@weaveaijs/mcp-observatory 0.3.0

package/dist/proposal/proposer.d.ts

@@ -0,0 +1,30 @@
+import { TokenManager } from './token.js';
+export interface ProposalOptions {
+    toolName: string;
+    toolArgs: Record<string, unknown>;
+    outputInstability?: number;
+    numericVariance?: number;
+    promptDrift?: number;
+}
+export interface ProposalResult {
+    proposalId: string;
+    status: 'allowed' | 'blocked' | 'review';
+    reason?: string;
+    commitToken?: string;
+    fallbackResponse?: unknown;
+}
+export interface ScoringOptions {
+    outputInstability?: number;
+    numericVariance?: number;
+    promptDrift?: number;
+}
+export declare class ToolProposer {
+    private tokenManager;
+    private blockThreshold;
+    private reviewThreshold;
+    constructor(tokenManager?: TokenManager);
+    propose(options: ProposalOptions): Promise<ProposalResult>;
+    private computeCompositeScore;
+    private deterministicFallback;
+}
+//# sourceMappingURL=proposer.d.ts.map

package/dist/proposal/proposer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposer.d.ts","sourceRoot":"","sources":["../../src/proposal/proposer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,cAAc,CAAe;IACrC,OAAO,CAAC,eAAe,CAAe;gBAE1B,YAAY,CAAC,EAAE,YAAY;IAIjC,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;IA+ChE,OAAO,CAAC,qBAAqB;IAkB7B,OAAO,CAAC,qBAAqB;CAW9B"}

package/dist/proposal/proposer.js

@@ -0,0 +1,73 @@
+import { randomUUID } from 'crypto';
+import { hashJson } from '../utils/hashing.js';
+import { TokenManager } from './token.js';
+export class ToolProposer {
+    constructor(tokenManager) {
+        this.blockThreshold = 0.7;
+        this.reviewThreshold = 0.4;
+        this.tokenManager = tokenManager || new TokenManager();
+    }
+    async propose(options) {
+        const proposalId = randomUUID();
+        const toolArgsHash = hashJson(options.toolArgs);
+        const compositeScore = this.computeCompositeScore({
+            outputInstability: options.outputInstability,
+            numericVariance: options.numericVariance,
+            promptDrift: options.promptDrift,
+        });
+        if (compositeScore > this.blockThreshold) {
+            return {
+                proposalId,
+                status: 'blocked',
+                reason: 'low_integrity',
+                fallbackResponse: this.deterministicFallback(options.toolName, options.toolArgs),
+            };
+        }
+        if (compositeScore > this.reviewThreshold) {
+            const { token } = this.tokenManager.issueToken({
+                proposalId,
+                toolName: options.toolName,
+                toolArgsHash,
+                compositeScore,
+            });
+            return {
+                proposalId,
+                status: 'review',
+                commitToken: token,
+            };
+        }
+        const { token } = this.tokenManager.issueToken({
+            proposalId,
+            toolName: options.toolName,
+            toolArgsHash,
+            compositeScore,
+        });
+        return {
+            proposalId,
+            status: 'allowed',
+            commitToken: token,
+        };
+    }
+    computeCompositeScore(scoring) {
+        const instability = Math.max(0, Math.min(1, scoring.outputInstability || 0));
+        const variance = Math.max(0, Math.min(1, scoring.numericVariance || 0));
+        const drift = Math.max(0, Math.min(1, scoring.promptDrift || 0));
+        const weights = {
+            instability: 0.5,
+            variance: 0.3,
+            drift: 0.2,
+        };
+        return (instability * weights.instability +
+            variance * weights.variance +
+            drift * weights.drift);
+    }
+    deterministicFallback(toolName, toolArgs) {
+        return {
+            status: 'blocked',
+            action: 'create_draft',
+            reason: 'low_integrity',
+            draft: { tool: toolName, ...toolArgs },
+        };
+    }
+}
+//# sourceMappingURL=proposer.js.map

package/dist/proposal/proposer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposer.js","sourceRoot":"","sources":["../../src/proposal/proposer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAwB1C,MAAM,OAAO,YAAY;IAKvB,YAAY,YAA2B;QAH/B,mBAAc,GAAW,GAAG,CAAC;QAC7B,oBAAe,GAAW,GAAG,CAAC;QAGpC,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,YAAY,EAAE,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,qBAAqB,CAAC;YAChD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;QAEH,IAAI,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,eAAe;gBACvB,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;aACjF,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;gBAC7C,UAAU;gBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY;gBACZ,cAAc;aACf,CAAC,CAAC;YAEH,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,KAAK;aACnB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;YAC7C,UAAU;YACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY;YACZ,cAAc;SACf,CAAC,CAAC;QAEH,OAAO;YACL,UAAU;YACV,MAAM,EAAE,SAAS;YACjB,WAAW,EAAE,KAAK;SACnB,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAAC,OAAuB;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;QAEjE,MAAM,OAAO,GAAG;YACd,WAAW,EAAE,GAAG;YAChB,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,GAAG;SACX,CAAC;QAEF,OAAO,CACL,WAAW,GAAG,OAAO,CAAC,WAAW;YACjC,QAAQ,GAAG,OAAO,CAAC,QAAQ;YAC3B,KAAK,GAAG,OAAO,CAAC,KAAK,CACtB,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,QAAgB,EAChB,QAAiC;QAEjC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,cAAc;YACtB,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE;SACvC,CAAC;IACJ,CAAC;CACF"}

package/dist/proposal/storage.d.ts

@@ -0,0 +1,38 @@
+export interface Proposal {
+    id: string;
+    toolName: string;
+    toolArgsHash: string;
+    status: 'allowed' | 'blocked' | 'review';
+    createdAt: Date;
+    expiresAt: Date;
+}
+export interface Commit {
+    id: string;
+    proposalId: string;
+    executed: boolean;
+    executedAt?: Date;
+}
+export declare class InMemoryProposalStorage {
+    private proposals;
+    private commits;
+    saveProposal(proposal: Proposal): Promise<void>;
+    getProposal(id: string): Promise<Proposal | null>;
+    saveCommit(commit: Commit): Promise<void>;
+    getCommit(id: string): Promise<Commit | null>;
+    saveNonce(nonce: string): Promise<void>;
+    hasNonce(nonce: string): Promise<boolean>;
+    cleanup(): Promise<void>;
+}
+export declare class PostgresProposalStorage {
+    private pool;
+    constructor(dsn: string);
+    saveProposal(proposal: Proposal): Promise<void>;
+    getProposal(id: string): Promise<Proposal | null>;
+    saveCommit(commit: Commit): Promise<void>;
+    getCommit(id: string): Promise<Commit | null>;
+    saveNonce(nonce: string): Promise<void>;
+    hasNonce(nonce: string): Promise<boolean>;
+    cleanup(): Promise<void>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/proposal/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/proposal/storage.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,OAAO,CAAkC;IAE3C,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAYjD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI7C,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ/B;AAED,qBAAa,uBAAuB;IAClC,OAAO,CAAC,IAAI,CAAO;gBAEP,GAAG,EAAE,MAAM;IAIjB,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB/C,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAiBjD,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAazC,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAY7C,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOzC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}

package/dist/proposal/storage.js

@@ -0,0 +1,115 @@
+import { Pool } from 'pg';
+export class InMemoryProposalStorage {
+    constructor() {
+        this.proposals = new Map();
+        this.commits = new Map();
+    }
+    async saveProposal(proposal) {
+        this.proposals.set(proposal.id, proposal);
+    }
+    async getProposal(id) {
+        const proposal = this.proposals.get(id);
+        if (!proposal)
+            return null;
+        if (proposal.expiresAt < new Date()) {
+            this.proposals.delete(id);
+            return null;
+        }
+        return proposal;
+    }
+    async saveCommit(commit) {
+        this.commits.set(commit.id, commit);
+    }
+    async getCommit(id) {
+        return this.commits.get(id) || null;
+    }
+    async saveNonce(nonce) {
+        // In-memory storage for nonce tracking
+    }
+    async hasNonce(nonce) {
+        // Would need separate nonce tracking
+        return false;
+    }
+    async cleanup() {
+        const now = new Date();
+        for (const [id, proposal] of this.proposals.entries()) {
+            if (proposal.expiresAt < now) {
+                this.proposals.delete(id);
+            }
+        }
+    }
+}
+export class PostgresProposalStorage {
+    constructor(dsn) {
+        this.pool = new Pool({ connectionString: dsn });
+    }
+    async saveProposal(proposal) {
+        const query = `
+      INSERT INTO proposals (id, tool_name, tool_args_hash, status, created_at, expires_at)
+      VALUES ($1, $2, $3, $4, $5, $6)
+      ON CONFLICT (id) DO UPDATE SET status = $4, expires_at = $6
+    `;
+        await this.pool.query(query, [
+            proposal.id,
+            proposal.toolName,
+            proposal.toolArgsHash,
+            proposal.status,
+            proposal.createdAt,
+            proposal.expiresAt,
+        ]);
+    }
+    async getProposal(id) {
+        const result = await this.pool.query('SELECT * FROM proposals WHERE id = $1 AND expires_at > NOW()', [id]);
+        if (result.rows.length === 0)
+            return null;
+        const row = result.rows[0];
+        return {
+            id: row.id,
+            toolName: row.tool_name,
+            toolArgsHash: row.tool_args_hash,
+            status: row.status,
+            createdAt: row.created_at,
+            expiresAt: row.expires_at,
+        };
+    }
+    async saveCommit(commit) {
+        const query = `
+      INSERT INTO commits (id, proposal_id, executed, executed_at)
+      VALUES ($1, $2, $3, $4)
+    `;
+        await this.pool.query(query, [
+            commit.id,
+            commit.proposalId,
+            commit.executed,
+            commit.executedAt,
+        ]);
+    }
+    async getCommit(id) {
+        const result = await this.pool.query('SELECT * FROM commits WHERE id = $1', [id]);
+        if (result.rows.length === 0)
+            return null;
+        const row = result.rows[0];
+        return {
+            id: row.id,
+            proposalId: row.proposal_id,
+            executed: row.executed,
+            executedAt: row.executed_at,
+        };
+    }
+    async saveNonce(nonce) {
+        await this.pool.query('INSERT INTO nonces (nonce, created_at) VALUES ($1, NOW())', [nonce]);
+    }
+    async hasNonce(nonce) {
+        const result = await this.pool.query('SELECT 1 FROM nonces WHERE nonce = $1', [
+            nonce,
+        ]);
+        return result.rows.length > 0;
+    }
+    async cleanup() {
+        await this.pool.query('DELETE FROM proposals WHERE expires_at < NOW()');
+    }
+    async close() {
+        await this.pool.end();
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/proposal/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/proposal/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAkB1B,MAAM,OAAO,uBAAuB;IAApC;QACU,cAAS,GAA0B,IAAI,GAAG,EAAE,CAAC;QAC7C,YAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IA2CnD,CAAC;IAzCC,KAAK,CAAC,YAAY,CAAC,QAAkB;QACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,uCAAuC;IACzC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,qCAAqC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,IAAI,QAAQ,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;gBAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,uBAAuB;IAGlC,YAAY,GAAW;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAkB;QACnC,MAAM,KAAK,GAAG;;;;KAIb,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YAC3B,QAAQ,CAAC,EAAE;YACX,QAAQ,CAAC,QAAQ;YACjB,QAAQ,CAAC,YAAY;YACrB,QAAQ,CAAC,MAAM;YACf,QAAQ,CAAC,SAAS;YAClB,QAAQ,CAAC,SAAS;SACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAClC,8DAA8D,EAC9D,CAAC,EAAE,CAAC,CACL,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,QAAQ,EAAE,GAAG,CAAC,SAAS;YACvB,YAAY,EAAE,GAAG,CAAC,cAAc;YAChC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,KAAK,GAAG;;;KAGb,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE;YAC3B,MAAM,CAAC,EAAE;YACT,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,UAAU;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,UAAU,EAAE,GAAG,CAAC,WAAW;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CACnB,2DAA2D,EAC3D,CAAC,KAAK,CAAC,CACR,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,uCAAuC,EAAE;YAC5E,KAAK;SACN,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,CAAC;CACF"}

package/dist/proposal/token.d.ts

@@ -0,0 +1,34 @@
+export interface TokenPayload {
+    tokenId: string;
+    proposalId: string;
+    toolName: string;
+    toolArgsHash: string;
+    issuedAt: number;
+    expiresAt: number;
+    nonce: string;
+    compositeScore: number;
+}
+export interface TokenVerificationResult {
+    valid: boolean;
+    reason?: string;
+    payload?: TokenPayload;
+}
+export declare class TokenManager {
+    private secret;
+    private tokenExpiryMs;
+    constructor(secret?: string);
+    issueToken(options: {
+        proposalId: string;
+        toolName: string;
+        toolArgsHash: string;
+        compositeScore: number;
+        expiryMs?: number;
+    }): {
+        token: string;
+        payload: TokenPayload;
+    };
+    verifyToken(token: string): TokenVerificationResult;
+    private sign;
+    private randomId;
+}
+//# sourceMappingURL=token.d.ts.map

package/dist/proposal/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/proposal/token.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAkB;gBAE3B,MAAM,CAAC,EAAE,MAAM;IAI3B,UAAU,CAAC,OAAO,EAAE;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,YAAY,CAAA;KAAE;IAuB5C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,uBAAuB;IAuBnD,OAAO,CAAC,IAAI;IAKZ,OAAO,CAAC,QAAQ;CAGjB"}

package/dist/proposal/token.js

@@ -0,0 +1,52 @@
+import { createHmac, randomBytes } from 'crypto';
+import { getCurrentTimeMs, addMs } from '../utils/time.js';
+export class TokenManager {
+    constructor(secret) {
+        this.tokenExpiryMs = 300000; // 5 minutes
+        this.secret = secret ? Buffer.from(secret) : randomBytes(32);
+    }
+    issueToken(options) {
+        const now = getCurrentTimeMs();
+        const expiryMs = options.expiryMs || this.tokenExpiryMs;
+        const payload = {
+            tokenId: this.randomId(),
+            proposalId: options.proposalId,
+            toolName: options.toolName,
+            toolArgsHash: options.toolArgsHash,
+            issuedAt: now,
+            expiresAt: addMs(new Date(now), expiryMs).getTime(),
+            nonce: randomBytes(16).toString('hex'),
+            compositeScore: options.compositeScore,
+        };
+        const signature = this.sign(payload);
+        const token = Buffer.from(JSON.stringify({ ...payload, signature })).toString('base64');
+        return { token, payload };
+    }
+    verifyToken(token) {
+        try {
+            const data = JSON.parse(Buffer.from(token, 'base64').toString());
+            const { signature, ...payload } = data;
+            if (!signature) {
+                return { valid: false, reason: 'missing_signature' };
+            }
+            if (this.sign(payload) !== signature) {
+                return { valid: false, reason: 'bad_signature' };
+            }
+            if (payload.expiresAt < getCurrentTimeMs()) {
+                return { valid: false, reason: 'expired' };
+            }
+            return { valid: true, payload: payload };
+        }
+        catch {
+            return { valid: false, reason: 'invalid_token_format' };
+        }
+    }
+    sign(payload) {
+        const data = JSON.stringify(payload);
+        return createHmac('sha256', this.secret).update(data).digest('hex');
+    }
+    randomId() {
+        return randomBytes(8).toString('hex');
+    }
+}
+//# sourceMappingURL=token.js.map

package/dist/proposal/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/proposal/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAmB3D,MAAM,OAAO,YAAY;IAIvB,YAAY,MAAe;QAFnB,kBAAa,GAAW,MAAM,CAAC,CAAC,YAAY;QAGlD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,UAAU,CAAC,OAMV;QACC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC;QAExD,MAAM,OAAO,GAAiB;YAC5B,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE;YACxB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE;YACnD,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtC,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAC1C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErB,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,GAAG,IAA4C,CAAC;YAE/E,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YACvD,CAAC;YAED,IAAI,IAAI,CAAC,IAAI,CAAC,OAAuB,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;YACnD,CAAC;YAED,IAAI,OAAO,CAAC,SAAS,GAAG,gBAAgB,EAAE,EAAE,CAAC;gBAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC7C,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAuB,EAAE,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,OAAqB;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAEO,QAAQ;QACd,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;CACF"}

package/dist/proposal/verifier.d.ts

@@ -0,0 +1,20 @@
+import { TokenManager } from './token.js';
+export interface VerificationOptions {
+    token: string;
+    proposalId: string;
+    toolName: string;
+    toolArgs: Record<string, unknown>;
+}
+export interface VerificationResult {
+    valid: boolean;
+    reason?: string;
+    canExecute: boolean;
+}
+export declare class CommitVerifier {
+    private tokenManager;
+    private usedNonces;
+    constructor(tokenManager?: TokenManager);
+    verify(options: VerificationOptions): VerificationResult;
+    resetNonces(): void;
+}
+//# sourceMappingURL=verifier.d.ts.map

package/dist/proposal/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../../src/proposal/verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,UAAU,CAA0B;gBAEhC,YAAY,CAAC,EAAE,YAAY;IAIvC,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,kBAAkB;IA6BxD,WAAW,IAAI,IAAI;CAGpB"}

package/dist/proposal/verifier.js

@@ -0,0 +1,34 @@
+import { hashJson } from '../utils/hashing.js';
+import { TokenManager } from './token.js';
+export class CommitVerifier {
+    constructor(tokenManager) {
+        this.usedNonces = new Set();
+        this.tokenManager = tokenManager || new TokenManager();
+    }
+    verify(options) {
+        const tokenResult = this.tokenManager.verifyToken(options.token);
+        if (!tokenResult.valid) {
+            return { valid: false, reason: tokenResult.reason, canExecute: false };
+        }
+        const payload = tokenResult.payload;
+        if (payload.proposalId !== options.proposalId) {
+            return { valid: false, reason: 'unknown_proposal', canExecute: false };
+        }
+        if (payload.toolName !== options.toolName) {
+            return { valid: false, reason: 'tool_name_mismatch', canExecute: false };
+        }
+        const argsHash = hashJson(options.toolArgs);
+        if (argsHash !== payload.toolArgsHash) {
+            return { valid: false, reason: 'args_hash_mismatch', canExecute: false };
+        }
+        if (this.usedNonces.has(payload.nonce)) {
+            return { valid: false, reason: 'nonce_replay', canExecute: false };
+        }
+        this.usedNonces.add(payload.nonce);
+        return { valid: true, canExecute: true };
+    }
+    resetNonces() {
+        this.usedNonces.clear();
+    }
+}
+//# sourceMappingURL=verifier.js.map

package/dist/proposal/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../../src/proposal/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe1C,MAAM,OAAO,cAAc;IAIzB,YAAY,YAA2B;QAF/B,eAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAG1C,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,YAAY,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,OAA4B;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAQ,CAAC;QAErC,IAAI,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YAC9C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACzE,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC3E,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,WAAW;QACT,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/dist/risk/scoring.d.ts

@@ -0,0 +1,11 @@
+export interface RiskSignals {
+    isDestructive: boolean;
+    isIrreversible: boolean;
+    isOpenWorld: boolean;
+    impactScope: 'high' | 'medium' | 'low';
+    confidenceLevel: number;
+}
+export declare function computeRiskScore(signals: RiskSignals): number;
+export declare function riskLevelForScore(score: number): 'low' | 'medium' | 'high';
+export declare function categorizeRisk(toolName: string, args: Record<string, unknown>): RiskSignals;
+//# sourceMappingURL=scoring.d.ts.map

package/dist/risk/scoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/risk/scoring.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,cAAc,EAAE,OAAO,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAI1E;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAqC3F"}

package/dist/risk/scoring.js

@@ -0,0 +1,54 @@
+export function computeRiskScore(signals) {
+    let score = 0;
+    if (signals.isDestructive)
+        score += 0.3;
+    if (signals.isIrreversible)
+        score += 0.3;
+    if (signals.isOpenWorld)
+        score += 0.15;
+    const scopeWeights = {
+        high: 0.2,
+        medium: 0.1,
+        low: 0.05,
+    };
+    score += scopeWeights[signals.impactScope];
+    const confidencePenalty = 1 - signals.confidenceLevel;
+    score += confidencePenalty * 0.15;
+    return Math.min(1, Math.max(0, score));
+}
+export function riskLevelForScore(score) {
+    if (score < 0.33)
+        return 'low';
+    if (score < 0.67)
+        return 'medium';
+    return 'high';
+}
+export function categorizeRisk(toolName, args) {
+    const lowerToolName = toolName.toLowerCase();
+    const isDestructive = lowerToolName.includes('delete') ||
+        lowerToolName.includes('drop') ||
+        lowerToolName.includes('remove') ||
+        lowerToolName.includes('destroy');
+    const isIrreversible = isDestructive;
+    const isOpenWorld = lowerToolName.includes('execute') ||
+        lowerToolName.includes('run') ||
+        lowerToolName.includes('eval');
+    let impactScope = 'low';
+    if (lowerToolName.includes('user') ||
+        lowerToolName.includes('account') ||
+        lowerToolName.includes('database')) {
+        impactScope = 'high';
+    }
+    else if (lowerToolName.includes('file') ||
+        lowerToolName.includes('resource')) {
+        impactScope = 'medium';
+    }
+    return {
+        isDestructive,
+        isIrreversible,
+        isOpenWorld,
+        impactScope,
+        confidenceLevel: 0.8,
+    };
+}
+//# sourceMappingURL=scoring.js.map

package/dist/risk/scoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/risk/scoring.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,gBAAgB,CAAC,OAAoB;IACnD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,IAAI,OAAO,CAAC,aAAa;QAAE,KAAK,IAAI,GAAG,CAAC;IACxC,IAAI,OAAO,CAAC,cAAc;QAAE,KAAK,IAAI,GAAG,CAAC;IACzC,IAAI,OAAO,CAAC,WAAW;QAAE,KAAK,IAAI,IAAI,CAAC;IAEvC,MAAM,YAAY,GAA2B;QAC3C,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,IAAI;KACV,CAAC;IACF,KAAK,IAAI,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAE3C,MAAM,iBAAiB,GAAG,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IACtD,KAAK,IAAI,iBAAiB,GAAG,IAAI,CAAC;IAElC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,QAAQ,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,IAA6B;IAC5E,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAE7C,MAAM,aAAa,GACjB,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAEpC,MAAM,cAAc,GAAG,aAAa,CAAC;IAErC,MAAM,WAAW,GACf,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACjC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC7B,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEjC,IAAI,WAAW,GAA8B,KAAK,CAAC;IACnD,IACE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;QACjC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAClC,CAAC;QACD,WAAW,GAAG,MAAM,CAAC;IACvB,CAAC;SAAM,IACL,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAClC,CAAC;QACD,WAAW,GAAG,QAAQ,CAAC;IACzB,CAAC;IAED,OAAO;QACL,aAAa;QACb,cAAc;QACd,WAAW;QACX,WAAW;QACX,eAAe,EAAE,GAAG;KACrB,CAAC;AACJ,CAAC"}

package/dist/tests/hashing.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hashing.test.d.ts.map

package/dist/tests/hashing.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashing.test.d.ts","sourceRoot":"","sources":["../../src/tests/hashing.test.ts"],"names":[],"mappings":""}

package/dist/tests/hashing.test.js

@@ -0,0 +1,39 @@
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { hashText, hashJson, normalizePrompt, computePromptHash } from '../utils/hashing.js';
+test('hashText produces consistent hashes', async () => {
+    const hash1 = hashText('hello world');
+    const hash2 = hashText('hello world');
+    assert.equal(hash1, hash2);
+    assert.equal(hash1.length, 64); // SHA256 hex
+});
+test('hashText produces different hashes for different inputs', async () => {
+    const hash1 = hashText('hello');
+    const hash2 = hashText('world');
+    assert.notEqual(hash1, hash2);
+});
+test('hashJson handles objects', async () => {
+    const obj = { b: 2, a: 1 };
+    const hash = hashJson(obj);
+    assert.ok(hash);
+    assert.equal(hash.length, 64);
+});
+test('hashJson is order-independent', async () => {
+    const obj1 = { a: 1, b: 2 };
+    const obj2 = { b: 2, a: 1 };
+    const hash1 = hashJson(obj1);
+    const hash2 = hashJson(obj2);
+    assert.equal(hash1, hash2);
+});
+test('normalizePrompt handles whitespace', async () => {
+    const prompt = '  Hello   WORLD  ';
+    const normalized = normalizePrompt(prompt);
+    assert.equal(normalized, 'hello world');
+});
+test('computePromptHash is stable', async () => {
+    const prompt = 'Generate a deployment plan';
+    const hash1 = computePromptHash(prompt);
+    const hash2 = computePromptHash('GENERATE A DEPLOYMENT PLAN');
+    assert.equal(hash1, hash2);
+});
+//# sourceMappingURL=hashing.test.js.map

package/dist/tests/hashing.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashing.test.js","sourceRoot":"","sources":["../../src/tests/hashing.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7F,IAAI,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEtC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;IACzE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEhC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;IAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IAChB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;IAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAE5B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;IACpD,MAAM,MAAM,GAAG,mBAAmB,CAAC;IACnC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAE3C,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;IAC7C,MAAM,MAAM,GAAG,4BAA4B,CAAC;IAC5C,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,iBAAiB,CAAC,4BAA4B,CAAC,CAAC;IAE9D,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC"}

package/dist/tests/proposer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=proposer.test.d.ts.map

package/dist/tests/proposer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposer.test.d.ts","sourceRoot":"","sources":["../../src/tests/proposer.test.ts"],"names":[],"mappings":""}

package/dist/tests/proposer.test.js

@@ -0,0 +1,49 @@
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { ToolProposer } from '../proposal/proposer.js';
+test('Proposer creates proposals', async () => {
+    const proposer = new ToolProposer();
+    const result = await proposer.propose({
+        toolName: 'transfer_funds',
+        toolArgs: { amount: 100, to: 'acct_123' },
+        outputInstability: 0.1,
+    });
+    assert.ok(result.proposalId);
+    assert.ok(['allowed', 'blocked', 'review'].includes(result.status));
+});
+test('Proposer blocks high-risk proposals', async () => {
+    const proposer = new ToolProposer();
+    const result = await proposer.propose({
+        toolName: 'transfer_funds',
+        toolArgs: { amount: 1000000, to: 'unknown' },
+        outputInstability: 0.9,
+        numericVariance: 0.9,
+        promptDrift: 0.8,
+    });
+    assert.equal(result.status, 'blocked');
+    assert.ok(result.fallbackResponse);
+});
+test('Proposer allows low-risk proposals', async () => {
+    const proposer = new ToolProposer();
+    const result = await proposer.propose({
+        toolName: 'get_account_info',
+        toolArgs: { accountId: 'acct_123' },
+        outputInstability: 0.05,
+        numericVariance: 0.02,
+        promptDrift: 0.01,
+    });
+    assert.equal(result.status, 'allowed');
+    assert.ok(result.commitToken);
+});
+test('Proposer includes commit token for non-blocked proposals', async () => {
+    const proposer = new ToolProposer();
+    const result = await proposer.propose({
+        toolName: 'read_file',
+        toolArgs: { path: '/tmp/test.txt' },
+        outputInstability: 0.3,
+    });
+    if (result.status !== 'blocked') {
+        assert.ok(result.commitToken);
+    }
+});
+//# sourceMappingURL=proposer.test.js.map

package/dist/tests/proposer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposer.test.js","sourceRoot":"","sources":["../../src/tests/proposer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAGvD,IAAI,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;IAC5C,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QACpC,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,UAAU,EAAE;QACzC,iBAAiB,EAAE,GAAG;KACvB,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACtE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;IACrD,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QACpC,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE;QAC5C,iBAAiB,EAAE,GAAG;QACtB,eAAe,EAAE,GAAG;QACpB,WAAW,EAAE,GAAG;KACjB,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;IACpD,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QACpC,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE;QACnC,iBAAiB,EAAE,IAAI;QACvB,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;IAC1E,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QACpC,QAAQ,EAAE,WAAW;QACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;QACnC,iBAAiB,EAAE,GAAG;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/tests/scoring.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scoring.test.d.ts.map

package/dist/tests/scoring.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoring.test.d.ts","sourceRoot":"","sources":["../../src/tests/scoring.test.ts"],"names":[],"mappings":""}