limen-ai 1.0.0

package/dist/kernel/interfaces/audit.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Audit trail interface types.
+ * S ref: I-03, I-06, §3.5, FM-08, T-5
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Append-only, hash-chained audit trail with tamper detection.
+ *
+ * I-03: Every state mutation and its audit entry in same transaction.
+ * I-06: Active database audit entries are append-only. No modify, no delete.
+ *        Retention = archival to cryptographically sealed file.
+ * §3.5: SHA-256 hash chaining. Monotonic sequence numbers. Append-only.
+ * FM-08: Defense against audit trail tampering.
+ */
+import type { Result, TenantId, OperationContext } from './common.js';
+import type { DatabaseConnection } from './database.js';
+/**
+ * A single audit log entry with hash chain fields.
+ * S ref: §3.5 (SHA-256 hash chaining, monotonic sequence numbers)
+ */
+export interface AuditEntry {
+    readonly seqNo: number;
+    readonly id: string;
+    readonly tenantId: TenantId | null;
+    readonly timestamp: string;
+    readonly actorType: 'system' | 'user' | 'agent' | 'scheduler';
+    readonly actorId: string;
+    readonly operation: string;
+    readonly resourceType: string;
+    readonly resourceId: string;
+    readonly detail: Record<string, unknown> | null;
+    readonly previousHash: string;
+    readonly currentHash: string;
+}
+/**
+ * Input for creating a new audit entry.
+ * S ref: I-03 (who, what, when, why)
+ */
+export interface AuditCreateInput {
+    tenantId: TenantId | null;
+    actorType: 'system' | 'user' | 'agent' | 'scheduler';
+    actorId: string;
+    operation: string;
+    resourceType: string;
+    resourceId: string;
+    detail?: Record<string, unknown>;
+}
+/**
+ * Filter for querying audit entries.
+ * S ref: I-06 (audit query)
+ */
+export interface AuditQueryFilter {
+    readonly tenantId?: TenantId;
+    readonly actorId?: string;
+    readonly operation?: string;
+    readonly resourceType?: string;
+    readonly resourceId?: string;
+    readonly fromTimestamp?: string;
+    readonly toTimestamp?: string;
+    readonly limit?: number;
+    readonly offset?: number;
+}
+/**
+ * Result of hash chain integrity verification.
+ * S ref: FM-08 (tamper detection), §3.5 (SHA-256 hash chaining)
+ */
+export interface ChainVerification {
+    readonly valid: boolean;
+    readonly totalEntries: number;
+    readonly firstSeqNo: number;
+    readonly lastSeqNo: number;
+    readonly brokenAt: number | null;
+    readonly expectedHash: string | null;
+    readonly actualHash: string | null;
+    readonly gaps: readonly number[];
+}
+/**
+ * Result of archiving audit entries to a sealed file.
+ * S ref: I-06 (archival to cryptographically sealed file, not deletion)
+ */
+export interface ArchiveResult {
+    readonly segmentId: string;
+    readonly archivedEntries: number;
+    readonly firstSeqNo: number;
+    readonly lastSeqNo: number;
+    readonly finalHash: string;
+    readonly filePath: string;
+}
+/**
+ * Append-only, hash-chained audit trail.
+ * S ref: I-03 (atomic mutation + audit), I-06 (immutability),
+ *        §3.5 (SHA-256 chaining), FM-08 (tamper detection)
+ */
+export interface AuditTrail {
+    /**
+     * Append entry. MUST be called within same transaction as mutation (I-03).
+     * Assigns monotonic sequence number and computes SHA-256 hash chain.
+     * S ref: I-03 (atomic audit), §3.5 (hash chaining)
+     */
+    append(conn: DatabaseConnection, input: AuditCreateInput): Result<AuditEntry>;
+    /**
+     * Batch append for observational (non-mutating) audits.
+     * Batched for performance -- up to 50 entries or 100ms window.
+     * S ref: §3.5 (observational audit batching)
+     */
+    appendBatch(conn: DatabaseConnection, inputs: AuditCreateInput[]): Result<AuditEntry[]>;
+    /**
+     * Query entries. RBAC: requires 'view_audit' permission.
+     * S ref: I-13 (authorization on audit read)
+     */
+    query(conn: DatabaseConnection, ctx: OperationContext, filter: AuditQueryFilter): Result<AuditEntry[]>;
+    /**
+     * Verify hash chain integrity.
+     * Returns detailed verification result with break location if tampered.
+     * S ref: FM-08 (chain verification as runtime health check)
+     */
+    verifyChain(conn: DatabaseConnection, tenantId?: TenantId): Result<ChainVerification>;
+    /**
+     * Archive entries to sealed file.
+     * Active DB starts new chain segment linked to archive's final hash.
+     * S ref: I-06 (archival, not deletion), §35 (7-year default retention)
+     */
+    archive(conn: DatabaseConnection, olderThan: string, outputPath: string): Result<ArchiveResult>;
+    /**
+     * Get current chain head hash.
+     * S ref: §3.5 (hash chaining state)
+     */
+    getChainHead(conn: DatabaseConnection, tenantId?: TenantId): Result<string>;
+    /**
+     * CF-035, GDPR Art. 17: Tombstone audit entries for a tenant.
+     * Replaces PII fields (detail, actor_id) with sanitized values
+     * while preserving hash chain integrity via cascade re-hash.
+     * S ref: I-06 (immutability — controlled exception for GDPR),
+     *        I-02 (data ownership — right to erasure),
+     *        DEC-CERT-001 (global chain GDPR condition)
+     */
+    tombstone(conn: DatabaseConnection, tenantId: TenantId): Result<TombstoneResult>;
+}
+/**
+ * CF-035: Result of a GDPR tombstone operation.
+ */
+export interface TombstoneResult {
+    readonly tombstonedEntries: number;
+    readonly rehashedEntries: number;
+    readonly chainValid: boolean;
+}
+//# sourceMappingURL=audit.d.ts.map

package/dist/kernel/interfaces/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,WAAW,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAID;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAID;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IAE9E;;;;OAIG;IACH,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAExF;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAEvG;;;;OAIG;IACH,WAAW,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAEtF;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;IAEhG;;;OAGG;IACH,YAAY,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAE5E;;;;;;;OAOG;IACH,SAAS,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;CAClF;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B"}

package/dist/kernel/interfaces/audit.js

@@ -0,0 +1,15 @@
+/**
+ * Audit trail interface types.
+ * S ref: I-03, I-06, §3.5, FM-08, T-5
+ *
+ * Phase: 1 (Kernel)
+ * Implements: Append-only, hash-chained audit trail with tamper detection.
+ *
+ * I-03: Every state mutation and its audit entry in same transaction.
+ * I-06: Active database audit entries are append-only. No modify, no delete.
+ *        Retention = archival to cryptographically sealed file.
+ * §3.5: SHA-256 hash chaining. Monotonic sequence numbers. Append-only.
+ * FM-08: Defense against audit trail tampering.
+ */
+export {};
+//# sourceMappingURL=audit.js.map

package/dist/kernel/interfaces/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/kernel/interfaces/capability_manifest.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Capability Manifest Schema interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 9 (Capability Manifest Schema), Deliverable 10 (Retry/Replay Safety Matrix)
+ *
+ * Phase: 0A (Foundation)
+ *
+ * BC-100: CapabilityManifest carries trust tier.
+ * BC-101: 5 ExecutionTrustTier values with defined retry policies.
+ * BC-102: secretRequirements carry references only, never plaintext.
+ * BC-103: Manifest immutable once registered.
+ * BC-104: SideEffectClass classification for operational safety.
+ * BC-110: Every system call must be classified in retry/replay matrix.
+ * BC-111: Retry classification lookup table.
+ * INV-X04: Every entity carries schemaVersion.
+ */
+import type { Result } from './common.js';
+import type { CapabilityManifestId } from './governance_ids.js';
+import type { DatabaseConnection } from './database.js';
+/**
+ * BC-101: Execution trust tier classification.
+ * Determines retry policy, supervisor requirements, and side-effect constraints.
+ *
+ *   deterministic-local: auto-retry, no constraint
+ *   sandboxed-local: same-request-ID, verify prior state
+ *   remote-tenant: no auto-retry, same-ID, verify
+ *   remote-third-party: no auto-retry, supervisor review for irreversible
+ *   human-mediated: always supervisor
+ */
+export type ExecutionTrustTier = 'deterministic-local' | 'sandboxed-local' | 'remote-tenant' | 'remote-third-party' | 'human-mediated';
+/**
+ * BC-104: Side effect classification for operational safety.
+ * Determines retry and replay behavior per capability.
+ */
+export type SideEffectClass = 'none' | 'idempotent' | 'reversible' | 'irreversible';
+/**
+ * BC-100, BC-103: CapabilityManifest — immutable capability registration.
+ * Once registered, a manifest cannot be modified. New versions create new manifests.
+ * BC-102: secretRequirements carry vault key references, never plaintext.
+ */
+export interface CapabilityManifest {
+    readonly manifestId: CapabilityManifestId;
+    /** Capability type identifier (e.g., 'web_search', 'code_execute') */
+    readonly capabilityType: string;
+    /** BC-101: Trust tier determining retry/supervisor policy */
+    readonly trustTier: ExecutionTrustTier;
+    /** BC-104: Side effect classification */
+    readonly sideEffectClass: SideEffectClass;
+    /**
+     * BC-102: Secret requirement references (vault key names, never plaintext).
+     * Empty array means no secrets required.
+     */
+    readonly secretRequirements: readonly string[];
+    /** INV-X04: Governance schema version (Amendment A12) */
+    readonly schemaVersion: string;
+    readonly createdAt: string;
+}
+/**
+ * CapabilityManifest persistence operations.
+ * BC-103: No update — manifests are immutable once registered.
+ */
+export interface CapabilityManifestStore {
+    register(conn: DatabaseConnection, manifest: CapabilityManifest): Result<CapabilityManifest>;
+    get(conn: DatabaseConnection, manifestId: CapabilityManifestId): Result<CapabilityManifest | null>;
+    getByType(conn: DatabaseConnection, capabilityType: string): Result<CapabilityManifest | null>;
+}
+/**
+ * BC-111: Retry classification per system call.
+ * BC-110: Every system call must have an entry.
+ * Source: Truth Model Deliverable 10.
+ */
+export interface RetryClassification {
+    readonly syscallId: string;
+    readonly autoRetryable: boolean;
+    readonly sameRequestIdRequired: boolean;
+    readonly verifyPriorStateRequired: boolean;
+    readonly supervisorReviewRequired: boolean;
+    readonly traceReconstructable: boolean;
+    readonly forkedRunReexecutable: boolean;
+}
+/**
+ * BC-111: Complete retry/replay classification lookup table.
+ * 13 system calls classified per Deliverable 10.
+ */
+export declare const RETRY_REPLAY_CLASSIFICATION: readonly RetryClassification[];
+/**
+ * BC-120 to BC-126: Retention/redaction classification per data category.
+ * Source: Truth Model Deliverable 11.
+ *
+ * BC-120: Audit trail — permanent, never redacted internally, projection at API boundary.
+ * BC-121: Trace events — configurable retention (default 90d), tool I/O redacted by default.
+ * BC-122: Resume tokens — hash only stored, excluded from trace payloads.
+ * BC-123: WMP thread — pruned on session close.
+ * BC-124: WMP active — pruned on mission completion + window.
+ * BC-125: Tombstone semantics — record persists, visibility changes, trace/audit intact.
+ * BC-126: All Phase 0A data categories are tenant-local.
+ */
+export interface RetentionCategory {
+    readonly category: string;
+    readonly defaultRetentionDays: number | 'permanent';
+    readonly redactionDefault: 'none' | 'tool-io' | 'hash-only';
+    readonly tenantLocal: boolean;
+}
+export declare const RETENTION_CATEGORIES: readonly RetentionCategory[];
+//# sourceMappingURL=capability_manifest.d.ts.map

package/dist/kernel/interfaces/capability_manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability_manifest.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/capability_manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAC1B,qBAAqB,GACrB,iBAAiB,GACjB,eAAe,GACf,oBAAoB,GACpB,gBAAgB,CAAC;AAIrB;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,YAAY,GACZ,YAAY,GACZ,cAAc,CAAC;AAInB;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,yCAAyC;IACzC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAID;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC7F,GAAG,CAAC,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,oBAAoB,GAAG,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACnG,SAAS,CAAC,IAAI,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CAChG;AAID;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;IAC3C,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;CACzC;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,mBAAmB,EAc5D,CAAC;AAIX;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,WAAW,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAAC;IAC5D,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,eAAO,MAAM,oBAAoB,EAAE,SAAS,iBAAiB,EAQnD,CAAC"}

package/dist/kernel/interfaces/capability_manifest.js

@@ -0,0 +1,44 @@
+/**
+ * Capability Manifest Schema interfaces for Phase 0A governance layer.
+ * Truth Model: Deliverable 9 (Capability Manifest Schema), Deliverable 10 (Retry/Replay Safety Matrix)
+ *
+ * Phase: 0A (Foundation)
+ *
+ * BC-100: CapabilityManifest carries trust tier.
+ * BC-101: 5 ExecutionTrustTier values with defined retry policies.
+ * BC-102: secretRequirements carry references only, never plaintext.
+ * BC-103: Manifest immutable once registered.
+ * BC-104: SideEffectClass classification for operational safety.
+ * BC-110: Every system call must be classified in retry/replay matrix.
+ * BC-111: Retry classification lookup table.
+ * INV-X04: Every entity carries schemaVersion.
+ */
+/**
+ * BC-111: Complete retry/replay classification lookup table.
+ * 13 system calls classified per Deliverable 10.
+ */
+export const RETRY_REPLAY_CLASSIFICATION = [
+    { syscallId: 'SC-1', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-2', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-3', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-4', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-5', autoRetryable: true, sameRequestIdRequired: false, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-6', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-7', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: true, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-8', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: true, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-9', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: true, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-10', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: true, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-14', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-15', autoRetryable: true, sameRequestIdRequired: false, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+    { syscallId: 'SC-16', autoRetryable: false, sameRequestIdRequired: true, verifyPriorStateRequired: false, supervisorReviewRequired: false, traceReconstructable: true, forkedRunReexecutable: true },
+];
+export const RETENTION_CATEGORIES = [
+    { category: 'audit_trail', defaultRetentionDays: 'permanent', redactionDefault: 'none', tenantLocal: true },
+    { category: 'trace_events', defaultRetentionDays: 90, redactionDefault: 'tool-io', tenantLocal: true },
+    { category: 'resume_tokens', defaultRetentionDays: 30, redactionDefault: 'hash-only', tenantLocal: true },
+    { category: 'wmp_thread', defaultRetentionDays: 1, redactionDefault: 'none', tenantLocal: true },
+    { category: 'wmp_active', defaultRetentionDays: 7, redactionDefault: 'none', tenantLocal: true },
+    { category: 'supervisor_decisions', defaultRetentionDays: 'permanent', redactionDefault: 'none', tenantLocal: true },
+    { category: 'eval_cases', defaultRetentionDays: 'permanent', redactionDefault: 'none', tenantLocal: true },
+];
+//# sourceMappingURL=capability_manifest.js.map

package/dist/kernel/interfaces/capability_manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability_manifest.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/capability_manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AA2FH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAmC;IACzE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACnM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACnM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACnM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACnM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACnM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACnM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IAClM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IAClM,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IAClM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACnM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACpM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;IACpM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE;CAC5L,CAAC;AAuBX,MAAM,CAAC,MAAM,oBAAoB,GAAiC;IAChE,EAAE,QAAQ,EAAE,aAAa,EAAE,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;IAC3G,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE;IACtG,EAAE,QAAQ,EAAE,eAAe,EAAE,oBAAoB,EAAE,EAAE,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE;IACzG,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;IAChG,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;IAChG,EAAE,QAAQ,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;IACpH,EAAE,QAAQ,EAAE,YAAY,EAAE,oBAAoB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE;CAClG,CAAC"}

package/dist/kernel/interfaces/common.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Common types shared across all kernel modules.
+ * S ref: S6-S13 (core objects), C-03 (TypeScript strict), C-09 (namespaces)
+ *
+ * Phase: 1 (Kernel)
+ * Implements: §4 I-13 (branded types for RBAC), §4 I-03 (Result<T>),
+ *             §34 (Permission), FM-10 (tenant isolation via branded types)
+ */
+/** §6: Mission identifier */
+export type TenantId = string & {
+    readonly __brand: 'TenantId';
+};
+/** §34: User identifier */
+export type UserId = string & {
+    readonly __brand: 'UserId';
+};
+/** §7: Agent identifier */
+export type AgentId = string & {
+    readonly __brand: 'AgentId';
+};
+/** §6: Mission identifier */
+export type MissionId = string & {
+    readonly __brand: 'MissionId';
+};
+/** §7: Task identifier */
+export type TaskId = string & {
+    readonly __brand: 'TaskId';
+};
+/** §10: Event identifier */
+export type EventId = string & {
+    readonly __brand: 'EventId';
+};
+/** §8: Artifact identifier */
+export type ArtifactId = string & {
+    readonly __brand: 'ArtifactId';
+};
+/** §13: Policy identifier */
+export type PolicyId = string & {
+    readonly __brand: 'PolicyId';
+};
+/** §34: Role identifier */
+export type RoleId = string & {
+    readonly __brand: 'RoleId';
+};
+/** §26: Session identifier */
+export type SessionId = string & {
+    readonly __brand: 'SessionId';
+};
+/** §34: Permission strings per specification §34 + §31.5 */
+export type Permission = 'create_agent' | 'modify_agent' | 'delete_agent' | 'chat' | 'infer' | 'create_mission' | 'view_telemetry' | 'view_audit' | 'manage_providers' | 'manage_budgets' | 'manage_roles' | 'purge_data' | 'approve_response' | 'edit_response' | 'takeover_session' | 'review_batch';
+/**
+ * Operation context for identity threading and RBAC enforcement.
+ * S ref: I-13 (authorization completeness), FM-10 (tenant isolation)
+ *
+ * Every public kernel function accepts this as its identity parameter.
+ * In single-tenant mode, tenantId is null. For system operations, userId is null.
+ */
+export interface OperationContext {
+    readonly tenantId: TenantId | null;
+    readonly userId: UserId | null;
+    readonly agentId: AgentId | null;
+    readonly permissions: ReadonlySet<Permission>;
+    readonly sessionId?: SessionId;
+}
+/**
+ * Standard kernel error. Machine-readable code + human-readable message + spec ref.
+ * S ref: C-10 (error handling), §3.1 (deterministic)
+ * BC-081: Optional violations array for structured governance error model.
+ */
+export interface KernelError {
+    readonly code: string;
+    readonly message: string;
+    readonly spec: string;
+    /** BC-081: Structured violation records for governance error classification. */
+    readonly violations?: readonly import('./governance_ids.js').LimenViolation[];
+}
+/**
+ * Discriminated union result type. Every kernel function returns this.
+ * Forces callers to handle both success and error paths at compile time.
+ * S ref: C-03 (TypeScript strict), §3.1 (deterministic infrastructure)
+ */
+export type Result<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly error: KernelError;
+};
+/** Valid table namespace prefixes per C-09 */
+export type NamespacePrefix = 'core_' | 'memory_' | 'agent_' | 'obs_' | 'hitl_' | 'meter_' | 'gov_';
+//# sourceMappingURL=common.d.ts.map

package/dist/kernel/interfaces/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,6BAA6B;AAC7B,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AACjE,2BAA2B;AAC3B,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAC7D,2BAA2B;AAC3B,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/D,6BAA6B;AAC7B,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AACnE,0BAA0B;AAC1B,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAC7D,4BAA4B;AAC5B,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAC/D,8BAA8B;AAC9B,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;CAAE,CAAC;AACrE,6BAA6B;AAC7B,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC;AACjE,2BAA2B;AAC3B,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAA;CAAE,CAAC;AAC7D,8BAA8B;AAC9B,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,CAAC;AAOnE,4DAA4D;AAC5D,MAAM,MAAM,UAAU,GAClB,cAAc,GAAG,cAAc,GAAG,cAAc,GAChD,MAAM,GAAG,OAAO,GAChB,gBAAgB,GAChB,gBAAgB,GAAG,YAAY,GAC/B,kBAAkB,GAAG,gBAAgB,GAAG,cAAc,GACtD,YAAY,GACZ,kBAAkB,GAAG,eAAe,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAOD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,OAAO,qBAAqB,EAAE,cAAc,EAAE,CAAC;CAC/E;AAED;;;;GAIG;AACH,MAAM,MAAM,MAAM,CAAC,CAAC,IAChB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAKxD,8CAA8C;AAC9C,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC"}

package/dist/kernel/interfaces/common.js

@@ -0,0 +1,10 @@
+/**
+ * Common types shared across all kernel modules.
+ * S ref: S6-S13 (core objects), C-03 (TypeScript strict), C-09 (namespaces)
+ *
+ * Phase: 1 (Kernel)
+ * Implements: §4 I-13 (branded types for RBAC), §4 I-03 (Result<T>),
+ *             §34 (Permission), FM-10 (tenant isolation via branded types)
+ */
+export {};
+//# sourceMappingURL=common.js.map

package/dist/kernel/interfaces/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/common.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/kernel/interfaces/crypto.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Cryptographic primitives interface types.
+ * S ref: I-11, FM-10, IP-1
+ *
+ * Phase: 1 (Kernel)
+ * Implements: AES-256-GCM encryption, PBKDF2 key derivation,
+ *             SHA-256 for audit chain, HMAC-SHA256 for webhook signing.
+ *
+ * I-11: Encryption at rest. AES-256-GCM default. ML-KEM-512 post-quantum opt-in.
+ * IP-1: Webhook signing with HMAC-SHA256.
+ * All crypto uses Node.js built-in crypto module (I-01 compliance).
+ */
+import type { Result, OperationContext } from './common.js';
+import type { DatabaseConnection } from './database.js';
+/**
+ * Crypto engine configuration.
+ * S ref: I-11 (AES-256-GCM default, PBKDF2 iterations)
+ */
+export interface CryptoConfig {
+    readonly masterKey: Buffer;
+    readonly defaultAlgorithm: 'aes-256-gcm';
+    readonly pbkdf2Iterations: number;
+    readonly postQuantum: boolean;
+}
+/**
+ * Encrypted data envelope with all metadata needed for decryption.
+ * S ref: I-11 (AES-256-GCM with IV and auth tag)
+ */
+export interface EncryptedPayload {
+    readonly ciphertext: Buffer;
+    readonly iv: Buffer;
+    readonly authTag: Buffer;
+    readonly keyVersion: number;
+    readonly algorithm: string;
+}
+/**
+ * Low-level cryptographic operations.
+ * S ref: I-11 (encryption at rest), §3.5 (SHA-256 for audit chain),
+ *        IP-6 (HMAC-SHA256 for webhook signing)
+ */
+export interface CryptoEngine {
+    /**
+     * Derive tenant-specific key via PBKDF2.
+     * Key material never written to DB.
+     * S ref: I-11 (key derivation, 600000 iterations default)
+     */
+    deriveKey(masterKey: Buffer, salt: Buffer, iterations: number): Result<Buffer>;
+    /**
+     * Encrypt plaintext with AES-256-GCM.
+     * S ref: I-11 (AES-256-GCM default encryption)
+     */
+    encrypt(plaintext: Buffer, key: Buffer): Result<EncryptedPayload>;
+    /**
+     * Decrypt ciphertext with AES-256-GCM.
+     * S ref: I-11 (decryption with authentication)
+     */
+    decrypt(payload: EncryptedPayload, key: Buffer): Result<Buffer>;
+    /**
+     * SHA-256 hash for audit chain.
+     * S ref: §3.5 (SHA-256 hash chaining)
+     */
+    sha256(data: string): string;
+    /**
+     * HMAC-SHA256 for webhook signing.
+     * S ref: IP-6 (webhook signing)
+     */
+    hmacSha256(data: string, secret: string): string;
+}
+/**
+ * Encrypted secret storage (vault).
+ * S ref: I-11 (encryption at rest), IP-1 (secure credential storage)
+ */
+export interface VaultOperations {
+    /**
+     * Store encrypted value in vault.
+     * S ref: I-11 (encryption at rest for secrets)
+     */
+    store(conn: DatabaseConnection, ctx: OperationContext, keyName: string, plaintext: Buffer): Result<void>;
+    /**
+     * Retrieve decrypted value from vault.
+     * S ref: I-11 (decryption for authorized access)
+     */
+    retrieve(conn: DatabaseConnection, ctx: OperationContext, keyName: string): Result<Buffer>;
+    /**
+     * Delete vault entry.
+     * S ref: I-02 (data deletion)
+     */
+    remove(conn: DatabaseConnection, ctx: OperationContext, keyName: string): Result<void>;
+    /**
+     * List vault key names (not values).
+     * S ref: I-11 (key inventory without exposing secrets)
+     */
+    list(conn: DatabaseConnection, ctx: OperationContext): Result<string[]>;
+}
+//# sourceMappingURL=crypto.d.ts.map

package/dist/kernel/interfaces/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../../src/kernel/interfaces/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAIxD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAID;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAID;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/E;;;OAGG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAElE;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAEhE;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAE7B;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAClD;AAID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAEzG;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAE3F;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAEvF;;;OAGG;IACH,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;CACzE"}

package/dist/kernel/interfaces/crypto.js

@@ -0,0 +1,14 @@
+/**
+ * Cryptographic primitives interface types.
+ * S ref: I-11, FM-10, IP-1
+ *
+ * Phase: 1 (Kernel)
+ * Implements: AES-256-GCM encryption, PBKDF2 key derivation,
+ *             SHA-256 for audit chain, HMAC-SHA256 for webhook signing.
+ *
+ * I-11: Encryption at rest. AES-256-GCM default. ML-KEM-512 post-quantum opt-in.
+ * IP-1: Webhook signing with HMAC-SHA256.
+ * All crypto uses Node.js built-in crypto module (I-01 compliance).
+ */
+export {};
+//# sourceMappingURL=crypto.js.map

package/dist/kernel/interfaces/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../../src/kernel/interfaces/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}