@agenticprimitives/tool-policy 1.0.0-alpha.22 → 1.0.0-alpha.23

package/dist/index.d.ts

@@ -7,4 +7,6 @@ export { ThresholdTier } from './types.js';
 export { classifyExchange, computeSkillSelector, buildSkillAuthorityRegistry, } from './authority-tier.js';
 export type { AuthorityTier, ExecLane, SurfaceEffect, SurfaceSensitivity, SurfaceAuthorityDescriptor, SkillAuthorityClass, ClassifyInput, SkillAuthorityRegistry, } from './authority-tier.js';
 export type { Address, Hex, RiskTier, ToolClassification, ExactCallPolicy, CaveatLike, DelegationLike, CaveatContext, PolicyContext, PolicyDecision, ThresholdPolicyDecision, LintResult, } from './types.js';
+export { MINIMUM_AUTHORITY, stepRiskClass, riskAtLeast } from './step-risk.js';
+export type { StepRiskClass, MinimumAuthority } from './step-risk.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,aAAa,EACb,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,aAAa,EACb,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,OAAO,EACP,GAAG,EACH,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,UAAU,GACX,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,aAAa,EACb,QAAQ,EACR,aAAa,EACb,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,aAAa,EACb,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACV,OAAO,EACP,GAAG,EACH,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,cAAc,EACd,aAAa,EACb,aAAa,EACb,cAAc,EACd,uBAAuB,EACvB,UAAU,GACX,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -16,4 +16,6 @@ export { ThresholdTier } from './types.js';
 // Authority-tier classification (spec 316 §3a/§(c)) — the ONE server-authoritative source the fabric
 // ingress gate and the mcp-runtime delegation gate both read to pick the execution LANE. Fail-closed.
 export { classifyExchange, computeSkillSelector, buildSkillAuthorityRegistry, } from './authority-tier.js';
+// ─── Spec 350 §3.4 — per-step risk → minimum authority ───────────────────────────────────────────────
+export { MINIMUM_AUTHORITY, stepRiskClass, riskAtLeast } from './step-risk.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,0DAA0D;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,qGAAqG;AACrG,sGAAsG;AACtG,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4DAA4D;AAC5D,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,0DAA0D;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,qGAAqG;AACrG,sGAAsG;AACtG,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AA2B7B,wGAAwG;AACxG,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/step-risk.d.ts

@@ -0,0 +1,33 @@
+import type { RiskTier } from './types.js';
+/** A step's risk: `informational` when it exercises no capability, else its tool's `RiskTier`. */
+export type StepRiskClass = 'informational' | RiskTier;
+/** The obligations a risk class imposes BEFORE execution, over and above a valid mandate. */
+export interface MinimumAuthority {
+    /** Is a mandate required at all? False only for `informational`. */
+    mandate: boolean;
+    /** Must the step carry an idempotency key (a retry of a mutation is not a re-read)? */
+    idempotencyKey: boolean;
+    /** Obligation kinds the policy layer attaches. Names, not implementations — a `PolicyEvaluator`
+     *  turns them into concrete `Obligation`s with who may discharge them. */
+    obligations: ReadonlyArray<'second-party-approval' | 'quorum' | 'fresh-authorization'>;
+}
+/**
+ * The DEFAULT ladder. A granting agent's own policy (an org's membership policy, a treasury's spend
+ * policy) may add to it and never subtract from it — the evaluator composes, it does not override.
+ *
+ *   informational  read; no consequence            → nothing
+ *   low            reversible mutation              → mandate
+ *   medium         significant mutation             → mandate + idempotency key
+ *   high           financial / legal / external     → + second-party approval
+ *   critical       irreversible / high-impact       → + quorum + fresh authorization
+ */
+export declare const MINIMUM_AUTHORITY: Readonly<Record<StepRiskClass, MinimumAuthority>>;
+/** Derive a step's risk class from what its tool declares. No capability ⇒ informational, whatever the
+ *  planner said — a plan cannot lower a risk, and it cannot raise one into needing authority either. */
+export declare function stepRiskClass(tool: {
+    capability?: unknown;
+    risk?: RiskTier;
+}): StepRiskClass;
+/** Is `a` at least as risky as `b`? For "an irreversible step imposes at least what a high one does". */
+export declare function riskAtLeast(a: StepRiskClass, b: StepRiskClass): boolean;
+//# sourceMappingURL=step-risk.d.ts.map

package/dist/step-risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-risk.d.ts","sourceRoot":"","sources":["../src/step-risk.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,kGAAkG;AAClG,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,QAAQ,CAAC;AAEvD,6FAA6F;AAC7F,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,uFAAuF;IACvF,cAAc,EAAE,OAAO,CAAC;IACxB;8EAC0E;IAC1E,WAAW,EAAE,aAAa,CAAC,uBAAuB,GAAG,QAAQ,GAAG,qBAAqB,CAAC,CAAC;CACxF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAM/E,CAAC;AAEF;wGACwG;AACxG,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;CAAE,GAAG,aAAa,CAG5F;AAGD,yGAAyG;AACzG,wBAAgB,WAAW,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAEvE"}

package/dist/step-risk.js

@@ -0,0 +1,30 @@
+/**
+ * The DEFAULT ladder. A granting agent's own policy (an org's membership policy, a treasury's spend
+ * policy) may add to it and never subtract from it — the evaluator composes, it does not override.
+ *
+ *   informational  read; no consequence            → nothing
+ *   low            reversible mutation              → mandate
+ *   medium         significant mutation             → mandate + idempotency key
+ *   high           financial / legal / external     → + second-party approval
+ *   critical       irreversible / high-impact       → + quorum + fresh authorization
+ */
+export const MINIMUM_AUTHORITY = {
+    informational: { mandate: false, idempotencyKey: false, obligations: [] },
+    low: { mandate: true, idempotencyKey: false, obligations: [] },
+    medium: { mandate: true, idempotencyKey: true, obligations: [] },
+    high: { mandate: true, idempotencyKey: true, obligations: ['second-party-approval'] },
+    critical: { mandate: true, idempotencyKey: true, obligations: ['second-party-approval', 'quorum', 'fresh-authorization'] },
+};
+/** Derive a step's risk class from what its tool declares. No capability ⇒ informational, whatever the
+ *  planner said — a plan cannot lower a risk, and it cannot raise one into needing authority either. */
+export function stepRiskClass(tool) {
+    if (!tool.capability)
+        return 'informational';
+    return tool.risk ?? 'low';
+}
+const ORDER = ['informational', 'low', 'medium', 'high', 'critical'];
+/** Is `a` at least as risky as `b`? For "an irreversible step imposes at least what a high one does". */
+export function riskAtLeast(a, b) {
+    return ORDER.indexOf(a) >= ORDER.indexOf(b);
+}
+//# sourceMappingURL=step-risk.js.map

package/dist/step-risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"step-risk.js","sourceRoot":"","sources":["../src/step-risk.ts"],"names":[],"mappings":"AAuBA;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsD;IAClF,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE;IACzE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAChE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,uBAAuB,CAAC,EAAE;IACrF,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,uBAAuB,EAAE,QAAQ,EAAE,qBAAqB,CAAC,EAAE;CAC3H,CAAC;AAEF;wGACwG;AACxG,MAAM,UAAU,aAAa,CAAC,IAA+C;IAC3E,IAAI,CAAC,IAAI,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IAC7C,OAAO,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;AAC5B,CAAC;AAED,MAAM,KAAK,GAAoB,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AACtF,yGAAyG;AACzG,MAAM,UAAU,WAAW,CAAC,CAAgB,EAAE,CAAgB;IAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/tool-policy",
-  "version": "1.0.0-alpha.22",
+  "version": "1.0.0-alpha.23",
   "description": "Protocol-agnostic classification, risk tiers, and exact-call policy. Consumable by MCP, A2A, LangGraph, and Vercel AI tool runtimes.",
   "license": "MIT",
   "repository": {
@@ -38,7 +38,7 @@
     "@noble/hashes": "^2.2.0"
   },
   "peerDependencies": {
-    "@agenticprimitives/types": "1.0.0-alpha.22"
+    "@agenticprimitives/types": "1.0.0-alpha.23"
   },
   "devDependencies": {
     "@types/node": "^22.7.0",