nexus-ai-pro 2.3.0 → 2.5.0

package/dist/adapter-kit/index.js

@@ -0,0 +1,178 @@
+import { runEmbeddingProviderConformance, } from '../testing/embedding-provider-conformance.js';
+import { runProviderConformance } from '../testing/provider-conformance.js';
+import { NEXUS_VERSION } from '../version.js';
+import { runRetrieverContract, runStoreContract, runVectorStoreContract, } from './contracts.js';
+import { AdapterError, classifyAdapterError } from './errors.js';
+import { satisfiesRange } from './semver.js';
+export { ADAPTER_FIXTURE_PASSAGES, runRetrieverContract, runStoreContract, runVectorStoreContract, } from './contracts.js';
+export { AdapterError, classifyAdapterError } from './errors.js';
+export { parseVersion, satisfiesRange } from './semver.js';
+const OPERATIONS = {
+    provider: ['complete', 'healthCheck'],
+    embeddings: ['embed'],
+    'vector-store': ['add', 'search', 'searchVector', 'delete'],
+    retriever: ['retrieve', 'add', 'delete'],
+    store: ['put', 'get', 'delete', 'search', 'listNamespaces'],
+};
+function build(kind, definition, contract) {
+    for (const field of ['name', 'version', 'nexus']) {
+        if (typeof definition[field] !== 'string' || !definition[field])
+            throw new TypeError(`An adapter needs a ${field}`);
+    }
+    satisfiesRange(NEXUS_VERSION, definition.nexus);
+    const create = async (config, options = {}) => instrument(kind, definition, await definition.create(config), options);
+    return {
+        kind,
+        name: definition.name,
+        version: definition.version,
+        nexus: definition.nexus,
+        capabilities: definition.capabilities,
+        ...(definition.normalizeError ? { normalizeError: definition.normalizeError } : {}),
+        ...(definition.budgets ? { budgets: definition.budgets } : {}),
+        create,
+        compatible: (nexusVersion = NEXUS_VERSION) => satisfiesRange(nexusVersion, definition.nexus),
+        async verify(config, options) {
+            const durations = new Map();
+            const instance = await create(config, {
+                onCall: (event) => {
+                    if (event.ok)
+                        durations.set(event.operation, [...(durations.get(event.operation) ?? []), event.durationMs]);
+                },
+            });
+            const compatible = satisfiesRange(NEXUS_VERSION, definition.nexus);
+            const checks = [
+                {
+                    name: `declares support for nexus-ai-pro ${NEXUS_VERSION}`,
+                    ok: compatible,
+                    ...(compatible ? {} : { detail: `the declared range is ${definition.nexus}` }),
+                },
+                ...(await contract(instance, options, definition.capabilities)),
+            ];
+            const benchmark = {};
+            for (const [operation, values] of durations) {
+                const sorted = [...values].sort((a, b) => a - b);
+                const at = (q) => round(sorted[Math.min(sorted.length - 1, Math.ceil(q * sorted.length) - 1)] ?? 0);
+                benchmark[operation] = { calls: sorted.length, p50Ms: at(0.5), p95Ms: at(0.95) };
+            }
+            for (const [operation, budget] of Object.entries(definition.budgets ?? {})) {
+                const measured = benchmark[operation]?.p95Ms;
+                checks.push(measured === undefined
+                    ? {
+                        name: `${operation} stays within ${budget} ms at p95`,
+                        ok: true,
+                        skipped: true,
+                        detail: 'not called by the contract',
+                    }
+                    : {
+                        name: `${operation} stays within ${budget} ms at p95`,
+                        ok: measured <= budget,
+                        ...(measured <= budget ? {} : { detail: `measured ${measured} ms` }),
+                    });
+            }
+            return {
+                adapter: definition.name,
+                version: definition.version,
+                kind,
+                nexusVersion: NEXUS_VERSION,
+                compatible,
+                passed: checks.every((check) => check.ok),
+                checks,
+                benchmark,
+            };
+        },
+    };
+}
+function instrument(kind, definition, instance, options) {
+    const operations = new Set(OPERATIONS[kind]);
+    return new Proxy(instance, {
+        get(target, property, receiver) {
+            const value = Reflect.get(target, property, receiver);
+            if (typeof property !== 'string' || !operations.has(property) || typeof value !== 'function') {
+                return typeof value === 'function' ? value.bind(target) : value;
+            }
+            return async (...args) => {
+                const started = performance.now();
+                try {
+                    const result = await value.apply(target, args);
+                    options.onCall?.({
+                        adapter: definition.name,
+                        kind,
+                        operation: property,
+                        durationMs: performance.now() - started,
+                        ok: true,
+                    });
+                    return result;
+                }
+                catch (error) {
+                    const failure = error instanceof AdapterError
+                        ? {
+                            code: error.code,
+                            retryable: error.retryable,
+                            ...(error.status === undefined ? {} : { status: error.status }),
+                        }
+                        : (definition.normalizeError?.(error, property) ?? classifyAdapterError(error));
+                    options.onCall?.({
+                        adapter: definition.name,
+                        kind,
+                        operation: property,
+                        durationMs: performance.now() - started,
+                        ok: false,
+                        error: failure,
+                    });
+                    throw error instanceof AdapterError ? error : new AdapterError(definition.name, property, failure, error);
+                }
+            };
+        },
+    });
+}
+export function defineProviderAdapter(definition) {
+    return build('provider', definition, async (provider, options, capabilities) => {
+        const results = await runProviderConformance(definition.name, provider, {
+            ...options,
+            testStream: capabilities.streaming,
+            testJson: capabilities.json,
+            testTools: capabilities.tools,
+            testHealth: capabilities.health,
+        });
+        return results.flatMap((result) => [
+            {
+                name: `completes the ${result.caseName} case`,
+                ok: result.completeOk,
+                ...(result.completeOk ? {} : { detail: result.error ?? 'the response was not accepted' }),
+            },
+            ...(result.streamOk === undefined ? [] : [{ name: `streams the ${result.caseName} case`, ok: result.streamOk }]),
+            ...(result.healthOk === undefined ? [] : [{ name: 'answers its health check', ok: result.healthOk }]),
+        ]);
+    });
+}
+export function defineEmbeddingsAdapter(definition) {
+    return build('embeddings', definition, async (provider, options, capabilities) => {
+        const results = await runEmbeddingProviderConformance(definition.name, provider, {
+            ...options,
+            testAbort: capabilities.abort,
+            testDeterminism: capabilities.deterministic,
+        });
+        return results.flatMap((result) => [
+            {
+                name: `embeds the ${result.caseName} case`,
+                ok: result.ok,
+                ...(result.ok ? {} : { detail: result.error ?? 'not accepted' }),
+            },
+            ...(result.abortOk === undefined
+                ? []
+                : [{ name: `stops the ${result.caseName} case when aborted`, ok: result.abortOk }]),
+        ]);
+    });
+}
+export function defineVectorStoreAdapter(definition) {
+    return build('vector-store', definition, (store, options, capabilities) => runVectorStoreContract(store, { ...options, capabilities }));
+}
+export function defineRetrieverAdapter(definition) {
+    return build('retriever', definition, (retriever, options, capabilities) => runRetrieverContract(retriever, { ...options, capabilities }));
+}
+export function defineStoreAdapter(definition) {
+    return build('store', definition, (store, _options, capabilities) => runStoreContract(store, { capabilities }));
+}
+function round(value) {
+    return Math.round(value * 100) / 100;
+}

package/dist/adapter-kit/semver.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Version ranges, as an adapter declares the releases of `nexus-ai-pro` it works with. A small,
+ * dependency-free subset of npm's ranges: comparators joined by spaces must all hold, alternatives
+ * joined by `||` need one to hold, and `>=`, `>`, `<=`, `<`, `=`, `^`, `~`, `x`, and `*` mean what
+ * they mean in npm.
+ */
+type Version = [number, number, number];
+/** A version as three numbers. A prerelease or build tag is ignored. `undefined` for anything else. */
+export declare function parseVersion(version: string): Version | undefined;
+/** Whether `version` satisfies `range`, such as `>=2.4.0 <3` or `^2.4.0 || ^3.0.0`. */
+export declare function satisfiesRange(version: string, range: string): boolean;
+export {};

package/dist/adapter-kit/semver.js

@@ -0,0 +1,55 @@
+export function parseVersion(version) {
+    const match = /^\s*v?(\d+)\.(\d+)\.(\d+)/.exec(version);
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : undefined;
+}
+export function satisfiesRange(version, range) {
+    const parsed = parseVersion(version);
+    if (!parsed)
+        return false;
+    return range.split('||').some((alternative) => {
+        const comparators = alternative.trim().split(/\s+/).filter(Boolean);
+        return comparators.length === 0 || comparators.every((comparator) => holds(parsed, comparator));
+    });
+}
+function holds(version, comparator) {
+    const match = /^(>=|<=|>|<|=|\^|~)?v?(\d+|x|X|\*)(?:\.(\d+|x|X|\*))?(?:\.(\d+|x|X|\*))?/.exec(comparator);
+    if (!match)
+        throw new RangeError(`"${comparator}" is not a version range`);
+    const operator = match[1] ?? '';
+    const parts = [match[2], match[3], match[4]];
+    const fixed = parts.findIndex((part) => part === undefined || /^[xX*]$/.test(part));
+    const known = fixed === -1 ? 3 : fixed;
+    const base = parts.map((part, index) => (index < known ? Number(part) : 0));
+    if (known === 0)
+        return operator === '' || operator === '=' || operator === '>=' || operator === '<=';
+    switch (operator) {
+        case '>=':
+            return compare(version, base) >= 0;
+        case '>':
+            return known === 3 ? compare(version, base) > 0 : compare(version, bump(base, known - 1)) >= 0;
+        case '<=':
+            return known === 3 ? compare(version, base) <= 0 : compare(version, bump(base, known - 1)) < 0;
+        case '<':
+            return compare(version, base) < 0;
+        case '^': {
+            const pinned = base[0] > 0 || known === 1 ? 0 : base[1] > 0 || known === 2 ? 1 : 2;
+            return compare(version, base) >= 0 && compare(version, bump(base, pinned)) < 0;
+        }
+        case '~':
+            return compare(version, base) >= 0 && compare(version, bump(base, known >= 2 ? 1 : 0)) < 0;
+        default:
+            return known === 3
+                ? compare(version, base) === 0
+                : compare(version, base) >= 0 && compare(version, bump(base, known - 1)) < 0;
+    }
+}
+function bump(version, part) {
+    return version.map((value, index) => (index < part ? value : index === part ? value + 1 : 0));
+}
+function compare(left, right) {
+    for (let index = 0; index < 3; index += 1) {
+        if (left[index] !== right[index])
+            return left[index] - right[index];
+    }
+    return 0;
+}

package/dist/agent/middleware/pii.js

@@ -1,3 +1,4 @@
+import { ibanChecksum, luhn, phoneNumber } from '../../utils/checksums.js';
 import { shortHash } from './shared.js';
 export class PiiBlockedError extends Error {
     kind;
@@ -21,10 +22,7 @@ const DETECTORS = {
     'ip-address': { pattern: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g },
     phone: {
         pattern: /(?<![\w+])\+?(?:\(\d{1,4}\)|\d{1,4})(?:[ .-]?(?:\(\d{1,4}\)|\d{2,4})){2,4}(?!\w)/g,
-        valid: (match) => {
-            const digits = match.replace(/\D/g, '').length;
-            return digits >= 10 && digits <= 15 && (/^\+/.test(match) || /[ .()-]/.test(match));
-        },
+        valid: phoneNumber,
     },
 };
 const ORDER = ['secret', 'email', 'credit-card', 'iban', 'ssn', 'ip-address', 'phone'];
@@ -142,32 +140,3 @@ function replace(match, kind, strategy) {
 function isToolOutput(value) {
     return value?.type === 'tool_output' && Array.isArray(value.content);
 }
-function luhn(match) {
-    const digits = match.replace(/\D/g, '');
-    if (digits.length < 13 || digits.length > 19)
-        return false;
-    let sum = 0;
-    for (let index = 0; index < digits.length; index += 1) {
-        let digit = Number(digits[digits.length - 1 - index]);
-        if (index % 2 === 1) {
-            digit *= 2;
-            if (digit > 9)
-                digit -= 9;
-        }
-        sum += digit;
-    }
-    return sum % 10 === 0;
-}
-function ibanChecksum(match) {
-    const iban = match.replace(/ /g, '');
-    if (iban.length < 15 || iban.length > 34)
-        return false;
-    const rearranged = `${iban.slice(4)}${iban.slice(0, 4)}`;
-    let remainder = 0;
-    for (const char of rearranged) {
-        const value = /\d/.test(char) ? char : String(char.charCodeAt(0) - 55);
-        for (const digit of value)
-            remainder = (remainder * 10 + Number(digit)) % 97;
-    }
-    return remainder === 1;
-}

package/dist/context-hub/hub.d.ts

@@ -2,6 +2,7 @@ import type { GateResult } from '../prompts/errors.js';
 import type { PromptRegistry } from '../prompts/registry.js';
 import type { PromptHistoryEntry, PromptLabel, PromptStore, PromptVersion, RenderedPrompt, RenderOptions } from '../types/prompts.js';
 import { type ContextDiff } from './diff.js';
+import { type ContextKeyring, type ContextSignature, type ContextSigner } from './signing.js';
 /** A prompt a bundle uses, pinned to one content version of the prompt registry. */
 export interface ContextPromptPin {
     /** The prompt's name in the registry. */
@@ -61,6 +62,8 @@ export interface ContextBundle extends ContextBundleDefinition {
     author?: string;
     /** The version that was newest before it. */
     parent?: string;
+    /** Signatures over its content and its pinned prompts' content. Not part of the version. */
+    signatures?: ContextSignature[];
 }
 /** Which bundle version is being used, as experiments and traces record it. */
 export interface ContextReference {
@@ -125,9 +128,33 @@ export interface ContextHubOptions {
     gates?: Record<string, readonly ContextPromotionGate[]>;
     /** Called after every recorded change. */
     onChange?: (entry: ContextHistoryEntry) => void | Promise<void>;
+    /**
+     * Signs every new version, over its content and its pinned prompts' content, so another hub can
+     * check where it came from. Signing a bundle that pins prompts needs `prompts`.
+     */
+    signer?: ContextSigner;
+    /**
+     * The keys whose signatures this hub trusts, for `verify()`, and for `requireSignature`. A signature
+     * by a key the keyring does not hold is kept, but never trusted.
+     */
+    keyring?: ContextKeyring;
+    /**
+     * Refuses any bundle without a valid signature by a key in `keyring`: on import, and whenever a
+     * version is served through `resolve()` or `renderPrompt()`.
+     */
+    requireSignature?: boolean;
     /** Replaces the system clock, for tests. */
     now?: () => Date;
 }
+/** What `ContextHub.verify()` found. */
+export interface ContextVerification {
+    /** Whether a key in the keyring signed exactly this content. */
+    trusted: boolean;
+    /** The digest the content has now. */
+    digest: string;
+    /** The signature that verified, when one did. */
+    signature?: ContextSignature;
+}
 /** Base class for context hub errors, each with a stable `code`. */
 export declare class ContextHubError extends Error {
     /** Stable code, such as `CONTEXT_NOT_FOUND`. */
@@ -160,6 +187,18 @@ export declare class ContextPromotionError extends ContextHubError {
     /** Every gate's verdict. */
     results: GateResult[]);
 }
+/** Raised when a bundle has no signature the hub trusts, or its signatures do not match its content. */
+export declare class ContextSignatureError extends ContextHubError {
+    /** The bundle. */
+    readonly bundle: string;
+    /** The version. */
+    readonly version: string;
+    constructor(
+    /** The bundle. */
+    bundle: string, 
+    /** The version. */
+    version: string, reason: string);
+}
 /** Raised when a bundle definition, a pin, or an import is invalid. */
 export declare class ContextDefinitionError extends ContextHubError {
     constructor(message: string);
@@ -182,6 +221,8 @@ export declare class ContextHub {
     /** Where versions, labels, and history live. */
     readonly store: PromptStore;
     private readonly now;
+    /** Versions already verified as trusted, which never change. */
+    private readonly trusted;
     constructor(options?: ContextHubOptions);
     /**
      * Commits a bundle and returns its version. Unchanged content returns the existing version and
@@ -193,8 +234,15 @@ export declare class ContextHub {
         author?: string;
         label?: string | readonly string[];
     }): Promise<ContextBundle>;
+    private commitSigned;
     /** A version by content version, label, or `latest`, the default. Throws `ContextNotFoundError` when there is none. */
     get(name: string, ref?: string): Promise<ContextBundle>;
+    /**
+     * Whether a key in the hub's keyring signed exactly this bundle's content, and its pinned prompts'
+     * content as the prompt registry holds them. A version's answer never changes, so it is checked
+     * once.
+     */
+    verify(bundle: ContextBundle): Promise<ContextVerification>;
     /** A version with the reference experiments and traces record for it. */
     resolve(name: string, ref?: string): Promise<{
         bundle: ContextBundle;
@@ -262,6 +310,11 @@ export declare class ContextHub {
         label?: string | readonly string[];
         by?: string;
     }): Promise<ContextBundle>;
+    /** Refuses a bundle without a trusted signature, when the hub requires one. */
+    private assertTrusted;
+    private check;
+    /** What a signature over this bundle covers, with its pinned prompts read from the registry. */
+    private signedContent;
     private read;
     private pointer;
     private record;

package/dist/context-hub/hub.js

@@ -1,6 +1,7 @@
 import { MemoryPromptStore } from '../prompts/memory.js';
 import { canonicalJson } from '../prompts/version.js';
 import { diffContexts } from './diff.js';
+import { contextDigest, signDigest, verifiedBy, } from './signing.js';
 export class ContextHubError extends Error {
     code;
     constructor(message, code) {
@@ -36,6 +37,16 @@ export class ContextPromotionError extends ContextHubError {
         this.name = 'ContextPromotionError';
     }
 }
+export class ContextSignatureError extends ContextHubError {
+    bundle;
+    version;
+    constructor(bundle, version, reason) {
+        super(`Context bundle "${bundle}" ${version}: ${reason}`, 'CONTEXT_SIGNATURE');
+        this.bundle = bundle;
+        this.version = version;
+        this.name = 'ContextSignatureError';
+    }
+}
 export class ContextDefinitionError extends ContextHubError {
     constructor(message) {
         super(message, 'CONTEXT_DEFINITION_ERROR');
@@ -63,12 +74,19 @@ export class ContextHub {
     options;
     store;
     now;
+    trusted = new Map();
     constructor(options = {}) {
         this.options = options;
+        if (options.requireSignature && !options.keyring) {
+            throw new TypeError('requireSignature needs a keyring of the keys the hub trusts');
+        }
         this.store = options.store ?? new MemoryPromptStore();
         this.now = options.now ?? (() => new Date());
     }
     async commit(definition, options = {}) {
+        return this.commitSigned(definition, options, []);
+    }
+    async commitSigned(definition, options, inherited) {
         validate(definition);
         if (this.options.prompts) {
             for (const [role, pin] of Object.entries(definition.prompts ?? {})) {
@@ -92,6 +110,13 @@ export class ContextHub {
                 ...(options.author === undefined ? {} : { author: options.author }),
                 ...(newest ? { parent: newest.version } : {}),
             };
+            const signatures = [...inherited];
+            if (this.options.signer) {
+                const digest = await contextDigest(await this.signedContent(definition));
+                signatures.push(await signDigest(this.options.signer, digest, this.now()));
+            }
+            if (signatures.length > 0)
+                stored.signatures = signatures;
             await this.store.saveVersion(toStored(stored));
             await this.record({ name: definition.name, action: 'commit', version: id, by: options.author });
         }
@@ -118,8 +143,19 @@ export class ContextHub {
             throw new ContextNotFoundError(name, ref);
         return found;
     }
+    async verify(bundle) {
+        const key = `${bundle.name}@${bundle.version}`;
+        let pending = this.trusted.get(key);
+        if (!pending) {
+            pending = this.check(bundle, await this.signedContent(bundle));
+            this.trusted.set(key, pending);
+            pending.catch(() => this.trusted.delete(key));
+        }
+        return pending;
+    }
     async resolve(name, ref = 'latest') {
         const bundle = await this.get(name, ref);
+        await this.assertTrusted(bundle);
         return {
             bundle,
             reference: {
@@ -133,6 +169,7 @@ export class ContextHub {
         const registry = this.options.prompts;
         if (!registry)
             throw new ContextDefinitionError('Rendering a pinned prompt needs the hub to have a prompt registry');
+        await this.assertTrusted(bundle);
         const pin = bundle.prompts?.[role];
         if (!pin)
             throw new ContextNotFoundError(bundle.name, `prompt role "${role}"`);
@@ -259,15 +296,52 @@ export class ContextHub {
                 throw new ContextDefinitionError(`Prompt ${prompt.name} was exported as ${version} but its content is ${committed.version}`);
             }
         }
-        const { version, createdAt: _createdAt, parent: _parent, message, author, ...definition } = exported.bundle;
+        const { version, createdAt: _createdAt, parent: _parent, message, author, signatures = [], ...definition } = exported.bundle;
         if ((await contextVersion(definition)) !== version) {
             throw new ContextDefinitionError(`Bundle ${definition.name} was exported as ${version} but its content has changed`);
         }
-        return this.commit(definition, {
+        const digest = await contextDigest(signedContentOf(definition, exportedPrompts(exported)));
+        const claims = signatures.filter((signature) => signature?.digest === digest);
+        if (this.options.requireSignature && this.options.keyring) {
+            const signed = await verifiedBy(this.options.keyring, digest, claims);
+            if (!signed) {
+                throw new ContextSignatureError(definition.name, version, signatures.length > 0
+                    ? 'no signature verifies against its content with a trusted key'
+                    : 'it is not signed, and this hub requires a signature');
+            }
+        }
+        return this.commitSigned(definition, {
             message: message ?? 'imported',
             ...((options.by ?? author) === undefined ? {} : { author: options.by ?? author }),
             ...(options.label === undefined ? {} : { label: options.label }),
-        });
+        }, claims);
+    }
+    async assertTrusted(bundle) {
+        if (!this.options.requireSignature)
+            return;
+        const verification = await this.verify(bundle);
+        if (!verification.trusted) {
+            throw new ContextSignatureError(bundle.name, bundle.version, bundle.signatures?.length
+                ? 'no signature verifies against its content with a trusted key'
+                : 'it is not signed, and this hub requires a signature');
+        }
+    }
+    async check(bundle, content) {
+        const digest = await contextDigest(content);
+        const signature = this.options.keyring
+            ? await verifiedBy(this.options.keyring, digest, bundle.signatures)
+            : undefined;
+        return { trusted: signature !== undefined, digest, ...(signature ? { signature } : {}) };
+    }
+    async signedContent(definition) {
+        const pins = Object.entries(definition.prompts ?? {});
+        if (pins.length > 0 && !this.options.prompts) {
+            throw new ContextDefinitionError(`Bundle "${definition.name}" pins prompts; signing or verifying it needs the hub to have a prompt registry`);
+        }
+        const prompts = [];
+        for (const [, pin] of pins)
+            prompts.push(await this.options.prompts.get(pin.name, pin.version));
+        return signedContentOf(definition, prompts);
     }
     async read(name, version) {
         const stored = await this.store.getVersion(name, version);
@@ -304,6 +378,37 @@ function validate(definition) {
         }
     }
 }
+function signedContentOf(definition, prompts) {
+    const byPin = new Map(prompts.map((prompt) => [`${prompt.name}@${prompt.version}`, prompt]));
+    const pinned = {};
+    for (const [role, pin] of Object.entries(definition.prompts ?? {})) {
+        const prompt = byPin.get(`${pin.name}@${pin.version}`);
+        if (!prompt)
+            throw new ContextDefinitionError(`Bundle "${definition.name}" pins ${role} to ${pin.name}@${pin.version}, which is not at hand`);
+        pinned[role] = {
+            name: prompt.name,
+            messages: prompt.messages,
+            partials: prompt.partials,
+            config: prompt.config,
+            defaults: prompt.defaults,
+        };
+    }
+    return {
+        bundle: {
+            name: definition.name,
+            description: definition.description,
+            prompts: definition.prompts,
+            instructions: definition.instructions,
+            tools: definition.tools,
+            skills: definition.skills,
+            config: definition.config,
+        },
+        prompts: pinned,
+    };
+}
+function exportedPrompts(exported) {
+    return exported.prompts;
+}
 function toStored(bundle) {
     return { ...bundle, messages: [], variables: [] };
 }

package/dist/context-hub/index.d.ts

@@ -4,8 +4,9 @@ import type { Dataset, DatasetExample, Evaluator, Experiment } from '../types/ev
 import type { ToolDefinition } from '../types/messages.js';
 import type { ContextBundle, ContextPromotionGate } from './hub.js';
 export { type ContextChange, type ContextDiff, diffContexts, formatContextDiff } from './diff.js';
-export { type ContextBundle, type ContextBundleDefinition, type ContextBundleExport, ContextConflictError, ContextDefinitionError, type ContextHistoryEntry, ContextHub, ContextHubError, type ContextHubOptions, type ContextLabel, ContextNotFoundError, type ContextPromotionContext, ContextPromotionError, type ContextPromotionGate, type ContextPromotionResult, type ContextPromptPin, type ContextReference, type ContextSkill, type ContextTool, contextVersion, } from './hub.js';
+export { type ContextBundle, type ContextBundleDefinition, type ContextBundleExport, ContextConflictError, ContextDefinitionError, type ContextHistoryEntry, ContextHub, ContextHubError, type ContextHubOptions, type ContextLabel, ContextNotFoundError, type ContextPromotionContext, ContextPromotionError, type ContextPromotionGate, ContextSignatureError, type ContextVerification, type ContextPromotionResult, type ContextPromptPin, type ContextReference, type ContextSkill, type ContextTool, contextVersion, } from './hub.js';
 export type { ExperimentGateOptions } from '../prompts/gates.js';
+export { type ContextCryptoKey, type ContextJsonWebKey, type ContextKeyring, type ContextSignature, type ContextSignedContent, type ContextSigner, type ContextSigningKey, contextDigest, ed25519Keyring, ed25519Signer, generateContextKey, } from './signing.js';
 /**
  * A bundle's instructions joined into one system text, in the order the bundle lists them, or only
  * the ones named in `include`, in that order.

package/dist/context-hub/index.js

@@ -1,7 +1,8 @@
 import { fingerprintOf } from '../evaluate/cache.js';
 import { experimentVerdict } from '../prompts/gates.js';
 export { diffContexts, formatContextDiff } from './diff.js';
-export { ContextConflictError, ContextDefinitionError, ContextHub, ContextHubError, ContextNotFoundError, ContextPromotionError, contextVersion, } from './hub.js';
+export { ContextConflictError, ContextDefinitionError, ContextHub, ContextHubError, ContextNotFoundError, ContextPromotionError, ContextSignatureError, contextVersion, } from './hub.js';
+export { contextDigest, ed25519Keyring, ed25519Signer, generateContextKey, } from './signing.js';
 export function contextInstructions(bundle, options = {}) {
     const names = options.include ?? Object.keys(bundle.instructions ?? {});
     return names