moflo 4.8.31 → 4.8.33

package/src/@claude-flow/guidance/dist/proof.d.ts

@@ -1,185 +0,0 @@
-/**
- * Proof Envelope - Cryptographic Evidence Trail
- *
- * Makes every run auditable and tamper-evident by producing a hash-chained,
- * HMAC-signed envelope for each RunEvent. Each envelope captures:
- *
- * - SHA-256 content hash of the run event
- * - Hash chain linking to the previous envelope (genesis = '0' x 64)
- * - Individual tool call hashes
- * - Memory lineage (reads/writes with value hashes)
- * - HMAC-SHA256 signature over the entire envelope body
- *
- * @module @claude-flow/guidance/proof
- */
-import type { RunEvent } from './types.js';
-/**
- * Record of a single tool invocation with its parameters and result.
- */
-export interface ToolCallRecord {
-    /** Unique call identifier */
-    callId: string;
-    /** Name of the tool invoked */
-    toolName: string;
-    /** Parameters passed to the tool */
-    params: Record<string, unknown>;
-    /** Result returned by the tool */
-    result: unknown;
-    /** Timestamp of the call (epoch ms) */
-    timestamp: number;
-    /** Duration of the call in milliseconds */
-    durationMs: number;
-}
-/**
- * Record of a memory read, write, or delete operation.
- */
-export interface MemoryOperation {
-    /** Memory key */
-    key: string;
-    /** Memory namespace */
-    namespace: string;
-    /** Type of operation */
-    operation: 'read' | 'write' | 'delete';
-    /** SHA-256 hash of the value */
-    valueHash: string;
-    /** Timestamp of the operation (epoch ms) */
-    timestamp: number;
-}
-/**
- * Entry in the memory lineage array stored inside a ProofEnvelope.
- */
-export interface MemoryLineageEntry {
-    key: string;
-    namespace: string;
-    operation: 'read' | 'write' | 'delete';
-    hash: string;
-}
-/**
- * Metadata attached to every proof envelope.
- */
-export interface ProofEnvelopeMetadata {
-    agentId: string;
-    sessionId: string;
-    parentEnvelopeId?: string;
-}
-/**
- * A cryptographically signed, hash-chained proof envelope.
- */
-export interface ProofEnvelope {
-    /** Unique envelope identifier */
-    envelopeId: string;
-    /** Reference to the RunEvent this envelope covers */
-    runEventId: string;
-    /** ISO 8601 timestamp of envelope creation */
-    timestamp: string;
-    /** SHA-256 hash of the full RunEvent */
-    contentHash: string;
-    /** Hash of the previous envelope in the chain (genesis = '0'.repeat(64)) */
-    previousHash: string;
-    /** Map of tool call ID to SHA-256(toolName + params + result) */
-    toolCallHashes: Record<string, string>;
-    /** SHA-256 hash of the policy bundle used */
-    guidanceHash: string;
-    /** Lineage of memory operations during the run */
-    memoryLineage: MemoryLineageEntry[];
-    /** HMAC-SHA256 signature of the envelope content */
-    signature: string;
-    /** Contextual metadata */
-    metadata: ProofEnvelopeMetadata;
-}
-/**
- * Serializable chain representation for export/import.
- */
-export interface SerializedProofChain {
-    envelopes: ProofEnvelope[];
-    createdAt: string;
-    version: number;
-}
-/**
- * A tamper-evident, hash-chained sequence of ProofEnvelopes.
- *
- * Each envelope links to the previous one via `previousHash`, forming
- * a blockchain-like structure. Every envelope is HMAC-signed so any
- * modification to the chain can be detected.
- */
-export declare class ProofChain {
-    private envelopes;
-    private readonly signingKey;
-    constructor(signingKey: string);
-    /**
-     * Append a new ProofEnvelope to the chain.
-     *
-     * @param runEvent - The RunEvent to wrap
-     * @param toolCalls - Tool call records from the run
-     * @param memoryOps - Memory operations from the run
-     * @param metadata - Optional metadata overrides
-     * @returns The newly created and signed ProofEnvelope
-     */
-    append(runEvent: RunEvent, toolCalls?: ToolCallRecord[], memoryOps?: MemoryOperation[], metadata?: Partial<ProofEnvelopeMetadata>): ProofEnvelope;
-    /**
-     * Verify a single envelope's HMAC signature and hash chain link.
-     *
-     * @returns true if the signature is valid and the previousHash is correct
-     */
-    verify(envelope: ProofEnvelope): boolean;
-    /**
-     * Verify the entire chain from genesis to tip.
-     *
-     * Checks that every envelope:
-     * 1. Has a valid HMAC signature
-     * 2. Links correctly to the previous envelope's contentHash
-     *
-     * @returns true if the full chain is intact
-     */
-    verifyChain(): boolean;
-    /**
-     * Retrieve an envelope by its ID.
-     */
-    getEnvelope(id: string): ProofEnvelope | undefined;
-    /**
-     * Get the most recent envelope in the chain.
-     */
-    getChainTip(): ProofEnvelope | undefined;
-    /**
-     * Get the number of envelopes in the chain.
-     */
-    getChainLength(): number;
-    /**
-     * Export the chain as a serializable object.
-     */
-    export(): SerializedProofChain;
-    /**
-     * Restore the chain from a previously exported object.
-     *
-     * Replaces the current chain contents entirely.
-     */
-    import(data: SerializedProofChain): void;
-    /**
-     * Compute the SHA-256 content hash of a RunEvent.
-     */
-    private computeContentHash;
-    /**
-     * Compute the SHA-256 hash of a single tool call.
-     *
-     * Hash = SHA-256(toolName + JSON(params) + JSON(result))
-     */
-    private computeToolCallHash;
-    /**
-     * Produce the HMAC-SHA256 signature for an envelope.
-     *
-     * The signature covers every field except `signature` itself.
-     */
-    private signEnvelope;
-}
-/**
- * Create a new ProofChain instance.
- *
- * @param config - Configuration with a required `signingKey` for HMAC signing.
- *   Callers that previously relied on the optional signature must now provide
- *   an explicit key (see ADR-G026).
- * @returns A fresh ProofChain
- */
-export declare function createProofChain(config: {
-    signingKey: string;
-}): ProofChain;
-//# sourceMappingURL=proof.d.ts.map

package/src/@claude-flow/guidance/dist/retriever.d.ts

@@ -1,116 +0,0 @@
-/**
- * Task Intent Classifier + Shard Retriever
- *
- * Stores rule shards in vector storage with embeddings and metadata.
- * At task start, retrieves the top N shards by semantic similarity
- * with hard filters by risk class and repo scope.
- *
- * Retrieval contract:
- * 1. Always include the constitution
- * 2. Retrieve up to 5 shards by semantic similarity
- * 3. Add hard filters by risk class and repo scope
- * 4. Contradiction check: prefer higher-priority rule ID
- *
- * @module @claude-flow/guidance/retriever
- */
-import type { PolicyBundle, Constitution, TaskIntent, RetrievalRequest, RetrievalResult } from './types.js';
-export interface IEmbeddingProvider {
-    embed(text: string): Promise<Float32Array>;
-    batchEmbed(texts: string[]): Promise<Float32Array[]>;
-}
-/**
- * Deterministic hash-based embedding provider — **test-only**.
- *
- * Produces fixed-dimension vectors from a simple character-hash → sin()
- * transform.  The resulting embeddings have no real semantic meaning;
- * they are stable and fast, which makes them useful for unit/integration
- * tests that need a concrete {@link IEmbeddingProvider} without loading
- * an ONNX model.
- *
- * **Do NOT use in production** — replace with a real model-backed
- * provider (e.g. the agentic-flow ONNX integration).
- */
-export declare class HashEmbeddingProvider implements IEmbeddingProvider {
-    private dimensions;
-    private cache;
-    constructor(dimensions?: number);
-    embed(text: string): Promise<Float32Array>;
-    batchEmbed(texts: string[]): Promise<Float32Array[]>;
-    private hashEmbed;
-}
-export declare class ShardRetriever {
-    private shards;
-    private constitution;
-    private embeddingProvider;
-    private indexed;
-    private globCache;
-    constructor(embeddingProvider?: IEmbeddingProvider);
-    /**
-     * Load a compiled policy bundle
-     */
-    loadBundle(bundle: PolicyBundle): Promise<void>;
-    /**
-     * Index all shards by generating embeddings
-     */
-    indexShards(): Promise<void>;
-    /**
-     * Classify task intent
-     */
-    classifyIntent(taskDescription: string): {
-        intent: TaskIntent;
-        confidence: number;
-    };
-    /**
-     * Retrieve relevant shards for a task
-     *
-     * Contract:
-     * 1. Always include the constitution
-     * 2. Up to maxShards by semantic similarity
-     * 3. Hard filters by risk class and repo scope
-     * 4. Contradiction check: prefer higher priority
-     */
-    retrieve(request: RetrievalRequest): Promise<RetrievalResult>;
-    /**
-     * Score all shards against the query
-     */
-    private scoreShards;
-    /**
-     * Select top N shards with contradiction checking
-     * When two rules contradict, keep the one with higher priority
-     */
-    private selectWithContradictionCheck;
-    /**
-     * Check if two rules are contradictory
-     */
-    private areContradictory;
-    /**
-     * Count contradictions in selected set
-     */
-    private countContradictions;
-    /**
-     * Build combined policy text for injection
-     */
-    private buildPolicyText;
-    /**
-     * Simple glob matching (supports * and **).
-     * Compiled regexes are cached per glob to avoid re-compiling on every call.
-     */
-    private matchGlob;
-    /**
-     * Cosine similarity between two vectors
-     */
-    private cosineSimilarity;
-    /**
-     * Get current shard count
-     */
-    get shardCount(): number;
-    /**
-     * Get constitution
-     */
-    getConstitution(): Constitution | null;
-}
-/**
- * Create a retriever instance
- */
-export declare function createRetriever(embeddingProvider?: IEmbeddingProvider): ShardRetriever;
-//# sourceMappingURL=retriever.d.ts.map

package/src/@claude-flow/guidance/dist/ruvbot-integration.d.ts

@@ -1,370 +0,0 @@
-/**
- * RuvBot Integration Bridge
- *
- * Bridges ruvbot (npm: ruvbot@0.1.8) with the @claude-flow/guidance control
- * plane. Wires ruvbot events to guidance hooks, wraps AIDefence as an
- * enforcement gate, governs memory operations, and feeds trust accumulation.
- *
- * ruvbot is an optional peer dependency. All types and classes are exported
- * regardless of whether ruvbot is installed. Runtime calls that require the
- * ruvbot package will throw a clear error if the package is missing.
- *
- * Components:
- * 1. RuvBotGuidanceBridge  - Event wiring, gate delegation, trust tracking
- * 2. AIDefenceGate         - Prompt injection, jailbreak, PII detection gate
- * 3. RuvBotMemoryAdapter   - Governed memory read/write with proof logging
- *
- * @module @claude-flow/guidance/ruvbot-integration
- */
-import type { GateResult } from './types.js';
-import type { MemoryAuthority, MemoryEntry, WriteDecision } from './memory-gate.js';
-/**
- * Minimal interface for a ruvbot instance. Mirrors the event-emitter surface
- * exposed by `createRuvBot()` without importing the package at compile time.
- */
-export interface RuvBotInstance {
-    on(event: string, handler: (...args: unknown[]) => void): void;
-    off(event: string, handler: (...args: unknown[]) => void): void;
-    emit?(event: string, ...args: unknown[]): void;
-}
-/**
- * Minimal interface for ruvbot's AIDefence guard returned by
- * `createAIDefenceGuard()`.
- */
-export interface RuvBotAIDefenceGuard {
-    check(input: string): Promise<{
-        safe: boolean;
-        threats: Array<{
-            type: string;
-            severity: string;
-            detail: string;
-        }>;
-        sanitizedInput?: string;
-    }>;
-}
-/**
- * Minimal interface for ruvbot's memory subsystem.
- */
-export interface RuvBotMemory {
-    read(key: string, namespace?: string): Promise<unknown>;
-    write(key: string, value: unknown, namespace?: string): Promise<void>;
-    delete?(key: string, namespace?: string): Promise<void>;
-    search?(query: string, options?: Record<string, unknown>): Promise<unknown[]>;
-}
-/**
- * Threat detected by the AIDefence layer.
- */
-export interface AIDefenceThreat {
-    type: 'prompt-injection' | 'jailbreak' | 'pii' | 'control-chars' | 'homoglyph';
-    severity: 'low' | 'medium' | 'high' | 'critical';
-    detail: string;
-}
-/**
- * Result of an AIDefence evaluation.
- */
-export interface AIDefenceResult {
-    safe: boolean;
-    threats: AIDefenceThreat[];
-    sanitizedInput?: string;
-    latencyMs: number;
-}
-/**
- * Configuration for the AIDefenceGate.
- */
-export interface AIDefenceGateConfig {
-    detectPromptInjection: boolean;
-    detectJailbreak: boolean;
-    detectPII: boolean;
-    blockThreshold: 'low' | 'medium' | 'high';
-}
-/**
- * Configuration for the RuvBotGuidanceBridge.
- */
-export interface RuvBotBridgeConfig {
-    enableAIDefence: boolean;
-    enableMemoryGovernance: boolean;
-    enableTrustTracking: boolean;
-    enableProofChain: boolean;
-    /** HMAC signing key for proof chains. Required when enableProofChain is true. */
-    proofSigningKey?: string;
-}
-/**
- * A normalized ruvbot event for internal processing.
- */
-export interface RuvBotEvent {
-    type: string;
-    timestamp: number;
-    sessionId?: string;
-    agentId?: string;
-    data: Record<string, unknown>;
-}
-/**
- * Wraps ruvbot's 6-layer AIDefence as an enforcement gate compatible with the
- * guidance control plane's GateResult / GateDecision interface.
- *
- * Supports:
- * - Prompt injection detection
- * - Jailbreak detection
- * - PII detection
- * - Control character and homoglyph detection (via ruvbot internals)
- * - Configurable sensitivity / block threshold
- *
- * Evaluates both input (pre-processing) and output (post-processing) text.
- */
-export declare class AIDefenceGate {
-    private config;
-    private guard;
-    private guardInitPromise;
-    constructor(config?: Partial<AIDefenceGateConfig>);
-    /**
-     * Lazily initialize the underlying ruvbot AIDefence guard.
-     * Safe to call multiple times; only the first call creates the guard.
-     */
-    private ensureGuard;
-    /**
-     * Evaluate input text for threats (pre-processing gate).
-     *
-     * Checks for prompt injection, jailbreak attempts, and PII based
-     * on the configured sensitivity.
-     */
-    evaluateInput(input: string): Promise<AIDefenceResult>;
-    /**
-     * Evaluate output text for threats (post-processing gate).
-     *
-     * Primarily checks for PII leakage and secret exposure in responses.
-     */
-    evaluateOutput(output: string): Promise<AIDefenceResult>;
-    /**
-     * Convert an AIDefenceResult into a GateResult compatible with the
-     * guidance enforcement pipeline.
-     *
-     * Decision logic:
-     * - If no threats: 'allow'
-     * - If threats above block threshold: 'block'
-     * - Otherwise: 'warn'
-     */
-    toGateResult(result: AIDefenceResult, context?: string): GateResult;
-    /**
-     * Get the current configuration.
-     */
-    getConfig(): AIDefenceGateConfig;
-    /**
-     * Update configuration. Resets the guard so the next evaluation
-     * re-initializes with the new settings.
-     */
-    updateConfig(config: Partial<AIDefenceGateConfig>): void;
-    private normalizeThreats;
-    private buildRemediation;
-}
-/**
- * Wraps ruvbot's memory read/write operations with guidance control plane
- * governance. Every write passes through the MemoryWriteGate for authority
- * and coherence checks. All operations are logged to a proof chain.
- */
-export declare class RuvBotMemoryAdapter {
-    private readonly memoryGate;
-    private readonly coherenceScheduler;
-    private proofChain;
-    private ruvbotMemory;
-    private operationLog;
-    constructor(memoryGate: import('./memory-gate.js').MemoryWriteGate, coherenceScheduler: import('./coherence.js').CoherenceScheduler);
-    /**
-     * Attach a ruvbot memory instance for proxied operations.
-     */
-    attachMemory(memory: RuvBotMemory): void;
-    /**
-     * Attach a proof chain for operation logging.
-     */
-    attachProofChain(proofChain: import('./proof.js').ProofChain): void;
-    /**
-     * Governed read: reads through ruvbot memory, logs to proof chain.
-     */
-    read(key: string, namespace?: string): Promise<unknown>;
-    /**
-     * Governed write: runs through MemoryWriteGate, checks coherence,
-     * logs to proof chain, then delegates to ruvbot memory.
-     *
-     * Returns the WriteDecision. If denied, the write is not performed.
-     */
-    write(key: string, namespace: string, value: unknown, authority: MemoryAuthority, existingEntries?: MemoryEntry[]): Promise<WriteDecision>;
-    /**
-     * Governed delete: checks authority, logs, then delegates.
-     */
-    delete(key: string, namespace: string, authority: MemoryAuthority): Promise<{
-        allowed: boolean;
-        reason: string;
-    }>;
-    /**
-     * Get the operation log for audit/proof purposes.
-     */
-    getOperationLog(): ReadonlyArray<{
-        operation: 'read' | 'write' | 'delete';
-        key: string;
-        namespace: string;
-        timestamp: number;
-        decision?: WriteDecision;
-    }>;
-    /**
-     * Get the count of governed operations.
-     */
-    get operationCount(): number;
-    /**
-     * Clear the operation log.
-     */
-    clearLog(): void;
-    private ensureMemoryAttached;
-}
-/**
- * Bridges a ruvbot instance with the @claude-flow/guidance control plane.
- *
- * Wires ruvbot event hooks to guidance enforcement and trust systems:
- *
- * - `message`        -> EnforcementGates (secrets, destructive ops) + AIDefence
- * - `agent:spawn`    -> ManifestValidator
- * - `session:create` -> ProofChain initialization
- * - `session:end`    -> ProofChain finalization and ledger persistence
- * - `ready`          -> Trust accumulator initialization
- * - `error`          -> Trust 'deny' outcome recording
- *
- * All gate outcomes are fed into the TrustAccumulator so that ruvbot agents
- * build (or lose) trust over time.
- */
-export declare class RuvBotGuidanceBridge {
-    private readonly config;
-    private ruvbot;
-    private gates;
-    private manifestValidator;
-    private trustSystem;
-    private aiDefenceGate;
-    private memoryAdapter;
-    private sessionChains;
-    private boundHandlers;
-    private eventLog;
-    private static readonly MAX_EVENT_LOG;
-    constructor(config?: Partial<RuvBotBridgeConfig>);
-    /**
-     * Attach guidance control plane components.
-     *
-     * Accepts either a full GuidanceControlPlane instance (from which
-     * sub-components are extracted) or individual components.
-     */
-    attachGuidance(components: {
-        gates?: import('./gates.js').EnforcementGates;
-        manifestValidator?: import('./manifest-validator.js').ManifestValidator;
-        trustSystem?: import('./trust.js').TrustSystem;
-        aiDefenceGate?: AIDefenceGate;
-        memoryAdapter?: RuvBotMemoryAdapter;
-    }): void;
-    /**
-     * Connect to a ruvbot instance and wire all event handlers.
-     *
-     * This is the primary entry point. Once called, the bridge will
-     * intercept ruvbot events and route them through guidance gates.
-     */
-    connect(ruvbot: RuvBotInstance): void;
-    /**
-     * Disconnect from the ruvbot instance, removing all event handlers.
-     */
-    disconnect(): void;
-    /**
-     * Evaluate a ruvbot AIDefence result and return a GateResult-compatible
-     * decision. Can be called independently of event wiring.
-     */
-    evaluateAIDefence(input: string): Promise<GateResult>;
-    /**
-     * Get the proof chain for a specific session.
-     */
-    getSessionProofChain(sessionId: string): import('./proof.js').ProofChain | undefined;
-    /**
-     * Get all active session IDs.
-     */
-    getActiveSessionIds(): string[];
-    /**
-     * Get the event log for diagnostics.
-     */
-    getEventLog(): ReadonlyArray<RuvBotEvent>;
-    /**
-     * Get the current bridge configuration.
-     */
-    getConfig(): RuvBotBridgeConfig;
-    /**
-     * Whether the bridge is currently connected to a ruvbot instance.
-     */
-    get connected(): boolean;
-    /**
-     * Handle `message` events: run content through enforcement gates
-     * and optionally through AIDefence.
-     */
-    private handleMessage;
-    /**
-     * Handle `agent:spawn` events: validate agent manifest.
-     */
-    private handleAgentSpawn;
-    /**
-     * Handle `session:create` events: initialize a proof chain for the session.
-     */
-    private handleSessionCreate;
-    /**
-     * Handle `session:end` events: finalize the proof chain and persist.
-     */
-    private handleSessionEnd;
-    /**
-     * Handle `ready` events: log bridge activation.
-     */
-    private handleReady;
-    /**
-     * Handle `shutdown` events: clean up all session proof chains.
-     */
-    private handleShutdown;
-    /**
-     * Handle `error` events: record a deny outcome in trust tracking.
-     */
-    private handleError;
-    /**
-     * Handle `agent:stop` events: record final trust snapshot.
-     */
-    private handleAgentStop;
-    private wireEvent;
-    private logEvent;
-}
-/**
- * Create a fully wired RuvBotGuidanceBridge.
- *
- * Connects the bridge to a ruvbot instance and attaches the guidance
- * control plane components. The bridge immediately begins intercepting
- * ruvbot events.
- *
- * @param ruvbotInstance - A ruvbot instance (from createRuvBot())
- * @param guidancePlane - A GuidanceControlPlane or individual components
- * @param config - Optional bridge configuration
- * @returns The connected RuvBotGuidanceBridge
- */
-export declare function createRuvBotBridge(ruvbotInstance: RuvBotInstance, guidancePlane: {
-    gates?: import('./gates.js').EnforcementGates;
-    manifestValidator?: import('./manifest-validator.js').ManifestValidator;
-    trustSystem?: import('./trust.js').TrustSystem;
-    aiDefenceGate?: AIDefenceGate;
-    memoryAdapter?: RuvBotMemoryAdapter;
-}, config?: Partial<RuvBotBridgeConfig>): RuvBotGuidanceBridge;
-/**
- * Create an AIDefenceGate with optional configuration.
- *
- * The gate lazily initializes the underlying ruvbot AIDefence guard
- * on the first evaluation call.
- *
- * @param config - Optional gate configuration
- * @returns A new AIDefenceGate instance
- */
-export declare function createAIDefenceGate(config?: Partial<AIDefenceGateConfig>): AIDefenceGate;
-/**
- * Create a RuvBotMemoryAdapter with governance components.
- *
- * The adapter wraps ruvbot memory operations with MemoryWriteGate authority
- * checks and CoherenceScheduler tracking.
- *
- * @param memoryGate - The MemoryWriteGate for authority/rate/contradiction checks
- * @param coherenceScheduler - The CoherenceScheduler for drift tracking
- * @returns A new RuvBotMemoryAdapter instance
- */
-export declare function createRuvBotMemoryAdapter(memoryGate: import('./memory-gate.js').MemoryWriteGate, coherenceScheduler: import('./coherence.js').CoherenceScheduler): RuvBotMemoryAdapter;
-//# sourceMappingURL=ruvbot-integration.d.ts.map