@tenova/swt3-ai 0.3.4 → 0.4.1

package/dist/exporters/otel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.d.ts","sourceRoot":"","sources":["../../src/exporters/otel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,WAAW,CAAM;gBAEb,OAAO,CAAC,EAAE,mBAAmB;IAezC;;;;OAIG;IACH,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI;IAoBpE,OAAO,CAAC,cAAc;CAiCvB"}

package/dist/exporters/otel.js

@@ -0,0 +1,94 @@
+/**
+ * SWT3 AI Witness SDK -- OpenTelemetry Exporter.
+ *
+ * Exports SWT3 witness anchors as OpenTelemetry spans, allowing them to
+ * flow into existing observability pipelines (Datadog, Grafana, Jaeger,
+ * Honeycomb, etc.).
+ *
+ * Usage:
+ *   import { Witness } from "@tenova/swt3-ai";
+ *   import { OTelExporter } from "@tenova/swt3-ai/exporters/otel";
+ *
+ *   const exporter = new OTelExporter({ tracerName: "swt3-witness" });
+ *   const witness = new Witness({ ..., onFlush: exporter.export.bind(exporter) });
+ *
+ * Requires: npm install @opentelemetry/api
+ *
+ * Copyright (c) 2026 Tenable Nova LLC. Apache 2.0. Patent pending.
+ */
+export class OTelExporter {
+    tracer;
+    traceModule;
+    constructor(options) {
+        const tracerName = options?.tracerName ?? "swt3-ai";
+        try {
+            // Dynamic require to avoid hard dependency
+            const trace = require("@opentelemetry/api").trace;
+            this.traceModule = require("@opentelemetry/api");
+            this.tracer = trace.getTracer(tracerName);
+        }
+        catch {
+            throw new Error("@opentelemetry/api is required for OTel export. " +
+                "Install with: npm install @opentelemetry/api");
+        }
+    }
+    /**
+     * Callback for Witness onFlush. Creates one span per anchor.
+     *
+     * Pass as: onFlush: exporter.export.bind(exporter)
+     */
+    export(payloads, receipts) {
+        for (let i = 0; i < payloads.length; i++) {
+            const payload = payloads[i];
+            const receipt = receipts[i] ?? null;
+            const spanName = `swt3.witness.${payload.procedure_id ?? "unknown"}`;
+            const attrs = this.spanAttributes(payload, receipt);
+            const span = this.tracer.startSpan(spanName, { attributes: attrs });
+            if (receipt && !receipt.ok) {
+                span.setStatus({
+                    code: this.traceModule.SpanStatusCode.ERROR,
+                    message: receipt.error ?? "",
+                });
+            }
+            span.end();
+        }
+    }
+    spanAttributes(payload, receipt) {
+        const attrs = {};
+        // Core anchor fields
+        if (payload.procedure_id)
+            attrs["swt3.procedure_id"] = payload.procedure_id;
+        if (payload.clearing_level != null)
+            attrs["swt3.clearing_level"] = payload.clearing_level;
+        if (payload.anchor_fingerprint)
+            attrs["swt3.fingerprint"] = payload.anchor_fingerprint;
+        if (payload.anchor_epoch)
+            attrs["swt3.epoch"] = payload.anchor_epoch;
+        // Factors
+        if (payload.factor_a != null)
+            attrs["swt3.factor_a"] = payload.factor_a;
+        if (payload.factor_b != null)
+            attrs["swt3.factor_b"] = payload.factor_b;
+        if (payload.factor_c != null)
+            attrs["swt3.factor_c"] = payload.factor_c;
+        // AI metadata (may be cleared depending on level)
+        if (payload.ai_model_id)
+            attrs["swt3.model_id"] = payload.ai_model_id;
+        if (payload.ai_latency_ms != null)
+            attrs["swt3.latency_ms"] = payload.ai_latency_ms;
+        // Identity (survives all clearing levels)
+        if (payload.agent_id)
+            attrs["swt3.agent_id"] = payload.agent_id;
+        if (payload.cycle_id)
+            attrs["swt3.cycle_id"] = payload.cycle_id;
+        // Receipt fields
+        if (receipt) {
+            if (receipt.verdict)
+                attrs["swt3.verdict"] = receipt.verdict;
+            if (receipt.swt3_anchor)
+                attrs["swt3.anchor"] = receipt.swt3_anchor;
+        }
+        return attrs;
+    }
+}
+//# sourceMappingURL=otel.js.map

package/dist/exporters/otel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.js","sourceRoot":"","sources":["../../src/exporters/otel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,MAAM,OAAO,YAAY;IACf,MAAM,CAAM;IACZ,WAAW,CAAM;IAEzB,YAAY,OAA6B;QACvC,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,SAAS,CAAC;QACpD,IAAI,CAAC;YACH,2CAA2C;YAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,kDAAkD;gBAClD,8CAA8C,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,QAA0B,EAAE,QAA0B;QAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YACpC,MAAM,QAAQ,GAAG,gBAAgB,OAAO,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEpD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;YAEpE,IAAI,OAAO,IAAI,CAAE,OAAe,CAAC,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,SAAS,CAAC;oBACb,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK;oBAC3C,OAAO,EAAG,OAAe,CAAC,KAAK,IAAI,EAAE;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAEO,cAAc,CACpB,OAAuB,EACvB,OAA8B;QAE9B,MAAM,KAAK,GAA8C,EAAE,CAAC;QAE5D,qBAAqB;QACrB,IAAI,OAAO,CAAC,YAAY;YAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;QAC5E,IAAI,OAAO,CAAC,cAAc,IAAI,IAAI;YAAE,KAAK,CAAC,qBAAqB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QAC1F,IAAI,OAAO,CAAC,kBAAkB;YAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACvF,IAAI,OAAO,CAAC,YAAY;YAAE,KAAK,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC;QAErE,UAAU;QACV,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI;YAAE,KAAK,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACxE,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI;YAAE,KAAK,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACxE,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI;YAAE,KAAK,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAExE,kDAAkD;QAClD,IAAI,OAAO,CAAC,WAAW;YAAE,KAAK,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACtE,IAAI,OAAO,CAAC,aAAa,IAAI,IAAI;YAAE,KAAK,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC;QAEpF,0CAA0C;QAC1C,IAAI,OAAO,CAAC,QAAQ;YAAE,KAAK,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAChE,IAAI,OAAO,CAAC,QAAQ;YAAE,KAAK,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QAEhE,iBAAiB;QACjB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,OAAO;gBAAE,KAAK,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;YAC7D,IAAI,OAAO,CAAC,WAAW;gBAAE,KAAK,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC;QACtE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/fingerprint.d.ts

@@ -0,0 +1,29 @@
+/**
+ * SWT3 AI Witness SDK — Fingerprint minting and SHA-256 utilities.
+ *
+ * The fingerprint formula MUST match the Python SDK and the ingestion endpoint:
+ *   SHA256("WITNESS:{tenant}:{proc}:{fa}:{fb}:{fc}:{ts_ms}").hex().slice(0, 12)
+ *
+ * Uses Node.js crypto module for server-side compatibility.
+ */
+/**
+ * SHA-256 hash a string, return first `length` hex characters.
+ */
+export declare function sha256Hex(data: string, length?: number): string;
+/**
+ * SHA-256 hash a string, return first 16 hex chars (prompt/response hashing).
+ */
+export declare function sha256Truncated(data: string, length?: number): string;
+/**
+ * Mint an SWT3 anchor fingerprint.
+ *
+ * This MUST match the endpoint's `validateFingerprint()` and the Python SDK's
+ * `mint_fingerprint()`:
+ *   SHA256("WITNESS:{tenant}:{proc}:{fa}:{fb}:{fc}:{ts_ms}").hex().slice(0, 12)
+ */
+export declare function mintFingerprint(tenantId: string, procedureId: string, factorA: number, factorB: number, factorC: number, timestampMs: number): string;
+/**
+ * Return [millisecond timestamp, epoch seconds] for anchor minting.
+ */
+export declare function timestampMs(): [number, number];
+//# sourceMappingURL=fingerprint.d.ts.map

package/dist/fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAW,GAAG,MAAM,CAEnE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,MAAW,GAAG,MAAM,CAEzE;AAiBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,MAAM,CAMR;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAI9C"}

package/dist/fingerprint.js

@@ -0,0 +1,57 @@
+/**
+ * SWT3 AI Witness SDK — Fingerprint minting and SHA-256 utilities.
+ *
+ * The fingerprint formula MUST match the Python SDK and the ingestion endpoint:
+ *   SHA256("WITNESS:{tenant}:{proc}:{fa}:{fb}:{fc}:{ts_ms}").hex().slice(0, 12)
+ *
+ * Uses Node.js crypto module for server-side compatibility.
+ */
+import { createHash } from "crypto";
+/**
+ * SHA-256 hash a string, return first `length` hex characters.
+ */
+export function sha256Hex(data, length = 64) {
+    return createHash("sha256").update(data, "utf-8").digest("hex").slice(0, length);
+}
+/**
+ * SHA-256 hash a string, return first 16 hex chars (prompt/response hashing).
+ */
+export function sha256Truncated(data, length = 16) {
+    return sha256Hex(data, length);
+}
+/**
+ * Format a numeric factor for the fingerprint formula.
+ *
+ * CRITICAL: Must match Python's behavior exactly.
+ * Integer-valued floats → "1" (no decimal), true floats → "1.5"
+ * JavaScript JSON.stringify(1) → "1", JSON.stringify(1.5) → "1.5"
+ * so we can use String() which matches.
+ */
+function numStr(v) {
+    if (Number.isInteger(v)) {
+        return String(v);
+    }
+    return String(v);
+}
+/**
+ * Mint an SWT3 anchor fingerprint.
+ *
+ * This MUST match the endpoint's `validateFingerprint()` and the Python SDK's
+ * `mint_fingerprint()`:
+ *   SHA256("WITNESS:{tenant}:{proc}:{fa}:{fb}:{fc}:{ts_ms}").hex().slice(0, 12)
+ */
+export function mintFingerprint(tenantId, procedureId, factorA, factorB, factorC, timestampMs) {
+    const fpInput = `WITNESS:${tenantId}:${procedureId}` +
+        `:${numStr(factorA)}:${numStr(factorB)}:${numStr(factorC)}` +
+        `:${timestampMs}`;
+    return createHash("sha256").update(fpInput, "utf-8").digest("hex").slice(0, 12);
+}
+/**
+ * Return [millisecond timestamp, epoch seconds] for anchor minting.
+ */
+export function timestampMs() {
+    const ts = Date.now();
+    const epoch = Math.floor(ts / 1000);
+    return [ts, epoch];
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,SAAiB,EAAE;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACnF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAAiB,EAAE;IAC/D,OAAO,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,WAAmB,EACnB,OAAe,EACf,OAAe,EACf,OAAe,EACf,WAAmB;IAEnB,MAAM,OAAO,GACX,WAAW,QAAQ,IAAI,WAAW,EAAE;QACpC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE;QAC3D,IAAI,WAAW,EAAE,CAAC;IACpB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;AACrB,CAAC"}

package/dist/handoff.d.ts

@@ -0,0 +1,17 @@
+/**
+ * SWT3 AI Witness SDK — Factor Handoff (Local File Export).
+ *
+ * Writes factor data to local JSON files before the clearing engine strips
+ * them from the wire payload. If the write fails, clearing does NOT proceed.
+ *
+ * Spec: SWT3 Factor Handoff Protocol v1.0.0
+ */
+import type { WitnessPayload, InferenceRecord } from "./types.js";
+/**
+ * Write one JSON file per payload to the handoff directory.
+ *
+ * Throws on failure — the caller must NOT proceed with clearing
+ * if this function throws.
+ */
+export declare function writeHandoffFiles(payloads: WitnessPayload[], inference: InferenceRecord, tenantId: string, handoffPath: string): void;
+//# sourceMappingURL=handoff.d.ts.map

package/dist/handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAuClE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,cAAc,EAAE,EAC1B,SAAS,EAAE,eAAe,EAC1B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,IAAI,CA+BN"}

package/dist/handoff.js

@@ -0,0 +1,82 @@
+/**
+ * SWT3 AI Witness SDK — Factor Handoff (Local File Export).
+ *
+ * Writes factor data to local JSON files before the clearing engine strips
+ * them from the wire payload. If the write fails, clearing does NOT proceed.
+ *
+ * Spec: SWT3 Factor Handoff Protocol v1.0.0
+ */
+import { writeFileSync, mkdirSync, renameSync, unlinkSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+const HANDOFF_VERSION = "1.0.0";
+/**
+ * Write one JSON file per payload to the handoff directory.
+ *
+ * Throws on failure — the caller must NOT proceed with clearing
+ * if this function throws.
+ */
+export function writeHandoffFiles(payloads, inference, tenantId, handoffPath) {
+    mkdirSync(handoffPath, { recursive: true });
+    for (const payload of payloads) {
+        const record = buildHandoffRecord(payload, inference, tenantId);
+        const filename = `${payload.anchor_fingerprint}.json`;
+        const filepath = join(handoffPath, filename);
+        const tmpPath = filepath + ".tmp";
+        try {
+            writeFileSync(tmpPath, JSON.stringify(record, null, 2) + "\n", "utf-8");
+            // Set restrictive permissions (owner read/write only, 0o600)
+            try {
+                chmodSync(tmpPath, 0o600);
+            }
+            catch {
+                // chmod may not be supported on all platforms (e.g., Windows)
+            }
+            // Atomic rename
+            renameSync(tmpPath, filepath);
+        }
+        catch (err) {
+            // Clean up temp file on failure
+            try {
+                unlinkSync(tmpPath);
+            }
+            catch {
+                // ignore cleanup errors
+            }
+            throw err;
+        }
+    }
+}
+function buildHandoffRecord(payload, inference, tenantId) {
+    return {
+        handoff_version: HANDOFF_VERSION,
+        handoff_type: `clearing_level_${payload.clearing_level}`,
+        tenant_id: tenantId,
+        timestamp_iso: new Date(payload.anchor_epoch * 1000).toISOString(),
+        anchor_fingerprint: payload.anchor_fingerprint,
+        anchor_epoch: payload.anchor_epoch,
+        fingerprint_timestamp_ms: payload.fingerprint_timestamp_ms,
+        clearing_level: payload.clearing_level,
+        factors: {
+            procedure_id: payload.procedure_id,
+            factor_a: payload.factor_a,
+            factor_b: payload.factor_b,
+            factor_c: payload.factor_c,
+        },
+        metadata: {
+            ai_model_id: inference.modelId,
+            ai_model_hash: inference.modelHash,
+            ai_prompt_hash: inference.promptHash,
+            ai_response_hash: inference.responseHash,
+            ai_latency_ms: inference.latencyMs,
+            ai_input_tokens: inference.inputTokens,
+            ai_output_tokens: inference.outputTokens,
+            ai_provider: inference.provider,
+            ai_system_fingerprint: inference.systemFingerprint,
+            ai_guardrail_names: inference.guardrailNames ?? [],
+            ai_guardrails_active: inference.guardrailsActive,
+            ai_guardrails_required: inference.guardrailsRequired,
+            ai_guardrail_passed: inference.guardrailPassed,
+        },
+    };
+}
+//# sourceMappingURL=handoff.js.map

package/dist/handoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.js","sourceRoot":"","sources":["../src/handoff.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACtF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,eAAe,GAAG,OAAO,CAAC;AAqChC;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA0B,EAC1B,SAA0B,EAC1B,QAAgB,EAChB,WAAmB;IAEnB,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,kBAAkB,OAAO,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAElC,IAAI,CAAC;YACH,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAExE,6DAA6D;YAC7D,IAAI,CAAC;gBACH,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YAED,gBAAgB;YAChB,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gCAAgC;YAChC,IAAI,CAAC;gBACH,UAAU,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAuB,EACvB,SAA0B,EAC1B,QAAgB;IAEhB,OAAO;QACL,eAAe,EAAE,eAAe;QAChC,YAAY,EAAE,kBAAkB,OAAO,CAAC,cAAc,EAAE;QACxD,SAAS,EAAE,QAAQ;QACnB,aAAa,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;QAClE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;QAC1D,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE;YACP,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B;QACD,QAAQ,EAAE;YACR,WAAW,EAAE,SAAS,CAAC,OAAO;YAC9B,aAAa,EAAE,SAAS,CAAC,SAAS;YAClC,cAAc,EAAE,SAAS,CAAC,UAAU;YACpC,gBAAgB,EAAE,SAAS,CAAC,YAAY;YACxC,aAAa,EAAE,SAAS,CAAC,SAAS;YAClC,eAAe,EAAE,SAAS,CAAC,WAAW;YACtC,gBAAgB,EAAE,SAAS,CAAC,YAAY;YACxC,WAAW,EAAE,SAAS,CAAC,QAAQ;YAC/B,qBAAqB,EAAE,SAAS,CAAC,iBAAiB;YAClD,kBAAkB,EAAE,SAAS,CAAC,cAAc,IAAI,EAAE;YAClD,oBAAoB,EAAE,SAAS,CAAC,gBAAgB;YAChD,sBAAsB,EAAE,SAAS,CAAC,kBAAkB;YACpD,mBAAmB,EAAE,SAAS,CAAC,eAAe;SAC/C;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @tenova/swt3-ai — SWT3 AI Witness SDK for TypeScript/Node.js
+ *
+ * Usage:
+ *   import { Witness } from "@tenova/swt3-ai";
+ *   import OpenAI from "openai";
+ *
+ *   const witness = new Witness({
+ *     endpoint: "https://sovereign.tenova.io",
+ *     apiKey: "axm_live_...",
+ *     tenantId: "YOUR_TENANT_ID",
+ *   });
+ *
+ *   const client = witness.wrap(new OpenAI()) as OpenAI;
+ */
+export { Witness, GatekeeperError } from "./witness.js";
+export type { WitnessOptions } from "./witness.js";
+export type { WitnessConfig, WitnessPayload, WitnessReceipt, InferenceRecord, BatchResponse, } from "./types.js";
+export { mintFingerprint, sha256Truncated, sha256Hex, timestampMs } from "./fingerprint.js";
+export { extractPayloads, extractGatekeeperPayload, extractRevocationPayload, REVOCATION_REASONS } from "./clearing.js";
+export { signPayload } from "./signing.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,YAAY,EACV,aAAa,EACb,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,20 @@
+/**
+ * @tenova/swt3-ai — SWT3 AI Witness SDK for TypeScript/Node.js
+ *
+ * Usage:
+ *   import { Witness } from "@tenova/swt3-ai";
+ *   import OpenAI from "openai";
+ *
+ *   const witness = new Witness({
+ *     endpoint: "https://sovereign.tenova.io",
+ *     apiKey: "axm_live_...",
+ *     tenantId: "YOUR_TENANT_ID",
+ *   });
+ *
+ *   const client = witness.wrap(new OpenAI()) as OpenAI;
+ */
+export { Witness, GatekeeperError } from "./witness.js";
+export { mintFingerprint, sha256Truncated, sha256Hex, timestampMs } from "./fingerprint.js";
+export { extractPayloads, extractGatekeeperPayload, extractRevocationPayload, REVOCATION_REASONS } from "./clearing.js";
+export { signPayload } from "./signing.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AASxD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/signing.d.ts

@@ -0,0 +1,20 @@
+/**
+ * SWT3 AI Witness SDK - Payload Signing (HMAC-SHA256).
+ *
+ * Signs anchor fingerprints to prove which SDK instance minted them.
+ * The signature input is deterministic and must match the Python SDK.
+ */
+/**
+ * Sign an anchor fingerprint with HMAC-SHA256.
+ *
+ * @param signingKey - Shared secret between SDK and server.
+ * @param anchorFingerprint - The 12-char hex fingerprint to sign.
+ * @param agentId - Optional agent identifier to bind to the signature.
+ * @returns 64-char hex HMAC-SHA256 digest.
+ *
+ * Message format:
+ *   "{fingerprint}:{agentId}" if agentId is provided
+ *   "{fingerprint}"           if agentId is undefined
+ */
+export declare function signPayload(signingKey: string, anchorFingerprint: string, agentId?: string): string;
+//# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAOR"}

package/dist/signing.js

@@ -0,0 +1,28 @@
+/**
+ * SWT3 AI Witness SDK - Payload Signing (HMAC-SHA256).
+ *
+ * Signs anchor fingerprints to prove which SDK instance minted them.
+ * The signature input is deterministic and must match the Python SDK.
+ */
+import { createHmac } from "node:crypto";
+/**
+ * Sign an anchor fingerprint with HMAC-SHA256.
+ *
+ * @param signingKey - Shared secret between SDK and server.
+ * @param anchorFingerprint - The 12-char hex fingerprint to sign.
+ * @param agentId - Optional agent identifier to bind to the signature.
+ * @returns 64-char hex HMAC-SHA256 digest.
+ *
+ * Message format:
+ *   "{fingerprint}:{agentId}" if agentId is provided
+ *   "{fingerprint}"           if agentId is undefined
+ */
+export function signPayload(signingKey, anchorFingerprint, agentId) {
+    const message = agentId
+        ? `${anchorFingerprint}:${agentId}`
+        : anchorFingerprint;
+    return createHmac("sha256", signingKey)
+        .update(message, "utf-8")
+        .digest("hex");
+}
+//# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,UAAkB,EAClB,iBAAyB,EACzB,OAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,GAAG,iBAAiB,IAAI,OAAO,EAAE;QACnC,CAAC,CAAC,iBAAiB,CAAC;IACtB,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SACpC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,108 @@
+/**
+ * SWT3 AI Witness SDK — Type definitions.
+ */
+export interface WitnessConfig {
+    endpoint: string;
+    apiKey: string;
+    tenantId: string;
+    clearingLevel: 0 | 1 | 2 | 3;
+    bufferSize: number;
+    flushInterval: number;
+    timeout: number;
+    maxRetries: number;
+    latencyThresholdMs: number;
+    guardrailsRequired: number;
+    guardrailNames: string[];
+    procedures?: string[];
+    factorHandoff?: "file";
+    factorHandoffPath?: string;
+    agentId?: string;
+    signingKey?: string;
+    cycleId?: string;
+    policyVersion?: string;
+    jurisdiction?: string;
+    legalBasis?: string;
+    purposeClass?: string;
+    onFlush?: (payloads: WitnessPayload[], receipts: WitnessReceipt[]) => void;
+}
+export interface WitnessPayload {
+    procedure_id: string;
+    factor_a: number;
+    factor_b: number;
+    factor_c: number;
+    clearing_level: number;
+    anchor_fingerprint: string;
+    anchor_epoch: number;
+    fingerprint_timestamp_ms: number;
+    ai_model_id?: string;
+    ai_prompt_hash?: string;
+    ai_response_hash?: string;
+    ai_system_prompt_hash?: string;
+    ai_latency_ms?: number;
+    ai_input_tokens?: number;
+    ai_output_tokens?: number;
+    ai_context?: {
+        provider?: string;
+        guardrails?: string[];
+        system_fingerprint?: string;
+        tool_name?: string;
+        tool_call_id?: string;
+        access_target?: string;
+        access_scope?: string;
+        access_granted?: boolean;
+        cycle_id?: string;
+    };
+    agent_id?: string;
+    cycle_id?: string;
+    payload_signature?: string;
+    policy_version_hash?: string;
+    jurisdiction?: string;
+    legal_basis?: string;
+    purpose_class?: string;
+    authorization_id?: string;
+    revocation_target?: string;
+    revocation_reason?: string;
+}
+export interface WitnessReceipt {
+    procedure_id: string;
+    verdict: "PASS" | "FAIL" | string;
+    swt3_anchor: string;
+    clearing_level: number;
+    witnessed_at: string;
+    verification_url: string;
+    ok: boolean;
+    error?: string;
+}
+export interface BatchResponse {
+    ok: boolean;
+    tenant_id: string;
+    total: number;
+    accepted: number;
+    rejected: number;
+    receipts: WitnessReceipt[];
+}
+export interface InferenceRecord {
+    modelId: string;
+    modelHash: string;
+    promptHash: string;
+    responseHash: string;
+    latencyMs: number;
+    inputTokens?: number;
+    outputTokens?: number;
+    guardrailsActive: number;
+    guardrailsRequired: number;
+    guardrailPassed: boolean;
+    hasRefusal: boolean;
+    provider: string;
+    systemFingerprint?: string;
+    systemPromptHash?: string;
+    guardrailNames: string[];
+    toolName?: string;
+    toolCallId?: string;
+    accessTarget?: string;
+    accessGranted?: boolean;
+    accessScope?: string;
+}
+/** Valid AI procedure IDs from SWT3 Spec v1.2.0 */
+export declare const AI_PROCEDURES: Set<string>;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,IAAI,CAAC;CAC5E;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB,EAAE,MAAM,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE;QACX,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mDAAmD;AACnD,eAAO,MAAM,aAAa,aAcxB,CAAC"}

package/dist/types.js

@@ -0,0 +1,20 @@
+/**
+ * SWT3 AI Witness SDK — Type definitions.
+ */
+/** Valid AI procedure IDs from SWT3 Spec v1.2.0 */
+export const AI_PROCEDURES = new Set([
+    "AI-INF.1", "AI-INF.2", "AI-INF.3",
+    "AI-MDL.1", "AI-MDL.2", "AI-MDL.3",
+    "AI-GRD.1", "AI-GRD.2", "AI-GRD.3",
+    "AI-FAIR.1", "AI-FAIR.2",
+    "AI-DATA.1", "AI-DATA.2",
+    "AI-HITL.1", "AI-HITL.2",
+    "AI-EXPL.1", "AI-EXPL.2",
+    "AI-TOOL.1",
+    "AI-ID.1",
+    "AI-ACC.1",
+    "AI-REV.1",
+    "AI-SEC.1",
+    "AI-SEC.2",
+]);
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AA6GH,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IACnC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW;IACX,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;CACX,CAAC,CAAC"}