@tangle-network/agent-runtime 0.337.2 → 0.339.0

package/dist/integrations-DopfCC2a.d.ts

@@ -1,190 +0,0 @@
-//#region src/platform/integrations.d.ts
-/**
- * Server-side client for the Tangle platform's integration hub
- * (`/v1/hub/*`). Consumer apps use this instead of rolling their own
- * OAuth + connection tables.
- *
- * Auth: the caller supplies a bearer (either the user's API key from
- * cross-site exchange, or a platform service token) on construction.
- *
- * Endpoint contract (authoritative): the platform's `src/lib/hub-contract.ts`
- * + `src/routes/hub.ts`. The platform wraps every response in
- * `{ success, data }`; non-2xx or `success:false` surfaces as `PlatformHubError`
- * carrying the real upstream status.
- */
-interface PlatformHubClientOptions {
-  /** Platform base URL, e.g. `https://id.tangle.tools`. */
-  baseUrl: string;
-  /** Bearer credential — user API key or service token. */
-  bearer: string;
-  /** Override fetch (tests + edge runtimes). */
-  fetchImpl?: typeof fetch;
-}
-/** A live integration connection, as returned by `/v1/hub/connections`. */
-interface PlatformConnection {
-  id: string;
-  providerId: string;
-  displayName: string;
-  accountDisplay: string | null;
-  scopes: string[];
-  status: 'active' | 'revoked' | 'unhealthy' | 'reconnect_required' | (string & {});
-  health: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {});
-  createdAt: string;
-  updatedAt: string;
-  lastUsedAt: string | null;
-}
-/** A connectable provider in the catalog (`/v1/hub/providers`). */
-interface PlatformCatalogProvider {
-  providerId: string;
-  title?: string;
-  authKind?: string;
-  category?: string;
-  scopes?: string[];
-  capabilityCount?: number;
-  native?: boolean;
-  /** Whether the OAuth app's credentials are wired — the UI offers Connect
-   *  only when true. */
-  configured?: boolean;
-  [k: string]: unknown;
-}
-interface CatalogResult {
-  providers: PlatformCatalogProvider[];
-  /** Count of substrate-bundled connectors behind the catalog. */
-  substrateBundled?: number;
-  [k: string]: unknown;
-}
-interface StartAuthInput {
-  /** The provider to connect (goes in the URL path). */
-  providerId: string;
-  /** Accepted for interface compatibility; the platform's start endpoint is
-   *  provider-level and does not consume a connector id. */
-  connectorId?: string;
-  /** Where the platform redirects the user back to after OAuth. */
-  returnUrl: string;
-  /** Accepted for interface compatibility; not consumed by the start endpoint. */
-  requestedScopes?: string[];
-  /** CLI flow flag — affects the platform's post-auth redirect handling. */
-  cli?: boolean;
-}
-interface StartAuthResult {
-  /** The URL to send the user to. Normalized across the platform's two start
-   *  branches: github returns `authorizationUrl`, substrate returns
-   *  `redirectUrl`. */
-  authorizationUrl: string;
-  state: string;
-  expiresAt?: string;
-  scopes?: string[];
-}
-interface ConnectionHealth {
-  status: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {});
-  checkedAt: string;
-  error?: {
-    code: string;
-    message: string;
-  };
-}
-interface ConnectionHealthResult {
-  connection: PlatformConnection;
-  health: ConnectionHealth;
-}
-/** Last-known health for a connection, derived from the connection row. */
-interface HealthCheck {
-  connectionId: string;
-  providerId: string;
-  /** Mirrors `PlatformConnection.health`. */
-  status: ConnectionHealth['status'];
-  checkedAt?: string;
-}
-interface MintTokenInput {
-  /** The hub action the token authorizes (e.g. `slack.chat.postMessage`). */
-  actionPath: string;
-  /** Bind to a specific connection, or … */
-  connectionId?: string;
-  /** … resolve the connection by provider for the calling user. */
-  provider?: string;
-}
-interface MintTokenResult {
-  tokenId: string;
-  token: string;
-  expiresAt: string;
-}
-interface ExecInput {
-  /** The hub action path to execute. */
-  path: string;
-  input?: unknown;
-  connectionId?: string;
-}
-interface PlatformHubStatus {
-  contract?: unknown;
-  principal: {
-    kind: string;
-    userId: string;
-    [k: string]: unknown;
-  };
-  connections: {
-    connectedProviderCount: number;
-    unhealthyProviderCount: number;
-  };
-}
-/** Thrown when a `PlatformHubClient` request returns a non-success status. */
-declare class PlatformHubError extends Error {
-  readonly status: number;
-  readonly code: string | undefined;
-  readonly body: unknown;
-  constructor(message: string, status: number, code: string | undefined, body: unknown);
-}
-/** HTTP client for the Tangle Platform Hub API: provider catalog, connection flow, and status. */
-declare class PlatformHubClient {
-  private readonly baseUrl;
-  private readonly bearer;
-  private readonly fetchImpl;
-  constructor(options: PlatformHubClientOptions);
-  /** GET /v1/hub/providers — the connectable provider catalog. */
-  catalog(): Promise<CatalogResult>;
-  /** GET /v1/hub/connections — the calling user's live connections. */
-  listConnections(): Promise<PlatformConnection[]>;
-  /** DELETE /v1/hub/connections/:connectionId — revoke + disable a connection. */
-  revokeConnection(connectionId: string): Promise<{
-    connection: PlatformConnection;
-  }>;
-  /**
-   * POST /v1/hub/connections/:provider/start — begin OAuth/grant. The provider
-   * is taken from the URL; the body carries `returnUrl` (+ `cli`). The platform's
-   * two start branches name the URL field differently (github → `authorizationUrl`,
-   * substrate → `redirectUrl`); this normalizes to `authorizationUrl`.
-   */
-  startAuth(input: StartAuthInput): Promise<StartAuthResult>;
-  /**
-   * Last-known health for every connection. The platform has no global
-   * healthcheck listing — health rides on each connection row — so this derives
-   * the list from `listConnections()` (one request, no extra round-trips).
-   */
-  listHealthchecks(): Promise<HealthCheck[]>;
-  /**
-   * POST /v1/hub/connections/:connectionId/health — trigger a fresh health
-   * probe for one connection and return its updated state.
-   */
-  checkConnectionHealth(connectionId: string): Promise<ConnectionHealthResult>;
-  /**
-   * Trigger a fresh health probe across all of the user's connections. The
-   * platform exposes health per-connection only, so this fans out over
-   * `listConnections()`. `scheduled` is the number of probes dispatched.
-   */
-  runHealthchecks(): Promise<{
-    scheduled: number;
-  }>;
-  /** GET /v1/hub/status — principal + aggregate connection counts. */
-  status(): Promise<PlatformHubStatus>;
-  /**
-   * POST /v1/hub/tokens — mint a short-lived, action-scoped capability token a
-   * sandbox can use to invoke one hub action on the user's behalf without
-   * seeing the underlying provider credential.
-   */
-  mintToken(input: MintTokenInput): Promise<MintTokenResult>;
-  /** POST /v1/hub/exec — execute a hub action and return its result. */
-  exec(input: ExecInput): Promise<unknown>;
-  private request;
-}
-//#endregion
-export { HealthCheck as a, PlatformCatalogProvider as c, PlatformHubClientOptions as d, PlatformHubError as f, StartAuthResult as h, ExecInput as i, PlatformConnection as l, StartAuthInput as m, ConnectionHealth as n, MintTokenInput as o, PlatformHubStatus as p, ConnectionHealthResult as r, MintTokenResult as s, CatalogResult as t, PlatformHubClient as u };
-//# sourceMappingURL=integrations-DopfCC2a.d.ts.map

package/dist/integrations-dFi-ALk7.js

@@ -1,132 +0,0 @@
-//#region src/platform/integrations.ts
-/** Thrown when a `PlatformHubClient` request returns a non-success status. */
-var PlatformHubError = class extends Error {
-	status;
-	code;
-	body;
-	constructor(message, status, code, body) {
-		super(message);
-		this.status = status;
-		this.code = code;
-		this.body = body;
-		this.name = "PlatformHubError";
-	}
-};
-/** HTTP client for the Tangle Platform Hub API: provider catalog, connection flow, and status. */
-var PlatformHubClient = class {
-	baseUrl;
-	bearer;
-	fetchImpl;
-	constructor(options) {
-		if (!options.baseUrl) throw new Error("PlatformHubClient: baseUrl is required");
-		if (!options.bearer) throw new Error("PlatformHubClient: bearer is required");
-		this.baseUrl = options.baseUrl.replace(/\/+$/, "");
-		this.bearer = options.bearer;
-		this.fetchImpl = options.fetchImpl ?? ((url, init) => fetch(url, init));
-	}
-	/** GET /v1/hub/providers — the connectable provider catalog. */
-	catalog() {
-		return this.request("GET", "/v1/hub/providers");
-	}
-	/** GET /v1/hub/connections — the calling user's live connections. */
-	async listConnections() {
-		return (await this.request("GET", "/v1/hub/connections")).connections;
-	}
-	/** DELETE /v1/hub/connections/:connectionId — revoke + disable a connection. */
-	revokeConnection(connectionId) {
-		return this.request("DELETE", `/v1/hub/connections/${encodeURIComponent(connectionId)}`);
-	}
-	/**
-	* POST /v1/hub/connections/:provider/start — begin OAuth/grant. The provider
-	* is taken from the URL; the body carries `returnUrl` (+ `cli`). The platform's
-	* two start branches name the URL field differently (github → `authorizationUrl`,
-	* substrate → `redirectUrl`); this normalizes to `authorizationUrl`.
-	*/
-	async startAuth(input) {
-		const body = { returnUrl: input.returnUrl };
-		if (input.cli !== void 0) body.cli = input.cli;
-		const data = await this.request("POST", `/v1/hub/connections/${encodeURIComponent(input.providerId)}/start`, body);
-		const authorizationUrl = data.authorizationUrl ?? data.redirectUrl;
-		if (!authorizationUrl) throw new PlatformHubError("Platform hub start response missing an authorization URL", 502, "HUB_INVALID_START_RESPONSE", data);
-		return {
-			authorizationUrl,
-			state: data.state,
-			expiresAt: data.expiresAt,
-			scopes: data.scopes
-		};
-	}
-	/**
-	* Last-known health for every connection. The platform has no global
-	* healthcheck listing — health rides on each connection row — so this derives
-	* the list from `listConnections()` (one request, no extra round-trips).
-	*/
-	async listHealthchecks() {
-		return (await this.listConnections()).map((c) => ({
-			connectionId: c.id,
-			providerId: c.providerId,
-			status: c.health,
-			checkedAt: c.updatedAt
-		}));
-	}
-	/**
-	* POST /v1/hub/connections/:connectionId/health — trigger a fresh health
-	* probe for one connection and return its updated state.
-	*/
-	checkConnectionHealth(connectionId) {
-		return this.request("POST", `/v1/hub/connections/${encodeURIComponent(connectionId)}/health`);
-	}
-	/**
-	* Trigger a fresh health probe across all of the user's connections. The
-	* platform exposes health per-connection only, so this fans out over
-	* `listConnections()`. `scheduled` is the number of probes dispatched.
-	*/
-	async runHealthchecks() {
-		const connections = await this.listConnections();
-		await Promise.allSettled(connections.map((c) => this.checkConnectionHealth(c.id)));
-		return { scheduled: connections.length };
-	}
-	/** GET /v1/hub/status — principal + aggregate connection counts. */
-	status() {
-		return this.request("GET", "/v1/hub/status");
-	}
-	/**
-	* POST /v1/hub/tokens — mint a short-lived, action-scoped capability token a
-	* sandbox can use to invoke one hub action on the user's behalf without
-	* seeing the underlying provider credential.
-	*/
-	mintToken(input) {
-		return this.request("POST", "/v1/hub/tokens", input);
-	}
-	/** POST /v1/hub/exec — execute a hub action and return its result. */
-	async exec(input) {
-		return (await this.request("POST", "/v1/hub/exec", input)).result;
-	}
-	async request(method, path, body) {
-		const headers = {
-			authorization: `Bearer ${this.bearer}`,
-			accept: "application/json"
-		};
-		if (body !== void 0) headers["content-type"] = "application/json";
-		const res = await this.fetchImpl(`${this.baseUrl}${path}`, {
-			method,
-			headers,
-			body: body !== void 0 ? JSON.stringify(body) : void 0
-		});
-		const text = await res.text();
-		let parsed = null;
-		if (text) try {
-			parsed = JSON.parse(text);
-		} catch {}
-		if (!res.ok || parsed && parsed.success === false) {
-			const code = parsed?.error && typeof parsed.error === "object" ? parsed.error.code : void 0;
-			throw new PlatformHubError(parsed?.error && typeof parsed.error === "object" && parsed.error.message || (typeof parsed?.error === "string" ? parsed.error : `Platform hub error (${res.status})`), res.status, code, parsed ?? text);
-		}
-		if (!parsed) throw new PlatformHubError(`Platform hub returned non-JSON success (${res.status})`, res.status, void 0, text);
-		if (parsed.data === void 0) throw new PlatformHubError("Platform hub envelope missing `data`", res.status, void 0, parsed);
-		return parsed.data;
-	}
-};
-//#endregion
-export { PlatformHubError as n, PlatformHubClient as t };
-
-//# sourceMappingURL=integrations-dFi-ALk7.js.map

package/dist/integrations-dFi-ALk7.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"integrations-dFi-ALk7.js","names":[],"sources":["../src/platform/integrations.ts"],"sourcesContent":["/**\n * Server-side client for the Tangle platform's integration hub\n * (`/v1/hub/*`). Consumer apps use this instead of rolling their own\n * OAuth + connection tables.\n *\n * Auth: the caller supplies a bearer (either the user's API key from\n * cross-site exchange, or a platform service token) on construction.\n *\n * Endpoint contract (authoritative): the platform's `src/lib/hub-contract.ts`\n * + `src/routes/hub.ts`. The platform wraps every response in\n * `{ success, data }`; non-2xx or `success:false` surfaces as `PlatformHubError`\n * carrying the real upstream status.\n */\n\nexport interface PlatformHubClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** Bearer credential — user API key or service token. */\n  bearer: string\n  /** Override fetch (tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\n/** A live integration connection, as returned by `/v1/hub/connections`. */\nexport interface PlatformConnection {\n  id: string\n  providerId: string\n  displayName: string\n  accountDisplay: string | null\n  scopes: string[]\n  status: 'active' | 'revoked' | 'unhealthy' | 'reconnect_required' | (string & {})\n  health: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {})\n  createdAt: string\n  updatedAt: string\n  lastUsedAt: string | null\n}\n\n/** A connectable provider in the catalog (`/v1/hub/providers`). */\nexport interface PlatformCatalogProvider {\n  providerId: string\n  title?: string\n  authKind?: string\n  category?: string\n  scopes?: string[]\n  capabilityCount?: number\n  native?: boolean\n  /** Whether the OAuth app's credentials are wired — the UI offers Connect\n   *  only when true. */\n  configured?: boolean\n  [k: string]: unknown\n}\n\nexport interface CatalogResult {\n  providers: PlatformCatalogProvider[]\n  /** Count of substrate-bundled connectors behind the catalog. */\n  substrateBundled?: number\n  [k: string]: unknown\n}\n\nexport interface StartAuthInput {\n  /** The provider to connect (goes in the URL path). */\n  providerId: string\n  /** Accepted for interface compatibility; the platform's start endpoint is\n   *  provider-level and does not consume a connector id. */\n  connectorId?: string\n  /** Where the platform redirects the user back to after OAuth. */\n  returnUrl: string\n  /** Accepted for interface compatibility; not consumed by the start endpoint. */\n  requestedScopes?: string[]\n  /** CLI flow flag — affects the platform's post-auth redirect handling. */\n  cli?: boolean\n}\n\nexport interface StartAuthResult {\n  /** The URL to send the user to. Normalized across the platform's two start\n   *  branches: github returns `authorizationUrl`, substrate returns\n   *  `redirectUrl`. */\n  authorizationUrl: string\n  state: string\n  expiresAt?: string\n  scopes?: string[]\n}\n\nexport interface ConnectionHealth {\n  status: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {})\n  checkedAt: string\n  error?: { code: string; message: string }\n}\n\nexport interface ConnectionHealthResult {\n  connection: PlatformConnection\n  health: ConnectionHealth\n}\n\n/** Last-known health for a connection, derived from the connection row. */\nexport interface HealthCheck {\n  connectionId: string\n  providerId: string\n  /** Mirrors `PlatformConnection.health`. */\n  status: ConnectionHealth['status']\n  checkedAt?: string\n}\n\nexport interface MintTokenInput {\n  /** The hub action the token authorizes (e.g. `slack.chat.postMessage`). */\n  actionPath: string\n  /** Bind to a specific connection, or … */\n  connectionId?: string\n  /** … resolve the connection by provider for the calling user. */\n  provider?: string\n}\n\nexport interface MintTokenResult {\n  tokenId: string\n  token: string\n  expiresAt: string\n}\n\nexport interface ExecInput {\n  /** The hub action path to execute. */\n  path: string\n  input?: unknown\n  connectionId?: string\n}\n\nexport interface PlatformHubStatus {\n  contract?: unknown\n  principal: { kind: string; userId: string; [k: string]: unknown }\n  connections: { connectedProviderCount: number; unhealthyProviderCount: number }\n}\n\n/** Thrown when a `PlatformHubClient` request returns a non-success status. */\nexport class PlatformHubError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string | undefined,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformHubError'\n  }\n}\n\ninterface PlatformEnvelope<T> {\n  success: boolean\n  data?: T\n  error?: { code?: string; message?: string } | string\n}\n\n/** HTTP client for the Tangle Platform Hub API: provider catalog, connection flow, and status. */\nexport class PlatformHubClient {\n  private readonly baseUrl: string\n  private readonly bearer: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformHubClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformHubClient: baseUrl is required')\n    if (!options.bearer) throw new Error('PlatformHubClient: bearer is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.bearer = options.bearer\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /** GET /v1/hub/providers — the connectable provider catalog. */\n  catalog(): Promise<CatalogResult> {\n    return this.request('GET', '/v1/hub/providers')\n  }\n\n  /** GET /v1/hub/connections — the calling user's live connections. */\n  async listConnections(): Promise<PlatformConnection[]> {\n    const data = await this.request<{ connections: PlatformConnection[] }>(\n      'GET',\n      '/v1/hub/connections',\n    )\n    return data.connections\n  }\n\n  /** DELETE /v1/hub/connections/:connectionId — revoke + disable a connection. */\n  revokeConnection(connectionId: string): Promise<{ connection: PlatformConnection }> {\n    return this.request('DELETE', `/v1/hub/connections/${encodeURIComponent(connectionId)}`)\n  }\n\n  /**\n   * POST /v1/hub/connections/:provider/start — begin OAuth/grant. The provider\n   * is taken from the URL; the body carries `returnUrl` (+ `cli`). The platform's\n   * two start branches name the URL field differently (github → `authorizationUrl`,\n   * substrate → `redirectUrl`); this normalizes to `authorizationUrl`.\n   */\n  async startAuth(input: StartAuthInput): Promise<StartAuthResult> {\n    const body: { returnUrl: string; cli?: boolean } = { returnUrl: input.returnUrl }\n    if (input.cli !== undefined) body.cli = input.cli\n    const data = await this.request<{\n      authorizationUrl?: string\n      redirectUrl?: string\n      state: string\n      expiresAt?: string\n      scopes?: string[]\n    }>('POST', `/v1/hub/connections/${encodeURIComponent(input.providerId)}/start`, body)\n    const authorizationUrl = data.authorizationUrl ?? data.redirectUrl\n    if (!authorizationUrl) {\n      throw new PlatformHubError(\n        'Platform hub start response missing an authorization URL',\n        502,\n        'HUB_INVALID_START_RESPONSE',\n        data,\n      )\n    }\n    return { authorizationUrl, state: data.state, expiresAt: data.expiresAt, scopes: data.scopes }\n  }\n\n  /**\n   * Last-known health for every connection. The platform has no global\n   * healthcheck listing — health rides on each connection row — so this derives\n   * the list from `listConnections()` (one request, no extra round-trips).\n   */\n  async listHealthchecks(): Promise<HealthCheck[]> {\n    const connections = await this.listConnections()\n    return connections.map((c) => ({\n      connectionId: c.id,\n      providerId: c.providerId,\n      status: c.health,\n      checkedAt: c.updatedAt,\n    }))\n  }\n\n  /**\n   * POST /v1/hub/connections/:connectionId/health — trigger a fresh health\n   * probe for one connection and return its updated state.\n   */\n  checkConnectionHealth(connectionId: string): Promise<ConnectionHealthResult> {\n    return this.request('POST', `/v1/hub/connections/${encodeURIComponent(connectionId)}/health`)\n  }\n\n  /**\n   * Trigger a fresh health probe across all of the user's connections. The\n   * platform exposes health per-connection only, so this fans out over\n   * `listConnections()`. `scheduled` is the number of probes dispatched.\n   */\n  async runHealthchecks(): Promise<{ scheduled: number }> {\n    const connections = await this.listConnections()\n    await Promise.allSettled(connections.map((c) => this.checkConnectionHealth(c.id)))\n    return { scheduled: connections.length }\n  }\n\n  /** GET /v1/hub/status — principal + aggregate connection counts. */\n  status(): Promise<PlatformHubStatus> {\n    return this.request('GET', '/v1/hub/status')\n  }\n\n  /**\n   * POST /v1/hub/tokens — mint a short-lived, action-scoped capability token a\n   * sandbox can use to invoke one hub action on the user's behalf without\n   * seeing the underlying provider credential.\n   */\n  mintToken(input: MintTokenInput): Promise<MintTokenResult> {\n    return this.request('POST', '/v1/hub/tokens', input)\n  }\n\n  /** POST /v1/hub/exec — execute a hub action and return its result. */\n  async exec(input: ExecInput): Promise<unknown> {\n    const data = await this.request<{ result: unknown }>('POST', '/v1/hub/exec', input)\n    return data.result\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'DELETE' | 'PUT',\n    path: string,\n    body?: unknown,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      authorization: `Bearer ${this.bearer}`,\n      accept: 'application/json',\n    }\n    if (body !== undefined) headers['content-type'] = 'application/json'\n\n    const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      method,\n      headers,\n      body: body !== undefined ? JSON.stringify(body) : undefined,\n    })\n    const text = await res.text()\n    let parsed: PlatformEnvelope<T> | null = null\n    if (text) {\n      try {\n        parsed = JSON.parse(text)\n      } catch {\n        // fall through to error handling below\n      }\n    }\n    if (!res.ok || (parsed && parsed.success === false)) {\n      const code = parsed?.error && typeof parsed.error === 'object' ? parsed.error.code : undefined\n      const message =\n        (parsed?.error && typeof parsed.error === 'object' && parsed.error.message) ||\n        (typeof parsed?.error === 'string' ? parsed.error : `Platform hub error (${res.status})`)\n      throw new PlatformHubError(message, res.status, code, parsed ?? text)\n    }\n    if (!parsed) {\n      throw new PlatformHubError(\n        `Platform hub returned non-JSON success (${res.status})`,\n        res.status,\n        undefined,\n        text,\n      )\n    }\n    if (parsed.data === undefined) {\n      throw new PlatformHubError(\n        'Platform hub envelope missing `data`',\n        res.status,\n        undefined,\n        parsed,\n      )\n    }\n    return parsed.data\n  }\n}\n"],"mappings":";;AAoIA,IAAa,mBAAb,cAAsC,MAAM;CAGxB;CACA;CACA;CAJlB,YACE,SACA,QACA,MACA,MACA;EACA,MAAM,OAAO;EAJG,KAAA,SAAA;EACA,KAAA,OAAA;EACA,KAAA,OAAA;EAGhB,KAAK,OAAO;CACd;AACF;;AASA,IAAa,oBAAb,MAA+B;CAC7B;CACA;CACA;CAEA,YAAY,SAAmC;EAC7C,IAAI,CAAC,QAAQ,SAAS,MAAM,IAAI,MAAM,wCAAwC;EAC9E,IAAI,CAAC,QAAQ,QAAQ,MAAM,IAAI,MAAM,uCAAuC;EAC5E,KAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;EACjD,KAAK,SAAS,QAAQ;EACtB,KAAK,YACH,QAAQ,eACN,KAAkC,SAAuC,MAAM,KAAK,IAAI;CAC9F;;CAGA,UAAkC;EAChC,OAAO,KAAK,QAAQ,OAAO,mBAAmB;CAChD;;CAGA,MAAM,kBAAiD;EAKrD,QAAO,MAJY,KAAK,QACtB,OACA,qBACF,EAAA,CACY;CACd;;CAGA,iBAAiB,cAAmE;EAClF,OAAO,KAAK,QAAQ,UAAU,uBAAuB,mBAAmB,YAAY,GAAG;CACzF;;;;;;;CAQA,MAAM,UAAU,OAAiD;EAC/D,MAAM,OAA6C,EAAE,WAAW,MAAM,UAAU;EAChF,IAAI,MAAM,QAAQ,KAAA,GAAW,KAAK,MAAM,MAAM;EAC9C,MAAM,OAAO,MAAM,KAAK,QAMrB,QAAQ,uBAAuB,mBAAmB,MAAM,UAAU,EAAE,SAAS,IAAI;EACpF,MAAM,mBAAmB,KAAK,oBAAoB,KAAK;EACvD,IAAI,CAAC,kBACH,MAAM,IAAI,iBACR,4DACA,KACA,8BACA,IACF;EAEF,OAAO;GAAE;GAAkB,OAAO,KAAK;GAAO,WAAW,KAAK;GAAW,QAAQ,KAAK;EAAO;CAC/F;;;;;;CAOA,MAAM,mBAA2C;EAE/C,QAAO,MADmB,KAAK,gBAAgB,EAAA,CAC5B,KAAK,OAAO;GAC7B,cAAc,EAAE;GAChB,YAAY,EAAE;GACd,QAAQ,EAAE;GACV,WAAW,EAAE;EACf,EAAE;CACJ;;;;;CAMA,sBAAsB,cAAuD;EAC3E,OAAO,KAAK,QAAQ,QAAQ,uBAAuB,mBAAmB,YAAY,EAAE,QAAQ;CAC9F;;;;;;CAOA,MAAM,kBAAkD;EACtD,MAAM,cAAc,MAAM,KAAK,gBAAgB;EAC/C,MAAM,QAAQ,WAAW,YAAY,KAAK,MAAM,KAAK,sBAAsB,EAAE,EAAE,CAAC,CAAC;EACjF,OAAO,EAAE,WAAW,YAAY,OAAO;CACzC;;CAGA,SAAqC;EACnC,OAAO,KAAK,QAAQ,OAAO,gBAAgB;CAC7C;;;;;;CAOA,UAAU,OAAiD;EACzD,OAAO,KAAK,QAAQ,QAAQ,kBAAkB,KAAK;CACrD;;CAGA,MAAM,KAAK,OAAoC;EAE7C,QAAO,MADY,KAAK,QAA6B,QAAQ,gBAAgB,KAAK,EAAA,CACtE;CACd;CAEA,MAAc,QACZ,QACA,MACA,MACY;EACZ,MAAM,UAAkC;GACtC,eAAe,UAAU,KAAK;GAC9B,QAAQ;EACV;EACA,IAAI,SAAS,KAAA,GAAW,QAAQ,kBAAkB;EAElD,MAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,QAAQ;GACzD;GACA;GACA,MAAM,SAAS,KAAA,IAAY,KAAK,UAAU,IAAI,IAAI,KAAA;EACpD,CAAC;EACD,MAAM,OAAO,MAAM,IAAI,KAAK;EAC5B,IAAI,SAAqC;EACzC,IAAI,MACF,IAAI;GACF,SAAS,KAAK,MAAM,IAAI;EAC1B,QAAQ,CAER;EAEF,IAAI,CAAC,IAAI,MAAO,UAAU,OAAO,YAAY,OAAQ;GACnD,MAAM,OAAO,QAAQ,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,OAAO,KAAA;GAIrF,MAAM,IAAI,iBAFP,QAAQ,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,YAClE,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ,uBAAuB,IAAI,OAAO,KACpD,IAAI,QAAQ,MAAM,UAAU,IAAI;EACtE;EACA,IAAI,CAAC,QACH,MAAM,IAAI,iBACR,2CAA2C,IAAI,OAAO,IACtD,IAAI,QACJ,KAAA,GACA,IACF;EAEF,IAAI,OAAO,SAAS,KAAA,GAClB,MAAM,IAAI,iBACR,wCACA,IAAI,QACJ,KAAA,GACA,MACF;EAEF,OAAO,OAAO;CAChB;AACF"}

package/dist/kb-gate-C8z2juK8.d.ts

@@ -1,80 +0,0 @@
-//#region src/mcp/kb-gate.d.ts
-/**
- *
- * `createKbGate` — the valid-only knowledge-base growth gate, distilled from
- * physim's KB-research subsystem. A research-in-a-loop delegate (or any KB
- * writer) runs candidate facts through this before persisting, so the KB grows
- * with ONLY grounded facts — hallucinated, unsourced, or laundered claims are
- * vetoed at the gate.
- *
- * Fail-closed by construction: every judge must `accept`; the FIRST veto wins
- * and the fact is rejected. The non-negotiable floor (always on, can't be
- * disabled) is the **passage-present guard** — a fact's `verbatimPassage` MUST
- * literally appear in its `sourceText`. That single check kills the dominant
- * failure mode (a confident claim decoupled from any real source).
- *
- * Pure + dependency-free: it operates on fact candidates, not on a store, so it
- * composes with `@tangle-network/agent-knowledge` or any persistence layer
- * without importing it. The remediation policy (correct-on-veto vs
- * escalate-as-unverified) is the caller's — this returns the verdict; it never
- * drops a fact silently.
- *
- * @experimental
- */
-/** @experimental A fact proposed for the KB, with its grounding. */
-interface FactCandidate {
-  /** The atomic claim text. */
-  claim: string;
-  /** Optional extracted value (number or string) the claim asserts. */
-  value?: string | number;
-  /** Verbatim span lifted from the source that backs the claim. */
-  verbatimPassage: string;
-  /** The raw source text the passage must be grounded in. */
-  sourceText: string;
-  /** Where the fact claims to come from — checked for circular/self citations. */
-  citation?: string;
-}
-/** @experimental */
-interface FactJudgeVerdict {
-  accept: boolean;
-  reason?: string;
-}
-/** @experimental A pluggable fact validator. Throw is NOT allowed — return a
- *  verdict; a thrown judge is a programmer error, not a veto. */
-interface FactJudge {
-  name: string;
-  judge(candidate: FactCandidate): FactJudgeVerdict | Promise<FactJudgeVerdict>;
-}
-/** @experimental */
-interface KbGateResult {
-  accepted: boolean;
-  /** Name of the judge that vetoed; undefined when accepted. */
-  vetoedBy?: string;
-  reason?: string;
-}
-/** @experimental */
-interface CreateKbGateOptions {
-  /** Extra judges appended after the built-in floor (e.g. an LLM judge). */
-  judges?: FactJudge[];
-  /** Minimum verbatim-passage length. Default 12 — kills empty/stub passages. */
-  minPassageChars?: number;
-  /**
-   * Citation tokens that denote a SELF-generated artifact (e.g. `'spec'`,
-   * `'cad_params'`, `'requirements'`). A citation naming one is circular
-   * (laundering) — the fact cites a derived artifact, not a real source.
-   * Default `[]` (no circular check unless the consumer declares its kinds).
-   */
-  selfArtifactKinds?: string[];
-}
-/**
- *
- * Build a fail-closed KB gate. The returned function runs the built-in floor
- * (passage-non-empty → passage-present → value-in-passage → no-circular-citation)
- * then any consumer judges, returning on the first veto.
- *
- * @experimental
- */
-declare function createKbGate(options?: CreateKbGateOptions): (candidate: FactCandidate) => Promise<KbGateResult>;
-//#endregion
-export { KbGateResult as a, FactJudgeVerdict as i, FactCandidate as n, createKbGate as o, FactJudge as r, CreateKbGateOptions as t };
-//# sourceMappingURL=kb-gate-C8z2juK8.d.ts.map

package/dist/kb-gate-DpaSwXVx.js

@@ -1,80 +0,0 @@
-//#region src/mcp/kb-gate.ts
-const norm = (s) => s.toLowerCase().replace(/\s+/g, " ").trim();
-/** Does `value` appear in the (normalized) passage — literally, comma-grouped,
-*  or in billion/million shorthand (the forms a source actually writes). */
-function valueAppears(value, passageNorm) {
-	if (passageNorm.includes(norm(String(value)))) return true;
-	if (typeof value !== "number" || !Number.isFinite(value)) return false;
-	const forms = [value.toLocaleString("en-US")];
-	if (Math.abs(value) >= 1e9) forms.push(`${trimZero(value / 1e9)} billion`);
-	if (Math.abs(value) >= 1e6) forms.push(`${trimZero(value / 1e6)} million`);
-	return forms.some((f) => passageNorm.includes(norm(f)));
-}
-function trimZero(n) {
-	return Number.isInteger(n) ? String(n) : String(Number(n.toFixed(2)));
-}
-/** The always-on floor judges. Order matters: cheapest / most-fundamental first. */
-function builtinJudges(minPassageChars, selfArtifactKinds) {
-	const kinds = selfArtifactKinds.map((k) => k.toLowerCase());
-	return [
-		{
-			name: "passage-non-empty",
-			judge: (c) => c.verbatimPassage.trim().length >= minPassageChars ? { accept: true } : {
-				accept: false,
-				reason: `passage shorter than ${minPassageChars} chars`
-			}
-		},
-		{
-			name: "passage-present",
-			judge: (c) => norm(c.sourceText).includes(norm(c.verbatimPassage)) ? { accept: true } : {
-				accept: false,
-				reason: "verbatim passage not found in source (unbacked fact)"
-			}
-		},
-		{
-			name: "value-in-passage",
-			judge: (c) => c.value === void 0 || valueAppears(c.value, norm(c.verbatimPassage)) ? { accept: true } : {
-				accept: false,
-				reason: `value ${JSON.stringify(c.value)} not present in passage`
-			}
-		},
-		{
-			name: "no-circular-citation",
-			judge: (c) => {
-				if (!c.citation || kinds.length === 0) return { accept: true };
-				const cite = c.citation.toLowerCase();
-				const hit = kinds.find((k) => cite.includes(k));
-				return hit ? {
-					accept: false,
-					reason: `circular citation to self-generated artifact "${hit}"`
-				} : { accept: true };
-			}
-		}
-	];
-}
-/**
-*
-* Build a fail-closed KB gate. The returned function runs the built-in floor
-* (passage-non-empty → passage-present → value-in-passage → no-circular-citation)
-* then any consumer judges, returning on the first veto.
-*
-* @experimental
-*/
-function createKbGate(options = {}) {
-	const judges = [...builtinJudges(options.minPassageChars ?? 12, options.selfArtifactKinds ?? []), ...options.judges ?? []];
-	return async (candidate) => {
-		for (const j of judges) {
-			const verdict = await j.judge(candidate);
-			if (!verdict.accept) return {
-				accepted: false,
-				vetoedBy: j.name,
-				reason: verdict.reason
-			};
-		}
-		return { accepted: true };
-	};
-}
-//#endregion
-export { createKbGate as t };
-
-//# sourceMappingURL=kb-gate-DpaSwXVx.js.map

package/dist/kb-gate-DpaSwXVx.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kb-gate-DpaSwXVx.js","names":[],"sources":["../src/mcp/kb-gate.ts"],"sourcesContent":["/**\n *\n * `createKbGate` — the valid-only knowledge-base growth gate, distilled from\n * physim's KB-research subsystem. A research-in-a-loop delegate (or any KB\n * writer) runs candidate facts through this before persisting, so the KB grows\n * with ONLY grounded facts — hallucinated, unsourced, or laundered claims are\n * vetoed at the gate.\n *\n * Fail-closed by construction: every judge must `accept`; the FIRST veto wins\n * and the fact is rejected. The non-negotiable floor (always on, can't be\n * disabled) is the **passage-present guard** — a fact's `verbatimPassage` MUST\n * literally appear in its `sourceText`. That single check kills the dominant\n * failure mode (a confident claim decoupled from any real source).\n *\n * Pure + dependency-free: it operates on fact candidates, not on a store, so it\n * composes with `@tangle-network/agent-knowledge` or any persistence layer\n * without importing it. The remediation policy (correct-on-veto vs\n * escalate-as-unverified) is the caller's — this returns the verdict; it never\n * drops a fact silently.\n *\n * @experimental\n */\n\n/** @experimental A fact proposed for the KB, with its grounding. */\nexport interface FactCandidate {\n  /** The atomic claim text. */\n  claim: string\n  /** Optional extracted value (number or string) the claim asserts. */\n  value?: string | number\n  /** Verbatim span lifted from the source that backs the claim. */\n  verbatimPassage: string\n  /** The raw source text the passage must be grounded in. */\n  sourceText: string\n  /** Where the fact claims to come from — checked for circular/self citations. */\n  citation?: string\n}\n\n/** @experimental */\nexport interface FactJudgeVerdict {\n  accept: boolean\n  reason?: string\n}\n\n/** @experimental A pluggable fact validator. Throw is NOT allowed — return a\n *  verdict; a thrown judge is a programmer error, not a veto. */\nexport interface FactJudge {\n  name: string\n  judge(candidate: FactCandidate): FactJudgeVerdict | Promise<FactJudgeVerdict>\n}\n\n/** @experimental */\nexport interface KbGateResult {\n  accepted: boolean\n  /** Name of the judge that vetoed; undefined when accepted. */\n  vetoedBy?: string\n  reason?: string\n}\n\n/** @experimental */\nexport interface CreateKbGateOptions {\n  /** Extra judges appended after the built-in floor (e.g. an LLM judge). */\n  judges?: FactJudge[]\n  /** Minimum verbatim-passage length. Default 12 — kills empty/stub passages. */\n  minPassageChars?: number\n  /**\n   * Citation tokens that denote a SELF-generated artifact (e.g. `'spec'`,\n   * `'cad_params'`, `'requirements'`). A citation naming one is circular\n   * (laundering) — the fact cites a derived artifact, not a real source.\n   * Default `[]` (no circular check unless the consumer declares its kinds).\n   */\n  selfArtifactKinds?: string[]\n}\n\nconst norm = (s: string): string => s.toLowerCase().replace(/\\s+/g, ' ').trim()\n\n/** Does `value` appear in the (normalized) passage — literally, comma-grouped,\n *  or in billion/million shorthand (the forms a source actually writes). */\nfunction valueAppears(value: string | number, passageNorm: string): boolean {\n  if (passageNorm.includes(norm(String(value)))) return true\n  if (typeof value !== 'number' || !Number.isFinite(value)) return false\n  const forms = [value.toLocaleString('en-US')]\n  if (Math.abs(value) >= 1e9) forms.push(`${trimZero(value / 1e9)} billion`)\n  if (Math.abs(value) >= 1e6) forms.push(`${trimZero(value / 1e6)} million`)\n  return forms.some((f) => passageNorm.includes(norm(f)))\n}\n\nfunction trimZero(n: number): string {\n  return Number.isInteger(n) ? String(n) : String(Number(n.toFixed(2)))\n}\n\n/** The always-on floor judges. Order matters: cheapest / most-fundamental first. */\nfunction builtinJudges(minPassageChars: number, selfArtifactKinds: string[]): FactJudge[] {\n  const kinds = selfArtifactKinds.map((k) => k.toLowerCase())\n  return [\n    {\n      name: 'passage-non-empty',\n      judge: (c) =>\n        c.verbatimPassage.trim().length >= minPassageChars\n          ? { accept: true }\n          : { accept: false, reason: `passage shorter than ${minPassageChars} chars` },\n    },\n    {\n      // THE anti-hallucination floor — the passage must literally be in the source.\n      name: 'passage-present',\n      judge: (c) =>\n        norm(c.sourceText).includes(norm(c.verbatimPassage))\n          ? { accept: true }\n          : { accept: false, reason: 'verbatim passage not found in source (unbacked fact)' },\n    },\n    {\n      name: 'value-in-passage',\n      judge: (c) =>\n        c.value === undefined || valueAppears(c.value, norm(c.verbatimPassage))\n          ? { accept: true }\n          : { accept: false, reason: `value ${JSON.stringify(c.value)} not present in passage` },\n    },\n    {\n      name: 'no-circular-citation',\n      judge: (c) => {\n        if (!c.citation || kinds.length === 0) return { accept: true }\n        const cite = c.citation.toLowerCase()\n        const hit = kinds.find((k) => cite.includes(k))\n        return hit\n          ? { accept: false, reason: `circular citation to self-generated artifact \"${hit}\"` }\n          : { accept: true }\n      },\n    },\n  ]\n}\n\n/**\n *\n * Build a fail-closed KB gate. The returned function runs the built-in floor\n * (passage-non-empty → passage-present → value-in-passage → no-circular-citation)\n * then any consumer judges, returning on the first veto.\n *\n * @experimental\n */\nexport function createKbGate(\n  options: CreateKbGateOptions = {},\n): (candidate: FactCandidate) => Promise<KbGateResult> {\n  const judges = [\n    ...builtinJudges(options.minPassageChars ?? 12, options.selfArtifactKinds ?? []),\n    ...(options.judges ?? []),\n  ]\n  return async (candidate) => {\n    for (const j of judges) {\n      const verdict = await j.judge(candidate)\n      if (!verdict.accept) {\n        return { accepted: false, vetoedBy: j.name, reason: verdict.reason }\n      }\n    }\n    return { accepted: true }\n  }\n}\n"],"mappings":";AAyEA,MAAM,QAAQ,MAAsB,EAAE,YAAY,CAAC,CAAC,QAAQ,QAAQ,GAAG,CAAC,CAAC,KAAK;;;AAI9E,SAAS,aAAa,OAAwB,aAA8B;CAC1E,IAAI,YAAY,SAAS,KAAK,OAAO,KAAK,CAAC,CAAC,GAAG,OAAO;CACtD,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG,OAAO;CACjE,MAAM,QAAQ,CAAC,MAAM,eAAe,OAAO,CAAC;CAC5C,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,MAAM,KAAK,GAAG,SAAS,QAAQ,GAAG,EAAE,SAAS;CACzE,IAAI,KAAK,IAAI,KAAK,KAAK,KAAK,MAAM,KAAK,GAAG,SAAS,QAAQ,GAAG,EAAE,SAAS;CACzE,OAAO,MAAM,MAAM,MAAM,YAAY,SAAS,KAAK,CAAC,CAAC,CAAC;AACxD;AAEA,SAAS,SAAS,GAAmB;CACnC,OAAO,OAAO,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,OAAO,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACtE;;AAGA,SAAS,cAAc,iBAAyB,mBAA0C;CACxF,MAAM,QAAQ,kBAAkB,KAAK,MAAM,EAAE,YAAY,CAAC;CAC1D,OAAO;EACL;GACE,MAAM;GACN,QAAQ,MACN,EAAE,gBAAgB,KAAK,CAAC,CAAC,UAAU,kBAC/B,EAAE,QAAQ,KAAK,IACf;IAAE,QAAQ;IAAO,QAAQ,wBAAwB,gBAAgB;GAAQ;EACjF;EACA;GAEE,MAAM;GACN,QAAQ,MACN,KAAK,EAAE,UAAU,CAAC,CAAC,SAAS,KAAK,EAAE,eAAe,CAAC,IAC/C,EAAE,QAAQ,KAAK,IACf;IAAE,QAAQ;IAAO,QAAQ;GAAuD;EACxF;EACA;GACE,MAAM;GACN,QAAQ,MACN,EAAE,UAAU,KAAA,KAAa,aAAa,EAAE,OAAO,KAAK,EAAE,eAAe,CAAC,IAClE,EAAE,QAAQ,KAAK,IACf;IAAE,QAAQ;IAAO,QAAQ,SAAS,KAAK,UAAU,EAAE,KAAK,EAAE;GAAyB;EAC3F;EACA;GACE,MAAM;GACN,QAAQ,MAAM;IACZ,IAAI,CAAC,EAAE,YAAY,MAAM,WAAW,GAAG,OAAO,EAAE,QAAQ,KAAK;IAC7D,MAAM,OAAO,EAAE,SAAS,YAAY;IACpC,MAAM,MAAM,MAAM,MAAM,MAAM,KAAK,SAAS,CAAC,CAAC;IAC9C,OAAO,MACH;KAAE,QAAQ;KAAO,QAAQ,iDAAiD,IAAI;IAAG,IACjF,EAAE,QAAQ,KAAK;GACrB;EACF;CACF;AACF;;;;;;;;;AAUA,SAAgB,aACd,UAA+B,CAAC,GACqB;CACrD,MAAM,SAAS,CACb,GAAG,cAAc,QAAQ,mBAAmB,IAAI,QAAQ,qBAAqB,CAAC,CAAC,GAC/E,GAAI,QAAQ,UAAU,CAAC,CACzB;CACA,OAAO,OAAO,cAAc;EAC1B,KAAK,MAAM,KAAK,QAAQ;GACtB,MAAM,UAAU,MAAM,EAAE,MAAM,SAAS;GACvC,IAAI,CAAC,QAAQ,QACX,OAAO;IAAE,UAAU;IAAO,UAAU,EAAE;IAAM,QAAQ,QAAQ;GAAO;EAEvE;EACA,OAAO,EAAE,UAAU,KAAK;CAC1B;AACF"}