vaspera 2.14.0 → 2.16.0

package/dist/evidence/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,aAAa,GACb,mBAAmB,GACnB,aAAa,GACb,MAAM,GACN,kBAAkB,GAClB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB;IACpB,IAAI,EAAE,oBAAoB,CAAC;IAE3B,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IAEb,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IAEpB,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IAEtB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAElB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IAEpB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IAEjB,wBAAwB;IACxB,OAAO,EAAE,MAAM,CAAC;IAEhB,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAElB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,6BAA6B;IAC7B,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IAEF,6CAA6C;IAC7C,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAEX,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IAEpB,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IAEvB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,sCAAsC;IACtC,EAAE,CAAC,EAAE,aAAa,CAAC;IAEnB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAEX,kCAAkC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAElB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IAEpB,mDAAmD;IACnD,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAElC,mCAAmC;IACnC,WAAW,EAAE,kBAAkB,CAAC;IAEhC,0BAA0B;IAC1B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAE9B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IAErB,uCAAuC;IACvC,SAAS,CAAC,EAAE;QACV,+BAA+B;QAC/B,KAAK,EAAE,MAAM,CAAC;QAEd,uCAAuC;QACvC,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB,mCAAmC;QACnC,aAAa,CAAC,EAAE,MAAM,CAAC;QAEvB,mBAAmB;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IAEpB,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAEnC,mBAAmB;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,2BAA2B;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,wDAAwD;IACxD,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,oCAAoC;IACpC,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IAEjB,oCAAoC;IACpC,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;IAEnB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,QAAQ,EAAE,OAAO,CAAC;IAElB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IAEjB,yCAAyC;IACzC,eAAe,EAAE,OAAO,CAAC;IAEzB,8CAA8C;IAC9C,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,iDAAiD;IACjD,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/evidence/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,aAAa,GACb,mBAAmB,GACnB,aAAa,GACb,MAAM,GACN,kBAAkB,GAClB,qBAAqB,GACrB,sBAAsB,CAAC;AAE3B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oBAAoB;IACpB,IAAI,EAAE,oBAAoB,CAAC;IAE3B,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IAEb,iDAAiD;IACjD,WAAW,EAAE,MAAM,CAAC;IAEpB,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IAEtB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAElB,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IAEpB,kCAAkC;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IAEjB,wBAAwB;IACxB,OAAO,EAAE,MAAM,CAAC;IAEhB,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAElB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,6BAA6B;IAC7B,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IAEF,6CAA6C;IAC7C,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAEX,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IAEpB,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC;IAEvB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,sCAAsC;IACtC,EAAE,CAAC,EAAE,aAAa,CAAC;IAEnB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,EAAE,EAAE,MAAM,CAAC;IAEX,kCAAkC;IAClC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAElB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IAEpB,mDAAmD;IACnD,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAElC,mCAAmC;IACnC,WAAW,EAAE,kBAAkB,CAAC;IAEhC,0BAA0B;IAC1B,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAE9B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,wDAAwD;QACxD,MAAM,EAAE,OAAO,CAAC;QAEhB,wDAAwD;QACxD,MAAM,EAAE,MAAM,CAAC;QAEf,gCAAgC;QAChC,QAAQ,EAAE,MAAM,CAAC;QAEjB,8DAA8D;QAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;QAEvB,sEAAsE;QACtE,MAAM,CAAC,EAAE,OAAO,CAAC;KAClB,CAAC;IAEF,sBAAsB;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IAEpB,yCAAyC;IACzC,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,mDAAmD;IACnD,UAAU,CAAC,EAAE,mBAAmB,EAAE,CAAC;IAEnC,mBAAmB;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,+BAA+B;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,2BAA2B;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B,wDAAwD;IACxD,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,oCAAoC;IACpC,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IAEjB,oCAAoC;IACpC,MAAM,CAAC,EAAE,cAAc,CAAC;IAExB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,EAAE,CAAC;IAEnB,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,qCAAqC;IACrC,QAAQ,EAAE,OAAO,CAAC;IAElB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,CAAC;IAEjB,yCAAyC;IACzC,eAAe,EAAE,OAAO,CAAC;IAEzB,8CAA8C;IAC9C,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,iDAAiD;IACjD,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/history/decisions.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Decision provenance.
+ *
+ * Records AI decisions to the existing tamper-evident hash chain
+ * (`history/store`), so every decision is traceable and the chain
+ * proves it wasn't altered after the fact. Raw inputs/prompts/outputs
+ * are stored as sha256 digests (+ optional short summaries), so the
+ * record captures *what was decided* without retaining secrets verbatim.
+ *
+ * This is the substrate for the certificate's explainability dimension:
+ * the regulations (EU AI Act, SR 11-7, NIST AI RMF) ask for traceability
+ * and reproducible provenance, not neuron-level interpretability.
+ *
+ * @module history/decisions
+ */
+import type { DecisionRecordEntry, ActorIdentity } from "./types.js";
+/** Raw decision inputs — large/sensitive fields are digested, not stored. */
+export interface DecisionInput {
+    /** Kind of decision (tool_call, classification, generation, refusal, …) */
+    decisionType: string;
+    /** Model that produced the decision */
+    model: string;
+    modelVersion?: string;
+    /** The input/context that led to the decision (digested) */
+    input: string;
+    /** The prompt, if applicable (digested) */
+    prompt?: string;
+    /** The output/decision (digested) */
+    output: string;
+    /** Tools/functions invoked */
+    toolsInvoked?: string[];
+    /** Short human-readable summary */
+    summary?: string;
+    /** Rationale / explanation */
+    rationale?: string;
+    /** Model confidence 0-100 */
+    confidence?: number;
+    /** Associated certification, if any */
+    certificationId?: string;
+}
+export interface RecordDecisionOptions {
+    actor?: ActorIdentity;
+    /** Sigstore-sign the entry (requires OIDC; default false). */
+    sign?: boolean;
+}
+/**
+ * Record an AI decision to the tamper-evident chain. Returns the appended
+ * entry, including its integrity proof (hash + previousHash).
+ */
+export declare function recordDecision(projectPath: string, decision: DecisionInput, options?: RecordDecisionOptions): Promise<DecisionRecordEntry>;
+export interface DecisionProvenance {
+    /** Head hash of the audit chain (anchors the certificate). */
+    auditTrailHead: string;
+    /** Number of decision records captured. */
+    decisionRecords: number;
+}
+/**
+ * Read the provenance anchor for a project: the head hash of the
+ * tamper-evident chain and the count of decision records. Used to
+ * populate a certificate's `provenance` block.
+ */
+export declare function getDecisionProvenance(projectPath: string): Promise<DecisionProvenance>;
+//# sourceMappingURL=decisions.d.ts.map

package/dist/history/decisions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.d.ts","sourceRoot":"","sources":["../../src/history/decisions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMrE,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,aAAa,EACvB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CAsB9B;AAED,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAO7B"}

package/dist/history/decisions.js

@@ -0,0 +1,60 @@
+/**
+ * Decision provenance.
+ *
+ * Records AI decisions to the existing tamper-evident hash chain
+ * (`history/store`), so every decision is traceable and the chain
+ * proves it wasn't altered after the fact. Raw inputs/prompts/outputs
+ * are stored as sha256 digests (+ optional short summaries), so the
+ * record captures *what was decided* without retaining secrets verbatim.
+ *
+ * This is the substrate for the certificate's explainability dimension:
+ * the regulations (EU AI Act, SR 11-7, NIST AI RMF) ask for traceability
+ * and reproducible provenance, not neuron-level interpretability.
+ *
+ * @module history/decisions
+ */
+import { createHash } from "crypto";
+import { appendHistoryEntry, getLastEntryHash, queryHistory } from "./store.js";
+function sha256(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+/**
+ * Record an AI decision to the tamper-evident chain. Returns the appended
+ * entry, including its integrity proof (hash + previousHash).
+ */
+export async function recordDecision(projectPath, decision, options = {}) {
+    const entry = {
+        type: "decision_record",
+        decisionType: decision.decisionType,
+        model: decision.model,
+        ...(decision.modelVersion ? { modelVersion: decision.modelVersion } : {}),
+        inputDigest: sha256(decision.input),
+        ...(decision.prompt !== undefined ? { promptDigest: sha256(decision.prompt) } : {}),
+        outputDigest: sha256(decision.output),
+        ...(decision.toolsInvoked ? { toolsInvoked: decision.toolsInvoked } : {}),
+        ...(decision.summary ? { summary: decision.summary } : {}),
+        ...(decision.rationale ? { rationale: decision.rationale } : {}),
+        ...(decision.confidence !== undefined ? { confidence: decision.confidence } : {}),
+        ...(decision.certificationId ? { certificationId: decision.certificationId } : {}),
+    };
+    const appended = await appendHistoryEntry(projectPath, entry, {
+        actor: options.actor,
+        enableIntegrity: true,
+        sign: options.sign,
+    });
+    return appended;
+}
+/**
+ * Read the provenance anchor for a project: the head hash of the
+ * tamper-evident chain and the count of decision records. Used to
+ * populate a certificate's `provenance` block.
+ */
+export async function getDecisionProvenance(projectPath) {
+    const auditTrailHead = await getLastEntryHash(projectPath);
+    const result = await queryHistory(projectPath, {
+        type: "decision_record",
+        limit: 1000,
+    });
+    return { auditTrailHead, decisionRecords: result.total };
+}
+//# sourceMappingURL=decisions.js.map

package/dist/history/decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../../src/history/decisions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGhF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAiCD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,QAAuB,EACvB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG;QACZ,IAAI,EAAE,iBAA0B;QAChC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE;QAC5D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,eAAe,EAAE,IAAI;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,OAAO,QAA+B,CAAC;AACzC,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB;IAEnB,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE;QAC7C,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,IAAI;KACZ,CAAC,CAAC;IACH,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC"}

package/dist/history/index.d.ts

@@ -9,5 +9,7 @@ export type { HistoryEntryType, BaseHistoryEntry, CertificationStartedEntry, Cer
 export { HistoryQueryOptionsSchema } from "./types.js";
 export { appendHistoryEntry, queryHistory, calculateTrends, getRecentActivity, formatTrendsAsMarkdown, getHistoryStats, calculateEntryHash, getLastEntryHash, } from "./store.js";
 export type { AppendHistoryOptions } from "./store.js";
+export { recordDecision, getDecisionProvenance } from "./decisions.js";
+export type { DecisionInput, RecordDecisionOptions, DecisionProvenance, } from "./decisions.js";
 export { verifyEntry, verifyHistoryIntegrity, formatVerificationResultAsMarkdown, getVerificationSummary, } from "./verify.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/history/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/history/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAGvD,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EAEf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGvD,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/history/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,aAAa,EAEb,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAGvD,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EAEf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGvD,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvE,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,aAAa,CAAC"}

package/dist/history/index.js

@@ -10,6 +10,8 @@ export { HistoryQueryOptionsSchema } from "./types.js";
 export { appendHistoryEntry, queryHistory, calculateTrends, getRecentActivity, formatTrendsAsMarkdown, getHistoryStats, 
 // Hash chain functions
 calculateEntryHash, getLastEntryHash, } from "./store.js";
+// Decision provenance
+export { recordDecision, getDecisionProvenance } from "./decisions.js";
 // Verification functions
 export { verifyEntry, verifyHistoryIntegrity, formatVerificationResultAsMarkdown, getVerificationSummary, } from "./verify.js";
 //# sourceMappingURL=index.js.map

package/dist/history/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/history/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA0BH,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,kBAAkB;AAClB,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,eAAe;AACf,uBAAuB;AACvB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAIpB,yBAAyB;AACzB,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/history/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA0BH,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEvD,kBAAkB;AAClB,OAAO,EACL,kBAAkB,EAClB,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,eAAe;AACf,uBAAuB;AACvB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAIpB,sBAAsB;AACtB,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAOvE,yBAAyB;AACzB,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,kCAAkC,EAClC,sBAAsB,GACvB,MAAM,aAAa,CAAC"}

package/dist/history/types.d.ts

@@ -11,7 +11,7 @@ import type { ComplianceFramework } from "../compliance/types.js";
 /**
  * History entry type
  */
-export type HistoryEntryType = "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "compliance_report" | "model_run";
+export type HistoryEntryType = "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "compliance_report" | "model_run" | "decision_record";
 /**
  * Actor identity for audit trail
  */
@@ -134,10 +134,39 @@ export interface ModelRunEntry extends BaseHistoryEntry {
     durationMs: number;
     cost?: number;
 }
+/**
+ * Decision record entry — a tamper-evident record of an AI decision for
+ * explainability/traceability. Large or sensitive content (prompts,
+ * inputs, outputs) is stored as a sha256 digest plus a short summary, so
+ * the chain proves *what was decided* without retaining raw secrets.
+ */
+export interface DecisionRecordEntry extends BaseHistoryEntry {
+    type: "decision_record";
+    /** Kind of decision (e.g. tool_call, classification, generation, refusal) */
+    decisionType: string;
+    /** Model that produced the decision */
+    model: string;
+    /** Model version/build, if known */
+    modelVersion?: string;
+    /** sha256 of the input/context that led to the decision */
+    inputDigest: string;
+    /** sha256 of the prompt (if applicable) */
+    promptDigest?: string;
+    /** Tools/functions invoked as part of the decision */
+    toolsInvoked?: string[];
+    /** sha256 of the output/decision */
+    outputDigest: string;
+    /** Short human-readable summary of the decision */
+    summary?: string;
+    /** Rationale / explanation, if captured */
+    rationale?: string;
+    /** Model confidence 0-100, if available */
+    confidence?: number;
+}
 /**
  * Union of all history entry types
  */
-export type HistoryEntry = CertificationStartedEntry | CertificationCompletedEntry | ScanCompletedEntry | FindingSubmittedEntry | FindingFixedEntry | ComplianceReportEntry | ModelRunEntry;
+export type HistoryEntry = CertificationStartedEntry | CertificationCompletedEntry | ScanCompletedEntry | FindingSubmittedEntry | FindingFixedEntry | ComplianceReportEntry | ModelRunEntry | DecisionRecordEntry;
 /**
  * History query options
  */
@@ -206,7 +235,7 @@ export interface TrendAnalysis {
  * Zod schemas for validation
  */
 export declare const HistoryQueryOptionsSchema: z.ZodObject<{
-    type: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["certification_started", "certification_completed", "scan_completed", "finding_submitted", "finding_fixed", "compliance_report", "model_run"]>, z.ZodArray<z.ZodEnum<["certification_started", "certification_completed", "scan_completed", "finding_submitted", "finding_fixed", "compliance_report", "model_run"]>, "many">]>>;
+    type: z.ZodOptional<z.ZodUnion<[z.ZodEnum<["certification_started", "certification_completed", "scan_completed", "finding_submitted", "finding_fixed", "compliance_report", "model_run", "decision_record"]>, z.ZodArray<z.ZodEnum<["certification_started", "certification_completed", "scan_completed", "finding_submitted", "finding_fixed", "compliance_report", "model_run", "decision_record"]>, "many">]>>;
     projectPath: z.ZodOptional<z.ZodString>;
     certificationId: z.ZodOptional<z.ZodString>;
     startDate: z.ZodOptional<z.ZodString>;
@@ -220,13 +249,13 @@ export declare const HistoryQueryOptionsSchema: z.ZodObject<{
     order: "asc" | "desc";
     projectPath?: string | undefined;
     certificationId?: string | undefined;
-    type?: "compliance_report" | "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "model_run" | ("compliance_report" | "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "model_run")[] | undefined;
+    type?: "compliance_report" | "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "model_run" | "decision_record" | ("compliance_report" | "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "model_run" | "decision_record")[] | undefined;
     startDate?: string | undefined;
     endDate?: string | undefined;
 }, {
     projectPath?: string | undefined;
     certificationId?: string | undefined;
-    type?: "compliance_report" | "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "model_run" | ("compliance_report" | "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "model_run")[] | undefined;
+    type?: "compliance_report" | "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "model_run" | "decision_record" | ("compliance_report" | "certification_started" | "certification_completed" | "scan_completed" | "finding_submitted" | "finding_fixed" | "model_run" | "decision_record")[] | undefined;
     limit?: number | undefined;
     offset?: number | undefined;
     order?: "asc" | "desc" | undefined;

package/dist/history/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/history/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB,uBAAuB,GACvB,yBAAyB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iBAAiB;IACjB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpC,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,MAAM,EAAE,SAAS,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA4B,SAAQ,gBAAgB;IACnE,IAAI,EAAE,yBAAyB,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,IAAI,EAAE,mBAAmB,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,IAAI,EAAE,mBAAmB,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,kBAAkB,GAClB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,aAAa,CAAC;AAElB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B;IAC3B,IAAI,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;IAC7C,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB;IACjB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BpC,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,eAAe;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,wDAAwD;IACxD,UAAU,EAAE,OAAO,CAAC;IACpB,kDAAkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,cAAc,EAAE,OAAO,CAAC;IACxB,mCAAmC;IACnC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC,yCAAyC;IACzC,QAAQ,EAAE,uBAAuB,EAAE,CAAC;IACpC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/history/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACzF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAElE;;GAEG;AACH,MAAM,MAAM,gBAAgB,GACxB,uBAAuB,GACvB,yBAAyB,GACzB,gBAAgB,GAChB,mBAAmB,GACnB,eAAe,GACf,mBAAmB,GACnB,WAAW,GACX,iBAAiB,CAAC;AAEtB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,iBAAiB;IACjB,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpC,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,MAAM,EAAE,SAAS,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA4B,SAAQ,gBAAgB;IACnE,IAAI,EAAE,yBAAyB,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,IAAI,EAAE,gBAAgB,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,IAAI,EAAE,mBAAmB,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,IAAI,EAAE,eAAe,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,IAAI,EAAE,mBAAmB,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,mBAAmB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,IAAI,EAAE,WAAW,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,SAAS,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,IAAI,EAAE,iBAAiB,CAAC;IACxB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,kBAAkB,GAClB,qBAAqB,GACrB,iBAAiB,GACjB,qBAAqB,GACrB,aAAa,GACb,mBAAmB,CAAC;AAExB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B;IAC3B,IAAI,CAAC,EAAE,gBAAgB,GAAG,gBAAgB,EAAE,CAAC;IAC7C,6BAA6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB;IACjB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,OAAO,EAAE;QACP,mBAAmB,EAAE,MAAM,CAAC;QAC5B,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8BpC,CAAC;AAEH;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,eAAe;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,SAAS,EAAE,OAAO,CAAC;IACnB,wDAAwD;IACxD,UAAU,EAAE,OAAO,CAAC;IACpB,kDAAkD;IAClD,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,cAAc,EAAE,OAAO,CAAC;IACxB,mCAAmC;IACnC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IACvC,yCAAyC;IACzC,QAAQ,EAAE,uBAAuB,EAAE,CAAC;IACpC,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/history/types.js

@@ -19,6 +19,7 @@ export const HistoryQueryOptionsSchema = z.object({
             "finding_fixed",
             "compliance_report",
             "model_run",
+            "decision_record",
         ]),
         z.array(z.enum([
             "certification_started",
@@ -28,6 +29,7 @@ export const HistoryQueryOptionsSchema = z.object({
             "finding_fixed",
             "compliance_report",
             "model_run",
+            "decision_record",
         ])),
     ]).optional(),
     projectPath: z.string().optional(),

package/dist/history/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/history/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqOxB;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,IAAI,CAAC;YACL,uBAAuB;YACvB,yBAAyB;YACzB,gBAAgB;YAChB,mBAAmB;YACnB,eAAe;YACf,mBAAmB;YACnB,WAAW;SACZ,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACb,uBAAuB;YACvB,yBAAyB;YACzB,gBAAgB;YAChB,mBAAmB;YACnB,eAAe;YACf,mBAAmB;YACnB,WAAW;SACZ,CAAC,CAAC;KACJ,CAAC,CAAC,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAC/C,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/history/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAqQxB;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,IAAI,CAAC;YACL,uBAAuB;YACvB,yBAAyB;YACzB,gBAAgB;YAChB,mBAAmB;YACnB,eAAe;YACf,mBAAmB;YACnB,WAAW;YACX,iBAAiB;SAClB,CAAC;QACF,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACb,uBAAuB;YACvB,yBAAyB;YACzB,gBAAgB;YAChB,mBAAmB;YACnB,eAAe;YACf,mBAAmB;YACnB,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;KACJ,CAAC,CAAC,QAAQ,EAAE;IACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAC/C,CAAC,CAAC"}

package/dist/http-auth.d.ts

@@ -0,0 +1,22 @@
+import type { IncomingMessage } from "http";
+export declare class HttpAuthConfigError extends Error {
+    constructor(message: string);
+}
+export interface HttpAuthConfig {
+    /** Shared secret required as `Authorization: Bearer <token>`; null when unauthenticated mode was explicitly enabled. */
+    token: string | null;
+}
+/**
+ * Resolve auth configuration from the environment.
+ *
+ * - `VASPERA_HTTP_TOKEN` set → bearer auth enforced on the MCP endpoint.
+ * - unset + `VASPERA_HTTP_ALLOW_UNAUTHENTICATED=true` → open mode (explicit opt-in).
+ * - unset otherwise → refuse to start.
+ */
+export declare function resolveAuthConfig(env?: NodeJS.ProcessEnv): HttpAuthConfig;
+/**
+ * Check a request against the resolved config. Constant-time comparison so
+ * the token cannot be recovered byte-by-byte via timing.
+ */
+export declare function isAuthorized(req: IncomingMessage, config: HttpAuthConfig): boolean;
+//# sourceMappingURL=http-auth.d.ts.map

package/dist/http-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../src/http-auth.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5C,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,cAAc;IAC7B,wHAAwH;IACxH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAoBtF;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAgBlF"}

package/dist/http-auth.js

@@ -0,0 +1,58 @@
+/**
+ * HTTP Server Authentication
+ *
+ * Bearer-token auth for the HTTP transport. The MCP endpoint exposes every
+ * registered tool (filesystem scans, autofix, integrations), so it must not
+ * be reachable unauthenticated unless the operator explicitly opts in.
+ *
+ * @module http-auth
+ */
+import { timingSafeEqual } from "crypto";
+export class HttpAuthConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HttpAuthConfigError";
+    }
+}
+/**
+ * Resolve auth configuration from the environment.
+ *
+ * - `VASPERA_HTTP_TOKEN` set → bearer auth enforced on the MCP endpoint.
+ * - unset + `VASPERA_HTTP_ALLOW_UNAUTHENTICATED=true` → open mode (explicit opt-in).
+ * - unset otherwise → refuse to start.
+ */
+export function resolveAuthConfig(env = process.env) {
+    const token = env.VASPERA_HTTP_TOKEN;
+    if (token && token.trim().length > 0) {
+        if (token.trim().length < 16) {
+            throw new HttpAuthConfigError("VASPERA_HTTP_TOKEN must be at least 16 characters; generate one with: openssl rand -hex 32");
+        }
+        return { token: token.trim() };
+    }
+    if (env.VASPERA_HTTP_ALLOW_UNAUTHENTICATED === "true") {
+        return { token: null };
+    }
+    throw new HttpAuthConfigError("Refusing to start: no VASPERA_HTTP_TOKEN is set, and the MCP endpoint exposes all tools. " +
+        "Set VASPERA_HTTP_TOKEN (e.g. openssl rand -hex 32), or set " +
+        "VASPERA_HTTP_ALLOW_UNAUTHENTICATED=true to explicitly run open (not recommended).");
+}
+/**
+ * Check a request against the resolved config. Constant-time comparison so
+ * the token cannot be recovered byte-by-byte via timing.
+ */
+export function isAuthorized(req, config) {
+    if (config.token === null) {
+        return true;
+    }
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith("Bearer ")) {
+        return false;
+    }
+    const presented = Buffer.from(header.slice("Bearer ".length));
+    const expected = Buffer.from(config.token);
+    if (presented.length !== expected.length) {
+        return false;
+    }
+    return timingSafeEqual(presented, expected);
+}
+//# sourceMappingURL=http-auth.js.map

package/dist/http-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth.js","sourceRoot":"","sources":["../src/http-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAGzC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAOD;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACpE,MAAM,KAAK,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACrC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC7B,MAAM,IAAI,mBAAmB,CAC3B,4FAA4F,CAC7F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,GAAG,CAAC,kCAAkC,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,MAAM,IAAI,mBAAmB,CAC3B,2FAA2F;QACzF,6DAA6D;QAC7D,mFAAmF,CACtF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAoB,EAAE,MAAsB;IACvE,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC"}

package/dist/http-policy.d.ts

@@ -0,0 +1,30 @@
+/**
+ * HTTP tool exposure policy.
+ *
+ * The stdio transport (local Claude Code) gets every tool; the HTTP
+ * transport is a remote attack surface, so by default it may only
+ * invoke tools registered with readOnlyHint: true. A leaked bearer
+ * token must not be equivalent to file writes or process execution.
+ *
+ * VASPERA_HTTP_TOOLS controls the policy:
+ *   - "readonly" (default): only readOnlyHint tools
+ *   - "all": every tool (not recommended)
+ *   - comma-separated tool names: explicit allowlist
+ *
+ * @module http-policy
+ */
+export interface HttpToolPolicy {
+    mode: "readonly" | "all" | "allowlist";
+    allowlist: ReadonlySet<string>;
+}
+export declare function resolveToolPolicy(env?: NodeJS.ProcessEnv): HttpToolPolicy;
+export declare function isToolAllowed(name: string, policy: HttpToolPolicy): boolean;
+/**
+ * Find the first tools/call in a JSON-RPC payload (single or batch)
+ * that the policy forbids. Returns null when everything is allowed.
+ */
+export declare function findBlockedToolCall(payload: unknown, policy: HttpToolPolicy): {
+    toolName: string;
+    id: unknown;
+} | null;
+//# sourceMappingURL=http-policy.d.ts.map

package/dist/http-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-policy.d.ts","sourceRoot":"","sources":["../src/http-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,GAAG,KAAK,GAAG,WAAW,CAAC;IACvC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,wBAAgB,iBAAiB,CAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,cAAc,CAYhB;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,OAAO,CAI3E;AAQD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,cAAc,GACrB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAY1C"}

package/dist/http-policy.js

@@ -0,0 +1,54 @@
+/**
+ * HTTP tool exposure policy.
+ *
+ * The stdio transport (local Claude Code) gets every tool; the HTTP
+ * transport is a remote attack surface, so by default it may only
+ * invoke tools registered with readOnlyHint: true. A leaked bearer
+ * token must not be equivalent to file writes or process execution.
+ *
+ * VASPERA_HTTP_TOOLS controls the policy:
+ *   - "readonly" (default): only readOnlyHint tools
+ *   - "all": every tool (not recommended)
+ *   - comma-separated tool names: explicit allowlist
+ *
+ * @module http-policy
+ */
+import { toolAnnotations } from "./tool-guard.js";
+export function resolveToolPolicy(env = process.env) {
+    const raw = (env.VASPERA_HTTP_TOOLS || "readonly").trim();
+    if (raw === "all") {
+        return { mode: "all", allowlist: new Set() };
+    }
+    if (raw === "readonly" || raw === "") {
+        return { mode: "readonly", allowlist: new Set() };
+    }
+    return {
+        mode: "allowlist",
+        allowlist: new Set(raw.split(",").map((s) => s.trim()).filter(Boolean)),
+    };
+}
+export function isToolAllowed(name, policy) {
+    if (policy.mode === "all")
+        return true;
+    if (policy.mode === "allowlist")
+        return policy.allowlist.has(name);
+    return toolAnnotations.get(name)?.readOnlyHint === true;
+}
+/**
+ * Find the first tools/call in a JSON-RPC payload (single or batch)
+ * that the policy forbids. Returns null when everything is allowed.
+ */
+export function findBlockedToolCall(payload, policy) {
+    const messages = Array.isArray(payload) ? payload : [payload];
+    for (const message of messages) {
+        const m = message;
+        if (m && m.method === "tools/call") {
+            const toolName = typeof m.params?.name === "string" ? m.params.name : "";
+            if (!isToolAllowed(toolName, policy)) {
+                return { toolName, id: m.id ?? null };
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=http-policy.js.map

package/dist/http-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-policy.js","sourceRoot":"","sources":["../src/http-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAOlD,MAAM,UAAU,iBAAiB,CAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAsB;IAChE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC;AAC1D,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,MAAsB;IAEtB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,OAAgC,CAAC;QAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}