC3C,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnD,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;CACpB;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,GAAG,EAAE,YAAY,EAAE,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/facades/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qDAAqD;AACrD,MAAM,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9E,2CAA2C;AAC3C,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnD,4BAA4B;AAC5B,MAAM,MAAM,QAAQ,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;AAEzD,sCAAsC;AACtC,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,4EAA4E;IAC5E,WAAW,EAAE,SAAS,CAAC;IACvB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACvC;AAED,kEAAkE;AAClE,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAIrD,CAAC;AAEF,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACnB,oEAAoE;IACpE,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IAC3B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,GAAG,EAAE,YAAY,EAAE,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/facades/types.js

@@ -1,4 +1,10 @@
 import { z } from 'zod';
+/** Numeric auth level for comparison: read=0, write=1, admin=2 */
+export const AUTH_LEVEL_RANK = {
+    read: 0,
+    write: 1,
+    admin: 2,
+};
 export const facadeInputSchema = z.object({
     op: z.string().describe('Operation name'),
     params: z.record(z.unknown()).optional().default({}),

package/dist/facades/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/facades/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoCxB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACrD,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/facades/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAA8B;IACxD,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC;AAgCF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACrD,CAAC,CAAC"}

package/dist/health/health-registry.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Centralized health registry — subsystems report status,
+ * consumers observe transitions, self-healing retries on recovery.
+ */
+export type SubsystemStatus = 'healthy' | 'degraded' | 'down';
+export interface SubsystemHealth {
+    name: string;
+    status: SubsystemStatus;
+    lastCheckedAt: number;
+    lastHealthyAt: number | null;
+    failureCount: number;
+    lastError: string | null;
+}
+export type StatusChangeListener = (name: string, prev: SubsystemStatus, next: SubsystemStatus) => void;
+export type RecoveryHook = (name: string) => void | Promise<void>;
+export interface HealthSnapshot {
+    overall: SubsystemStatus;
+    subsystems: Record<string, SubsystemHealth>;
+    registeredAt: number;
+}
+export declare class HealthRegistry {
+    private subsystems;
+    private listeners;
+    private recoveryHooks;
+    private readonly registeredAt;
+    register(name: string, initialStatus?: SubsystemStatus): void;
+    update(name: string, status: SubsystemStatus, error?: string): void;
+    get(name: string): SubsystemHealth | undefined;
+    snapshot(): HealthSnapshot;
+    onStatusChange(listener: StatusChangeListener): void;
+    onRecovery(subsystem: string, hook: RecoveryHook): void;
+    private triggerRecovery;
+    private computeOverall;
+}
+/**
+ * Wrap an async call with graceful degradation.
+ * On failure, returns the fallback value and updates health registry.
+ */
+export declare function withDegradation<T>(registry: HealthRegistry, subsystem: string, fn: () => Promise<T>, fallback: T): Promise<T>;
+//# sourceMappingURL=health-registry.d.ts.map

package/dist/health/health-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-registry.d.ts","sourceRoot":"","sources":["../../src/health/health-registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,eAAe,KAClB,IAAI,CAAC;AAEV,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,UAAU,CAAsC;IACxD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,aAAa,CAAqC;IAC1D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAE3C,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,GAAE,eAA2B,GAAG,IAAI;IAYxE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAsCnE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAI9C,QAAQ,IAAI,cAAc;IAY1B,cAAc,CAAC,QAAQ,EAAE,oBAAoB,GAAG,IAAI;IAIpD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI;IAMvD,OAAO,CAAC,eAAe;IAiBvB,OAAO,CAAC,cAAc;CAWvB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,QAAQ,EAAE,CAAC,GACV,OAAO,CAAC,CAAC,CAAC,CAaZ"}