@axtary/actionpass 0.0.1 → 0.1.0

package/dist/index.js

@@ -0,0 +1,1204 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { decodeProtectedHeader, SignJWT, jwtVerify, } from "jose";
+import { z } from "zod";
+export const ACTION_SCHEMA_VERSION = "axtary.action.v0";
+export const ACTIONPASS_VERSION = "axtary.actionpass.v0";
+export const APPROVAL_ARTIFACT_VERSION = "axtary.approval.v0";
+export const ACTIONPASS_REVOCATION_VERSION = "axtary.actionpass_revocation.v0";
+export const ACTIONPASS_TRUST_STORE_VERSION = "axtary.actionpass_trust_store.v0";
+export const LEDGER_SCHEMA_VERSION = "axtary.ledger.v0";
+export const LEDGER_PROVIDER_EVIDENCE_VERSION = "axtary.ledger_provider_evidence.v0";
+export const LEDGER_EXECUTION_OUTCOME_VERSION = "axtary.ledger_execution_outcome.v0";
+export const DEFAULT_EXPIRES_IN_SECONDS = 600;
+export const DEFAULT_SIGNING_ALGORITHM = "ES256";
+const JsonValueSchema = z.lazy(() => z.union([
+    z.string(),
+    z.number().finite(),
+    z.boolean(),
+    z.null(),
+    z.array(JsonValueSchema),
+    z.record(z.string(), JsonValueSchema),
+]));
+export const AxtaryDecisionSchema = z.enum(["allow", "deny", "step_up"]);
+export const NormalizedActionSchema = z.object({
+    schemaVersion: z.literal(ACTION_SCHEMA_VERSION).default(ACTION_SCHEMA_VERSION),
+    actor: z.object({
+        agentId: z.string().min(1),
+        humanOwner: z.string().min(1),
+        runtime: z.string().min(1),
+        tenant: z.string().min(1).optional(),
+    }),
+    intent: z.object({
+        taskId: z.string().min(1),
+        declaredGoal: z.string().min(1),
+        maxDelegationDepth: z.number().int().nonnegative().optional(),
+    }),
+    capability: z.object({
+        tool: z.string().min(1),
+        resource: z.string().min(1),
+        payload: z.record(z.string(), JsonValueSchema),
+        constraints: z.record(z.string(), JsonValueSchema).optional(),
+    }),
+    toolDefinition: z
+        .object({
+        serverIdentity: z.string().min(1),
+        schemaVersion: z.string().min(1),
+        definitionHash: z.string().min(1),
+    })
+        .optional(),
+    budget: z
+        .object({
+        reservationId: z.string().min(1).optional(),
+        limit: z.record(z.string(), JsonValueSchema).optional(),
+        commitStatus: z.enum(["pending", "committed", "rolled_back"]).optional(),
+    })
+        .optional(),
+});
+export const PolicyDecisionSchema = z.object({
+    decision: AxtaryDecisionSchema,
+    reasons: z.array(z.string().min(1)),
+    policy: z.object({
+        nativeRule: z.string().min(1),
+        version: z.string().min(1),
+        cedarCompatible: z.boolean(),
+        opaCompatible: z.boolean(),
+    }),
+    constraints: z.object({
+        expiresInSeconds: z.number().int().positive(),
+        maxFilesChanged: z.number().int().nonnegative(),
+        blockedPaths: z.array(z.string().min(1)),
+    }),
+});
+export const ApprovalSchema = z.object({
+    mode: z.enum(["none", "human", "policy_override"]),
+    approvedBy: z.string().min(1).optional(),
+    approvalArtifact: z.string().min(1).optional(),
+    approvalArtifactHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    approvedAt: z.string().datetime().optional(),
+});
+export const ApprovalArtifactSchema = z.object({
+    schemaVersion: z.literal(APPROVAL_ARTIFACT_VERSION),
+    id: z.string().min(1),
+    mode: z.enum(["human", "policy_override"]),
+    approvedBy: z.string().min(1),
+    approvedAt: z.string().datetime(),
+    actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    taskId: z.string().min(1),
+    tool: z.string().min(1),
+    resource: z.string().min(1),
+    reason: z.string().min(1).optional(),
+    expiresAt: z.string().datetime().optional(),
+});
+export const ActionPassClaimsSchema = z.object({
+    apv: z.literal(ACTIONPASS_VERSION),
+    iss: z.string().min(1),
+    sub: z.string().min(1),
+    aud: z.union([z.string().min(1), z.array(z.string().min(1))]),
+    exp: z.number().int().positive(),
+    nbf: z.number().int().positive(),
+    iat: z.number().int().positive(),
+    jti: z.string().min(1),
+    tenant: z.string().min(1),
+    humanOwner: z.string().min(1),
+    agentRuntime: z.string().min(1),
+    intent: NormalizedActionSchema.shape.intent,
+    capability: z.object({
+        tool: z.string().min(1),
+        resource: z.string().min(1),
+        constraints: z.record(z.string(), JsonValueSchema).optional(),
+    }),
+    decision: AxtaryDecisionSchema,
+    reasons: z.array(z.string().min(1)),
+    policy: PolicyDecisionSchema.shape.policy,
+    payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    approval: ApprovalSchema.optional(),
+    audit: z.object({
+        traceId: z.string().min(1),
+        parentPassId: z.string().min(1).nullable(),
+        ledgerHash: z.string().min(1).nullable(),
+    }),
+});
+export const ActionPassRevocationSchema = z.object({
+    schemaVersion: z.literal(ACTIONPASS_REVOCATION_VERSION),
+    passId: z.string().min(1),
+    revokedAt: z.string().datetime(),
+    revokedBy: z.string().min(1).optional(),
+    reason: z.string().min(1).optional(),
+});
+export const ActionPassVerificationKeyRecordSchema = z.object({
+    kid: z.string().min(1),
+    publicJwk: z.record(z.string(), JsonValueSchema),
+    algorithm: z.string().min(1).optional(),
+    status: z.enum(["active", "retired", "revoked"]).default("active"),
+    notBefore: z.string().datetime().optional(),
+    expiresAt: z.string().datetime().optional(),
+});
+export const ActionPassTrustStoreSchema = z.object({
+    schemaVersion: z.literal(ACTIONPASS_TRUST_STORE_VERSION),
+    keys: z.array(ActionPassVerificationKeyRecordSchema).default([]),
+    revocations: z.array(ActionPassRevocationSchema).default([]),
+});
+export const LedgerProviderEvidenceDiffLineSchema = z.object({
+    type: z.enum(["context", "addition", "deletion"]),
+    content: z.string(),
+    oldLine: z.number().int().positive().optional(),
+    newLine: z.number().int().positive().optional(),
+});
+export const LedgerProviderEvidenceDiffFileSchema = z.object({
+    path: z.string().min(1),
+    oldPath: z.string().min(1).optional(),
+    status: z.enum(["added", "modified", "deleted", "renamed"]),
+    additions: z.number().int().nonnegative().default(0),
+    deletions: z.number().int().nonnegative().default(0),
+    hunks: z
+        .array(z.object({
+        header: z.string().min(1),
+        lines: z.array(LedgerProviderEvidenceDiffLineSchema),
+    }))
+        .default([]),
+});
+export const LedgerProviderSchema = z.enum([
+    "github",
+    "slack",
+    "linear",
+    "docs",
+    "mcp",
+    "aws",
+    "gcp",
+    "jira",
+]);
+export const LedgerProviderEvidenceDiffSchema = z.object({
+    provider: LedgerProviderSchema,
+    summary: z.string().min(1).optional(),
+    files: z.array(LedgerProviderEvidenceDiffFileSchema).default([]),
+});
+export const LedgerProviderEvidenceFieldChangeSchema = z.object({
+    field: z.string().min(1),
+    before: JsonValueSchema.optional(),
+    after: JsonValueSchema.optional(),
+});
+export const LedgerProviderEvidenceSchema = z.object({
+    schemaVersion: z.literal(LEDGER_PROVIDER_EVIDENCE_VERSION),
+    provider: LedgerProviderSchema,
+    tool: z.string().min(1),
+    operation: z.string().min(1),
+    resource: z
+        .object({
+        provider: LedgerProviderSchema,
+        kind: z.string().min(1),
+        id: z.string().min(1),
+        label: z.string().min(1).optional(),
+        url: z.string().url().optional(),
+    })
+        .strict(),
+    normalized: z.record(z.string(), JsonValueSchema).default({}),
+    fieldChanges: z.array(LedgerProviderEvidenceFieldChangeSchema).default([]),
+    diff: LedgerProviderEvidenceDiffSchema.optional(),
+});
+export const LedgerExecutionOutcomeSchema = z
+    .object({
+    schemaVersion: z.literal(LEDGER_EXECUTION_OUTCOME_VERSION),
+    status: z.enum(["succeeded", "failed"]),
+    provider: LedgerProviderSchema.optional(),
+    resultId: z.string().min(1).optional(),
+    resultUrl: z.string().url().optional(),
+    resourceId: z.string().min(1).optional(),
+    resourceLabel: z.string().min(1).optional(),
+    failureReason: z.string().min(1).optional(),
+    errorClass: z.string().min(1).optional(),
+    sideEffectProof: z.record(z.string(), JsonValueSchema).default({}),
+})
+    .strict();
+export const LedgerRecordSchema = z.object({
+    schemaVersion: z.literal(LEDGER_SCHEMA_VERSION),
+    id: z.string().min(1),
+    occurredAt: z.string().datetime(),
+    actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    decision: AxtaryDecisionSchema,
+    reasons: z.array(z.string().min(1)),
+    policy: PolicyDecisionSchema.shape.policy,
+    providerEvidence: LedgerProviderEvidenceSchema.optional(),
+    executionOutcome: LedgerExecutionOutcomeSchema.optional(),
+    traceId: z.string().min(1).optional(),
+    actionPassId: z.string().min(1).nullable(),
+    correlationId: z.string().min(1).optional(),
+    previousLedgerHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).nullable(),
+    ledgerHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+});
+export const demoAction = NormalizedActionSchema.parse({
+    actor: {
+        agentId: "agent:codex-prod",
+        humanOwner: "user:asrar@company.com",
+        runtime: "codex-cli",
+        tenant: "org:company",
+    },
+    intent: {
+        taskId: "AXT-418",
+        declaredGoal: "Open a PR that fixes the auth redirect bug",
+    },
+    capability: {
+        tool: "github.pull_requests.create",
+        resource: "repo:company/web-app",
+        payload: {
+            baseBranch: "main",
+            filesChanged: ["src/app/login/page.tsx", "src/lib/auth/session.ts"],
+            touchesProduction: false,
+        },
+    },
+});
+export function parseNormalizedAction(action) {
+    return NormalizedActionSchema.parse(action);
+}
+export function evaluateAction(actionInput, options = {}) {
+    const action = parseNormalizedAction(actionInput);
+    const payload = action.capability.payload;
+    const filesChanged = getStringArray(payload.filesChanged);
+    const requiredBaseBranch = options.requiredBaseBranch ?? "main";
+    const maxFilesChanged = options.maxFilesChanged ?? 12;
+    const blockedPathPrefixes = options.blockedPathPrefixes ?? [
+        "infra/prod/",
+        "billing/",
+        ".env",
+    ];
+    const policy = {
+        nativeRule: "github_pr_coding_agent_v0",
+        version: options.policyVersion ?? "2026-05-30",
+        cedarCompatible: true,
+        opaCompatible: true,
+    };
+    const constraints = {
+        expiresInSeconds: DEFAULT_EXPIRES_IN_SECONDS,
+        maxFilesChanged,
+        blockedPaths: ["infra/prod/**", "billing/**", ".env*"],
+    };
+    const stepUpReasons = [];
+    if (action.capability.tool !== (options.allowedTool ?? "github.pull_requests.create")) {
+        return {
+            decision: "deny",
+            reasons: [
+                `unsupported_tool: ${action.capability.tool} is not enabled by this policy`,
+            ],
+            policy,
+            constraints,
+        };
+    }
+    if (payload.baseBranch !== requiredBaseBranch) {
+        stepUpReasons.push(`base_branch_mismatch: expected ${requiredBaseBranch}`);
+    }
+    if (filesChanged.length > maxFilesChanged) {
+        stepUpReasons.push("file_count_exceeds_policy_limit");
+    }
+    if (filesChanged.some((path) => blockedPathPrefixes.some((prefix) => path.startsWith(prefix)))) {
+        stepUpReasons.push("payload_touches_protected_path");
+    }
+    if (payload.touchesProduction === true) {
+        stepUpReasons.push("payload_declares_production_impact");
+    }
+    if (stepUpReasons.length > 0) {
+        return {
+            decision: "step_up",
+            reasons: stepUpReasons,
+            policy,
+            constraints,
+        };
+    }
+    return {
+        decision: "allow",
+        reasons: ["payload_is_inside_current_actionpass_constraints"],
+        policy,
+        constraints,
+    };
+}
+export async function authorize(input) {
+    const action = parseNormalizedAction(input.action);
+    const decision = evaluateAction(action, input.policy);
+    const payloadHash = hashPayload(action.capability.payload);
+    const traceId = input.traceId ?? `trace_${randomUUID()}`;
+    const actionPass = decision.decision === "allow"
+        ? await issueActionPass({
+            action,
+            decision,
+            issuer: input.issuer,
+            tenant: input.tenant,
+            signingKey: input.signingKey,
+            keyId: input.keyId,
+            algorithm: input.algorithm,
+            now: input.now,
+            approval: input.approval,
+            approvalArtifact: input.approvalArtifact,
+            traceId,
+        })
+        : null;
+    const ledger = recordDecision({
+        action,
+        decision,
+        actionPassId: actionPass?.claims.jti ?? null,
+        previousLedgerHash: input.previousLedgerHash ?? null,
+        occurredAt: input.now,
+        traceId,
+    });
+    return {
+        action,
+        decision,
+        payloadHash,
+        actionPass,
+        ledger,
+    };
+}
+export function createApprovalArtifact(input) {
+    const action = parseNormalizedAction(input.action);
+    const artifact = ApprovalArtifactSchema.parse({
+        schemaVersion: APPROVAL_ARTIFACT_VERSION,
+        id: input.id ?? `approval_${randomUUID()}`,
+        mode: input.mode,
+        approvedBy: input.approvedBy,
+        approvedAt: (input.approvedAt ?? new Date()).toISOString(),
+        actionHash: hashAction(action),
+        payloadHash: hashPayload(action.capability.payload),
+        taskId: action.intent.taskId,
+        tool: action.capability.tool,
+        resource: action.capability.resource,
+        reason: input.reason,
+        expiresAt: input.expiresAt?.toISOString(),
+    });
+    const artifactHash = hashJson(artifact);
+    return {
+        artifact,
+        artifactHash,
+        approval: {
+            mode: artifact.mode,
+            approvedBy: artifact.approvedBy,
+            approvedAt: artifact.approvedAt,
+            approvalArtifact: artifact.id,
+            approvalArtifactHash: artifactHash,
+            actionHash: artifact.actionHash,
+            payloadHash: artifact.payloadHash,
+        },
+    };
+}
+export async function issueActionPass(input) {
+    const action = parseNormalizedAction(input.action);
+    const decision = PolicyDecisionSchema.parse(input.decision);
+    if (decision.decision !== "allow") {
+        throw new Error("ActionPass can only be issued for an allow decision.");
+    }
+    const now = input.now ?? new Date();
+    const issuedAt = toNumericDate(now);
+    const expiresInSeconds = input.expiresInSeconds ?? decision.constraints.expiresInSeconds;
+    const expiresAt = issuedAt + expiresInSeconds;
+    const passId = `ap_${randomUUID()}`;
+    const actionHash = hashAction(action);
+    const payloadHash = hashPayload(action.capability.payload);
+    const approval = bindApproval({
+        action,
+        actionHash,
+        payloadHash,
+        approval: input.approval,
+        approvalArtifact: input.approvalArtifact,
+        now,
+    });
+    const claims = ActionPassClaimsSchema.parse({
+        apv: ACTIONPASS_VERSION,
+        iss: input.issuer,
+        sub: action.actor.agentId,
+        aud: action.capability.resource,
+        exp: expiresAt,
+        nbf: issuedAt,
+        iat: issuedAt,
+        jti: passId,
+        tenant: input.tenant,
+        humanOwner: action.actor.humanOwner,
+        agentRuntime: action.actor.runtime,
+        intent: action.intent,
+        capability: {
+            tool: action.capability.tool,
+            resource: action.capability.resource,
+            constraints: action.capability.constraints,
+        },
+        decision: decision.decision,
+        reasons: decision.reasons,
+        policy: decision.policy,
+        payloadHash,
+        approval,
+        audit: {
+            traceId: input.traceId ?? `trace_${randomUUID()}`,
+            parentPassId: input.parentPassId ?? null,
+            ledgerHash: input.ledgerHash ?? null,
+        },
+    });
+    const token = await new SignJWT(claims)
+        .setProtectedHeader({
+        alg: input.algorithm ?? DEFAULT_SIGNING_ALGORITHM,
+        typ: "axtary-actionpass+jwt",
+        kid: input.keyId,
+    })
+        .sign(input.signingKey);
+    return { token, claims };
+}
+export async function verifyActionPass(input) {
+    try {
+        const action = parseNormalizedAction(input.action);
+        const verificationKey = await resolveVerificationKey(input);
+        const { payload } = await jwtVerify(input.token, verificationKey, {
+            issuer: input.issuer,
+            audience: input.audience ?? action.capability.resource,
+            algorithms: input.algorithms ?? [DEFAULT_SIGNING_ALGORITHM],
+            clockTolerance: input.clockTolerance,
+            currentDate: input.currentDate,
+        });
+        const claims = ActionPassClaimsSchema.parse(payload);
+        const payloadHash = hashPayload(action.capability.payload);
+        const bindingError = validatePassBinding(claims, action, payloadHash);
+        if (bindingError) {
+            return {
+                valid: false,
+                reason: bindingError,
+            };
+        }
+        const revocationError = await validateRevocation(input, claims);
+        if (revocationError) {
+            return {
+                valid: false,
+                reason: revocationError,
+            };
+        }
+        return {
+            valid: true,
+            claims,
+            payloadHash,
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            reason: error instanceof Error ? error.message : "verification_failed",
+        };
+    }
+}
+export function revokeActionPass(input) {
+    return ActionPassRevocationSchema.parse({
+        schemaVersion: ACTIONPASS_REVOCATION_VERSION,
+        passId: input.passId,
+        revokedAt: (input.revokedAt ?? new Date()).toISOString(),
+        revokedBy: input.revokedBy,
+        reason: input.reason,
+    });
+}
+export class LocalActionPassTrustStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async read() {
+        return readTrustStore(this.filePath);
+    }
+    async write(dataInput) {
+        const data = ActionPassTrustStoreSchema.parse({
+            schemaVersion: ACTIONPASS_TRUST_STORE_VERSION,
+            keys: dataInput.keys ?? [],
+            revocations: dataInput.revocations ?? [],
+        });
+        await writeTrustStore(this.filePath, data);
+        return data;
+    }
+    async putVerificationKey(keyInput) {
+        const key = ActionPassVerificationKeyRecordSchema.parse(keyInput);
+        const data = await this.read();
+        const nextKeys = [
+            ...data.keys.filter((entry) => entry.kid !== key.kid),
+            key,
+        ].sort((left, right) => left.kid.localeCompare(right.kid));
+        await this.write({
+            ...data,
+            keys: nextKeys,
+        });
+        return key;
+    }
+    async revokeActionPass(input) {
+        const revocation = "schemaVersion" in input
+            ? ActionPassRevocationSchema.parse(input)
+            : revokeActionPass(input);
+        const data = await this.read();
+        const nextRevocations = [
+            ...data.revocations.filter((entry) => entry.passId !== revocation.passId),
+            revocation,
+        ].sort((left, right) => left.passId.localeCompare(right.passId));
+        await this.write({
+            ...data,
+            revocations: nextRevocations,
+        });
+        return revocation;
+    }
+    async getVerificationKey(keyId, now = new Date()) {
+        if (!keyId) {
+            return undefined;
+        }
+        const data = await this.read();
+        const key = data.keys.find((entry) => entry.kid === keyId);
+        if (!key || !isTrustedVerificationKey(key, now)) {
+            return undefined;
+        }
+        return key.publicJwk;
+    }
+    async isPassRevoked(passId) {
+        const data = await this.read();
+        return data.revocations.some((entry) => entry.passId === passId);
+    }
+}
+export async function verifyActionPassWithTrustStore(input) {
+    const store = typeof input.trustStore === "string"
+        ? new LocalActionPassTrustStore(input.trustStore)
+        : input.trustStore;
+    return verifyActionPass({
+        ...input,
+        verificationKeys: (keyId) => store.getVerificationKey(keyId),
+        isRevoked: (claims) => store.isPassRevoked(claims.jti),
+    });
+}
+export function recordDecision(input) {
+    const action = parseNormalizedAction(input.action);
+    const decision = PolicyDecisionSchema.parse(input.decision);
+    const payloadHash = hashPayload(action.capability.payload);
+    const actionHash = hashAction(action);
+    const traceId = input.traceId ?? `trace_${randomUUID()}`;
+    const recordWithoutHash = {
+        schemaVersion: LEDGER_SCHEMA_VERSION,
+        id: `ledger_${randomUUID()}`,
+        occurredAt: (input.occurredAt ?? new Date()).toISOString(),
+        actionHash,
+        payloadHash,
+        decision: decision.decision,
+        reasons: decision.reasons,
+        policy: decision.policy,
+        providerEvidence: input.providerEvidence ?? providerEvidenceForAction(action),
+        executionOutcome: input.executionOutcome,
+        traceId,
+        actionPassId: input.actionPassId ?? null,
+        correlationId: input.correlationId ?? undefined,
+        previousLedgerHash: input.previousLedgerHash ?? null,
+    };
+    return LedgerRecordSchema.parse({
+        ...recordWithoutHash,
+        ledgerHash: hashJson(recordWithoutHash),
+    });
+}
+export function hashPayload(payload) {
+    return hashJson(JsonValueSchema.parse(payload));
+}
+export function hashAction(action) {
+    return hashJson(parseNormalizedAction(action));
+}
+export function providerEvidenceForAction(actionInput) {
+    const action = parseNormalizedAction(actionInput);
+    const payload = action.capability.payload;
+    switch (action.capability.tool) {
+        case "github.pull_requests.create":
+            return githubPullRequestEvidence(action, payload);
+        case "github.contents.read":
+            return githubContentEvidence(action, payload, "content_read");
+        case "github.contents.write":
+            return githubContentEvidence(action, payload, "content_write");
+        case "github.branches.create":
+            return githubBranchEvidence(action, payload);
+        case "slack.chat.postMessage":
+            return slackMessageEvidence(action, payload);
+        case "linear.issues.read":
+            return linearIssueEvidence(action, payload, "issue_read");
+        case "linear.comments.create":
+            return linearIssueEvidence(action, payload, "comment_create");
+        case "linear.issues.update":
+            return linearIssueEvidence(action, payload, "issue_update");
+        case "jira.issues.read":
+            return issueTrackerEvidence(action, payload, "jira", "issue_read");
+        case "jira.comments.create":
+            return issueTrackerEvidence(action, payload, "jira", "comment_create");
+        case "jira.issues.update":
+            return issueTrackerEvidence(action, payload, "jira", "issue_update");
+        case "docs.documents.search":
+            return docsEvidence(action, payload, "document_search");
+        case "docs.documents.read":
+            return docsEvidence(action, payload, "document_read");
+        case "mcp.tool.call":
+            return mcpEvidence(action, payload);
+        case "aws.identity.get":
+            return awsEvidence(action, payload, "identity_get");
+        case "aws.s3.objects.list":
+            return awsEvidence(action, payload, "s3_objects_list");
+        case "gcp.projects.get":
+            return gcpEvidence(action, payload, "project_get");
+        case "gcp.storage.objects.list":
+            return gcpEvidence(action, payload, "storage_objects_list");
+        default:
+            return undefined;
+    }
+}
+export function hashJson(value) {
+    return `sha256:${createHash("sha256")
+        .update(stableStringify(value))
+        .digest("hex")}`;
+}
+export function stableStringify(value) {
+    return JSON.stringify(canonicalize(value));
+}
+function validatePassBinding(claims, action, payloadHash) {
+    if (claims.sub !== action.actor.agentId) {
+        return "agent_id_mismatch";
+    }
+    if (claims.humanOwner !== action.actor.humanOwner) {
+        return "human_owner_mismatch";
+    }
+    if (claims.agentRuntime !== action.actor.runtime) {
+        return "agent_runtime_mismatch";
+    }
+    if (claims.intent.taskId !== action.intent.taskId) {
+        return "task_id_mismatch";
+    }
+    if (claims.capability.tool !== action.capability.tool) {
+        return "tool_mismatch";
+    }
+    if (claims.capability.resource !== action.capability.resource) {
+        return "resource_mismatch";
+    }
+    if (claims.payloadHash !== payloadHash) {
+        return "payload_hash_mismatch";
+    }
+    if (claims.approval?.payloadHash && claims.approval.payloadHash !== payloadHash) {
+        return "approval_payload_hash_mismatch";
+    }
+    if (claims.approval?.actionHash && claims.approval.actionHash !== hashAction(action)) {
+        return "approval_action_hash_mismatch";
+    }
+    return null;
+}
+async function readTrustStore(filePath) {
+    const text = await readTrustStoreFile(filePath);
+    if (!text.trim()) {
+        return ActionPassTrustStoreSchema.parse({
+            schemaVersion: ACTIONPASS_TRUST_STORE_VERSION,
+        });
+    }
+    return ActionPassTrustStoreSchema.parse(JSON.parse(text));
+}
+async function writeTrustStore(filePath, data) {
+    await mkdir(dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tmpPath, `${JSON.stringify(data, null, 2)}\n`, {
+        encoding: "utf8",
+        flag: "wx",
+    });
+    await rename(tmpPath, filePath);
+}
+async function readTrustStoreFile(filePath) {
+    try {
+        return await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT") {
+            return "";
+        }
+        throw error;
+    }
+}
+function isTrustedVerificationKey(key, now) {
+    if (key.status === "revoked") {
+        return false;
+    }
+    if (key.notBefore && Date.parse(key.notBefore) > now.getTime()) {
+        return false;
+    }
+    if (key.expiresAt && Date.parse(key.expiresAt) < now.getTime()) {
+        return false;
+    }
+    return true;
+}
+async function resolveVerificationKey(input) {
+    if (!input.verificationKeys) {
+        if (!input.verificationKey) {
+            throw new Error("verification_key_required");
+        }
+        return input.verificationKey;
+    }
+    const { kid } = decodeProtectedHeader(input.token);
+    const key = typeof input.verificationKeys === "function"
+        ? await input.verificationKeys(kid)
+        : kid
+            ? input.verificationKeys[kid]
+            : undefined;
+    if (!key) {
+        throw new Error(kid ? `verification_key_not_found:${kid}` : "verification_key_id_required");
+    }
+    return key;
+}
+async function validateRevocation(input, claims) {
+    if (input.revokedPassIds) {
+        for (const passId of input.revokedPassIds) {
+            if (passId === claims.jti) {
+                return "actionpass_revoked";
+            }
+        }
+    }
+    if (input.revocations) {
+        for (const revocationInput of input.revocations) {
+            const revocation = ActionPassRevocationSchema.parse(revocationInput);
+            if (revocation.passId === claims.jti) {
+                return "actionpass_revoked";
+            }
+        }
+    }
+    if (input.isRevoked) {
+        const result = await input.isRevoked(claims);
+        if (result === true) {
+            return "actionpass_revoked";
+        }
+        if (typeof result === "string" && result.length > 0) {
+            return result;
+        }
+    }
+    return null;
+}
+function bindApproval(input) {
+    const approval = input.approval
+        ? ApprovalSchema.parse(input.approval)
+        : undefined;
+    const artifact = input.approvalArtifact
+        ? ApprovalArtifactSchema.parse(input.approvalArtifact)
+        : undefined;
+    if (!approval && !artifact) {
+        return undefined;
+    }
+    if (approval && approval.mode !== "none" && !approval.approvedBy && !artifact) {
+        throw new Error("approval_approver_required");
+    }
+    if (approval?.payloadHash && approval.payloadHash !== input.payloadHash) {
+        throw new Error("approval_payload_hash_mismatch");
+    }
+    if (approval?.actionHash && approval.actionHash !== input.actionHash) {
+        throw new Error("approval_action_hash_mismatch");
+    }
+    if (approval &&
+        approval.mode !== "none" &&
+        !approval.payloadHash &&
+        !approval.actionHash &&
+        !artifact) {
+        throw new Error("approval_binding_required");
+    }
+    if (!artifact) {
+        return approval;
+    }
+    const artifactError = validateApprovalArtifact(artifact, input.action, input.now);
+    if (artifactError) {
+        throw new Error(artifactError);
+    }
+    const artifactHash = hashJson(artifact);
+    if (approval?.approvalArtifactHash &&
+        approval.approvalArtifactHash !== artifactHash) {
+        throw new Error("approval_artifact_hash_mismatch");
+    }
+    return ApprovalSchema.parse({
+        mode: approval?.mode ?? artifact.mode,
+        approvedBy: approval?.approvedBy ?? artifact.approvedBy,
+        approvedAt: approval?.approvedAt ?? artifact.approvedAt,
+        approvalArtifact: approval?.approvalArtifact ?? artifact.id,
+        approvalArtifactHash: artifactHash,
+        actionHash: artifact.actionHash,
+        payloadHash: artifact.payloadHash,
+    });
+}
+export function validateApprovalArtifact(artifactInput, actionInput, now = new Date()) {
+    const artifact = ApprovalArtifactSchema.parse(artifactInput);
+    const action = parseNormalizedAction(actionInput);
+    if (artifact.actionHash !== hashAction(action)) {
+        return "approval_action_hash_mismatch";
+    }
+    if (artifact.payloadHash !== hashPayload(action.capability.payload)) {
+        return "approval_payload_hash_mismatch";
+    }
+    if (artifact.taskId !== action.intent.taskId) {
+        return "approval_task_id_mismatch";
+    }
+    if (artifact.tool !== action.capability.tool) {
+        return "approval_tool_mismatch";
+    }
+    if (artifact.resource !== action.capability.resource) {
+        return "approval_resource_mismatch";
+    }
+    if (artifact.expiresAt && Date.parse(artifact.expiresAt) < now.getTime()) {
+        return "approval_artifact_expired";
+    }
+    return null;
+}
+function githubPullRequestEvidence(action, payload) {
+    const files = changedFilesFromPayload(payload);
+    const diff = providerDiffFromPayload("github", payload) ?? {
+        provider: "github",
+        summary: `${files.length} changed ${files.length === 1 ? "file" : "files"}`,
+        files: files.map((path) => ({
+            path,
+            status: "modified",
+            additions: 0,
+            deletions: 0,
+            hunks: [],
+        })),
+    };
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "pull_request_create",
+        resource: providerResource("github", "repo", action.capability.resource),
+        normalized: compactJsonRecord({
+            title: getString(payload.title) ?? action.intent.declaredGoal,
+            baseBranch: getString(payload.baseBranch),
+            headBranch: getString(payload.headBranch) ?? getString(payload.branch),
+            filesChanged: files,
+            touchesProduction: getBoolean(payload.touchesProduction),
+            testsPassed: getBoolean(payload.testsPassed),
+            draft: getBoolean(payload.draft),
+        }),
+        diff,
+    });
+}
+function githubContentEvidence(action, payload, operation) {
+    const path = getString(payload.path) ?? "unknown";
+    const diff = operation === "content_write"
+        ? providerDiffFromPayload("github", payload) ?? {
+            provider: "github",
+            summary: "1 changed file",
+            files: [
+                {
+                    path,
+                    status: "modified",
+                    additions: 0,
+                    deletions: 0,
+                    hunks: [],
+                },
+            ],
+        }
+        : undefined;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource("github", "file", `${action.capability.resource}:${path}`),
+        normalized: compactJsonRecord({
+            path,
+            branch: getString(payload.branch) ?? getString(payload.ref),
+            message: getString(payload.message),
+            contentLength: operation === "content_write"
+                ? getString(payload.content)?.length ?? null
+                : null,
+        }),
+        diff,
+    });
+}
+function githubBranchEvidence(action, payload) {
+    const branch = getString(payload.branch) ?? "unknown";
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "branch_create",
+        resource: providerResource("github", "branch", `${action.capability.resource}:${branch}`),
+        normalized: compactJsonRecord({
+            branch,
+            baseBranch: getString(payload.baseBranch),
+            sha: getString(payload.sha),
+        }),
+    });
+}
+function slackMessageEvidence(action, payload) {
+    const channel = getString(payload.channel) ?? "unknown";
+    const message = getString(payload.text) ?? getString(payload.message) ?? "";
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "slack",
+        tool: action.capability.tool,
+        operation: "message_post",
+        resource: providerResource("slack", "channel", `${action.capability.resource}:${channel}`, channel),
+        normalized: compactJsonRecord({
+            channel,
+            message: redactCredentialLikeText(message),
+            messageLength: message.length,
+            threadTs: getString(payload.threadTs),
+            externalRecipients: getStringArray(payload.externalRecipients),
+            mentionedUsers: getStringArray(payload.mentionedUsers),
+            mentionedGroups: getStringArray(payload.mentionedGroups),
+            links: getStringArray(payload.links),
+            attachmentCount: getArrayLength(payload.attachments),
+            unfurlLinks: getBoolean(payload.unfurlLinks),
+            unfurlMedia: getBoolean(payload.unfurlMedia),
+        }),
+    });
+}
+function linearIssueEvidence(action, payload, operation) {
+    return issueTrackerEvidence(action, payload, "linear", operation);
+}
+function issueTrackerEvidence(action, payload, provider, operation) {
+    const issueKey = getString(payload.issueKey) ?? getString(payload.issueId) ?? "unknown";
+    const projectKey = getString(payload.projectKey) ?? issueKey.split("-", 1)[0];
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider,
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource(provider, "issue", `${action.capability.resource}:${issueKey}`, issueKey),
+        normalized: compactJsonRecord({
+            issueKey,
+            projectKey,
+            title: getString(payload.title),
+            status: getString(payload.status),
+            stateId: getString(payload.stateId),
+            priority: getNumber(payload.priority),
+            commentBody: operation === "comment_create"
+                ? redactCredentialLikeText(getString(payload.body) ?? "")
+                : null,
+        }),
+        fieldChanges: linearFieldChanges(payload),
+    });
+}
+function docsEvidence(action, payload, operation) {
+    const workspace = getString(payload.workspace) ?? "local";
+    const path = getString(payload.path);
+    const query = getString(payload.query);
+    const resourceId = path
+        ? `${action.capability.resource}:${workspace}:${path}`
+        : `${action.capability.resource}:${workspace}:search`;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "docs",
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource("docs", path ? "document" : "workspace", resourceId, path ?? workspace),
+        normalized: compactJsonRecord({
+            workspace,
+            path,
+            query,
+            maxResults: getNumber(payload.maxResults),
+            maxBytes: getNumber(payload.maxBytes),
+        }),
+    });
+}
+function mcpEvidence(action, payload) {
+    const serverIdentity = action.toolDefinition?.serverIdentity ??
+        getString(payload.serverIdentity) ??
+        "mcp:unknown";
+    const toolName = getString(payload.toolName) ?? action.capability.tool;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "mcp",
+        tool: action.capability.tool,
+        operation: "tool_call",
+        resource: providerResource("mcp", "tool", `${serverIdentity}:${toolName}`, toolName),
+        normalized: compactJsonRecord({
+            serverIdentity,
+            schemaVersion: action.toolDefinition?.schemaVersion,
+            definitionHash: action.toolDefinition?.definitionHash,
+            toolName,
+        }),
+    });
+}
+function awsEvidence(action, payload, operation) {
+    const bucket = getString(payload.bucket);
+    const accountId = getString(payload.accountId);
+    const region = getString(payload.region);
+    const resourceId = bucket
+        ? `aws:s3:${region ?? "unknown"}:${bucket}`
+        : accountId
+            ? `aws:account:${accountId}`
+            : action.capability.resource;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "aws",
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource("aws", bucket ? "s3_bucket" : "identity", resourceId, bucket ?? accountId),
+        normalized: compactJsonRecord({
+            accountId,
+            region,
+            bucket,
+            prefix: getString(payload.prefix),
+            maxKeys: getNumber(payload.maxKeys),
+        }),
+    });
+}
+function gcpEvidence(action, payload, operation) {
+    const projectId = getString(payload.projectId);
+    const bucket = getString(payload.bucket);
+    const resourceId = bucket
+        ? `gcp:storage:${bucket}`
+        : projectId
+            ? `gcp:project:${projectId}`
+            : action.capability.resource;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "gcp",
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource("gcp", bucket ? "storage_bucket" : "project", resourceId, bucket ?? projectId),
+        normalized: compactJsonRecord({
+            projectId,
+            bucket,
+            prefix: getString(payload.prefix),
+            maxResults: getNumber(payload.maxResults),
+        }),
+    });
+}
+function providerResource(provider, kind, id, label) {
+    return {
+        provider,
+        kind,
+        id,
+        ...(label ? { label } : {}),
+    };
+}
+function providerDiffFromPayload(provider, payload) {
+    const diff = isJsonObject(payload.diff) ? payload.diff : null;
+    if (!diff)
+        return undefined;
+    return LedgerProviderEvidenceDiffSchema.parse({
+        provider,
+        summary: getString(diff.summary) ?? undefined,
+        files: getObjectArray(diff.files).map((file) => ({
+            path: getString(file.path) ?? "unknown",
+            oldPath: getString(file.oldPath) ?? undefined,
+            status: parseDiffStatus(getString(file.status)),
+            additions: getNumber(file.additions) ?? 0,
+            deletions: getNumber(file.deletions) ?? 0,
+            hunks: getObjectArray(file.hunks).map((hunk) => ({
+                header: getString(hunk.header) ?? "@@",
+                lines: getObjectArray(hunk.lines).map((line) => ({
+                    type: parseDiffLineType(getString(line.type)),
+                    content: redactCredentialLikeText(getString(line.content) ?? ""),
+                    oldLine: getNumber(line.oldLine) ?? undefined,
+                    newLine: getNumber(line.newLine) ?? undefined,
+                })),
+            })),
+        })),
+    });
+}
+function changedFilesFromPayload(payload) {
+    const changes = getObjectArray(payload.changes)
+        .map((change) => getString(change.path))
+        .filter((path) => Boolean(path));
+    return [...new Set([...getStringArray(payload.filesChanged), ...changes])];
+}
+function linearFieldChanges(payload) {
+    return [
+        fieldChange("title", payload.fromTitle, payload.title),
+        fieldChange("description", payload.fromDescription, payload.description),
+        fieldChange("status", payload.fromStatus, payload.status),
+        fieldChange("stateId", payload.fromStateId, payload.stateId),
+        fieldChange("priority", payload.fromPriority, payload.priority),
+    ].filter((change) => change !== null);
+}
+function fieldChange(field, before, after) {
+    if (before === undefined && after === undefined)
+        return null;
+    return LedgerProviderEvidenceFieldChangeSchema.parse({
+        field,
+        before: sanitizeJsonValue(before),
+        after: sanitizeJsonValue(after),
+    });
+}
+function compactJsonRecord(input) {
+    return Object.fromEntries(Object.entries(input)
+        .map(([key, value]) => [key, sanitizeJsonValue(value)])
+        .filter((entry) => entry[1] !== undefined));
+}
+function sanitizeJsonValue(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "string")
+        return redactCredentialLikeText(value);
+    if (Array.isArray(value)) {
+        return value
+            .map((item) => sanitizeJsonValue(item))
+            .filter((item) => item !== undefined);
+    }
+    if (isJsonObject(value)) {
+        return compactJsonRecord(value);
+    }
+    return value;
+}
+function redactCredentialLikeText(value) {
+    return value
+        .replace(/\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g, "[redacted-github-token]")
+        .replace(/\bxox[baprs]-[A-Za-z0-9-]{20,}\b/g, "[redacted-slack-token]")
+        .replace(/\bsk-[A-Za-z0-9_-]{20,}\b/g, "[redacted-api-key]")
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, "[redacted-aws-access-key]")
+        .replace(/\b[A-Za-z0-9+/]{40}\b/g, "[redacted-token-like-value]");
+}
+function parseDiffStatus(value) {
+    if (value === "added" ||
+        value === "modified" ||
+        value === "deleted" ||
+        value === "renamed") {
+        return value;
+    }
+    return "modified";
+}
+function parseDiffLineType(value) {
+    if (value === "addition" || value === "deletion" || value === "context") {
+        return value;
+    }
+    return "context";
+}
+function getString(value) {
+    return typeof value === "string" ? value : null;
+}
+function getStringArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((item) => typeof item === "string");
+}
+function getNumber(value) {
+    return typeof value === "number" ? value : null;
+}
+function getBoolean(value) {
+    return typeof value === "boolean" ? value : null;
+}
+function getArrayLength(value) {
+    return Array.isArray(value) ? value.length : null;
+}
+function getObjectArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((item) => isJsonObject(item));
+}
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toNumericDate(date) {
+    return Math.floor(date.getTime() / 1000);
+}
+function canonicalize(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => canonicalize(item));
+    }
+    if (isPlainObject(value)) {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, entryValue]) => entryValue !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entryValue]) => [key, canonicalize(entryValue)]));
+    }
+    return value;
+}
+function isPlainObject(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.getPrototypeOf(value) === Object.prototype);
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
+//# sourceMappingURL=index.js.map