@vurb/core 3.2.0

package/dist/introspection/ToolContract.js

@@ -0,0 +1,218 @@
+/**
+ * ToolContract — Behavioral Contract Materialization
+ *
+ * Unifies the declarative surface (tool names, schemas, tags) with
+ * the behavioral contract (Presenter egress schema, system rules,
+ * cognitive guardrails, middleware chain, state-sync policies) into
+ * a single, serializable, diffable, hashable artifact.
+ *
+ * **Key insight**: Vurb's Presenter is not just a response
+ * formatter — it's a declarative behavioral specification. The Zod
+ * schema, system rules, agent limits, and affordances are all
+ * explicit, serializable contracts. By materializing them into a
+ * `ToolContract`, we create a fingerprint that changes when behavior
+ * changes — even if the MCP tool declaration stays identical.
+ *
+ * **Zero developer effort**: The contract materializes from what the
+ * developer has already declared. No annotations, no config, no
+ * ceremony — just `materializeContract(builder)`.
+ *
+ * Pure-function module: no state, no side effects.
+ *
+ * @module
+ */
+import {} from '../core/types.js';
+import { sha256, canonicalize } from './canonicalize.js';
+import { scanSource, buildEntitlements } from './EntitlementScanner.js';
+// ============================================================================
+// Materialization
+// ============================================================================
+/**
+ * Materialize a `ToolContract` from a builder's public API.
+ *
+ * Extracts all behavioral metadata from the builder's introspection
+ * methods without accessing any private internals. This guarantees
+ * compatibility with any `ToolBuilder` implementation.
+ *
+ * @param builder - A registered tool builder
+ * @returns A fully materialized `ToolContract`
+ */
+export async function materializeContract(builder) {
+    const toolDef = builder.buildToolDefinition();
+    const metadata = builder.getActionMetadata();
+    // Surface
+    const actions = {};
+    for (const action of metadata) {
+        actions[action.key] = {
+            description: action.description,
+            destructive: action.destructive,
+            idempotent: action.idempotent,
+            readOnly: action.readOnly,
+            requiredFields: action.requiredFields,
+            presenterName: action.presenterName,
+            inputSchemaDigest: await sha256(JSON.stringify(action.requiredFields)),
+            hasMiddleware: action.hasMiddleware,
+        };
+    }
+    const surface = {
+        name: builder.getName(),
+        description: toolDef.description,
+        tags: builder.getTags(),
+        actions,
+        inputSchemaDigest: await sha256(canonicalize(toolDef.inputSchema)),
+    };
+    // Behavior — extract from action metadata (Presenter introspection accessors)
+    const behavior = await materializeBehavior(metadata, builder);
+    // Token Economics
+    const tokenEconomics = computeTokenEconomics(metadata, behavior);
+    // Entitlements — real static analysis via EntitlementScanner
+    let entitlements;
+    try {
+        const builderAny = builder;
+        const actions = typeof builderAny['getActions'] === 'function'
+            ? builderAny.getActions()
+            : [];
+        const combinedSource = actions
+            .filter(a => typeof a.handler === 'function')
+            .map(a => a.handler.toString())
+            .join('\n');
+        if (combinedSource.length > 0) {
+            const matches = scanSource(combinedSource);
+            entitlements = buildEntitlements(matches);
+        }
+        else {
+            entitlements = { filesystem: false, network: false, subprocess: false, crypto: false, codeEvaluation: false, raw: [] };
+        }
+    }
+    catch {
+        entitlements = { filesystem: false, network: false, subprocess: false, crypto: false, codeEvaluation: false, raw: [] };
+    }
+    return { surface, behavior, tokenEconomics, entitlements };
+}
+/**
+ * Materialize the behavioral contract from action metadata.
+ * @internal
+ */
+async function materializeBehavior(metadata, builder) {
+    // Collect Presenter data from the first action that declares one
+    let egressSchemaDigest = null;
+    let systemRulesFingerprint = 'none';
+    const affordanceTopology = [];
+    const embeddedPresenters = [];
+    // Collect unique Presenter metadata across all actions
+    const presenterSchemaKeys = new Set();
+    const staticRuleStrings = [];
+    for (const action of metadata) {
+        if (action.presenterSchemaKeys) {
+            for (const key of action.presenterSchemaKeys) {
+                presenterSchemaKeys.add(key);
+            }
+        }
+        if (action.presenterStaticRules) {
+            for (const rule of action.presenterStaticRules) {
+                staticRuleStrings.push(rule);
+            }
+        }
+        if (action.presenterHasContextualRules) {
+            systemRulesFingerprint = 'dynamic';
+        }
+    }
+    if (presenterSchemaKeys.size > 0) {
+        const sortedKeys = [...presenterSchemaKeys].sort();
+        egressSchemaDigest = await sha256(sortedKeys.join(','));
+    }
+    // Bug #47 fix: condition should only check staticRuleStrings, not presenterSchemaKeys
+    // Bug #48 fix: always hash static rules even when dynamic rules coexist
+    if (staticRuleStrings.length > 0) {
+        const sortedRules = [...new Set(staticRuleStrings)].sort();
+        const hash = await sha256(sortedRules.join(','));
+        // Composite fingerprint preserves static rule coverage alongside dynamic indicator
+        const prefix = systemRulesFingerprint === 'dynamic' ? 'dynamic' : 'static';
+        systemRulesFingerprint = prefix + ':' + hash;
+    }
+    // Middleware chain — extract names from builder
+    const middlewareChain = [];
+    // Cannot access private _middlewares, but we can infer from action metadata
+    for (const action of metadata) {
+        if (action.hasMiddleware) {
+            middlewareChain.push(`${action.key}:mw`);
+        }
+    }
+    return {
+        egressSchemaDigest,
+        systemRulesFingerprint,
+        cognitiveGuardrails: {
+            agentLimitMax: null, // Extracted per-Presenter in extended materialization
+            egressMaxBytes: null,
+        },
+        middlewareChain,
+        stateSyncFingerprint: null, // Injected by StateSyncLayer integration
+        concurrencyFingerprint: null,
+        affordanceTopology,
+        embeddedPresenters,
+    };
+}
+/**
+ * Compute token economics profile from contract metadata.
+ * @internal
+ */
+function computeTokenEconomics(metadata, behavior) {
+    // Count schema fields across all Presenters
+    let schemaFieldCount = 0;
+    const seenPresenters = new Set();
+    for (const action of metadata) {
+        if (action.presenterName && !seenPresenters.has(action.presenterName)) {
+            seenPresenters.add(action.presenterName);
+            schemaFieldCount += action.presenterSchemaKeys?.length ?? 0;
+        }
+    }
+    // Unbounded collection risk
+    const unboundedCollection = behavior.cognitiveGuardrails.agentLimitMax === null
+        && schemaFieldCount > 0;
+    // Base overhead estimation (~4 chars per token, GPT heuristic)
+    // Rules: ~50 tokens each, UI blocks: ~100 tokens each
+    const rulesOverhead = behavior.systemRulesFingerprint !== 'none' ? 50 : 0;
+    const affordanceOverhead = behavior.affordanceTopology.length * 20;
+    const baseOverheadTokens = rulesOverhead + affordanceOverhead;
+    // Inflation risk — derived from guardrails and schema density
+    const inflationRisk = classifyInflationRisk(unboundedCollection, schemaFieldCount);
+    return {
+        schemaFieldCount,
+        unboundedCollection,
+        baseOverheadTokens,
+        inflationRisk,
+    };
+}
+// ============================================================================
+// Server-Level Contract Compilation
+// ============================================================================
+/**
+ * Compile contracts for all tools in a registry.
+ *
+ * @param builders - Iterable of all registered tool builders
+ * @returns Record mapping tool names to their materialized contracts
+ */
+export async function compileContracts(builders) {
+    const contracts = {};
+    for (const builder of builders) {
+        const contract = await materializeContract(builder);
+        contracts[contract.surface.name] = contract;
+    }
+    return contracts;
+}
+// ============================================================================
+// Internals
+// ============================================================================
+/** @internal */
+function classifyInflationRisk(unbounded, fieldCount) {
+    if (unbounded && fieldCount > 10)
+        return 'critical';
+    if (unbounded)
+        return 'high';
+    if (fieldCount > 20)
+        return 'medium';
+    return 'low';
+}
+// ── Re-export shared utilities for public API stability ──
+export { sha256, canonicalize } from './canonicalize.js';
+//# sourceMappingURL=ToolContract.js.map

package/dist/introspection/ToolContract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ToolContract.js","sourceRoot":"","sources":["../../src/introspection/ToolContract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAoB,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAkIxE,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,OAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAE7C,UAAU;IACV,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG;YAClB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,aAAa,EAAE,MAAM,CAAC,aAAa;SACtC,CAAC;IACN,CAAC;IAED,MAAM,OAAO,GAAgB;QACzB,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;QACvB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE;QACvB,OAAO;QACP,iBAAiB,EAAE,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;KACrE,CAAC;IAEF,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE9D,kBAAkB;IAClB,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEjE,6DAA6D;IAC7D,IAAI,YAAiC,CAAC;IACtC,IAAI,CAAC;QACD,MAAM,UAAU,GAAG,OAA6C,CAAC;QACjE,MAAM,OAAO,GACT,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,UAAU;YAC1C,CAAC,CAAE,UAAiG,CAAC,UAAU,EAAE;YACjH,CAAC,CAAC,EAAE,CAAC;QAEb,MAAM,cAAc,GAAG,OAAO;aACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAQ,CAAC,QAAQ,EAAE,CAAC;aAC/B,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;YAC3C,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACJ,YAAY,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QAC3H,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,YAAY,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAC3H,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAC9B,QAA8D,EAC9D,OAA8B;IAE9B,iEAAiE;IACjE,IAAI,kBAAkB,GAAkB,IAAI,CAAC;IAC7C,IAAI,sBAAsB,GAAG,MAAM,CAAC;IACpC,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,MAAM,kBAAkB,GAAa,EAAE,CAAC;IAExC,uDAAuD;IACvD,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,MAAM,iBAAiB,GAAa,EAAE,CAAC;IAEvC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAC7B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBAC3C,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;YAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAC7C,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;YACrC,sBAAsB,GAAG,SAAS,CAAC;QACvC,CAAC;IACL,CAAC;IAED,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,kBAAkB,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,sFAAsF;IACtF,wEAAwE;IACxE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,mFAAmF;QACnF,MAAM,MAAM,GAAG,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3E,sBAAsB,GAAG,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC;IACjD,CAAC;IAED,gDAAgD;IAChD,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,4EAA4E;IAC5E,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACvB,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;QAC7C,CAAC;IACL,CAAC;IAED,OAAO;QACH,kBAAkB;QAClB,sBAAsB;QACtB,mBAAmB,EAAE;YACjB,aAAa,EAAE,IAAI,EAAE,sDAAsD;YAC3E,cAAc,EAAE,IAAI;SACvB;QACD,eAAe;QACf,oBAAoB,EAAE,IAAI,EAAE,yCAAyC;QACrE,sBAAsB,EAAE,IAAI;QAC5B,kBAAkB;QAClB,kBAAkB;KACrB,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAC1B,QAA8D,EAC9D,QAAsB;IAEtB,4CAA4C;IAC5C,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACpE,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACzC,gBAAgB,IAAI,MAAM,CAAC,mBAAmB,EAAE,MAAM,IAAI,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;IAED,4BAA4B;IAC5B,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC,aAAa,KAAK,IAAI;WACxE,gBAAgB,GAAG,CAAC,CAAC;IAE5B,+DAA+D;IAC/D,sDAAsD;IACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,sBAAsB,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,MAAM,GAAG,EAAE,CAAC;IACnE,MAAM,kBAAkB,GAAG,aAAa,GAAG,kBAAkB,CAAC;IAE9D,8DAA8D;IAC9D,MAAM,aAAa,GAAG,qBAAqB,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAEnF,OAAO;QACH,gBAAgB;QAChB,mBAAmB;QACnB,kBAAkB;QAClB,aAAa;KAChB,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,QAAyC;IAEzC,MAAM,SAAS,GAAiC,EAAE,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACpD,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAChD,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,gBAAgB;AAChB,SAAS,qBAAqB,CAC1B,SAAkB,EAClB,UAAkB;IAElB,IAAI,SAAS,IAAI,UAAU,GAAG,EAAE;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,SAAS;QAAE,OAAO,MAAM,CAAC;IAC7B,IAAI,UAAU,GAAG,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrC,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,4DAA4D;AAC5D,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/introspection/canonicalize.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Canonical — Shared Cryptographic Primitives
+ *
+ * Deterministic JSON serialization and SHA-256 hashing
+ * used across governance modules. Single source of truth
+ * eliminates duplication and guarantees behavioral consistency.
+ *
+ * Uses Web Crypto API (globalThis.crypto.subtle) for runtime
+ * agnosticism — works on Node.js 20+, Cloudflare Workers, Deno, Bun.
+ *
+ * @module
+ * @internal
+ */
+/**
+ * SHA-256 hash of a string, returned as lowercase hex.
+ *
+ * Uses the Web Crypto API (crypto.subtle) for runtime agnosticism.
+ *
+ * @param input - The string to hash
+ * @returns 64-character hex digest
+ */
+export declare function sha256(input: string): Promise<string>;
+/**
+ * Canonical JSON serialization with deterministic key ordering.
+ *
+ * Guarantees that two structurally identical objects produce
+ * the same string regardless of property insertion order.
+ * This is critical for content-addressed hashing — the same
+ * contract must always produce the same digest.
+ *
+ * @param obj - The value to serialize
+ * @returns Deterministic JSON string
+ */
+export declare function canonicalize(obj: unknown): string;
+//# sourceMappingURL=canonicalize.d.ts.map

package/dist/introspection/canonicalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.d.ts","sourceRoot":"","sources":["../../src/introspection/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3D;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAYjD"}

package/dist/introspection/canonicalize.js

@@ -0,0 +1,72 @@
+/**
+ * Canonical — Shared Cryptographic Primitives
+ *
+ * Deterministic JSON serialization and SHA-256 hashing
+ * used across governance modules. Single source of truth
+ * eliminates duplication and guarantees behavioral consistency.
+ *
+ * Uses Web Crypto API (globalThis.crypto.subtle) for runtime
+ * agnosticism — works on Node.js 20+, Cloudflare Workers, Deno, Bun.
+ *
+ * @module
+ * @internal
+ */
+// ============================================================================
+// Hashing
+// ============================================================================
+/**
+ * SHA-256 hash of a string, returned as lowercase hex.
+ *
+ * Uses the Web Crypto API (crypto.subtle) for runtime agnosticism.
+ *
+ * @param input - The string to hash
+ * @returns 64-character hex digest
+ */
+export async function sha256(input) {
+    const data = new TextEncoder().encode(input);
+    // Web Crypto API (browsers, Cloudflare Workers, Deno, Bun, Node 20+)
+    if (typeof globalThis.crypto !== 'undefined' && globalThis.crypto.subtle) {
+        const hashBuffer = await globalThis.crypto.subtle.digest('SHA-256', data);
+        return hexFromBuffer(hashBuffer);
+    }
+    // Node.js fallback (test environments, older Node versions)
+    const { createHash } = await import('node:crypto');
+    return createHash('sha256').update(data).digest('hex');
+}
+/**
+ * Convert an ArrayBuffer to lowercase hex string.
+ * @internal
+ */
+function hexFromBuffer(buffer) {
+    return Array.from(new Uint8Array(buffer))
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+// ============================================================================
+// Serialization
+// ============================================================================
+/**
+ * Canonical JSON serialization with deterministic key ordering.
+ *
+ * Guarantees that two structurally identical objects produce
+ * the same string regardless of property insertion order.
+ * This is critical for content-addressed hashing — the same
+ * contract must always produce the same digest.
+ *
+ * @param obj - The value to serialize
+ * @returns Deterministic JSON string
+ */
+export function canonicalize(obj) {
+    return JSON.stringify(obj, (_key, value) => {
+        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+            return Object.keys(value)
+                .sort()
+                .reduce((sorted, k) => {
+                sorted[k] = value[k];
+                return sorted;
+            }, {});
+        }
+        return value;
+    });
+}
+//# sourceMappingURL=canonicalize.js.map

package/dist/introspection/canonicalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalize.js","sourceRoot":"","sources":["../../src/introspection/canonicalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,KAAa;IACtC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE7C,qEAAqE;IACrE,IAAI,OAAO,UAAU,CAAC,MAAM,KAAK,WAAW,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1E,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAED,4DAA4D;IAC5D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAmB;IACtC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACzC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,GAAY;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACvC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC;iBAC/C,IAAI,EAAE;iBACN,MAAM,CAA0B,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;gBAC3C,MAAM,CAAC,CAAC,CAAC,GAAI,KAAiC,CAAC,CAAC,CAAC,CAAC;gBAClD,OAAO,MAAM,CAAC;YAClB,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/introspection/index.d.ts

@@ -0,0 +1,26 @@
+/** Introspection Module — Barrel Export */
+export { compileManifest, cloneManifest } from './ManifestCompiler.js';
+export { registerIntrospectionResource } from './IntrospectionResource.js';
+export type { IntrospectionConfig, ManifestPayload, ManifestCapabilities, ManifestTool, ManifestAction, ManifestPresenter, } from './types.js';
+export type { IntrospectionRegistryDelegate } from './IntrospectionResource.js';
+export { materializeContract, compileContracts, sha256, canonicalize, } from './ToolContract.js';
+export type { ToolContract, ToolSurface, ActionContract, ToolBehavior, CognitiveGuardrailsContract, TokenEconomicsProfile, HandlerEntitlements, } from './ToolContract.js';
+export { diffContracts, formatDiffReport, formatDeltasAsXml, } from './ContractDiff.js';
+export type { ContractDelta, ContractDiffResult, DeltaSeverity, DeltaCategory, } from './ContractDiff.js';
+export { computeDigest, computeServerDigest, compareServerDigests, } from './BehaviorDigest.js';
+export type { BehaviorDigestResult, DigestComponents, ServerDigest, DigestComparison, } from './BehaviorDigest.js';
+export { generateLockfile, serializeLockfile, checkLockfile, parseLockfile, writeLockfile, readLockfile, LOCKFILE_NAME, } from './CapabilityLockfile.js';
+export type { CapabilityLockfile, LockfileCapabilities, LockfileTool, LockfileToolSurface, LockfileToolBehavior, LockfileTokenEconomics, LockfileEntitlements, LockfileCheckResult, LockfilePrompt, LockfilePromptArgument, PromptBuilderLike, GenerateLockfileOptions, } from './CapabilityLockfile.js';
+export { createHmacSigner, attestServerDigest, verifyAttestation, verifyCapabilityPin, buildTrustCapability, AttestationError, } from './CryptoAttestation.js';
+export type { ZeroTrustConfig, AttestationSigner, AttestationResult, VurbTrustCapability, } from './CryptoAttestation.js';
+export { estimateTokens, profileBlock, profileResponse, computeStaticProfile, aggregateProfiles, } from './TokenEconomics.js';
+export type { TokenAnalysis, BlockTokenProfile, TokenRisk, TokenThresholds, TokenEconomicsConfig, StaticTokenProfile, FieldTokenEstimate, ServerTokenSummary, } from './TokenEconomics.js';
+export { scanSource, buildEntitlements, validateClaims, scanAndValidate, scanEvasionIndicators, } from './EntitlementScanner.js';
+export type { EntitlementReport, EntitlementMatch, EntitlementViolation, EntitlementCategory, EntitlementClaims, EvasionIndicator, EvasionType, } from './EntitlementScanner.js';
+export { createProbe, buildJudgePrompt, parseJudgeResponse, evaluateProbe, evaluateProbes, aggregateResults, } from './SemanticProbe.js';
+export type { SemanticProbeConfig, SemanticProbeAdapter, SemanticThresholds, SemanticProbe, ProbeContractContext, SemanticProbeResult, DriftLevel, SemanticProbeReport, } from './SemanticProbe.js';
+export { enrichValidationError, createToolEnhancer, } from './ContractAwareSelfHealing.js';
+export type { SelfHealingConfig, SelfHealingResult, } from './ContractAwareSelfHealing.js';
+export { createGovernanceObserver, createNoopObserver, } from './GovernanceObserver.js';
+export type { GovernanceObserverConfig, GovernanceObserver, } from './GovernanceObserver.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/introspection/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/introspection/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAC3E,YAAY,EACR,mBAAmB,EACnB,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,iBAAiB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAGhF,OAAO,EACH,mBAAmB,EACnB,gBAAgB,EAChB,MAAM,EACN,YAAY,GACf,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACR,YAAY,EACZ,WAAW,EACX,cAAc,EACd,YAAY,EACZ,2BAA2B,EAC3B,qBAAqB,EACrB,mBAAmB,GACtB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACH,aAAa,EACb,gBAAgB,EAChB,iBAAiB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACR,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,aAAa,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACH,aAAa,EACb,mBAAmB,EACnB,oBAAoB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACR,oBAAoB,EACpB,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACH,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,aAAa,EACb,YAAY,EACZ,aAAa,GAChB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACR,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GAC1B,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACH,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACR,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,GACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACH,cAAc,EACd,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACR,aAAa,EACb,iBAAiB,EACjB,SAAS,EACT,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACH,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,qBAAqB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACR,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,GACd,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACH,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,gBAAgB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACR,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,UAAU,EACV,mBAAmB,GACtB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACH,qBAAqB,EACrB,kBAAkB,GACrB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACR,iBAAiB,EACjB,iBAAiB,GACpB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACH,wBAAwB,EACxB,kBAAkB,GACrB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACR,wBAAwB,EACxB,kBAAkB,GACrB,MAAM,yBAAyB,CAAC"}

package/dist/introspection/index.js

@@ -0,0 +1,24 @@
+/** Introspection Module — Barrel Export */
+export { compileManifest, cloneManifest } from './ManifestCompiler.js';
+export { registerIntrospectionResource } from './IntrospectionResource.js';
+// ── Contract Materialization ─────────────────────────────
+export { materializeContract, compileContracts, sha256, canonicalize, } from './ToolContract.js';
+// ── Contract Diffing ─────────────────────────────────────
+export { diffContracts, formatDiffReport, formatDeltasAsXml, } from './ContractDiff.js';
+// ── Behavioral Fingerprinting ────────────────────────────
+export { computeDigest, computeServerDigest, compareServerDigests, } from './BehaviorDigest.js';
+// ── Capability Lockfile ──────────────────────────────────
+export { generateLockfile, serializeLockfile, checkLockfile, parseLockfile, writeLockfile, readLockfile, LOCKFILE_NAME, } from './CapabilityLockfile.js';
+// ── Zero-Trust Runtime ───────────────────────────────────
+export { createHmacSigner, attestServerDigest, verifyAttestation, verifyCapabilityPin, buildTrustCapability, AttestationError, } from './CryptoAttestation.js';
+// ── Token Economics ──────────────────────────────────────
+export { estimateTokens, profileBlock, profileResponse, computeStaticProfile, aggregateProfiles, } from './TokenEconomics.js';
+// ── Entitlement Scanner (Blast Radius) ───────────────────
+export { scanSource, buildEntitlements, validateClaims, scanAndValidate, scanEvasionIndicators, } from './EntitlementScanner.js';
+// ── Semantic Probing (LLM-as-Judge) ──────────────────────
+export { createProbe, buildJudgePrompt, parseJudgeResponse, evaluateProbe, evaluateProbes, aggregateResults, } from './SemanticProbe.js';
+// ── Self-Healing Context ─────────────────────────────────
+export { enrichValidationError, createToolEnhancer, } from './ContractAwareSelfHealing.js';
+// ── Governance Observer (Observability Bridge) ───────────
+export { createGovernanceObserver, createNoopObserver, } from './GovernanceObserver.js';
+//# sourceMappingURL=index.js.map

package/dist/introspection/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/introspection/index.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,6BAA6B,EAAE,MAAM,4BAA4B,CAAC;AAW3E,4DAA4D;AAC5D,OAAO,EACH,mBAAmB,EACnB,gBAAgB,EAChB,MAAM,EACN,YAAY,GACf,MAAM,mBAAmB,CAAC;AAW3B,4DAA4D;AAC5D,OAAO,EACH,aAAa,EACb,gBAAgB,EAChB,iBAAiB,GACpB,MAAM,mBAAmB,CAAC;AAQ3B,4DAA4D;AAC5D,OAAO,EACH,aAAa,EACb,mBAAmB,EACnB,oBAAoB,GACvB,MAAM,qBAAqB,CAAC;AAQ7B,4DAA4D;AAC5D,OAAO,EACH,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,aAAa,EACb,YAAY,EACZ,aAAa,GAChB,MAAM,yBAAyB,CAAC;AAgBjC,4DAA4D;AAC5D,OAAO,EACH,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,GACnB,MAAM,wBAAwB,CAAC;AAQhC,4DAA4D;AAC5D,OAAO,EACH,cAAc,EACd,YAAY,EACZ,eAAe,EACf,oBAAoB,EACpB,iBAAiB,GACpB,MAAM,qBAAqB,CAAC;AAY7B,4DAA4D;AAC5D,OAAO,EACH,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,qBAAqB,GACxB,MAAM,yBAAyB,CAAC;AAWjC,4DAA4D;AAC5D,OAAO,EACH,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,gBAAgB,GACnB,MAAM,oBAAoB,CAAC;AAY5B,4DAA4D;AAC5D,OAAO,EACH,qBAAqB,EACrB,kBAAkB,GACrB,MAAM,+BAA+B,CAAC;AAMvC,4DAA4D;AAC5D,OAAO,EACH,wBAAwB,EACxB,kBAAkB,GACrB,MAAM,yBAAyB,CAAC"}

package/dist/introspection/types.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Introspection Types — Enterprise-Grade Dynamic Manifest
+ *
+ * Type definitions for the RBAC-aware introspection system.
+ * The manifest is exposed as a standard MCP Resource, never as
+ * a custom HTTP endpoint.
+ *
+ * This module has ZERO runtime code — only type declarations.
+ *
+ * @module
+ */
+/**
+ * Configuration for the introspection system.
+ *
+ * When enabled, the framework silently registers a MCP Resource
+ * that exposes a dynamic manifest of all tools, actions, and
+ * presenters — filtered by the session's security context.
+ *
+ * @typeParam TContext - Application context (same as ToolRegistry)
+ *
+ * @example
+ * ```typescript
+ * registry.attachToServer(server, {
+ *     contextFactory: createContext,
+ *     introspection: {
+ *         enabled: process.env.NODE_ENV !== 'production',
+ *         uri: 'vurb://manifest.json',
+ *         filter: (manifest, ctx) => {
+ *             if (ctx.user.role !== 'admin') {
+ *                 delete manifest.capabilities.tools['admin.delete_user'];
+ *             }
+ *             return manifest;
+ *         },
+ *     },
+ * });
+ * ```
+ */
+export interface IntrospectionConfig<TContext> {
+    /**
+     * Whether introspection is enabled.
+     *
+     * Smart default pattern: `process.env.NODE_ENV !== 'production'`
+     * The framework NEVER enables this silently — strict opt-in.
+     */
+    readonly enabled: boolean;
+    /**
+     * Custom URI for the MCP Resource.
+     * @defaultValue `'vurb://manifest.json'`
+     */
+    readonly uri?: string;
+    /**
+     * RBAC-aware manifest filter.
+     *
+     * Called on every `resources/read` with the compiled manifest
+     * and the session context. Use this to remove tools, actions,
+     * or presenters that the requesting agent should not see.
+     *
+     * **Security model**: Unauthorized agents don't even know the
+     * hidden surface exists — it's removed from the tree entirely.
+     *
+     * @param manifest - The full compiled manifest (mutable clone)
+     * @param ctx - The session context (user, role, tenant, etc.)
+     * @returns The filtered manifest
+     */
+    readonly filter?: (manifest: ManifestPayload, ctx: TContext) => ManifestPayload;
+}
+/** Top-level manifest payload returned by `resources/read` */
+export interface ManifestPayload {
+    /** Server name (from AttachOptions or registry metadata) */
+    readonly server: string;
+    /** Vurb framework version */
+    readonly vurb_version: string;
+    /** Architecture label */
+    readonly architecture: 'MVA (Model-View-Agent)';
+    /** Capabilities tree */
+    capabilities: ManifestCapabilities;
+}
+/** Capabilities subtree of the manifest */
+export interface ManifestCapabilities {
+    /** Registered tools, keyed by tool name */
+    tools: Record<string, ManifestTool>;
+    /** Registered presenters, keyed by presenter name */
+    presenters: Record<string, ManifestPresenter>;
+}
+/** A single tool entry in the manifest */
+export interface ManifestTool {
+    /** Human-readable tool description */
+    readonly description: string | undefined;
+    /** Tags for selective exposure */
+    readonly tags: readonly string[];
+    /** Actions within this tool */
+    readonly actions: Record<string, ManifestAction>;
+    /** JSON Schema of the complete inputSchema */
+    readonly input_schema: object;
+}
+/** A single action entry within a tool */
+export interface ManifestAction {
+    /** Human-readable description */
+    readonly description: string | undefined;
+    /** Whether this action is destructive */
+    readonly destructive: boolean;
+    /** Whether this action is idempotent */
+    readonly idempotent: boolean;
+    /** Whether this action is read-only */
+    readonly readOnly: boolean;
+    /** Required field names */
+    readonly required_fields: readonly string[];
+    /** Presenter name (if MVA pattern is used) */
+    readonly returns_presenter: string | undefined;
+}
+/** A presenter entry in the manifest */
+export interface ManifestPresenter {
+    /** Schema keys exposed to the LLM */
+    readonly schema_keys: readonly string[];
+    /** UI block types supported (echarts, mermaid, etc.) */
+    readonly ui_blocks_supported: readonly string[];
+    /** Whether the presenter has context-aware system rules */
+    readonly has_contextual_rules: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/introspection/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/introspection/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,mBAAmB,CAAC,QAAQ;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,QAAQ,KAAK,eAAe,CAAC;CACnF;AAID,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6BAA6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,YAAY,EAAE,wBAAwB,CAAC;IAChD,wBAAwB;IACxB,YAAY,EAAE,oBAAoB,CAAC;CACtC;AAED,2CAA2C;AAC3C,MAAM,WAAW,oBAAoB;IACjC,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpC,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CACjD;AAED,0CAA0C;AAC1C,MAAM,WAAW,YAAY;IACzB,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,+BAA+B;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACjD,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CACjC;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,yCAAyC;IACzC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2BAA2B;IAC3B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,8CAA8C;IAC9C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,wDAAwD;IACxD,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,2DAA2D;IAC3D,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;CAC1C"}

package/dist/introspection/types.js

@@ -0,0 +1,13 @@
+/**
+ * Introspection Types — Enterprise-Grade Dynamic Manifest
+ *
+ * Type definitions for the RBAC-aware introspection system.
+ * The manifest is exposed as a standard MCP Resource, never as
+ * a custom HTTP endpoint.
+ *
+ * This module has ZERO runtime code — only type declarations.
+ *
+ * @module
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/introspection/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/introspection/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}