@tenova/swt3-ai 0.5.2 → 0.5.4

package/dist/sentinel-client.d.ts

@@ -0,0 +1,90 @@
+/**
+ * SWT3 AI Witness SDK: Sentinel Client.
+ *
+ * Thin proxy that connects to the swt3-sentinel daemon over a Unix
+ * domain socket. When the daemon is detected, witness operations
+ * (attestation signing, WAL persistence, Merkle accumulation) are
+ * delegated to the isolated process for tamper-proof evidence.
+ * When the daemon is absent, the SDK operates standalone with
+ * zero degradation.
+ *
+ * Auto-detection adds less than 10ms to initialization and requires
+ * zero code changes from the developer.
+ *
+ * Copyright (c) 2026 Tenable Nova LLC. Apache 2.0. Patent pending.
+ */
+export interface SentinelClientOptions {
+    socketPath?: string;
+    timeoutMs?: number;
+    failSecure?: boolean;
+}
+export interface SentinelViolation {
+    rule: string;
+    tool: string;
+    action: "blocked" | "logged";
+    reason: string;
+    timestamp: number;
+    context?: Record<string, unknown>;
+}
+export interface SentinelCheckResult {
+    allowed: boolean;
+    violation?: SentinelViolation;
+}
+export interface SentinelStatusResult {
+    uptime: number;
+    tokens: number;
+    violations: number;
+    walSeq: number;
+    walCheckpoint: number;
+    connections: number;
+    protocolVersion: number;
+}
+export declare class SentinelClient {
+    private socket;
+    private _connected;
+    private pending;
+    private buffer;
+    private socketPath;
+    private timeoutMs;
+    private failSecure;
+    constructor(options?: SentinelClientOptions);
+    /**
+     * Non-blocking auto-detection. Attempts to connect to the sentinel
+     * daemon with a 10ms timeout. Returns a connected client or null.
+     *
+     * Usage:
+     *   const sentinel = await SentinelClient.detect();
+     *   if (sentinel) { // daemon present, delegate operations }
+     */
+    static detect(socketPath?: string): Promise<SentinelClient | null>;
+    /** Connect to the sentinel daemon. */
+    connect(): Promise<void>;
+    get connected(): boolean;
+    /** Check a tool call against the shared enforcement engine. */
+    check(tool: string): Promise<SentinelCheckResult>;
+    /** Record a witness entry in the protected WAL. */
+    record(fingerprint: string, payload: string): Promise<{
+        seq: number;
+        merkleRoot?: string;
+    }>;
+    /** Sign a payload using the daemon's isolated key. */
+    sign(data: string, agentId?: string): Promise<string>;
+    /** Record token consumption in the shared budget. */
+    recordTokens(count: number): Promise<{
+        total: number;
+        budget: number;
+    }>;
+    /** Flush the protected WAL. */
+    flush(): Promise<{
+        flushedSeq: number;
+        merkleRoot?: string;
+    }>;
+    /** Get daemon status. */
+    status(): Promise<SentinelStatusResult>;
+    /** Disconnect from the daemon. */
+    destroy(): void;
+    private request;
+    private onData;
+    private rejectAllPending;
+}
+//# sourceMappingURL=sentinel-client.d.ts.map

package/dist/sentinel-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel-client.d.ts","sourceRoot":"","sources":["../src/sentinel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAYH,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;CACzB;AAQD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,MAAM,CAAM;IACpB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,UAAU,CAAU;gBAEhB,OAAO,GAAE,qBAA0B;IAQ/C;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IA4BlE,sCAAsC;IAChC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAsB9B,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,+DAA+D;IACzD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIvD,mDAAmD;IAC7C,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAIjG,sDAAsD;IAChD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAK3D,qDAAqD;IAC/C,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7E,+BAA+B;IACzB,KAAK,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAInE,yBAAyB;IACnB,MAAM,IAAI,OAAO,CAAC,oBAAoB,CAAC;IAI7C,kCAAkC;IAClC,OAAO,IAAI,IAAI;IAWf,OAAO,CAAC,OAAO;IAoBf,OAAO,CAAC,MAAM;IA0Bd,OAAO,CAAC,gBAAgB;CAOzB"}

package/dist/sentinel-client.js

@@ -0,0 +1,179 @@
+/**
+ * SWT3 AI Witness SDK: Sentinel Client.
+ *
+ * Thin proxy that connects to the swt3-sentinel daemon over a Unix
+ * domain socket. When the daemon is detected, witness operations
+ * (attestation signing, WAL persistence, Merkle accumulation) are
+ * delegated to the isolated process for tamper-proof evidence.
+ * When the daemon is absent, the SDK operates standalone with
+ * zero degradation.
+ *
+ * Auto-detection adds less than 10ms to initialization and requires
+ * zero code changes from the developer.
+ *
+ * Copyright (c) 2026 Tenable Nova LLC. Apache 2.0. Patent pending.
+ */
+import { connect } from "node:net";
+import { randomUUID } from "node:crypto";
+import { join } from "node:path";
+import { homedir } from "node:os";
+/** User-writable default: ~/.swt3/sentinel.sock. No root needed. */
+const DEFAULT_SOCKET_PATH = join(homedir(), ".swt3", "sentinel.sock");
+const DEFAULT_TIMEOUT_MS = 50;
+const DETECT_TIMEOUT_MS = 10;
+export class SentinelClient {
+    socket = null;
+    _connected = false;
+    pending = new Map();
+    buffer = "";
+    socketPath;
+    timeoutMs;
+    failSecure;
+    constructor(options = {}) {
+        this.socketPath = options.socketPath
+            ?? process.env.SWT3_SENTINEL_SOCKET
+            ?? DEFAULT_SOCKET_PATH;
+        this.timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+        this.failSecure = options.failSecure ?? false;
+    }
+    /**
+     * Non-blocking auto-detection. Attempts to connect to the sentinel
+     * daemon with a 10ms timeout. Returns a connected client or null.
+     *
+     * Usage:
+     *   const sentinel = await SentinelClient.detect();
+     *   if (sentinel) { // daemon present, delegate operations }
+     */
+    static detect(socketPath) {
+        const path = socketPath
+            ?? process.env.SWT3_SENTINEL_SOCKET
+            ?? DEFAULT_SOCKET_PATH;
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                sock.destroy();
+                resolve(null);
+            }, DETECT_TIMEOUT_MS);
+            const sock = connect({ path }, () => {
+                clearTimeout(timer);
+                sock.destroy();
+                // Socket exists and accepts connections -- create a real client
+                const client = new SentinelClient({ socketPath: path });
+                client.connect()
+                    .then(() => resolve(client))
+                    .catch(() => resolve(null));
+            });
+            sock.on("error", () => {
+                clearTimeout(timer);
+                resolve(null);
+            });
+        });
+    }
+    /** Connect to the sentinel daemon. */
+    async connect() {
+        return new Promise((resolve, reject) => {
+            this.socket = connect({ path: this.socketPath }, () => {
+                this._connected = true;
+                resolve();
+            });
+            this.socket.on("data", (chunk) => this.onData(chunk));
+            this.socket.on("close", () => {
+                this._connected = false;
+                this.rejectAllPending("Connection closed");
+            });
+            this.socket.on("error", (err) => {
+                this._connected = false;
+                this.rejectAllPending(err.message);
+                reject(err);
+            });
+        });
+    }
+    get connected() {
+        return this._connected;
+    }
+    /** Check a tool call against the shared enforcement engine. */
+    async check(tool) {
+        return this.request({ op: "check", tool });
+    }
+    /** Record a witness entry in the protected WAL. */
+    async record(fingerprint, payload) {
+        return this.request({ op: "record", fingerprint, payload });
+    }
+    /** Sign a payload using the daemon's isolated key. */
+    async sign(data, agentId) {
+        const resp = await this.request({ op: "sign", payload: data, agentId });
+        return resp.signature;
+    }
+    /** Record token consumption in the shared budget. */
+    async recordTokens(count) {
+        return this.request({ op: "tokens", count });
+    }
+    /** Flush the protected WAL. */
+    async flush() {
+        return this.request({ op: "flush" });
+    }
+    /** Get daemon status. */
+    async status() {
+        return this.request({ op: "status" });
+    }
+    /** Disconnect from the daemon. */
+    destroy() {
+        this.rejectAllPending("Client destroyed");
+        if (this.socket) {
+            this.socket.destroy();
+            this.socket = null;
+        }
+        this._connected = false;
+    }
+    // ── Internal ──────────────────────────────────────────────────────
+    request(req) {
+        const id = randomUUID().slice(0, 8);
+        const line = JSON.stringify({ ...req, id }) + "\n";
+        return new Promise((resolve, reject) => {
+            if (!this.socket || !this._connected) {
+                reject(new Error("Not connected to sentinel daemon"));
+                return;
+            }
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error("Sentinel request timed out"));
+            }, this.timeoutMs);
+            this.pending.set(id, { resolve, reject, timer });
+            this.socket.write(line);
+        });
+    }
+    onData(chunk) {
+        this.buffer += chunk.toString();
+        let idx;
+        while ((idx = this.buffer.indexOf("\n")) !== -1) {
+            const line = this.buffer.slice(0, idx).trim();
+            this.buffer = this.buffer.slice(idx + 1);
+            if (!line)
+                continue;
+            try {
+                const resp = JSON.parse(line);
+                const pending = this.pending.get(resp.id);
+                if (pending) {
+                    clearTimeout(pending.timer);
+                    this.pending.delete(resp.id);
+                    if (resp.ok) {
+                        pending.resolve(resp);
+                    }
+                    else {
+                        pending.reject(new Error(resp.error ?? "Sentinel error"));
+                    }
+                }
+            }
+            catch {
+                // Corrupted response line -- skip
+            }
+        }
+    }
+    rejectAllPending(reason) {
+        for (const [id, pending] of this.pending) {
+            clearTimeout(pending.timer);
+            pending.reject(new Error(reason));
+        }
+        this.pending.clear();
+    }
+}
+//# sourceMappingURL=sentinel-client.js.map

package/dist/sentinel-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel-client.js","sourceRoot":"","sources":["../src/sentinel-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,oEAAoE;AACpE,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;AACtE,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAsC7B,MAAM,OAAO,cAAc;IACjB,MAAM,GAAkB,IAAI,CAAC;IAC7B,UAAU,GAAG,KAAK,CAAC;IACnB,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC5C,MAAM,GAAG,EAAE,CAAC;IACZ,UAAU,CAAS;IACnB,SAAS,CAAS;IAClB,UAAU,CAAU;IAE5B,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU;eAC/B,OAAO,CAAC,GAAG,CAAC,oBAAoB;eAChC,mBAAmB,CAAC;QACzB,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACzD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,KAAK,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,MAAM,CAAC,UAAmB;QAC/B,MAAM,IAAI,GAAG,UAAU;eAClB,OAAO,CAAC,GAAG,CAAC,oBAAoB;eAChC,mBAAmB,CAAC;QAEzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,EAAE,iBAAiB,CAAC,CAAC;YAEtB,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE;gBAClC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,gEAAgE;gBAChE,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,MAAM,CAAC,OAAO,EAAE;qBACb,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;qBAC3B,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,sCAAsC;IACtC,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE;gBACpD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAE9D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;gBACxB,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;YAC7C,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;gBACxB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,KAAK,CAAC,IAAY;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,OAAe;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,sDAAsD;IACtD,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAgB;QACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,+BAA+B;IAC/B,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,yBAAyB;IACzB,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,kCAAkC;IAClC,OAAO;QACL,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED,qEAAqE;IAE7D,OAAO,CAAC,GAA4B;QAC1C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;QAEnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,CAAC;YAClD,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,GAAW,CAAC;QAChB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC1C,IAAI,OAAO,EAAE,CAAC;oBACZ,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC7B,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;wBACZ,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACxB,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,gBAAgB,CAAC,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACrC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACzC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/signing.d.ts

@@ -1,20 +1,45 @@
 /**
- * SWT3 AI Witness SDK - Payload Signing (HMAC-SHA256).
+ * SWT3 AI Witness SDK - Payload Signing.
  *
- * Signs anchor fingerprints to prove which SDK instance minted them.
+ * Supports HMAC-SHA256 (default) and ML-DSA-65 (FIPS 204, post-quantum).
  * The signature input is deterministic and must match the Python SDK.
+ *
+ * ML-DSA-65 requires: npm install @noble/post-quantum
+ */
+export declare const SIGNING_ALGORITHM_HMAC: "hmac-sha256";
+export declare const SIGNING_ALGORITHM_MLDSA: "ml-dsa-65";
+export type SigningAlgorithm = typeof SIGNING_ALGORITHM_HMAC | typeof SIGNING_ALGORITHM_MLDSA;
+export declare const VALID_SIGNING_ALGORITHMS: Set<string>;
+export declare const DEFAULT_SIGNING_ALGORITHM: SigningAlgorithm;
+/**
+ * Generate an ML-DSA-65 key pair from a random 32-byte seed.
+ * @returns { seed: Uint8Array, publicKey: Uint8Array } - seed is 32 bytes, publicKey is 1952 bytes.
+ */
+export declare function generateMldsaKeypair(): {
+    seed: Uint8Array;
+    publicKey: Uint8Array;
+};
+/**
+ * Verify an ML-DSA-65 signature.
+ * @param publicKeyHex - Hex-encoded public key (1952 bytes = 3904 hex chars).
+ * @param message - The canonical message that was signed.
+ * @param signatureHex - Hex-encoded ML-DSA-65 signature.
+ * @returns True if valid, false otherwise.
  */
+export declare function verifyMldsa(publicKeyHex: string, message: string, signatureHex: string): boolean;
 /**
- * Sign an anchor fingerprint with HMAC-SHA256.
+ * Sign an anchor fingerprint.
  *
- * @param signingKey - Shared secret between SDK and server.
+ * @param signingKey - For hmac-sha256: shared secret string.
+ *                     For ml-dsa-65: hex-encoded 32-byte seed.
  * @param anchorFingerprint - The 12-char hex fingerprint to sign.
  * @param agentId - Optional agent identifier to bind to the signature.
- * @returns 64-char hex HMAC-SHA256 digest.
+ * @param algorithm - "hmac-sha256" (default) or "ml-dsa-65".
+ * @returns Hex-encoded signature string.
  *
  * Message format:
  *   "{fingerprint}:{agentId}" if agentId is provided
  *   "{fingerprint}"           if agentId is undefined
  */
-export declare function signPayload(signingKey: string, anchorFingerprint: string, agentId?: string): string;
+export declare function signPayload(signingKey: string, anchorFingerprint: string, agentId?: string, algorithm?: SigningAlgorithm): string;
 //# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAOR"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,eAAO,MAAM,sBAAsB,EAAG,aAAsB,CAAC;AAC7D,eAAO,MAAM,uBAAuB,EAAG,WAAoB,CAAC;AAC5D,MAAM,MAAM,gBAAgB,GAAG,OAAO,sBAAsB,GAAG,OAAO,uBAAuB,CAAC;AAC9F,eAAO,MAAM,wBAAwB,aAAqE,CAAC;AAC3G,eAAO,MAAM,yBAAyB,EAAE,gBAAyC,CAAC;AAsClF;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,CAMlF;AAYD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,GACnB,OAAO,CAUT;AAmBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,iBAAiB,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,MAAM,EAChB,SAAS,GAAE,gBAA4C,GACtD,MAAM,CAgBR"}

package/dist/signing.js

@@ -1,28 +1,121 @@
 /**
- * SWT3 AI Witness SDK - Payload Signing (HMAC-SHA256).
+ * SWT3 AI Witness SDK - Payload Signing.
  *
- * Signs anchor fingerprints to prove which SDK instance minted them.
+ * Supports HMAC-SHA256 (default) and ML-DSA-65 (FIPS 204, post-quantum).
  * The signature input is deterministic and must match the Python SDK.
+ *
+ * ML-DSA-65 requires: npm install @noble/post-quantum
  */
 import { createHmac } from "node:crypto";
+import { createRequire } from "node:module";
+// ── Algorithm Constants ──────────────────────────────────────────────
+export const SIGNING_ALGORITHM_HMAC = "hmac-sha256";
+export const SIGNING_ALGORITHM_MLDSA = "ml-dsa-65";
+export const VALID_SIGNING_ALGORITHMS = new Set([SIGNING_ALGORITHM_HMAC, SIGNING_ALGORITHM_MLDSA]);
+export const DEFAULT_SIGNING_ALGORITHM = SIGNING_ALGORITHM_HMAC;
+// ── Message Builder ──────────────────────────────────────────────────
+function buildMessage(anchorFingerprint, agentId) {
+    return agentId ? `${anchorFingerprint}:${agentId}` : anchorFingerprint;
+}
+// ── HMAC-SHA256 ──────────────────────────────────────────────────────
+function signHmac(signingKey, message) {
+    return createHmac("sha256", signingKey)
+        .update(message, "utf-8")
+        .digest("hex");
+}
+// ── ML-DSA-65 (FIPS 204) ────────────────────────────────────────────
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let _mlDsa = null;
+function getMlDsa() {
+    if (_mlDsa)
+        return _mlDsa;
+    try {
+        // Use createRequire for ESM-compatible sync import of @noble/post-quantum
+        const esmRequire = createRequire(import.meta.url);
+        _mlDsa = esmRequire("@noble/post-quantum/ml-dsa.js");
+        return _mlDsa;
+    }
+    catch {
+        throw new Error("ML-DSA-65 signing requires @noble/post-quantum. " +
+            "Install with: npm install @noble/post-quantum");
+    }
+}
 /**
- * Sign an anchor fingerprint with HMAC-SHA256.
+ * Generate an ML-DSA-65 key pair from a random 32-byte seed.
+ * @returns { seed: Uint8Array, publicKey: Uint8Array } - seed is 32 bytes, publicKey is 1952 bytes.
+ */
+export function generateMldsaKeypair() {
+    const { ml_dsa65 } = getMlDsa();
+    const seed = globalThis.crypto?.getRandomValues?.(new Uint8Array(32))
+        ?? require("node:crypto").randomBytes(32);
+    const kp = ml_dsa65.keygen(seed);
+    return { seed, publicKey: kp.publicKey };
+}
+function signMlDsa(seedHex, message) {
+    const { ml_dsa65 } = getMlDsa();
+    const seed = hexToBytes(seedHex);
+    // Expand seed to full 4032-byte secret key via deterministic keygen
+    const kp = ml_dsa65.keygen(seed);
+    const msgBytes = new TextEncoder().encode(message);
+    const sig = ml_dsa65.sign(msgBytes, kp.secretKey);
+    return bytesToHex(sig);
+}
+/**
+ * Verify an ML-DSA-65 signature.
+ * @param publicKeyHex - Hex-encoded public key (1952 bytes = 3904 hex chars).
+ * @param message - The canonical message that was signed.
+ * @param signatureHex - Hex-encoded ML-DSA-65 signature.
+ * @returns True if valid, false otherwise.
+ */
+export function verifyMldsa(publicKeyHex, message, signatureHex) {
+    const { ml_dsa65 } = getMlDsa();
+    const publicKey = hexToBytes(publicKeyHex);
+    const msgBytes = new TextEncoder().encode(message);
+    const sig = hexToBytes(signatureHex);
+    try {
+        return ml_dsa65.verify(sig, msgBytes, publicKey);
+    }
+    catch {
+        return false;
+    }
+}
+// ── Hex Utilities ────────────────────────────────────────────────────
+function hexToBytes(hex) {
+    const len = hex.length;
+    const bytes = new Uint8Array(len / 2);
+    for (let i = 0; i < len; i += 2) {
+        bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+    }
+    return bytes;
+}
+function bytesToHex(bytes) {
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+// ── Public API ───────────────────────────────────────────────────────
+/**
+ * Sign an anchor fingerprint.
  *
- * @param signingKey - Shared secret between SDK and server.
+ * @param signingKey - For hmac-sha256: shared secret string.
+ *                     For ml-dsa-65: hex-encoded 32-byte seed.
  * @param anchorFingerprint - The 12-char hex fingerprint to sign.
  * @param agentId - Optional agent identifier to bind to the signature.
- * @returns 64-char hex HMAC-SHA256 digest.
+ * @param algorithm - "hmac-sha256" (default) or "ml-dsa-65".
+ * @returns Hex-encoded signature string.
  *
  * Message format:
  *   "{fingerprint}:{agentId}" if agentId is provided
  *   "{fingerprint}"           if agentId is undefined
  */
-export function signPayload(signingKey, anchorFingerprint, agentId) {
-    const message = agentId
-        ? `${anchorFingerprint}:${agentId}`
-        : anchorFingerprint;
-    return createHmac("sha256", signingKey)
-        .update(message, "utf-8")
-        .digest("hex");
+export function signPayload(signingKey, anchorFingerprint, agentId, algorithm = DEFAULT_SIGNING_ALGORITHM) {
+    if (!VALID_SIGNING_ALGORITHMS.has(algorithm)) {
+        throw new Error(`Unknown signing algorithm: '${algorithm}'. ` +
+            `Valid: ${[...VALID_SIGNING_ALGORITHMS].sort().join(", ")}`);
+    }
+    const message = buildMessage(anchorFingerprint, agentId);
+    if (algorithm === SIGNING_ALGORITHM_HMAC) {
+        return signHmac(signingKey, message);
+    }
+    // ML-DSA-65: signingKey is hex-encoded private key bytes
+    return signMlDsa(signingKey, message);
 }
 //# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,UAAkB,EAClB,iBAAyB,EACzB,OAAgB;IAEhB,MAAM,OAAO,GAAG,OAAO;QACrB,CAAC,CAAC,GAAG,iBAAiB,IAAI,OAAO,EAAE;QACnC,CAAC,CAAC,iBAAiB,CAAC;IACtB,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SACpC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,wEAAwE;AAExE,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAsB,CAAC;AAC7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,WAAoB,CAAC;AAE5D,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,CAAC,sBAAsB,EAAE,uBAAuB,CAAC,CAAC,CAAC;AAC3G,MAAM,CAAC,MAAM,yBAAyB,GAAqB,sBAAsB,CAAC;AAElF,wEAAwE;AAExE,SAAS,YAAY,CAAC,iBAAyB,EAAE,OAAgB;IAC/D,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,iBAAiB,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACzE,CAAC;AAED,wEAAwE;AAExE,SAAS,QAAQ,CAAC,UAAkB,EAAE,OAAe;IACnD,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SACpC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;SACxB,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,uEAAuE;AAEvE,8DAA8D;AAC9D,IAAI,MAAM,GAAQ,IAAI,CAAC;AAIvB,SAAS,QAAQ;IACf,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,0EAA0E;QAC1E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,GAAG,UAAU,CAAC,+BAA+B,CAAC,CAAC;QACrD,OAAO,MAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,kDAAkD;YAClD,+CAA+C,CAChD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;WAChE,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,SAAS,CAAC,OAAe,EAAE,OAAe;IACjD,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,oEAAoE;IACpE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,YAAoB,EACpB,OAAe,EACf,YAAoB;IAEpB,MAAM,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wEAAwE;AAExE,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CACzB,UAAkB,EAClB,iBAAyB,EACzB,OAAgB,EAChB,YAA8B,yBAAyB;IAEvD,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,+BAA+B,SAAS,KAAK;YAC7C,UAAU,CAAC,GAAG,wBAAwB,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAEzD,IAAI,SAAS,KAAK,sBAAsB,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,yDAAyD;IACzD,OAAO,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACxC,CAAC"}

package/dist/types.d.ts

@@ -20,12 +20,14 @@ export interface WitnessConfig {
     signingKey?: string;
     signingKeyId?: string;
     signingKeyVersion?: number;
+    signingAlgorithm?: "hmac-sha256" | "ml-dsa-65";
     cycleId?: string;
     policyVersion?: string;
     jurisdiction?: string;
     legalBasis?: string;
     purposeClass?: string;
     tokenBudget?: number;
+    chainMinTrustLevel?: number;
     onFlush?: (payloads: WitnessPayload[], receipts: WitnessReceipt[]) => void;
 }
 export interface WitnessPayload {
@@ -48,6 +50,7 @@ export interface WitnessPayload {
     agent_id?: string;
     cycle_id?: string;
     payload_signature?: string;
+    signing_algorithm?: string;
     signing_key_id?: string;
     signing_key_version?: number;
     policy_version_hash?: string;
@@ -152,6 +155,12 @@ export declare const BINDING_METHODS: Record<string, number>;
 export declare const APPROVAL_STATUS: Record<string, number>;
 /** Training data PII lifecycle event type codes for AI-DATA.4. */
 export declare const PII_EVENT_TYPES: Record<string, number>;
+/** Content type codes for AI-MARK.1 content provenance marking. */
+export declare const CONTENT_TYPE_CODES: Record<string, number>;
+/** Valid marking methods for AI-MARK.1. */
+export declare const MARKING_METHODS: readonly ["c2pa", "watermark", "metadata_tag", "steganographic", "manifest"];
+/** Baseline mode codes for AI-BASE.1 agent behavioral baseline. */
+export declare const BASELINE_MODE_CODES: Record<string, number>;
 /** Trust mesh configuration from .swt3.yaml trust_mesh section. */
 export interface TrustMeshConfig {
     mode: "strict" | "permissive" | "monitor";
@@ -171,11 +180,26 @@ export interface TrustMeshConfig {
         key: string;
     }[];
 }
+/** Hardware runtime profile for config-time topology binding. */
+export interface RuntimeProfileConfig {
+    expectedTopology?: string;
+    minGpuCount?: number;
+    minMemoryMb?: number;
+    expectedAccelerator?: string;
+    maxTemperatureCelsius?: number;
+    maxPowerWatts?: number;
+}
 /** Hardware attestation configuration from .swt3.yaml hardware section. */
 export interface HardwareConfig {
     requireAttestation: boolean;
     attestationFreshness: number;
     allowedMethods: string[];
+    runtimeProfile?: RuntimeProfileConfig;
+}
+/** Skill card configuration from .swt3.yaml skill_card section. */
+export interface SkillCardConfig {
+    skills: (string | SkillInfo)[];
+    expectedManifestHash?: string;
 }
 /** Density policy configuration from .swt3.yaml density_policy section. */
 export interface DensityPolicyConfig {
@@ -259,6 +283,7 @@ export interface LoadedConfig {
     witnessOptions: Record<string, unknown>;
     trustMesh: TrustMeshConfig | null;
     hardware: HardwareConfig | null;
+    skillCard: SkillCardConfig | null;
     densityPolicy: DensityPolicyConfig | null;
     mcpPolicy: McpPolicyConfig | null;
     merkle: MerkleConfig | null;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,IAAI,CAAC;CAC5E;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB,EAAE,MAAM,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mDAAmD;AACnD,eAAO,MAAM,aAAa,aAkCxB,CAAC;AAEH,2DAA2D;AAC3D,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,CAAC,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAErD,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEpD,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGlD,CAAC;AAIF,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;IACxB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,2EAA2E;IAC3E,cAAc,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kFAAkF;IAClF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,aAAa,GAAG,WAAW,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,IAAI,CAAC;CAC5E;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,wBAAwB,EAAE,MAAM,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mDAAmD;AACnD,eAAO,MAAM,aAAa,aAqCxB,CAAC;AAEH,2DAA2D;AAC3D,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,uCAAuC;AACvC,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,CAAC,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,4DAA4D;AAC5D,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,8CAA8C;AAC9C,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAErD,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEpD,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAElD,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAGlD,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAErD,CAAC;AAEF,2CAA2C;AAC3C,eAAO,MAAM,eAAe,8EAElB,CAAC;AAEX,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAEtD,CAAC;AAIF,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACnD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC/C;AAED,iEAAiE;AACjE,MAAM,WAAW,oBAAoB;IACnC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAC/B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,MAAM,EAAE,OAAO,GAAG,KAAK,CAAC;IACxB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,0DAA0D;AAC1D,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,qEAAqE;AACrE,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kEAAkE;IAClE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iEAAiE;IACjE,WAAW,EAAE,OAAO,CAAC;IACrB,2EAA2E;IAC3E,cAAc,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,sCAAsC;IACtC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kFAAkF;IAClF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,uDAAuD;AACvD,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,eAAe,GAAG,IAAI,CAAC;IAClC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/types.js

@@ -31,11 +31,14 @@ export const AI_PROCEDURES = new Set([
     "AI-CHR.1",
     "AI-VIO.1",
     "AI-CHAIN.1",
+    "AI-CHAIN.2",
     "AI-SAFE.1",
     "AI-DATA.3",
     "AI-DATA.4",
     "AI-ENV.1",
     "AI-ENV.2",
+    "AI-MARK.1",
+    "AI-BASE.1",
 ]);
 /** Quantization method codes for AI-MDL.7. */
 export const QUANTIZATION_CODES = {
@@ -58,4 +61,16 @@ export const PII_EVENT_TYPES = {
     unspecified: 0, pseudonymization: 1, anonymization: 2,
     access_restriction: 3, deletion: 4, encryption: 5,
 };
+/** Content type codes for AI-MARK.1 content provenance marking. */
+export const CONTENT_TYPE_CODES = {
+    text: 0, image: 1, audio: 2, video: 3, multimodal: 4, code: 5, structured_data: 6,
+};
+/** Valid marking methods for AI-MARK.1. */
+export const MARKING_METHODS = [
+    "c2pa", "watermark", "metadata_tag", "steganographic", "manifest",
+];
+/** Baseline mode codes for AI-BASE.1 agent behavioral baseline. */
+export const BASELINE_MODE_CODES = {
+    establishing: 0, monitoring: 1, drift_detected: 2, baseline_reset: 3,
+};
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAwGH,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IACnC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,WAAW,EAAE,WAAW,EAAE,WAAW;IACrC,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW;IACX,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,UAAU;IACV,YAAY;IACZ,WAAW;IACX,WAAW;IACX,WAAW;IACX,UAAU;IACV,UAAU;CACX,CAAC,CAAC;AAkDH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;CACtE,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;CACzE,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;CACtC,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;CACnC,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,WAAW,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;IACrD,kBAAkB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;CAClD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AA2GH,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IACnC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,UAAU,EAAE,UAAU,EAAE,UAAU;IAClC,WAAW,EAAE,WAAW,EAAE,WAAW;IACrC,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW,EAAE,WAAW;IACxB,WAAW;IACX,SAAS;IACT,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,UAAU;IACV,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,WAAW;IACX,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAkDH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;CACtE,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,iBAAiB,GAA2B;IACvD,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;CACzE,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;CACtC,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;CACnC,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAA2B;IACrD,WAAW,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;IACrD,kBAAkB,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC;CAClD,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAA2B;IACxD,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC;CAClF,CAAC;AAEF,2CAA2C;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU;CACzD,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAA2B;IACzD,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC;CACrE,CAAC"}

package/dist/wal.d.ts

@@ -14,7 +14,7 @@
  *   duplicate witness anchors from being submitted. The set is populated
  *   from the WAL on startup and updated on each enqueue.
  *
- * Patent pending. All rights reserved.
+ * Copyright (c) 2026 Tenable Nova LLC. Apache 2.0. Patent pending.
  */
 import type { WitnessPayload } from "./types.js";
 export interface WalOptions {