agentic-qe 3.7.21 → 3.8.0

package/dist/integrations/ruvector/cognitive-container-codec.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Cognitive Container Binary Codec (Task 4.1)
+ *
+ * Binary pack/unpack helpers for the cognitive container format.
+ * Separated from cognitive-container.ts to keep each file under 500 lines.
+ *
+ * Binary layout:
+ *   [MAGIC 8B][VERSION 4B][MANIFEST_LEN 4B][MANIFEST JSON][SEGMENT DATA...]
+ *
+ * @module integrations/ruvector/cognitive-container-codec
+ */
+import { Buffer } from 'buffer';
+import Database from 'better-sqlite3';
+import type { ContainerManifest, ContainerSegment } from './cognitive-container.js';
+/** 8-byte magic header: "COGCNTNR" */
+export declare const MAGIC: Buffer<ArrayBuffer>;
+/** Current container format version */
+export declare const FORMAT_VERSION = 2;
+/** Segment names in canonical order */
+export declare const SEGMENT_NAMES: readonly ["patterns", "embeddings", "q-values", "lora-weights", "graph", "witness-chain"];
+export type SegmentName = (typeof SEGMENT_NAMES)[number];
+/** SHA-256 hash of a Buffer, returned as hex. */
+export declare function sha256buf(data: Buffer): string;
+/**
+ * Collect all table data from the database, grouped by segment.
+ */
+export declare function collectSegmentData(db: Database.Database, domains?: readonly string[]): Record<SegmentName, Record<string, unknown[]>>;
+/**
+ * Serialize a segment's data map to a Buffer, optionally compressed.
+ */
+export declare function serializeSegment(data: Record<string, unknown[]>, compress: boolean): Buffer;
+/**
+ * Deserialize a segment Buffer back to its data map.
+ */
+export declare function deserializeSegment(buf: Buffer, compressed: boolean): Record<string, unknown[]>;
+/**
+ * Write the container binary from a manifest and segment buffers.
+ */
+export declare function packContainer(manifest: ContainerManifest, segmentBuffers: Buffer[]): Buffer;
+/**
+ * Parse the header from container data and return manifest + data offset.
+ */
+export declare function unpackHeader(data: Buffer): {
+    manifest: ContainerManifest;
+    dataOffset: number;
+};
+/**
+ * Extract segment buffers from container data using manifest offsets.
+ */
+export declare function extractSegments(data: Buffer, dataOffset: number, segments: ContainerSegment[]): Map<string, Buffer>;
+//# sourceMappingURL=cognitive-container-codec.d.ts.map

package/dist/integrations/ruvector/cognitive-container-codec.js

@@ -0,0 +1,180 @@
+/**
+ * Cognitive Container Binary Codec (Task 4.1)
+ *
+ * Binary pack/unpack helpers for the cognitive container format.
+ * Separated from cognitive-container.ts to keep each file under 500 lines.
+ *
+ * Binary layout:
+ *   [MAGIC 8B][VERSION 4B][MANIFEST_LEN 4B][MANIFEST JSON][SEGMENT DATA...]
+ *
+ * @module integrations/ruvector/cognitive-container-codec
+ */
+import { createHash } from 'crypto';
+import { Buffer } from 'buffer';
+import { gunzipSync, gzipSync } from 'zlib';
+import { queryAll, domainFilterForColumn, serializeRowBlobs, TABLE_CONFIGS, TABLE_BLOB_COLUMNS, } from './brain-shared.js';
+// ============================================================================
+// Constants
+// ============================================================================
+/** 8-byte magic header: "COGCNTNR" */
+export const MAGIC = Buffer.from('COGCNTNR', 'ascii');
+/** Current container format version */
+export const FORMAT_VERSION = 2;
+/** Segment names in canonical order */
+export const SEGMENT_NAMES = [
+    'patterns',
+    'embeddings',
+    'q-values',
+    'lora-weights',
+    'graph',
+    'witness-chain',
+];
+// ============================================================================
+// Helpers
+// ============================================================================
+/** SHA-256 hash of a Buffer, returned as hex. */
+export function sha256buf(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/** Table name to segment name mapping. */
+const TABLE_TO_SEGMENT = {
+    qe_patterns: 'patterns',
+    qe_pattern_embeddings: 'embeddings',
+    captured_experiences: 'embeddings',
+    sona_patterns: 'embeddings',
+    rl_q_values: 'q-values',
+    dream_cycles: 'lora-weights',
+    dream_insights: 'lora-weights',
+    concept_nodes: 'graph',
+    concept_edges: 'graph',
+    witness_chain: 'witness-chain',
+};
+/** Assign a segment name for a given table. Defaults to 'patterns'. */
+function segmentForTable(tableName) {
+    return TABLE_TO_SEGMENT[tableName] ?? 'patterns';
+}
+// ============================================================================
+// Data Collection
+// ============================================================================
+/**
+ * Collect all table data from the database, grouped by segment.
+ */
+export function collectSegmentData(db, domains) {
+    const segments = {
+        'patterns': {},
+        'embeddings': {},
+        'q-values': {},
+        'lora-weights': {},
+        'graph': {},
+        'witness-chain': {},
+    };
+    for (const config of TABLE_CONFIGS) {
+        const [where, params] = config.domainColumn
+            ? domainFilterForColumn(domains, config.domainColumn)
+            : [undefined, []];
+        let rows = queryAll(db, config.tableName, where, params);
+        const blobCols = TABLE_BLOB_COLUMNS[config.tableName];
+        if (blobCols && blobCols.length > 0) {
+            rows = rows.map(r => serializeRowBlobs(r, blobCols));
+        }
+        const seg = segmentForTable(config.tableName);
+        segments[seg][config.tableName] = rows;
+    }
+    return segments;
+}
+// ============================================================================
+// Segment Serialization
+// ============================================================================
+/**
+ * Serialize a segment's data map to a Buffer, optionally compressed.
+ */
+export function serializeSegment(data, compress) {
+    const json = JSON.stringify(data);
+    const raw = Buffer.from(json, 'utf-8');
+    if (compress) {
+        return gzipSync(raw);
+    }
+    return raw;
+}
+/**
+ * Deserialize a segment Buffer back to its data map.
+ */
+export function deserializeSegment(buf, compressed) {
+    const raw = compressed ? gunzipSync(buf) : buf;
+    return JSON.parse(raw.toString('utf-8'));
+}
+// ============================================================================
+// Binary Packing
+// ============================================================================
+/**
+ * Write the container binary from a manifest and segment buffers.
+ */
+export function packContainer(manifest, segmentBuffers) {
+    const manifestJson = JSON.stringify(manifest);
+    const manifestBuf = Buffer.from(manifestJson, 'utf-8');
+    const headerLen = MAGIC.length + 4 + 4; // MAGIC(8) + VERSION(4) + MANIFEST_LEN(4)
+    const totalDataLen = segmentBuffers.reduce((sum, b) => sum + b.length, 0);
+    const totalLen = headerLen + manifestBuf.length + totalDataLen;
+    const out = Buffer.alloc(totalLen);
+    let pos = 0;
+    MAGIC.copy(out, pos);
+    pos += MAGIC.length;
+    out.writeUInt32BE(FORMAT_VERSION, pos);
+    pos += 4;
+    out.writeUInt32BE(manifestBuf.length, pos);
+    pos += 4;
+    manifestBuf.copy(out, pos);
+    pos += manifestBuf.length;
+    for (const buf of segmentBuffers) {
+        buf.copy(out, pos);
+        pos += buf.length;
+    }
+    return out;
+}
+/**
+ * Parse the header from container data and return manifest + data offset.
+ */
+export function unpackHeader(data) {
+    if (data.length < 16) {
+        throw new Error('Container too small: missing header');
+    }
+    const magic = data.subarray(0, MAGIC.length);
+    if (!magic.equals(MAGIC)) {
+        throw new Error('Invalid container: bad magic bytes');
+    }
+    const version = data.readUInt32BE(MAGIC.length);
+    if (version !== FORMAT_VERSION) {
+        throw new Error(`Unsupported container version: ${version}`);
+    }
+    const manifestLen = data.readUInt32BE(MAGIC.length + 4);
+    const manifestStart = MAGIC.length + 8;
+    const manifestEnd = manifestStart + manifestLen;
+    if (data.length < manifestEnd) {
+        throw new Error('Container truncated: manifest extends beyond data');
+    }
+    const manifestJson = data.subarray(manifestStart, manifestEnd).toString('utf-8');
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestJson);
+    }
+    catch {
+        throw new Error('Container corrupt: manifest JSON parse failed');
+    }
+    return { manifest, dataOffset: manifestEnd };
+}
+/**
+ * Extract segment buffers from container data using manifest offsets.
+ */
+export function extractSegments(data, dataOffset, segments) {
+    const result = new Map();
+    for (const seg of segments) {
+        const start = dataOffset + seg.offset;
+        const end = start + seg.length;
+        if (end > data.length) {
+            throw new Error(`Segment '${seg.name}' extends beyond container data`);
+        }
+        result.set(seg.name, data.subarray(start, end));
+    }
+    return result;
+}
+//# sourceMappingURL=cognitive-container-codec.js.map

package/dist/integrations/ruvector/cognitive-container.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Cognitive Container Export/Import (RVF v2, Task 4.1)
+ *
+ * Produces full cognitive containers that bundle all brain state into a single
+ * self-verifying binary format. Each container includes:
+ *   - Patterns, embeddings, Q-values, LoRA weights, graph state, witness chain
+ *   - Container manifest with per-segment SHA-256 checksums
+ *   - Ed25519 signing for container authenticity (Node.js crypto)
+ *   - COW (copy-on-write) branching for cheap forks
+ *
+ * Binary layout:
+ *   [MAGIC 8B][VERSION 4B][MANIFEST_LEN 4B][MANIFEST JSON][SEGMENT DATA...]
+ *
+ * @module integrations/ruvector/cognitive-container
+ */
+import { Buffer } from 'buffer';
+import Database from 'better-sqlite3';
+import { type MergeStrategy } from './brain-shared.js';
+export interface ContainerSegment {
+    readonly name: string;
+    readonly offset: number;
+    readonly length: number;
+    readonly checksum: string;
+    readonly compressed: boolean;
+}
+export interface ContainerManifest {
+    readonly version: string;
+    readonly created: string;
+    readonly source: string;
+    readonly segments: ContainerSegment[];
+    readonly checksums: Record<string, string>;
+    readonly signature?: string;
+    readonly branchOf?: string;
+}
+export interface ExportOptions {
+    readonly domains?: readonly string[];
+    readonly compress?: boolean;
+    readonly sign?: boolean;
+    readonly privateKey?: Buffer;
+    readonly sourceId?: string;
+}
+export interface ImportOptions {
+    readonly mergeStrategy: MergeStrategy;
+    readonly dryRun?: boolean;
+    readonly verifySignature?: boolean;
+    readonly publicKey?: Buffer;
+}
+export interface ImportResult {
+    readonly imported: number;
+    readonly skipped: number;
+    readonly conflicts: number;
+    readonly segmentsRestored: number;
+}
+export interface VerificationResult {
+    readonly valid: boolean;
+    readonly manifestValid: boolean;
+    readonly segmentsValid: boolean;
+    readonly signatureValid: boolean | null;
+    readonly errors: string[];
+}
+export interface ContainerInfo {
+    readonly version: string;
+    readonly created: string;
+    readonly source: string;
+    readonly segmentCount: number;
+    readonly segmentNames: string[];
+    readonly totalDataBytes: number;
+    readonly signed: boolean;
+    readonly branchOf: string | null;
+}
+export interface Ed25519KeyPair {
+    readonly publicKey: Buffer;
+    readonly privateKey: Buffer;
+}
+/** Generate an Ed25519 key pair for container signing. */
+export declare function generateSigningKeyPair(): Ed25519KeyPair;
+export declare class CognitiveContainer {
+    /**
+     * Export a full cognitive container from the database.
+     *
+     * Produces a self-contained binary Buffer including all brain segments
+     * with per-segment checksums and optional Ed25519 signing.
+     */
+    exportContainer(db: Database.Database, options?: ExportOptions): {
+        data: Buffer;
+        manifest: ContainerManifest;
+    };
+    /**
+     * Import a cognitive container into the database.
+     *
+     * Verifies segment checksums before importing. Optionally verifies
+     * the Ed25519 signature.
+     */
+    importContainer(data: Buffer, db: Database.Database, options: ImportOptions): ImportResult;
+    /**
+     * Verify container integrity without importing.
+     *
+     * Checks: magic, manifest parse, segment checksums, optional signature.
+     */
+    verifyContainer(data: Buffer, publicKey?: Buffer): VerificationResult;
+    /**
+     * Create a COW (copy-on-write) branch of a container.
+     *
+     * The branch references the parent container by ID and includes only
+     * the manifest with updated metadata. The segment data is shared
+     * (not duplicated).
+     */
+    branchContainer(sourceData: Buffer, branchName: string): {
+        data: Buffer;
+        manifest: ContainerManifest;
+    };
+    /** Get container info without importing or fully verifying. */
+    getContainerInfo(data: Buffer): ContainerInfo;
+    private buildSignedPayload;
+    private verifySignatureInternal;
+    private verifyChecksums;
+    private requireValidSignature;
+    private dryRunImport;
+    private executeImport;
+    private verifySegmentChecksums;
+    private verifySignatureStatus;
+}
+/** Create a CognitiveContainer instance. */
+export declare function createCognitiveContainer(): CognitiveContainer;
+//# sourceMappingURL=cognitive-container.d.ts.map

package/dist/integrations/ruvector/cognitive-container.js

@@ -0,0 +1,306 @@
+/**
+ * Cognitive Container Export/Import (RVF v2, Task 4.1)
+ *
+ * Produces full cognitive containers that bundle all brain state into a single
+ * self-verifying binary format. Each container includes:
+ *   - Patterns, embeddings, Q-values, LoRA weights, graph state, witness chain
+ *   - Container manifest with per-segment SHA-256 checksums
+ *   - Ed25519 signing for container authenticity (Node.js crypto)
+ *   - COW (copy-on-write) branching for cheap forks
+ *
+ * Binary layout:
+ *   [MAGIC 8B][VERSION 4B][MANIFEST_LEN 4B][MANIFEST JSON][SEGMENT DATA...]
+ *
+ * @module integrations/ruvector/cognitive-container
+ */
+import { generateKeyPairSync, sign, verify, randomUUID } from 'crypto';
+import { Buffer } from 'buffer';
+import { ensureTargetTables, mergeGenericRow, mergeAppendOnlyRow, TABLE_CONFIGS, PK_COLUMNS, CONFIDENCE_COLUMNS, TIMESTAMP_COLUMNS, deserializeRowBlobs, TABLE_BLOB_COLUMNS, } from './brain-shared.js';
+import { SEGMENT_NAMES, sha256buf, collectSegmentData, serializeSegment, deserializeSegment, packContainer, unpackHeader, extractSegments, } from './cognitive-container-codec.js';
+/** Generate an Ed25519 key pair for container signing. */
+export function generateSigningKeyPair() {
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519', {
+        publicKeyEncoding: { type: 'spki', format: 'der' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+    });
+    return {
+        publicKey: Buffer.from(publicKey),
+        privateKey: Buffer.from(privateKey),
+    };
+}
+// ============================================================================
+// CognitiveContainer
+// ============================================================================
+export class CognitiveContainer {
+    /**
+     * Export a full cognitive container from the database.
+     *
+     * Produces a self-contained binary Buffer including all brain segments
+     * with per-segment checksums and optional Ed25519 signing.
+     */
+    exportContainer(db, options = {}) {
+        const compress = options.compress ?? true;
+        const sourceId = options.sourceId ?? randomUUID();
+        const segmentData = collectSegmentData(db, options.domains);
+        const segmentBuffers = [];
+        const segments = [];
+        const checksums = {};
+        let currentOffset = 0;
+        for (const name of SEGMENT_NAMES) {
+            const tableData = segmentData[name];
+            const buf = serializeSegment(tableData, compress);
+            const checksum = sha256buf(buf);
+            segments.push({
+                name,
+                offset: currentOffset,
+                length: buf.length,
+                checksum,
+                compressed: compress,
+            });
+            checksums[name] = checksum;
+            segmentBuffers.push(buf);
+            currentOffset += buf.length;
+        }
+        const manifest = {
+            version: '2.0.0',
+            created: new Date().toISOString(),
+            source: sourceId,
+            segments,
+            checksums,
+        };
+        if (options.sign && options.privateKey) {
+            const payload = this.buildSignedPayload(manifest);
+            const signature = sign(null, Buffer.from(payload, 'utf-8'), { key: options.privateKey, format: 'der', type: 'pkcs8' });
+            manifest.signature = signature.toString('hex');
+        }
+        const data = packContainer(manifest, segmentBuffers);
+        return { data, manifest };
+    }
+    /**
+     * Import a cognitive container into the database.
+     *
+     * Verifies segment checksums before importing. Optionally verifies
+     * the Ed25519 signature.
+     */
+    importContainer(data, db, options) {
+        const { manifest, dataOffset } = unpackHeader(data);
+        const segmentBuffers = extractSegments(data, dataOffset, manifest.segments);
+        this.verifyChecksums(manifest.segments, segmentBuffers);
+        if (options.verifySignature) {
+            this.requireValidSignature(manifest, options.publicKey);
+        }
+        if (options.dryRun) {
+            return this.dryRunImport(manifest, segmentBuffers);
+        }
+        ensureTargetTables(db);
+        return this.executeImport(db, manifest, segmentBuffers, options.mergeStrategy);
+    }
+    /**
+     * Verify container integrity without importing.
+     *
+     * Checks: magic, manifest parse, segment checksums, optional signature.
+     */
+    verifyContainer(data, publicKey) {
+        const errors = [];
+        let manifestValid = false;
+        let segmentsValid = false;
+        let signatureValid = null;
+        let manifest;
+        let dataOffset;
+        try {
+            const result = unpackHeader(data);
+            manifest = result.manifest;
+            dataOffset = result.dataOffset;
+            manifestValid = true;
+        }
+        catch (err) {
+            errors.push(err instanceof Error ? err.message : String(err));
+            return { valid: false, manifestValid, segmentsValid, signatureValid, errors };
+        }
+        segmentsValid = this.verifySegmentChecksums(data, dataOffset, manifest, errors);
+        signatureValid = this.verifySignatureStatus(manifest, publicKey, errors);
+        const valid = manifestValid && segmentsValid
+            && (signatureValid === null || signatureValid);
+        return { valid, manifestValid, segmentsValid, signatureValid, errors };
+    }
+    /**
+     * Create a COW (copy-on-write) branch of a container.
+     *
+     * The branch references the parent container by ID and includes only
+     * the manifest with updated metadata. The segment data is shared
+     * (not duplicated).
+     */
+    branchContainer(sourceData, branchName) {
+        const { manifest: src, dataOffset } = unpackHeader(sourceData);
+        const segBufs = extractSegments(sourceData, dataOffset, src.segments);
+        const branchManifest = {
+            version: src.version,
+            created: new Date().toISOString(),
+            source: branchName,
+            segments: src.segments.map(seg => ({ ...seg })),
+            checksums: { ...src.checksums },
+            branchOf: src.source,
+        };
+        const buffers = [];
+        for (const seg of src.segments) {
+            buffers.push(segBufs.get(seg.name));
+        }
+        const data = packContainer(branchManifest, buffers);
+        return { data, manifest: branchManifest };
+    }
+    /** Get container info without importing or fully verifying. */
+    getContainerInfo(data) {
+        const { manifest } = unpackHeader(data);
+        const totalDataBytes = manifest.segments.reduce((sum, s) => sum + s.length, 0);
+        return {
+            version: manifest.version,
+            created: manifest.created,
+            source: manifest.source,
+            segmentCount: manifest.segments.length,
+            segmentNames: manifest.segments.map(s => s.name),
+            totalDataBytes,
+            signed: !!manifest.signature,
+            branchOf: manifest.branchOf ?? null,
+        };
+    }
+    // --------------------------------------------------------------------------
+    // Private helpers
+    // --------------------------------------------------------------------------
+    buildSignedPayload(manifest) {
+        return JSON.stringify({
+            version: manifest.version,
+            created: manifest.created,
+            source: manifest.source,
+            checksums: manifest.checksums,
+        });
+    }
+    verifySignatureInternal(manifest, publicKey) {
+        if (!manifest.signature)
+            return false;
+        const payload = this.buildSignedPayload(manifest);
+        return verify(null, Buffer.from(payload, 'utf-8'), { key: publicKey, format: 'der', type: 'spki' }, Buffer.from(manifest.signature, 'hex'));
+    }
+    verifyChecksums(segments, segmentBuffers) {
+        for (const seg of segments) {
+            const buf = segmentBuffers.get(seg.name);
+            if (!buf)
+                throw new Error(`Missing segment data: ${seg.name}`);
+            const actual = sha256buf(buf);
+            if (actual !== seg.checksum) {
+                throw new Error(`Checksum mismatch for segment '${seg.name}': ` +
+                    `expected ${seg.checksum}, got ${actual}`);
+            }
+        }
+    }
+    requireValidSignature(manifest, publicKey) {
+        if (!manifest.signature) {
+            throw new Error('Container is not signed but signature verification was requested');
+        }
+        if (!publicKey) {
+            throw new Error('Public key required for signature verification');
+        }
+        if (!this.verifySignatureInternal(manifest, publicKey)) {
+            throw new Error('Container signature verification failed');
+        }
+    }
+    dryRunImport(manifest, segmentBuffers) {
+        let total = 0;
+        for (const seg of manifest.segments) {
+            const buf = segmentBuffers.get(seg.name);
+            const tableData = deserializeSegment(buf, seg.compressed);
+            for (const rows of Object.values(tableData)) {
+                total += (rows?.length ?? 0);
+            }
+        }
+        return { imported: total, skipped: 0, conflicts: 0, segmentsRestored: manifest.segments.length };
+    }
+    executeImport(db, manifest, segmentBuffers, mergeStrategy) {
+        let imported = 0;
+        let skipped = 0;
+        let conflicts = 0;
+        let segmentsRestored = 0;
+        const importAll = db.transaction(() => {
+            for (const seg of manifest.segments) {
+                const buf = segmentBuffers.get(seg.name);
+                const tableData = deserializeSegment(buf, seg.compressed);
+                segmentsRestored++;
+                for (const [tableName, rows] of Object.entries(tableData)) {
+                    if (!Array.isArray(rows) || rows.length === 0)
+                        continue;
+                    const config = TABLE_CONFIGS.find(c => c.tableName === tableName);
+                    if (!config)
+                        continue;
+                    const blobCols = TABLE_BLOB_COLUMNS[tableName];
+                    let processedRows = rows;
+                    if (blobCols && blobCols.length > 0) {
+                        processedRows = processedRows.map(r => deserializeRowBlobs(r, blobCols));
+                    }
+                    for (const row of processedRows) {
+                        let result;
+                        if (config.dedupColumns && config.dedupColumns.length > 0) {
+                            result = mergeAppendOnlyRow(db, config.tableName, row, config.dedupColumns);
+                        }
+                        else {
+                            const idCol = PK_COLUMNS[config.tableName] || 'id';
+                            const tsCol = TIMESTAMP_COLUMNS[config.tableName];
+                            const confCol = CONFIDENCE_COLUMNS[config.tableName];
+                            result = mergeGenericRow(db, config.tableName, row, idCol, mergeStrategy, tsCol, confCol);
+                        }
+                        imported += result.imported;
+                        skipped += result.skipped;
+                        conflicts += result.conflicts;
+                    }
+                }
+            }
+        });
+        importAll();
+        return { imported, skipped, conflicts, segmentsRestored };
+    }
+    verifySegmentChecksums(data, dataOffset, manifest, errors) {
+        try {
+            const segBufs = extractSegments(data, dataOffset, manifest.segments);
+            let allGood = true;
+            for (const seg of manifest.segments) {
+                const buf = segBufs.get(seg.name);
+                if (!buf) {
+                    errors.push(`Missing segment: ${seg.name}`);
+                    allGood = false;
+                    continue;
+                }
+                if (sha256buf(buf) !== seg.checksum) {
+                    errors.push(`Checksum mismatch for '${seg.name}'`);
+                    allGood = false;
+                }
+            }
+            return allGood;
+        }
+        catch (err) {
+            errors.push(err instanceof Error ? err.message : String(err));
+            return false;
+        }
+    }
+    verifySignatureStatus(manifest, publicKey, errors) {
+        if (!manifest.signature)
+            return null;
+        if (!publicKey)
+            return null;
+        try {
+            const valid = this.verifySignatureInternal(manifest, publicKey);
+            if (!valid)
+                errors.push('Signature verification failed');
+            return valid;
+        }
+        catch (err) {
+            errors.push(`Signature error: ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
+}
+// ============================================================================
+// Convenience factory
+// ============================================================================
+/** Create a CognitiveContainer instance. */
+export function createCognitiveContainer() {
+    return new CognitiveContainer();
+}
+//# sourceMappingURL=cognitive-container.js.map