@atrib/action-gate 0.0.1

package/LICENSE

@@ -0,0 +1,216 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Copyright 2025-2026 Atrib contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing
+   permissions and limitations under the License.

package/README.md

@@ -0,0 +1,138 @@
+# @atrib/action-gate
+
+`@atrib/action-gate` signs policy decisions and outcomes around high-impact
+agent actions before the action body runs.
+
+Use it when a host already knows where an action boundary is: browser
+automation, computer use, support tooling, payment workflows, admin changes, or
+production writes. The host owns policy, identity, approval UI, and execution.
+Atrib records what the host decided and what happened next.
+
+The core use case is an action that must outlive the session that proposed it.
+One browser or computer-use run can sign the proposed action, policy decision,
+and outcome. A later session, a different agent, or a reviewer team can accept
+those hashes as verifiable context before continuing work.
+
+## Release state
+
+`@atrib/action-gate` is a publish target, but the package has not been created
+on npm yet. Use the workspace dependency or a packed tarball until the manual
+first publish creates version `0.0.1`. Later releases use npm Trusted Publisher
+through `.github/workflows/release.yml`.
+
+## Install
+
+Inside the monorepo, depend on the workspace package:
+
+```json
+"@atrib/action-gate": "workspace:*"
+```
+
+Before the first npm publish, test the packed tarball from a clean temp project:
+
+```bash
+npx -y pnpm@9.15.4 --filter @atrib/action-gate build
+cd packages/action-gate
+tarball=$(npx -y pnpm@9.15.4 --silent pack --pack-destination /tmp | tail -n 1)
+tmpdir=$(mktemp -d)
+cd "$tmpdir"
+npm init -y
+npm install "$tarball"
+node --input-type=module -e "import('@atrib/action-gate').then((m) => console.log(Object.keys(m).sort()))"
+```
+
+After the first npm release:
+
+```bash
+pnpm add @atrib/action-gate
+```
+
+## Basic use
+
+```ts
+import { runGatedAction } from '@atrib/action-gate'
+
+const result = await runGatedAction({
+  privateKey,
+  contextId: '5f9a8a2b68f94a5cb7f9361b2c8d4e10',
+  action: {
+    run_id: 'browser-run-42',
+    action_id: 'act-3',
+    agent_id: 'support-agent',
+    surface: 'browser',
+    tool_name: 'browser.act',
+    args: { instruction: 'send customer email' },
+    risk: ['external_write', 'customer_message'],
+  },
+  evaluate: ({ action }) => ({
+    outcome: action.risk?.includes('external_write') ? 'escalate' : 'allow',
+    policy_id: 'browser-write-policy',
+    policy_version: '2026-06-28.1',
+    reason: 'browser writes that send customer messages need approval',
+  }),
+  execute: async () => ({ status: 'sent' }),
+})
+
+console.log(result.decision.record_hash)
+console.log(result.outcome.record_hash)
+console.log(result.verification.valid)
+```
+
+## Contract
+
+The package has four gate states:
+
+| State          | Runtime behavior                                    | Proof behavior                                                                       |
+| -------------- | --------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| `allowed`      | Runs the action body.                               | Signs a decision, then signs an outcome with `informed_by` pointing at the decision. |
+| `blocked`      | Does not run the action body.                       | Signs the closed decision and blocked outcome.                                       |
+| `escalated`    | Does not run until the host approval path resolves. | Signs the escalation decision and outcome.                                           |
+| `policy_error` | Does not run the action body.                       | Signs that the policy evaluator failed closed.                                       |
+
+`verifyActionGateRun()` checks signatures, record hashes, decision-to-outcome
+binding, action id consistency, and the rule that blocked, escalated, and
+policy-error states did not execute.
+
+`runGatedAction()` returns both signed records and local sidecars. If `onRecord`
+throws while delivering a signed record to a mirror, log sink, or proof-packet
+writer, the action result still returns a complete decision/outcome pair and
+adds the callback failure to `record_delivery_errors`.
+
+## Privacy and degradation
+
+Signed records carry canonical hashes of the action arguments and outcome
+material. Raw action arguments and results stay in local sidecars returned to
+the host. The package does not submit records to the public log by itself.
+Hosts choose whether `onRecord` writes a local mirror, submits to a log, writes
+a proof packet, or does nothing.
+
+Policy failures fail closed. If the policy evaluator throws, the package signs a
+`policy_error` decision and a `policy_error` outcome, and the action body does
+not run. If an allowed action body throws, the package signs an
+`execution_error` outcome tied to the decision record.
+
+## Boundary
+
+This package does not issue authorization, run a browser, store raw session
+data, or replace a host policy engine. It gives hosts a small control/proof
+contract:
+
+1. propose an action;
+2. evaluate policy before execution;
+3. run only when allowed;
+4. sign the decision and outcome;
+5. pass the accepted record hashes to a later session, another agent, a reviewer
+   team, or a proof packet.
+
+Browserbase, Stagehand, browser-use, Playwright, OpenAI Computer Use, hosted
+desktop runtimes, and support tools can keep their own automation layer while
+using this package for the gate.
+
+## Local verification
+
+```bash
+npx -y pnpm@9.15.4 --filter @atrib/action-gate typecheck
+npx -y pnpm@9.15.4 --filter @atrib/action-gate test
+npx -y pnpm@9.15.4 --filter @atrib/action-gate build
+npx -y pnpm@9.15.4 --filter @atrib/integration action-control-gate-smoke
+```

package/dist/index.d.ts

@@ -0,0 +1,200 @@
+import type { AtribRecord } from '@atrib/mcp';
+export declare const ACTION_GATE_DECISION_EVENT_TYPE_URI: "https://atrib.dev/v1/extensions/action-gate/decision";
+export declare const ACTION_GATE_OUTCOME_EVENT_TYPE_URI: "https://atrib.dev/v1/extensions/action-gate/outcome";
+export declare const ACTION_GATE_DECISION_SCHEMA: "atrib.action-gate.decision.v1";
+export declare const ACTION_GATE_OUTCOME_SCHEMA: "atrib.action-gate.outcome.v1";
+export declare const DEFAULT_ACTION_GATE_SERVER_URL: "action-gate://local";
+type MaybePromise<T> = T | Promise<T>;
+export type Sha256Uri = `sha256:${string}`;
+export type ActionGatePolicyOutcome = 'allow' | 'block' | 'escalate' | 'error';
+export type ActionGateDecisionState = 'allowed' | 'blocked' | 'escalated' | 'policy_error';
+export type ActionGateOutcomeStatus = 'executed' | 'blocked' | 'escalated' | 'policy_error' | 'execution_error';
+export interface ActionGateActionEnvelope {
+    readonly run_id: string;
+    readonly action_id: string;
+    readonly agent_id: string;
+    readonly surface: string;
+    readonly tool_name: string;
+    readonly args?: unknown;
+    readonly risk?: readonly string[];
+    readonly parent_record_hashes?: readonly Sha256Uri[];
+    readonly refs?: Record<string, string>;
+}
+export interface ActionGateAuthority {
+    readonly mode: 'host-policy' | 'agent-auth' | 'user-auth' | 'service-auth';
+    readonly principal_hash?: Sha256Uri;
+}
+export interface ActionGateApproval {
+    readonly required: boolean;
+    readonly approval_id?: string;
+    readonly reviewer_hint?: string;
+}
+export interface ActionGatePolicyDecision {
+    readonly outcome: ActionGatePolicyOutcome;
+    readonly policy_id: string;
+    readonly policy_version: string;
+    readonly reason?: string;
+    readonly authority?: ActionGateAuthority;
+    readonly approval?: ActionGateApproval;
+    readonly evidence?: Record<string, string>;
+}
+export interface ActionGatePolicyInput {
+    readonly action: ActionGateActionEnvelope;
+    readonly timestamp: string;
+}
+export interface ActionGateDecisionPolicy {
+    readonly policy_id: string;
+    readonly version: string;
+    readonly outcome: ActionGatePolicyOutcome;
+    readonly reason?: string;
+    readonly authority: ActionGateAuthority;
+    readonly approval: ActionGateApproval;
+    readonly evidence?: Record<string, string>;
+}
+export interface ActionGateDecisionEntry {
+    readonly schema: typeof ACTION_GATE_DECISION_SCHEMA;
+    readonly decision_id: Sha256Uri;
+    readonly decision_state: ActionGateDecisionState;
+    readonly run_id: string;
+    readonly action_id: string;
+    readonly agent_id: string;
+    readonly surface: string;
+    readonly tool_name: string;
+    readonly args_digest: Sha256Uri;
+    readonly risk: readonly string[];
+    readonly policy: ActionGateDecisionPolicy;
+    readonly timestamp: string;
+    readonly parent_record_hashes: readonly Sha256Uri[];
+    readonly refs?: Record<string, string>;
+}
+export interface ActionGateOutcomeEntry {
+    readonly schema: typeof ACTION_GATE_OUTCOME_SCHEMA;
+    readonly outcome_id: Sha256Uri;
+    readonly status: ActionGateOutcomeStatus;
+    readonly run_id: string;
+    readonly action_id: string;
+    readonly decision_id: Sha256Uri;
+    readonly decision_record_hash: Sha256Uri;
+    readonly executed: boolean;
+    readonly result_digest?: Sha256Uri;
+    readonly error?: {
+        readonly name: string;
+        readonly message: string;
+    };
+    readonly timestamp: string;
+}
+export interface ActionGateLocalSidecar {
+    readonly package: '@atrib/action-gate';
+    readonly record_kind: 'decision' | 'outcome';
+    readonly record_hash: Sha256Uri;
+    readonly action: ActionGateActionEnvelope;
+    readonly decision?: ActionGateDecisionEntry;
+    readonly outcome?: ActionGateOutcomeEntry;
+    readonly args?: unknown;
+    readonly result?: unknown;
+    readonly informed_by: readonly Sha256Uri[];
+}
+export interface SignedActionGateDecision {
+    readonly record: AtribRecord;
+    readonly record_hash: Sha256Uri;
+    readonly entry: ActionGateDecisionEntry;
+    readonly sidecar: ActionGateLocalSidecar;
+}
+export interface SignedActionGateOutcome {
+    readonly record: AtribRecord;
+    readonly record_hash: Sha256Uri;
+    readonly entry: ActionGateOutcomeEntry;
+    readonly sidecar: ActionGateLocalSidecar;
+}
+export interface RunGatedActionInput<TResult> {
+    readonly privateKey?: Uint8Array | string;
+    readonly contextId?: string;
+    readonly serverUrl?: string;
+    readonly parentRecordHashes?: readonly Sha256Uri[];
+    readonly action: ActionGateActionEnvelope;
+    readonly evaluate: (input: ActionGatePolicyInput) => MaybePromise<ActionGatePolicyDecision>;
+    readonly execute: () => MaybePromise<TResult>;
+    readonly now?: () => number;
+    readonly onRecord?: (record: AtribRecord, sidecar: ActionGateLocalSidecar) => MaybePromise<void>;
+}
+export interface ActionGateRunResult<TResult> {
+    readonly state: ActionGateDecisionState;
+    readonly action_executed: boolean;
+    readonly decision: SignedActionGateDecision;
+    readonly outcome: SignedActionGateOutcome;
+    readonly signed_records: readonly AtribRecord[];
+    readonly sidecars: readonly ActionGateLocalSidecar[];
+    readonly verification: ActionGateVerificationResult;
+    readonly record_delivery_errors: readonly ActionGateRecordDeliveryError[];
+    readonly result?: TResult;
+    readonly error?: {
+        readonly name: string;
+        readonly message: string;
+    };
+}
+export type ActionGateVerificationIssueCode = 'decision_signature_invalid' | 'outcome_signature_invalid' | 'decision_sidecar_hash_mismatch' | 'outcome_sidecar_hash_mismatch' | 'outcome_missing_decision_parent' | 'decision_record_hash_mismatch' | 'decision_id_mismatch' | 'run_id_mismatch' | 'action_id_mismatch' | 'blocked_action_executed' | 'escalated_action_executed' | 'policy_error_action_executed' | 'allowed_action_missing_execution_status' | 'closed_decision_status_mismatch';
+export interface ActionGateVerificationIssue {
+    readonly code: ActionGateVerificationIssueCode;
+    readonly message: string;
+}
+export interface ActionGateVerificationResult {
+    readonly valid: boolean;
+    readonly issues: readonly ActionGateVerificationIssue[];
+}
+export interface ActionGateRecordDeliveryError {
+    readonly record_kind: 'decision' | 'outcome';
+    readonly record_hash: Sha256Uri;
+    readonly name: string;
+    readonly message: string;
+}
+export declare function runGatedAction<TResult>(input: RunGatedActionInput<TResult>): Promise<ActionGateRunResult<TResult>>;
+export declare function buildActionGateDecisionEntry({ action, policy, timestamp, parent_record_hashes, }: {
+    readonly action: ActionGateActionEnvelope;
+    readonly policy: ActionGatePolicyDecision;
+    readonly timestamp: string;
+    readonly parent_record_hashes?: readonly Sha256Uri[];
+}): ActionGateDecisionEntry;
+export declare function buildActionGateOutcomeEntry({ status, run_id, action_id, decision_id, decision_record_hash, executed, timestamp, result, error, }: {
+    readonly status: ActionGateOutcomeStatus;
+    readonly run_id: string;
+    readonly action_id: string;
+    readonly decision_id: Sha256Uri;
+    readonly decision_record_hash: Sha256Uri;
+    readonly executed: boolean;
+    readonly timestamp: string;
+    readonly result?: unknown;
+    readonly error?: {
+        readonly name: string;
+        readonly message: string;
+    };
+}): ActionGateOutcomeEntry;
+export declare function signActionGateDecision({ entry, action, privateKey, contextId, serverUrl, chainTailHex, timestampMs, }: {
+    readonly entry: ActionGateDecisionEntry;
+    readonly action: ActionGateActionEnvelope;
+    readonly privateKey: Uint8Array;
+    readonly contextId: string;
+    readonly serverUrl?: string;
+    readonly chainTailHex?: string;
+    readonly timestampMs: number;
+}): Promise<SignedActionGateDecision>;
+export declare function signActionGateOutcome({ entry, action, privateKey, contextId, decisionRecordHash, serverUrl, chainTailHex, timestampMs, result, }: {
+    readonly entry: ActionGateOutcomeEntry;
+    readonly action: ActionGateActionEnvelope;
+    readonly privateKey: Uint8Array;
+    readonly contextId: string;
+    readonly decisionRecordHash: Sha256Uri;
+    readonly serverUrl?: string;
+    readonly chainTailHex?: string;
+    readonly timestampMs: number;
+    readonly result?: unknown;
+}): Promise<SignedActionGateOutcome>;
+export declare function verifyActionGateRun({ decision, outcome, }: {
+    readonly decision: SignedActionGateDecision;
+    readonly outcome: SignedActionGateOutcome;
+}): Promise<ActionGateVerificationResult>;
+export declare function digestCanonical(value: unknown): Sha256Uri;
+export declare function hashCanonical(value: unknown): Sha256Uri;
+export declare function recordHashFor(record: AtribRecord): Sha256Uri;
+export declare function resolveActionGatePrivateKey(value?: Uint8Array | string): Uint8Array;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,eAAO,MAAM,mCAAmC,EAC9C,sDAA+D,CAAA;AACjE,eAAO,MAAM,kCAAkC,EAC7C,qDAA8D,CAAA;AAChE,eAAO,MAAM,2BAA2B,EAAG,+BAAwC,CAAA;AACnF,eAAO,MAAM,0BAA0B,EAAG,8BAAuC,CAAA;AACjF,eAAO,MAAM,8BAA8B,EAAG,qBAA8B,CAAA;AAM5E,KAAK,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;AAErC,MAAM,MAAM,SAAS,GAAG,UAAU,MAAM,EAAE,CAAA;AAC1C,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAA;AAC9E,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAA;AAC1F,MAAM,MAAM,uBAAuB,GAC/B,UAAU,GACV,SAAS,GACT,WAAW,GACX,cAAc,GACd,iBAAiB,CAAA;AAErB,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,GAAG,WAAW,GAAG,cAAc,CAAA;IAC1E,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,CAAA;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAA;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAA;IACvC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAA;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,OAAO,2BAA2B,CAAA;IACnD,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAA;IAC/B,QAAQ,CAAC,cAAc,EAAE,uBAAuB,CAAA;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,SAAS,EAAE,CAAA;IACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,OAAO,0BAA0B,CAAA;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAA;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,CAAA;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,WAAW,EAAE,UAAU,GAAG,SAAS,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAA;IACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,SAAS,SAAS,EAAE,CAAA;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;CACzC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;CACzC;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,GAAG,MAAM,CAAA;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;IAClD,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,YAAY,CAAC,wBAAwB,CAAC,CAAA;IAC3F,QAAQ,CAAC,OAAO,EAAE,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,sBAAsB,KAAK,YAAY,CAAC,IAAI,CAAC,CAAA;CACjG;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO;IAC1C,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;IACzC,QAAQ,CAAC,cAAc,EAAE,SAAS,WAAW,EAAE,CAAA;IAC/C,QAAQ,CAAC,QAAQ,EAAE,SAAS,sBAAsB,EAAE,CAAA;IACpD,QAAQ,CAAC,YAAY,EAAE,4BAA4B,CAAA;IACnD,QAAQ,CAAC,sBAAsB,EAAE,SAAS,6BAA6B,EAAE,CAAA;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACrE;AAED,MAAM,MAAM,+BAA+B,GACvC,4BAA4B,GAC5B,2BAA2B,GAC3B,gCAAgC,GAChC,+BAA+B,GAC/B,iCAAiC,GACjC,+BAA+B,GAC/B,sBAAsB,GACtB,iBAAiB,GACjB,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,8BAA8B,GAC9B,yCAAyC,GACzC,iCAAiC,CAAA;AAErC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAA;CACxD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,WAAW,EAAE,UAAU,GAAG,SAAS,CAAA;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAC1C,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CA+EvC;AAED,wBAAgB,4BAA4B,CAAC,EAC3C,MAAM,EACN,MAAM,EACN,SAAS,EACT,oBAAyB,GAC1B,EAAE;IACD,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,SAAS,EAAE,CAAA;CACrD,GAAG,uBAAuB,CA8B1B;AAED,wBAAgB,2BAA2B,CAAC,EAC1C,MAAM,EACN,MAAM,EACN,SAAS,EACT,WAAW,EACX,oBAAoB,EACpB,QAAQ,EACR,SAAS,EACT,MAAM,EACN,KAAK,GACN,EAAE;IACD,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAA;IAC/B,QAAQ,CAAC,oBAAoB,EAAE,SAAS,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACrE,GAAG,sBAAsB,CAkBzB;AAED,wBAAsB,sBAAsB,CAAC,EAC3C,KAAK,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,SAA0C,EAC1C,YAAY,EACZ,WAAW,GACZ,EAAE;IACD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAkCpC;AAED,wBAAsB,qBAAqB,CAAC,EAC1C,KAAK,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,SAA0C,EAC1C,YAAY,EACZ,WAAW,EACX,MAAM,GACP,EAAE;IACD,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,SAAS,CAAA;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAgCnC;AAED,wBAAsB,mBAAmB,CAAC,EACxC,QAAQ,EACR,OAAO,GACR,EAAE;IACD,QAAQ,CAAC,QAAQ,EAAE,wBAAwB,CAAA;IAC3C,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;CAC1C,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAwGxC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAEzD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAIvD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAE5D;AAED,wBAAgB,2BAA2B,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,UAAU,CAYnF"}

package/dist/index.js

@@ -0,0 +1,460 @@
+// SPDX-License-Identifier: Apache-2.0
+import { randomBytes } from 'node:crypto';
+import canonicalize from 'canonicalize';
+import { base64urlDecode, base64urlEncode, canonicalRecord, computeContentId, getPublicKey, hexDecode, hexEncode, resolveChainRoot, sha256, signRecord, verifyRecord, } from '@atrib/mcp';
+export const ACTION_GATE_DECISION_EVENT_TYPE_URI = 'https://atrib.dev/v1/extensions/action-gate/decision';
+export const ACTION_GATE_OUTCOME_EVENT_TYPE_URI = 'https://atrib.dev/v1/extensions/action-gate/outcome';
+export const ACTION_GATE_DECISION_SCHEMA = 'atrib.action-gate.decision.v1';
+export const ACTION_GATE_OUTCOME_SCHEMA = 'atrib.action-gate.outcome.v1';
+export const DEFAULT_ACTION_GATE_SERVER_URL = 'action-gate://local';
+const DECISION_TOOL_NAME = 'atrib.action_gate.decision';
+const OUTCOME_TOOL_NAME = 'atrib.action_gate.outcome';
+const encoder = new TextEncoder();
+export async function runGatedAction(input) {
+    const recordDeliveryErrors = [];
+    const privateKey = resolveActionGatePrivateKey(input.privateKey);
+    const now = input.now ?? Date.now;
+    const contextId = input.contextId ?? randomContextId();
+    const serverUrl = input.serverUrl ?? DEFAULT_ACTION_GATE_SERVER_URL;
+    const timestampMs = now();
+    const timestamp = new Date(timestampMs).toISOString();
+    const parentRecordHashes = normalizeRecordHashes([
+        ...(input.parentRecordHashes ?? []),
+        ...(input.action.parent_record_hashes ?? []),
+    ]);
+    const policy = await resolvePolicyDecision({
+        evaluate: input.evaluate,
+        action: input.action,
+        timestamp,
+    });
+    const decisionEntry = buildActionGateDecisionEntry({
+        action: input.action,
+        policy,
+        timestamp,
+        parent_record_hashes: parentRecordHashes,
+    });
+    const decision = await signActionGateDecision({
+        entry: decisionEntry,
+        action: input.action,
+        privateKey,
+        contextId,
+        serverUrl,
+        timestampMs,
+    });
+    await notifyRecord(input.onRecord, decision.record, decision.sidecar, recordDeliveryErrors);
+    const outcomeInput = await resolveOutcomeInput({
+        state: decisionEntry.decision_state,
+        execute: input.execute,
+    });
+    const outcomeEntry = buildActionGateOutcomeEntry({
+        status: outcomeInput.status,
+        run_id: input.action.run_id,
+        action_id: input.action.action_id,
+        decision_id: decisionEntry.decision_id,
+        decision_record_hash: decision.record_hash,
+        executed: outcomeInput.executed,
+        timestamp: new Date(now()).toISOString(),
+        ...(outcomeInput.result !== undefined ? { result: outcomeInput.result } : {}),
+        ...(outcomeInput.error ? { error: outcomeInput.error } : {}),
+    });
+    const outcome = await signActionGateOutcome({
+        entry: outcomeEntry,
+        action: input.action,
+        privateKey,
+        contextId,
+        serverUrl,
+        decisionRecordHash: decision.record_hash,
+        chainTailHex: decision.record_hash.slice('sha256:'.length),
+        timestampMs: now(),
+    });
+    await notifyRecord(input.onRecord, outcome.record, outcome.sidecar, recordDeliveryErrors);
+    const verification = await verifyActionGateRun({ decision, outcome });
+    const base = {
+        state: decisionEntry.decision_state,
+        action_executed: outcomeEntry.executed,
+        decision,
+        outcome,
+        signed_records: [decision.record, outcome.record],
+        sidecars: [decision.sidecar, outcome.sidecar],
+        verification,
+        record_delivery_errors: recordDeliveryErrors,
+    };
+    if (outcomeInput.status === 'executed') {
+        return { ...base, result: outcomeInput.result };
+    }
+    if (outcomeInput.status === 'execution_error' && outcomeInput.error) {
+        return { ...base, error: outcomeInput.error };
+    }
+    return base;
+}
+export function buildActionGateDecisionEntry({ action, policy, timestamp, parent_record_hashes = [], }) {
+    const decisionState = decisionStateFromPolicy(policy.outcome);
+    const entryWithoutId = {
+        schema: ACTION_GATE_DECISION_SCHEMA,
+        decision_state: decisionState,
+        run_id: action.run_id,
+        action_id: action.action_id,
+        agent_id: action.agent_id,
+        surface: action.surface,
+        tool_name: action.tool_name,
+        args_digest: digestCanonical(action.args ?? {}),
+        risk: [...(action.risk ?? [])].sort(),
+        policy: {
+            policy_id: policy.policy_id,
+            version: policy.policy_version,
+            outcome: policy.outcome,
+            ...(policy.reason ? { reason: policy.reason } : {}),
+            authority: policy.authority ?? { mode: 'host-policy' },
+            approval: policy.approval ?? { required: policy.outcome === 'escalate' },
+            ...(policy.evidence ? { evidence: sortedRecord(policy.evidence) } : {}),
+        },
+        timestamp,
+        parent_record_hashes: normalizeRecordHashes(parent_record_hashes),
+        ...(action.refs ? { refs: sortedRecord(action.refs) } : {}),
+    };
+    return {
+        ...entryWithoutId,
+        decision_id: digestCanonical(entryWithoutId),
+    };
+}
+export function buildActionGateOutcomeEntry({ status, run_id, action_id, decision_id, decision_record_hash, executed, timestamp, result, error, }) {
+    const entryWithoutId = {
+        schema: ACTION_GATE_OUTCOME_SCHEMA,
+        status,
+        run_id,
+        action_id,
+        decision_id,
+        decision_record_hash,
+        executed,
+        ...(result !== undefined ? { result_digest: digestCanonical(result) } : {}),
+        ...(error ? { error } : {}),
+        timestamp,
+    };
+    return {
+        ...entryWithoutId,
+        outcome_id: digestCanonical(entryWithoutId),
+    };
+}
+export async function signActionGateDecision({ entry, action, privateKey, contextId, serverUrl = DEFAULT_ACTION_GATE_SERVER_URL, chainTailHex, timestampMs, }) {
+    const creatorKey = base64urlEncode(await getPublicKey(privateKey));
+    const record = {
+        spec_version: 'atrib/1.0',
+        content_id: computeContentId(serverUrl, `${DECISION_TOOL_NAME}.${entry.decision_state}`),
+        creator_key: creatorKey,
+        chain_root: resolveChainRoot({ contextId, autoChainTailHex: chainTailHex }),
+        event_type: ACTION_GATE_DECISION_EVENT_TYPE_URI,
+        context_id: contextId,
+        timestamp: timestampMs,
+        signature: '',
+        args_hash: hashCanonical(decisionSubject(entry)),
+        result_hash: hashCanonical(decisionResult(entry)),
+        tool_name: `${DECISION_TOOL_NAME}.${entry.decision_state}`,
+        ...(entry.parent_record_hashes.length > 0
+            ? { informed_by: [...entry.parent_record_hashes] }
+            : {}),
+    };
+    const signed = await signRecord(record, privateKey);
+    const recordHash = recordHashFor(signed);
+    return {
+        record: signed,
+        record_hash: recordHash,
+        entry,
+        sidecar: {
+            package: '@atrib/action-gate',
+            record_kind: 'decision',
+            record_hash: recordHash,
+            action,
+            decision: entry,
+            args: snapshotCanonical(action.args ?? {}),
+            informed_by: entry.parent_record_hashes,
+        },
+    };
+}
+export async function signActionGateOutcome({ entry, action, privateKey, contextId, decisionRecordHash, serverUrl = DEFAULT_ACTION_GATE_SERVER_URL, chainTailHex, timestampMs, result, }) {
+    const creatorKey = base64urlEncode(await getPublicKey(privateKey));
+    const record = {
+        spec_version: 'atrib/1.0',
+        content_id: computeContentId(serverUrl, `${OUTCOME_TOOL_NAME}.${entry.status}`),
+        creator_key: creatorKey,
+        chain_root: resolveChainRoot({ contextId, autoChainTailHex: chainTailHex }),
+        event_type: ACTION_GATE_OUTCOME_EVENT_TYPE_URI,
+        context_id: contextId,
+        timestamp: timestampMs,
+        signature: '',
+        args_hash: hashCanonical(outcomeSubject(entry)),
+        result_hash: hashCanonical(outcomeResult(entry)),
+        tool_name: `${OUTCOME_TOOL_NAME}.${entry.status}`,
+        informed_by: [decisionRecordHash],
+    };
+    const signed = await signRecord(record, privateKey);
+    const recordHash = recordHashFor(signed);
+    return {
+        record: signed,
+        record_hash: recordHash,
+        entry,
+        sidecar: {
+            package: '@atrib/action-gate',
+            record_kind: 'outcome',
+            record_hash: recordHash,
+            action,
+            outcome: entry,
+            ...(result !== undefined ? { result: snapshotCanonical(result) } : {}),
+            informed_by: [decisionRecordHash],
+        },
+    };
+}
+export async function verifyActionGateRun({ decision, outcome, }) {
+    const issues = [];
+    const decisionOk = await verifyRecord(decision.record);
+    const outcomeOk = await verifyRecord(outcome.record);
+    if (!decisionOk) {
+        issues.push({
+            code: 'decision_signature_invalid',
+            message: 'decision record signature failed verification',
+        });
+    }
+    if (!outcomeOk) {
+        issues.push({
+            code: 'outcome_signature_invalid',
+            message: 'outcome record signature failed verification',
+        });
+    }
+    if (decision.record_hash !== recordHashFor(decision.record)) {
+        issues.push({
+            code: 'decision_sidecar_hash_mismatch',
+            message: 'decision record_hash does not match signed bytes',
+        });
+    }
+    if (outcome.record_hash !== recordHashFor(outcome.record)) {
+        issues.push({
+            code: 'outcome_sidecar_hash_mismatch',
+            message: 'outcome record_hash does not match signed bytes',
+        });
+    }
+    if (!outcome.record.informed_by?.includes(decision.record_hash)) {
+        issues.push({
+            code: 'outcome_missing_decision_parent',
+            message: 'outcome record does not cite the decision record',
+        });
+    }
+    if (outcome.entry.decision_record_hash !== decision.record_hash) {
+        issues.push({
+            code: 'decision_record_hash_mismatch',
+            message: 'outcome entry points at a different decision record hash',
+        });
+    }
+    if (outcome.entry.decision_id !== decision.entry.decision_id) {
+        issues.push({
+            code: 'decision_id_mismatch',
+            message: 'outcome entry points at a different decision id',
+        });
+    }
+    if (outcome.entry.run_id !== decision.entry.run_id) {
+        issues.push({ code: 'run_id_mismatch', message: 'run id drifted between records' });
+    }
+    if (outcome.entry.action_id !== decision.entry.action_id) {
+        issues.push({
+            code: 'action_id_mismatch',
+            message: 'action id drifted between records',
+        });
+    }
+    const state = decision.entry.decision_state;
+    if (state === 'allowed' && !['executed', 'execution_error'].includes(outcome.entry.status)) {
+        issues.push({
+            code: 'allowed_action_missing_execution_status',
+            message: 'allowed decisions must end in executed or execution_error',
+        });
+    }
+    if (state === 'blocked') {
+        if (outcome.entry.executed) {
+            issues.push({ code: 'blocked_action_executed', message: 'blocked action executed' });
+        }
+        if (outcome.entry.status !== 'blocked') {
+            issues.push({
+                code: 'closed_decision_status_mismatch',
+                message: 'blocked decision did not produce blocked outcome',
+            });
+        }
+    }
+    if (state === 'escalated') {
+        if (outcome.entry.executed) {
+            issues.push({
+                code: 'escalated_action_executed',
+                message: 'escalated action executed before approval',
+            });
+        }
+        if (outcome.entry.status !== 'escalated') {
+            issues.push({
+                code: 'closed_decision_status_mismatch',
+                message: 'escalated decision did not produce escalated outcome',
+            });
+        }
+    }
+    if (state === 'policy_error') {
+        if (outcome.entry.executed) {
+            issues.push({
+                code: 'policy_error_action_executed',
+                message: 'policy-error action executed',
+            });
+        }
+        if (outcome.entry.status !== 'policy_error') {
+            issues.push({
+                code: 'closed_decision_status_mismatch',
+                message: 'policy-error decision did not produce policy_error outcome',
+            });
+        }
+    }
+    return { valid: issues.length === 0, issues };
+}
+export function digestCanonical(value) {
+    return hashCanonical(value);
+}
+export function hashCanonical(value) {
+    const json = canonicalize(value);
+    if (json === undefined)
+        throw new Error('failed to canonicalize action-gate material');
+    return `sha256:${hexEncode(sha256(encoder.encode(json)))}`;
+}
+export function recordHashFor(record) {
+    return `sha256:${hexEncode(sha256(canonicalRecord(record)))}`;
+}
+export function resolveActionGatePrivateKey(value) {
+    const raw = value ?? (typeof process !== 'undefined' ? process.env.ATRIB_PRIVATE_KEY : undefined);
+    if (raw instanceof Uint8Array) {
+        if (raw.length !== 32)
+            throw new Error('Action Gate privateKey must be 32 bytes');
+        return new Uint8Array(raw);
+    }
+    if (typeof raw !== 'string' || raw.length === 0) {
+        throw new Error('provide privateKey or set ATRIB_PRIVATE_KEY');
+    }
+    const decoded = /^[0-9a-f]{64}$/u.test(raw) ? hexDecode(raw) : base64urlDecode(raw);
+    if (decoded.length !== 32)
+        throw new Error('Action Gate privateKey must be 32 bytes');
+    return decoded;
+}
+function decisionStateFromPolicy(outcome) {
+    if (outcome === 'allow')
+        return 'allowed';
+    if (outcome === 'block')
+        return 'blocked';
+    if (outcome === 'escalate')
+        return 'escalated';
+    return 'policy_error';
+}
+async function resolveOutcomeInput({ state, execute, }) {
+    if (state === 'blocked')
+        return { status: 'blocked', executed: false };
+    if (state === 'escalated')
+        return { status: 'escalated', executed: false };
+    if (state === 'policy_error')
+        return { status: 'policy_error', executed: false };
+    try {
+        return { status: 'executed', executed: true, result: await execute() };
+    }
+    catch (error) {
+        return { status: 'execution_error', executed: true, error: normalizeError(error) };
+    }
+}
+async function resolvePolicyDecision({ evaluate, action, timestamp, }) {
+    try {
+        return await evaluate({ action, timestamp });
+    }
+    catch (error) {
+        const normalized = normalizeError(error);
+        return {
+            outcome: 'error',
+            policy_id: 'action-gate-policy-evaluator',
+            policy_version: 'error',
+            reason: `policy evaluator failed: ${normalized.name}: ${normalized.message}`,
+            authority: { mode: 'host-policy' },
+            approval: { required: false },
+        };
+    }
+}
+function decisionSubject(entry) {
+    return {
+        schema: entry.schema,
+        decision_id: entry.decision_id,
+        run_id: entry.run_id,
+        action_id: entry.action_id,
+        agent_id: entry.agent_id,
+        surface: entry.surface,
+        tool_name: entry.tool_name,
+        args_digest: entry.args_digest,
+    };
+}
+function decisionResult(entry) {
+    return {
+        decision_state: entry.decision_state,
+        risk: entry.risk,
+        policy: entry.policy,
+        parent_record_hashes: entry.parent_record_hashes,
+        refs: entry.refs ?? {},
+    };
+}
+function outcomeSubject(entry) {
+    return {
+        schema: entry.schema,
+        outcome_id: entry.outcome_id,
+        run_id: entry.run_id,
+        action_id: entry.action_id,
+        decision_id: entry.decision_id,
+        decision_record_hash: entry.decision_record_hash,
+    };
+}
+function outcomeResult(entry) {
+    return {
+        status: entry.status,
+        executed: entry.executed,
+        result_digest: entry.result_digest ?? null,
+        error: entry.error ?? null,
+    };
+}
+function snapshotCanonical(value) {
+    try {
+        const json = canonicalize(value);
+        if (json === undefined)
+            return undefined;
+        return JSON.parse(json);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function notifyRecord(onRecord, record, sidecar, errors) {
+    if (!onRecord)
+        return;
+    try {
+        await onRecord(record, sidecar);
+    }
+    catch (error) {
+        errors.push({
+            record_kind: sidecar.record_kind,
+            record_hash: sidecar.record_hash,
+            ...normalizeError(error),
+        });
+    }
+}
+function sortedRecord(input) {
+    return Object.fromEntries(Object.entries(input).sort(([left], [right]) => left.localeCompare(right)));
+}
+function normalizeRecordHashes(values) {
+    const unique = new Set();
+    for (const value of values) {
+        if (!/^sha256:[0-9a-f]{64}$/u.test(value)) {
+            throw new Error('record hashes must be sha256:<64 lowercase hex>');
+        }
+        unique.add(value);
+    }
+    return [...unique].sort();
+}
+function randomContextId() {
+    return randomBytes(16).toString('hex');
+}
+function normalizeError(error) {
+    if (error instanceof Error)
+        return { name: error.name, message: error.message };
+    return { name: 'Error', message: String(error) };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,YAAY,MAAM,cAAc,CAAA;AACvC,OAAO,EACL,eAAe,EACf,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,MAAM,EACN,UAAU,EACV,YAAY,GACb,MAAM,YAAY,CAAA;AAGnB,MAAM,CAAC,MAAM,mCAAmC,GAC9C,sDAA+D,CAAA;AACjE,MAAM,CAAC,MAAM,kCAAkC,GAC7C,qDAA8D,CAAA;AAChE,MAAM,CAAC,MAAM,2BAA2B,GAAG,+BAAwC,CAAA;AACnF,MAAM,CAAC,MAAM,0BAA0B,GAAG,8BAAuC,CAAA;AACjF,MAAM,CAAC,MAAM,8BAA8B,GAAG,qBAA8B,CAAA;AAE5E,MAAM,kBAAkB,GAAG,4BAA4B,CAAA;AACvD,MAAM,iBAAiB,GAAG,2BAA2B,CAAA;AACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAiLjC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAmC;IAEnC,MAAM,oBAAoB,GAAoC,EAAE,CAAA;IAChE,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,eAAe,EAAE,CAAA;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,8BAA8B,CAAA;IACnE,MAAM,WAAW,GAAG,GAAG,EAAE,CAAA;IACzB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAA;IACrD,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;QAC/C,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC;QACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS;KACV,CAAC,CAAA;IACF,MAAM,aAAa,GAAG,4BAA4B,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,SAAS;QACT,oBAAoB,EAAE,kBAAkB;KACzC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC;QAC5C,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU;QACV,SAAS;QACT,SAAS;QACT,WAAW;KACZ,CAAC,CAAA;IACF,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;IAE3F,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC;QAC7C,KAAK,EAAE,aAAa,CAAC,cAAc;QACnC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAA;IACF,MAAM,YAAY,GAAG,2BAA2B,CAAC;QAC/C,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;QAC3B,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACjC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,oBAAoB,EAAE,QAAQ,CAAC,WAAW;QAC1C,QAAQ,EAAE,YAAY,CAAC,QAAQ;QAC/B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;QACxC,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC;QAC1C,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU;QACV,SAAS;QACT,SAAS;QACT,kBAAkB,EAAE,QAAQ,CAAC,WAAW;QACxC,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QAC1D,WAAW,EAAE,GAAG,EAAE;KACnB,CAAC,CAAA;IACF,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;IAEzF,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAA;IACrE,MAAM,IAAI,GAAG;QACX,KAAK,EAAE,aAAa,CAAC,cAAc;QACnC,eAAe,EAAE,YAAY,CAAC,QAAQ;QACtC,QAAQ;QACR,OAAO;QACP,cAAc,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;QACjD,QAAQ,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;QAC7C,YAAY;QACZ,sBAAsB,EAAE,oBAAoB;KACoB,CAAA;IAElE,IAAI,YAAY,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACvC,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,MAAiB,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,KAAK,iBAAiB,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC;QACpE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAA;IAC/C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,EAC3C,MAAM,EACN,MAAM,EACN,SAAS,EACT,oBAAoB,GAAG,EAAE,GAM1B;IACC,MAAM,aAAa,GAAG,uBAAuB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7D,MAAM,cAAc,GAAG;QACrB,MAAM,EAAE,2BAA2B;QACnC,cAAc,EAAE,aAAa;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/C,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QACrC,MAAM,EAAE;YACN,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,cAAc;YAC9B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE;YACtD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE;YACxE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE;QACD,SAAS;QACT,oBAAoB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACL,CAAA;IAExD,OAAO;QACL,GAAG,cAAc;QACjB,WAAW,EAAE,eAAe,CAAC,cAAc,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,EAC1C,MAAM,EACN,MAAM,EACN,SAAS,EACT,WAAW,EACX,oBAAoB,EACpB,QAAQ,EACR,SAAS,EACT,MAAM,EACN,KAAK,GAWN;IACC,MAAM,cAAc,GAAG;QACrB,MAAM,EAAE,0BAA0B;QAClC,MAAM;QACN,MAAM;QACN,SAAS;QACT,WAAW;QACX,oBAAoB;QACpB,QAAQ;QACR,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,SAAS;KAC2C,CAAA;IAEtD,OAAO;QACL,GAAG,cAAc;QACjB,UAAU,EAAE,eAAe,CAAC,cAAc,CAAC;KAC5C,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAC3C,KAAK,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,SAAS,GAAG,8BAA8B,EAC1C,YAAY,EACZ,WAAW,GASZ;IACC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC,CAAA;IAClE,MAAM,MAAM,GAAgB;QAC1B,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,gBAAgB,CAAC,SAAS,EAAE,GAAG,kBAAkB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACxF,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;QAC3E,UAAU,EAAE,mCAAmC;QAC/C,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAChD,WAAW,EAAE,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACjD,SAAS,EAAE,GAAG,kBAAkB,IAAI,KAAK,CAAC,cAAc,EAAE;QAC1D,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;YACvC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,UAAU;QACvB,KAAK;QACL,OAAO,EAAE;YACP,OAAO,EAAE,oBAAoB;YAC7B,WAAW,EAAE,UAAU;YACvB,WAAW,EAAE,UAAU;YACvB,MAAM;YACN,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1C,WAAW,EAAE,KAAK,CAAC,oBAAoB;SACxC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAC1C,KAAK,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,kBAAkB,EAClB,SAAS,GAAG,8BAA8B,EAC1C,YAAY,EACZ,WAAW,EACX,MAAM,GAWP;IACC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC,CAAA;IAClE,MAAM,MAAM,GAAgB;QAC1B,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,gBAAgB,CAAC,SAAS,EAAE,GAAG,iBAAiB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC/E,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC;QAC3E,UAAU,EAAE,kCAAkC;QAC9C,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/C,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAChD,SAAS,EAAE,GAAG,iBAAiB,IAAI,KAAK,CAAC,MAAM,EAAE;QACjD,WAAW,EAAE,CAAC,kBAAkB,CAAC;KAClC,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,UAAU;QACvB,KAAK;QACL,OAAO,EAAE;YACP,OAAO,EAAE,oBAAoB;YAC7B,WAAW,EAAE,SAAS;YACtB,WAAW,EAAE,UAAU;YACvB,MAAM;YACN,OAAO,EAAE,KAAK;YACd,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,WAAW,EAAE,CAAC,kBAAkB,CAAC;SAClC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,QAAQ,EACR,OAAO,GAIR;IACC,MAAM,MAAM,GAAkC,EAAE,CAAA;IAChD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACpD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,4BAA4B;YAClC,OAAO,EAAE,+CAA+C;SACzD,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,KAAK,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iCAAiC;YACvC,OAAO,EAAE,kDAAkD;SAC5D,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,oBAAoB,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QAChE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,iDAAiD;SAC3D,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAA;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3F,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,yCAAyC;YAC/C,OAAO,EAAE,2DAA2D;SACrE,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAA;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,kDAAkD;aAC5D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,2CAA2C;aACrD,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,8BAA8B;aACxC,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,4DAA4D;aACtE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,aAAa,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IACtF,OAAO,UAAU,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,OAAO,UAAU,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAA2B;IACrE,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACjG,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;QAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACjF,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;IACnF,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IACrF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAgC;IAC/D,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,OAAO,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IACzC,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,WAAW,CAAA;IAC9C,OAAO,cAAc,CAAA;AACvB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAU,EAC1C,KAAK,EACL,OAAO,GAIR;IAMC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACtE,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IAC1E,IAAI,KAAK,KAAK,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IAChF,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,EAAE,CAAA;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAA;IACpF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,EACnC,QAAQ,EACR,MAAM,EACN,SAAS,GAKV;IACC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;QACxC,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,8BAA8B;YACzC,cAAc,EAAE,OAAO;YACvB,MAAM,EAAE,4BAA4B,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE;YAC5E,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;YAClC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;SAC9B,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B;IACrD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA8B;IACpD,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE;KACvB,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA6B;IACnD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;KACjD,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;KAC3B,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAAkD,EAClD,MAAmB,EACnB,OAA+B,EAC/B,MAAuC;IAEvC,IAAI,CAAC,QAAQ;QAAE,OAAM;IACrB,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,cAAc,CAAC,KAAK,CAAC;SACzB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAA6B;IACjD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAC3E,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAyB;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAa,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,KAAkB,CAAC,CAAA;IAChC,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED,SAAS,eAAe;IACtB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAA;IAC/E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;AAClD,CAAC"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@atrib/action-gate",
+  "version": "0.0.1",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "description": "Host-owned action gate helpers for Atrib's verifiable action layer. Signs policy decisions and outcomes before high-impact agent actions run.",
+  "author": "atrib <hello@atrib.dev>",
+  "license": "Apache-2.0",
+  "homepage": "https://atrib.dev",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/creatornader/atrib.git",
+    "directory": "packages/action-gate"
+  },
+  "keywords": [
+    "action-gate",
+    "action-control",
+    "agent",
+    "policy",
+    "approval",
+    "governance",
+    "human-in-the-loop",
+    "agent-control",
+    "verifiable",
+    "receipts",
+    "browser-automation",
+    "computer-use",
+    "atrib"
+  ],
+  "dependencies": {
+    "canonicalize": "^3.0.0",
+    "@atrib/mcp": "0.18.1"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.3",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  }
+}