@axtary/actionpass 0.0.1 → 0.2.0

package/dist/index.js

@@ -0,0 +1,2851 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { lock } from "proper-lockfile";
+import { decodeProtectedHeader, calculateJwkThumbprint, importJWK, SignJWT, jwtVerify, } from "jose";
+import { z } from "zod";
+import { ActionPassStatusClaimSchema, } from "./status-list.js";
+import { ActionProvenanceSchema, } from "./provenance.js";
+import { analyzePostgresSelect } from "./postgres.js";
+import { explainDecision, } from "./explain.js";
+import { AXTARY_DEV_SIGNING_KEY_ENV, devKeypair, } from "./dev-key.js";
+export * from "./caep.js";
+export * from "./dev-key.js";
+export * from "./explain.js";
+export * from "./postgres.js";
+export * from "./provenance.js";
+export * from "./status-list.js";
+export const ACTION_SCHEMA_VERSION = "axtary.action.v0";
+export const ACTIONPASS_V0_VERSION = "axtary.actionpass.v0";
+export const ACTIONPASS_V1_VERSION = "axtary.actionpass.v1";
+export const ACTIONPASS_V2_VERSION = "axtary.actionpass.v2";
+export const ACTIONPASS_VERSION = ACTIONPASS_V0_VERSION;
+export const APPROVAL_ARTIFACT_VERSION = "axtary.approval.v0";
+export const ACTIONPASS_REVOCATION_VERSION = "axtary.actionpass_revocation.v0";
+export const ACTIONPASS_TRUST_STORE_VERSION = "axtary.actionpass_trust_store.v0";
+export const LEDGER_SCHEMA_VERSION = "axtary.ledger.v0";
+export const LEDGER_PROVIDER_EVIDENCE_VERSION = "axtary.ledger_provider_evidence.v0";
+export const LEDGER_EXECUTION_OUTCOME_VERSION = "axtary.ledger_execution_outcome.v0";
+export const DEFAULT_EXPIRES_IN_SECONDS = 600;
+export const DEFAULT_SIGNING_ALGORITHM = "ES256";
+export const DPOP_PROOF_TYP = "dpop+jwt";
+export const DEFAULT_DPOP_MAX_AGE_SECONDS = 60;
+export const DEFAULT_DPOP_CLOCK_SKEW_SECONDS = 5;
+const JsonValueSchema = z.lazy(() => z.union([
+    z.string(),
+    z.number().finite(),
+    z.boolean(),
+    z.null(),
+    z.array(JsonValueSchema),
+    z.record(z.string(), JsonValueSchema),
+]));
+export const BudgetAmountSchema = z.record(z.string().min(1), z.number().finite().nonnegative());
+export const ActionBudgetSchema = z.object({
+    reservationId: z.string().min(1),
+    cost: BudgetAmountSchema,
+    limit: BudgetAmountSchema,
+    commitStatus: z.enum(["pending", "committed", "rolled_back"]),
+});
+export const AxtaryDecisionSchema = z.enum(["allow", "deny", "step_up"]);
+export const NormalizedActionSchema = z.object({
+    schemaVersion: z.literal(ACTION_SCHEMA_VERSION).default(ACTION_SCHEMA_VERSION),
+    actor: z.object({
+        agentId: z.string().min(1),
+        humanOwner: z.string().min(1),
+        runtime: z.string().min(1),
+        tenant: z.string().min(1).optional(),
+    }),
+    intent: z.object({
+        taskId: z.string().min(1),
+        declaredGoal: z.string().min(1),
+        maxDelegationDepth: z.number().int().nonnegative().optional(),
+    }),
+    capability: z.object({
+        tool: z.string().min(1),
+        resource: z.string().min(1),
+        payload: z.record(z.string(), JsonValueSchema),
+        constraints: z.record(z.string(), JsonValueSchema).optional(),
+    }),
+    toolDefinition: z
+        .object({
+        serverIdentity: z.string().min(1),
+        schemaVersion: z.string().min(1),
+        definitionHash: z.string().min(1),
+        // Optional signed-publisher provenance (MCP signed definitions, M5.5).
+        // Absent for hash-only (unsigned) tools, so existing actions hash
+        // identically; present, they bind publisher identity + version lineage
+        // into the ActionPass and ledger.
+        publisher: z.string().min(1).optional(),
+        publisherKeyId: z.string().min(1).optional(),
+        semver: z.string().min(1).optional(),
+        priorDefinitionHash: z.string().min(1).optional(),
+    })
+        .optional(),
+    provenance: ActionProvenanceSchema.optional(),
+    budget: ActionBudgetSchema.optional(),
+});
+export const PolicyDecisionSchema = z.object({
+    decision: AxtaryDecisionSchema,
+    reasons: z.array(z.string().min(1)),
+    policy: z.object({
+        nativeRule: z.string().min(1),
+        version: z.string().min(1),
+        cedarCompatible: z.boolean(),
+        opaCompatible: z.boolean(),
+    }),
+    constraints: z.object({
+        expiresInSeconds: z.number().int().positive(),
+        maxFilesChanged: z.number().int().nonnegative(),
+        blockedPaths: z.array(z.string().min(1)),
+    }),
+    rule: z
+        .object({
+        id: z.string().min(1),
+        matchedRuleIds: z.array(z.string().min(1)).default([]),
+    })
+        .optional(),
+    obligations: z
+        .object({
+        requiredApproverRoles: z.array(z.string().min(1)).default([]),
+        timeWindow: z
+            .object({
+            startHourUtc: z.number().int().min(0).max(23),
+            endHourUtc: z.number().int().min(0).max(23),
+            daysOfWeek: z.array(z.number().int().min(0).max(6)).default([]),
+        })
+            .optional(),
+        rateLimit: z
+            .object({
+            ruleId: z.string().min(1),
+            maxActions: z.number().int().positive(),
+            windowSeconds: z.number().int().positive(),
+            scope: z.enum(["actor", "tool", "resource", "tenant"]),
+        })
+            .optional(),
+    })
+        .optional(),
+});
+export const ApprovalSchema = z.object({
+    mode: z.enum(["none", "human", "policy_override"]),
+    approvedBy: z.string().min(1).optional(),
+    approverRoles: z.array(z.string().min(1)).optional(),
+    approvalArtifact: z.string().min(1).optional(),
+    approvalArtifactHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    approvedAt: z.string().datetime().optional(),
+});
+export const ApprovalArtifactSchema = z.object({
+    schemaVersion: z.literal(APPROVAL_ARTIFACT_VERSION),
+    id: z.string().min(1),
+    mode: z.enum(["human", "policy_override"]),
+    approvedBy: z.string().min(1),
+    approverRoles: z.array(z.string().min(1)).optional(),
+    approvedAt: z.string().datetime(),
+    actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    taskId: z.string().min(1),
+    tool: z.string().min(1),
+    resource: z.string().min(1),
+    reason: z.string().min(1).optional(),
+    expiresAt: z.string().datetime().optional(),
+});
+const ActionPassBaseClaimsSchema = z.object({
+    iss: z.string().min(1),
+    sub: z.string().min(1),
+    aud: z.union([z.string().min(1), z.array(z.string().min(1))]),
+    exp: z.number().int().positive(),
+    nbf: z.number().int().positive(),
+    iat: z.number().int().positive(),
+    jti: z.string().min(1),
+    tenant: z.string().min(1),
+    humanOwner: z.string().min(1),
+    agentRuntime: z.string().min(1),
+    intent: NormalizedActionSchema.shape.intent,
+    capability: z.object({
+        tool: z.string().min(1),
+        resource: z.string().min(1),
+        constraints: z.record(z.string(), JsonValueSchema).optional(),
+    }),
+    decision: AxtaryDecisionSchema,
+    reasons: z.array(z.string().min(1)),
+    policy: PolicyDecisionSchema.shape.policy,
+    payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    provenanceHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    budget: ActionBudgetSchema.optional(),
+    approval: ApprovalSchema.optional(),
+    audit: z.object({
+        traceId: z.string().min(1),
+        parentPassId: z.string().min(1).nullable(),
+        ledgerHash: z.string().min(1).nullable(),
+    }),
+});
+export const ActionPassV0ClaimsSchema = z.object({
+    apv: z.literal(ACTIONPASS_V0_VERSION),
+    ...ActionPassBaseClaimsSchema.shape,
+});
+export const ActionPassV1ClaimsSchema = z.object({
+    apv: z.literal(ACTIONPASS_V1_VERSION),
+    ...ActionPassBaseClaimsSchema.shape,
+    cnf: z.object({
+        jkt: z.string().min(1),
+    }),
+    delegation: z
+        .object({
+        depth: z.number().int().positive(),
+        rootPassId: z.string().min(1),
+    })
+        .optional(),
+});
+export const ActionPassV2ClaimsSchema = z.object({
+    apv: z.literal(ACTIONPASS_V2_VERSION),
+    ...ActionPassBaseClaimsSchema.shape,
+    cnf: z.object({
+        jkt: z.string().min(1),
+    }),
+    delegation: z
+        .object({
+        depth: z.number().int().positive(),
+        rootPassId: z.string().min(1),
+    })
+        .optional(),
+    status: ActionPassStatusClaimSchema,
+});
+export const ActionPassClaimsSchema = z.union([
+    ActionPassV0ClaimsSchema,
+    ActionPassV1ClaimsSchema,
+    ActionPassV2ClaimsSchema,
+]);
+export const DpopProofClaimsSchema = z.object({
+    htm: z.string().min(1),
+    htu: z.string().url(),
+    iat: z.number().int().positive(),
+    jti: z.string().min(1),
+    ath: z.string().min(1),
+    nonce: z.string().min(1).optional(),
+});
+export const ActionPassRevocationSchema = z.object({
+    schemaVersion: z.literal(ACTIONPASS_REVOCATION_VERSION),
+    passId: z.string().min(1),
+    revokedAt: z.string().datetime(),
+    revokedBy: z.string().min(1).optional(),
+    reason: z.string().min(1).optional(),
+});
+export const ActionPassVerificationKeyRecordSchema = z.object({
+    kid: z.string().min(1),
+    publicJwk: z.record(z.string(), JsonValueSchema),
+    algorithm: z.string().min(1).optional(),
+    status: z.enum(["active", "retired", "revoked"]).default("active"),
+    notBefore: z.string().datetime().optional(),
+    expiresAt: z.string().datetime().optional(),
+});
+export const ActionPassTrustStoreSchema = z.object({
+    schemaVersion: z.literal(ACTIONPASS_TRUST_STORE_VERSION),
+    keys: z.array(ActionPassVerificationKeyRecordSchema).default([]),
+    revocations: z.array(ActionPassRevocationSchema).default([]),
+});
+export const LedgerProviderEvidenceDiffLineSchema = z.object({
+    type: z.enum(["context", "addition", "deletion"]),
+    content: z.string(),
+    oldLine: z.number().int().positive().optional(),
+    newLine: z.number().int().positive().optional(),
+});
+export const LedgerProviderEvidenceDiffFileSchema = z.object({
+    path: z.string().min(1),
+    oldPath: z.string().min(1).optional(),
+    status: z.enum(["added", "modified", "deleted", "renamed"]),
+    additions: z.number().int().nonnegative().default(0),
+    deletions: z.number().int().nonnegative().default(0),
+    hunks: z
+        .array(z.object({
+        header: z.string().min(1),
+        lines: z.array(LedgerProviderEvidenceDiffLineSchema),
+    }))
+        .default([]),
+});
+export const LedgerProviderSchema = z.enum([
+    "github",
+    "slack",
+    "linear",
+    "docs",
+    "drive",
+    "mcp",
+    "aws",
+    "gcp",
+    "jira",
+    "postgres",
+]);
+export const LedgerProviderEvidenceDiffSchema = z.object({
+    provider: LedgerProviderSchema,
+    summary: z.string().min(1).optional(),
+    files: z.array(LedgerProviderEvidenceDiffFileSchema).default([]),
+});
+export const LedgerProviderEvidenceFieldChangeSchema = z.object({
+    field: z.string().min(1),
+    before: JsonValueSchema.optional(),
+    after: JsonValueSchema.optional(),
+});
+export const LedgerProviderEvidenceSchema = z.object({
+    schemaVersion: z.literal(LEDGER_PROVIDER_EVIDENCE_VERSION),
+    provider: LedgerProviderSchema,
+    tool: z.string().min(1),
+    operation: z.string().min(1),
+    resource: z
+        .object({
+        provider: LedgerProviderSchema,
+        kind: z.string().min(1),
+        id: z.string().min(1),
+        label: z.string().min(1).optional(),
+        url: z.string().url().optional(),
+    })
+        .strict(),
+    normalized: z.record(z.string(), JsonValueSchema).default({}),
+    fieldChanges: z.array(LedgerProviderEvidenceFieldChangeSchema).default([]),
+    diff: LedgerProviderEvidenceDiffSchema.optional(),
+});
+export const GitHubNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["fake", "rest", "app"]).default("fake"),
+    tokenEnv: z.string().min(1).default("GITHUB_TOKEN"),
+    apiBaseUrl: z.string().url().default("https://api.github.com"),
+    userAgent: z.string().min(1).default("axtary-local-proxy"),
+    appId: z.string().min(1).optional(),
+    appIdEnv: z.string().min(1).default("AXTARY_GITHUB_APP_ID"),
+    installationId: z.string().min(1).optional(),
+    installationIdEnv: z
+        .string()
+        .min(1)
+        .default("AXTARY_GITHUB_INSTALLATION_ID"),
+    privateKeyEnv: z
+        .string()
+        .min(1)
+        .default("AXTARY_GITHUB_APP_PRIVATE_KEY"),
+});
+export const DEFAULT_GITHUB_NATIVE_CONNECTOR_CONFIG = {
+    mode: "fake",
+    tokenEnv: "GITHUB_TOKEN",
+    apiBaseUrl: "https://api.github.com",
+    userAgent: "axtary-local-proxy",
+    appIdEnv: "AXTARY_GITHUB_APP_ID",
+    installationIdEnv: "AXTARY_GITHUB_INSTALLATION_ID",
+    privateKeyEnv: "AXTARY_GITHUB_APP_PRIVATE_KEY",
+};
+export const LinearNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["fake", "graphql"]).default("fake"),
+    tokenEnv: z.string().min(1).default("LINEAR_API_KEY"),
+    apiUrl: z.string().url().default("https://api.linear.app/graphql"),
+});
+export const DEFAULT_LINEAR_NATIVE_CONNECTOR_CONFIG = {
+    mode: "fake",
+    tokenEnv: "LINEAR_API_KEY",
+    apiUrl: "https://api.linear.app/graphql",
+};
+export const JiraNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["fake", "rest"]).default("fake"),
+    auth: z.enum(["api_token", "oauth"]).default("api_token"),
+    tokenEnv: z.string().min(1).default("JIRA_API_TOKEN"),
+    emailEnv: z.string().min(1).default("JIRA_EMAIL"),
+    siteUrl: z.string().url().default("https://example.atlassian.net"),
+    cloudId: z.string().min(1).optional(),
+    cloudIdEnv: z.string().min(1).default("AXTARY_JIRA_CLOUD_ID"),
+});
+export const DEFAULT_JIRA_NATIVE_CONNECTOR_CONFIG = {
+    mode: "fake",
+    auth: "api_token",
+    tokenEnv: "JIRA_API_TOKEN",
+    emailEnv: "JIRA_EMAIL",
+    siteUrl: "https://example.atlassian.net",
+    cloudIdEnv: "AXTARY_JIRA_CLOUD_ID",
+};
+export const PostgresNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["off", "postgres"]).default("off"),
+    dsnEnv: z.string().min(1).default("AXTARY_POSTGRES_DSN"),
+    allowedTables: z.array(z.string().min(1)).default([]),
+    allowedFunctions: z.array(z.string().min(1)).default([]),
+    requireRls: z.boolean().default(true),
+    maxRows: z.number().int().positive().max(10_000).default(100),
+    statementTimeoutMs: z.number().int().positive().default(5_000),
+    lockTimeoutMs: z.number().int().positive().default(1_000),
+    idleTransactionTimeoutMs: z.number().int().positive().default(5_000),
+});
+export const DEFAULT_POSTGRES_NATIVE_CONNECTOR_CONFIG = {
+    mode: "off",
+    dsnEnv: "AXTARY_POSTGRES_DSN",
+    allowedTables: [],
+    allowedFunctions: [],
+    requireRls: true,
+    maxRows: 100,
+    statementTimeoutMs: 5_000,
+    lockTimeoutMs: 1_000,
+    idleTransactionTimeoutMs: 5_000,
+};
+export const DriveNativeConnectorConfigSchema = z.object({
+    mode: z.enum(["off", "rest"]).default("off"),
+    tokenEnv: z.string().min(1).default("AXTARY_DRIVE_ACCESS_TOKEN"),
+    selectedFileId: z.string().min(1).optional(),
+    apiBaseUrl: z
+        .string()
+        .url()
+        .default("https://www.googleapis.com/drive/v3"),
+    allowedMimeTypes: z
+        .array(z.string().min(1))
+        .default([
+        "application/vnd.google-apps.document",
+        "text/plain",
+        "text/markdown",
+        "text/html",
+        "text/csv",
+        "application/json",
+        "application/xml",
+    ]),
+    maxReadBytes: z.number().int().positive().max(10_000_000).default(100_000),
+});
+export const DEFAULT_DRIVE_NATIVE_CONNECTOR_CONFIG = {
+    mode: "off",
+    tokenEnv: "AXTARY_DRIVE_ACCESS_TOKEN",
+    apiBaseUrl: "https://www.googleapis.com/drive/v3",
+    allowedMimeTypes: [
+        "application/vnd.google-apps.document",
+        "text/plain",
+        "text/markdown",
+        "text/html",
+        "text/csv",
+        "application/json",
+        "application/xml",
+    ],
+    maxReadBytes: 100_000,
+};
+export const LedgerExecutionOutcomeSchema = z
+    .object({
+    schemaVersion: z.literal(LEDGER_EXECUTION_OUTCOME_VERSION),
+    status: z.enum(["succeeded", "failed"]),
+    provider: LedgerProviderSchema.optional(),
+    resultId: z.string().min(1).optional(),
+    resultUrl: z.string().url().optional(),
+    resourceId: z.string().min(1).optional(),
+    resourceLabel: z.string().min(1).optional(),
+    failureReason: z.string().min(1).optional(),
+    errorClass: z.string().min(1).optional(),
+    sideEffectProof: z.record(z.string(), JsonValueSchema).default({}),
+})
+    .strict();
+export const DelegationLedgerEdgeSchema = z.object({
+    parentPassId: z.string().min(1),
+    childPassId: z.string().min(1),
+    depth: z.number().int().positive(),
+    rootPassId: z.string().min(1),
+});
+export const BudgetLedgerEventSchema = z.object({
+    reservationId: z.string().min(1).nullable(),
+    scope: z.string().min(1),
+    status: z.enum(["denied", "pending", "committed", "rolled_back"]),
+    expiresAt: z.string().datetime().nullable(),
+    cost: BudgetAmountSchema,
+    limit: BudgetAmountSchema,
+    committedBefore: BudgetAmountSchema,
+    committedAfter: BudgetAmountSchema,
+    reservedAfter: BudgetAmountSchema,
+});
+export const LedgerAuditContextSchema = z.object({
+    tenant: z.string().min(1).nullable(),
+    agentId: z.string().min(1),
+    humanOwner: z.string().min(1),
+    taskId: z.string().min(1),
+    tool: z.string().min(1),
+    resource: z.string().min(1),
+});
+export const LedgerRecordSchema = z.object({
+    schemaVersion: z.literal(LEDGER_SCHEMA_VERSION),
+    id: z.string().min(1),
+    occurredAt: z.string().datetime(),
+    auditContext: LedgerAuditContextSchema.optional(),
+    actionHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    payloadHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+    provenanceHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    decision: AxtaryDecisionSchema,
+    reasons: z.array(z.string().min(1)),
+    policy: PolicyDecisionSchema.shape.policy,
+    providerEvidence: LedgerProviderEvidenceSchema.optional(),
+    executionOutcome: LedgerExecutionOutcomeSchema.optional(),
+    traceId: z.string().min(1).optional(),
+    actionPassId: z.string().min(1).nullable(),
+    delegation: DelegationLedgerEdgeSchema.optional(),
+    budget: BudgetLedgerEventSchema.optional(),
+    correlationId: z.string().min(1).optional(),
+    previousLedgerHash: z.string().regex(/^sha256:[a-f0-9]{64}$/).nullable(),
+    ledgerHash: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+});
+export const demoAction = NormalizedActionSchema.parse({
+    actor: {
+        agentId: "agent:codex-prod",
+        humanOwner: "user:asrar@company.com",
+        runtime: "codex-cli",
+        tenant: "org:company",
+    },
+    intent: {
+        taskId: "AXT-418",
+        declaredGoal: "Open a PR that fixes the auth redirect bug",
+    },
+    capability: {
+        tool: "github.pull_requests.create",
+        resource: "repo:company/web-app",
+        payload: {
+            baseBranch: "main",
+            filesChanged: ["src/app/login/page.tsx", "src/lib/auth/session.ts"],
+            touchesProduction: false,
+        },
+    },
+});
+export function parseNormalizedAction(action) {
+    return NormalizedActionSchema.parse(action);
+}
+export function evaluateAction(actionInput, options = {}) {
+    const action = parseNormalizedAction(actionInput);
+    const payload = action.capability.payload;
+    const filesChanged = getStringArray(payload.filesChanged);
+    const requiredBaseBranch = options.requiredBaseBranch ?? "main";
+    const maxFilesChanged = options.maxFilesChanged ?? 12;
+    const blockedPathPrefixes = options.blockedPathPrefixes ?? [
+        "infra/prod/",
+        "billing/",
+        ".env",
+    ];
+    const policy = {
+        nativeRule: "github_pr_coding_agent_v0",
+        version: options.policyVersion ?? "2026-05-30",
+        cedarCompatible: true,
+        opaCompatible: true,
+    };
+    const constraints = {
+        expiresInSeconds: DEFAULT_EXPIRES_IN_SECONDS,
+        maxFilesChanged,
+        blockedPaths: ["infra/prod/**", "billing/**", ".env*"],
+    };
+    const stepUpReasons = [];
+    if (action.capability.tool !== (options.allowedTool ?? "github.pull_requests.create")) {
+        return {
+            decision: "deny",
+            reasons: [
+                `unsupported_tool: ${action.capability.tool} is not enabled by this policy`,
+            ],
+            policy,
+            constraints,
+        };
+    }
+    if (payload.baseBranch !== requiredBaseBranch) {
+        stepUpReasons.push(`base_branch_mismatch: expected ${requiredBaseBranch}`);
+    }
+    if (filesChanged.length > maxFilesChanged) {
+        stepUpReasons.push("file_count_exceeds_policy_limit");
+    }
+    if (filesChanged.some((path) => blockedPathPrefixes.some((prefix) => path.startsWith(prefix)))) {
+        stepUpReasons.push("payload_touches_protected_path");
+    }
+    if (payload.touchesProduction === true) {
+        stepUpReasons.push("payload_declares_production_impact");
+    }
+    if (stepUpReasons.length > 0) {
+        return {
+            decision: "step_up",
+            reasons: stepUpReasons,
+            policy,
+            constraints,
+        };
+    }
+    return {
+        decision: "allow",
+        reasons: ["payload_is_inside_current_actionpass_constraints"],
+        policy,
+        constraints,
+    };
+}
+export async function authorize(input) {
+    const action = parseNormalizedAction(input.action);
+    const decision = evaluateAction(action, input.policy);
+    const payloadHash = hashPayload(action.capability.payload);
+    const traceId = input.traceId ?? `trace_${randomUUID()}`;
+    const actionPass = decision.decision === "allow"
+        ? await issueActionPass({
+            action,
+            decision,
+            issuer: input.issuer,
+            tenant: input.tenant,
+            signingKey: input.signingKey,
+            keyId: input.keyId,
+            algorithm: input.algorithm,
+            now: input.now,
+            approval: input.approval,
+            approvalArtifact: input.approvalArtifact,
+            traceId,
+        })
+        : null;
+    const ledger = recordDecision({
+        action,
+        decision,
+        actionPassId: actionPass?.claims.jti ?? null,
+        previousLedgerHash: input.previousLedgerHash ?? null,
+        occurredAt: input.now,
+        traceId,
+    });
+    return {
+        action,
+        decision,
+        payloadHash,
+        actionPass,
+        ledger,
+    };
+}
+export function createApprovalArtifact(input) {
+    const action = parseNormalizedAction(input.action);
+    const artifact = ApprovalArtifactSchema.parse({
+        schemaVersion: APPROVAL_ARTIFACT_VERSION,
+        id: input.id ?? `approval_${randomUUID()}`,
+        mode: input.mode,
+        approvedBy: input.approvedBy,
+        approverRoles: input.approverRoles,
+        approvedAt: (input.approvedAt ?? new Date()).toISOString(),
+        actionHash: hashAction(action),
+        payloadHash: hashPayload(action.capability.payload),
+        taskId: action.intent.taskId,
+        tool: action.capability.tool,
+        resource: action.capability.resource,
+        reason: input.reason,
+        expiresAt: input.expiresAt?.toISOString(),
+    });
+    const artifactHash = hashJson(artifact);
+    return {
+        artifact,
+        artifactHash,
+        approval: {
+            mode: artifact.mode,
+            approvedBy: artifact.approvedBy,
+            approverRoles: artifact.approverRoles,
+            approvedAt: artifact.approvedAt,
+            approvalArtifact: artifact.id,
+            approvalArtifactHash: artifactHash,
+            actionHash: artifact.actionHash,
+            payloadHash: artifact.payloadHash,
+        },
+    };
+}
+export async function issueActionPass(input) {
+    return issueActionPassProfile(input, ACTIONPASS_V0_VERSION);
+}
+export async function issueActionPassV1(input) {
+    const publicJwk = publicOnlyJwk(input.holderPublicJwk);
+    const jkt = await calculateJwkThumbprint(publicJwk, "sha256");
+    return (await issueActionPassProfile(input, ACTIONPASS_V1_VERSION, jkt));
+}
+export async function issueActionPassV2(input) {
+    const publicJwk = publicOnlyJwk(input.holderPublicJwk);
+    const jkt = await calculateJwkThumbprint(publicJwk, "sha256");
+    return (await issueActionPassProfile(input, ACTIONPASS_V2_VERSION, jkt));
+}
+export async function delegateActionPassV1(input) {
+    const delegationNow = input.now ?? input.parentChain.at(-1)?.currentDate ?? new Date();
+    const verifiedChain = await verifyDelegationChain({
+        chain: input.parentChain,
+        currentDate: delegationNow,
+        revocation: input.revocation,
+    });
+    if (!verifiedChain.valid) {
+        throw new Error(verifiedChain.reason);
+    }
+    const parentClaims = verifiedChain.claims.at(-1);
+    const parentAction = verifiedChain.actions.at(-1);
+    if (!parentClaims || !parentAction) {
+        throw new Error("delegation_parent_required");
+    }
+    const childAction = parseNormalizedAction(input.childAction);
+    if (input.tenant !== parentClaims.tenant) {
+        throw new Error("delegation_scope_broadened");
+    }
+    const attenuationError = validateDelegationAttenuation(parentAction, childAction);
+    if (attenuationError) {
+        throw new Error(attenuationError);
+    }
+    const depth = parentClaims.delegation
+        ? parentClaims.delegation.depth + 1
+        : 1;
+    const rootPassId = parentClaims.delegation?.rootPassId ?? parentClaims.jti;
+    const now = delegationNow;
+    const requestedTtl = input.expiresInSeconds ?? input.childDecision.constraints.expiresInSeconds;
+    const parentRemainingTtl = parentClaims.exp - toNumericDate(now);
+    if (parentRemainingTtl < 1) {
+        throw new Error("delegation_parent_expired");
+    }
+    const issued = await issueActionPassV1({
+        ...input,
+        action: childAction,
+        decision: input.childDecision,
+        holderPublicJwk: input.childHolderPublicJwk,
+        parentPassId: parentClaims.jti,
+        delegation: {
+            depth,
+            rootPassId,
+        },
+        expiresInSeconds: Math.min(requestedTtl, parentRemainingTtl),
+    });
+    const delegation = DelegationLedgerEdgeSchema.parse({
+        parentPassId: parentClaims.jti,
+        childPassId: issued.claims.jti,
+        depth,
+        rootPassId,
+    });
+    return {
+        ...issued,
+        delegation,
+    };
+}
+export async function delegateActionPassV2(input) {
+    const delegationNow = input.now ?? input.parentChain.at(-1)?.currentDate ?? new Date();
+    const verifiedChain = await verifyDelegationChain({
+        chain: input.parentChain,
+        currentDate: delegationNow,
+        revocation: input.revocation,
+    });
+    if (!verifiedChain.valid)
+        throw new Error(verifiedChain.reason);
+    if (verifiedChain.claims.some((claims) => claims.apv !== ACTIONPASS_V2_VERSION)) {
+        throw new Error("delegation_requires_actionpass_v2");
+    }
+    const parentClaims = verifiedChain.claims.at(-1);
+    const parentAction = verifiedChain.actions.at(-1);
+    const childAction = parseNormalizedAction(input.childAction);
+    if (input.tenant !== parentClaims.tenant) {
+        throw new Error("delegation_scope_broadened");
+    }
+    const attenuationError = validateDelegationAttenuation(parentAction, childAction);
+    if (attenuationError)
+        throw new Error(attenuationError);
+    const depth = parentClaims.delegation
+        ? parentClaims.delegation.depth + 1
+        : 1;
+    const rootPassId = parentClaims.delegation?.rootPassId ?? parentClaims.jti;
+    const parentRemainingTtl = parentClaims.exp - toNumericDate(delegationNow);
+    if (parentRemainingTtl < 1)
+        throw new Error("delegation_parent_expired");
+    const requestedTtl = input.expiresInSeconds ?? input.childDecision.constraints.expiresInSeconds;
+    const issued = await issueActionPassV2({
+        ...input,
+        action: childAction,
+        decision: input.childDecision,
+        holderPublicJwk: input.childHolderPublicJwk,
+        parentPassId: parentClaims.jti,
+        delegation: { depth, rootPassId },
+        status: input.childStatus,
+        expiresInSeconds: Math.min(requestedTtl, parentRemainingTtl),
+    });
+    const delegation = DelegationLedgerEdgeSchema.parse({
+        parentPassId: parentClaims.jti,
+        childPassId: issued.claims.jti,
+        depth,
+        rootPassId,
+    });
+    return { ...issued, delegation };
+}
+async function issueActionPassProfile(input, version, holderJkt) {
+    const action = parseNormalizedAction(input.action);
+    const decision = PolicyDecisionSchema.parse(input.decision);
+    if (decision.decision !== "allow") {
+        throw new Error("ActionPass can only be issued for an allow decision.");
+    }
+    const now = input.now ?? new Date();
+    const issuedAt = toNumericDate(now);
+    const expiresInSeconds = input.expiresInSeconds ?? decision.constraints.expiresInSeconds;
+    const expiresAt = issuedAt + expiresInSeconds;
+    const passId = input.passId ?? `ap_${randomUUID()}`;
+    const actionHash = hashAction(action);
+    const payloadHash = hashPayload(action.capability.payload);
+    const approval = bindApproval({
+        action,
+        actionHash,
+        payloadHash,
+        approval: input.approval,
+        approvalArtifact: input.approvalArtifact,
+        now,
+    });
+    const claims = ActionPassClaimsSchema.parse({
+        apv: version,
+        iss: input.issuer,
+        sub: action.actor.agentId,
+        aud: action.capability.resource,
+        exp: expiresAt,
+        nbf: issuedAt,
+        iat: issuedAt,
+        jti: passId,
+        tenant: input.tenant,
+        humanOwner: action.actor.humanOwner,
+        agentRuntime: action.actor.runtime,
+        intent: action.intent,
+        capability: {
+            tool: action.capability.tool,
+            resource: action.capability.resource,
+            constraints: action.capability.constraints,
+        },
+        decision: decision.decision,
+        reasons: decision.reasons,
+        policy: decision.policy,
+        payloadHash,
+        provenanceHash: action.provenance
+            ? hashProvenance(action.provenance)
+            : undefined,
+        budget: action.budget,
+        cnf: holderJkt ? { jkt: holderJkt } : undefined,
+        delegation: (version === ACTIONPASS_V1_VERSION || version === ACTIONPASS_V2_VERSION) &&
+            "delegation" in input &&
+            input.delegation
+            ? input.delegation
+            : undefined,
+        status: version === ACTIONPASS_V2_VERSION && "status" in input
+            ? input.status
+            : undefined,
+        approval,
+        audit: {
+            traceId: input.traceId ?? `trace_${randomUUID()}`,
+            parentPassId: input.parentPassId ?? null,
+            ledgerHash: input.ledgerHash ?? null,
+        },
+    });
+    const token = await new SignJWT(claims)
+        .setProtectedHeader({
+        alg: input.algorithm ?? DEFAULT_SIGNING_ALGORITHM,
+        typ: "axtary-actionpass+jwt",
+        kid: input.keyId,
+    })
+        .sign(input.signingKey);
+    return { token, claims };
+}
+export async function createDpopProof(input) {
+    const publicJwk = publicOnlyJwk(input.publicJwk);
+    const jkt = await calculateJwkThumbprint(publicJwk, "sha256");
+    const claims = DpopProofClaimsSchema.parse({
+        htm: normalizeDpopMethod(input.method),
+        htu: normalizeDpopUri(input.uri),
+        iat: toNumericDate(input.now ?? new Date()),
+        jti: input.proofId ?? `dpop_${randomUUID()}`,
+        ath: computeDpopAccessTokenHash(input.actionPass),
+        nonce: input.nonce,
+    });
+    const proof = await new SignJWT(claims)
+        .setProtectedHeader({
+        alg: input.algorithm ?? DEFAULT_SIGNING_ALGORITHM,
+        typ: DPOP_PROOF_TYP,
+        jwk: publicJwk,
+    })
+        .sign(input.signingKey);
+    return { proof, claims, jkt };
+}
+export class InMemoryDpopReplayStore {
+    entries = new Map();
+    consume(proofId, expiresAt, currentDate = new Date()) {
+        const now = currentDate.getTime();
+        for (const [id, expiry] of this.entries) {
+            if (expiry <= now) {
+                this.entries.delete(id);
+            }
+        }
+        if (this.entries.has(proofId)) {
+            return false;
+        }
+        this.entries.set(proofId, expiresAt.getTime());
+        return true;
+    }
+}
+/**
+ * Durable, inter-process replay store for DPoP proof `jti`s. A proof captured
+ * before a restart stays rejected after restart, for as long as it remains
+ * inside its own time window. Entries live only until their proof expires, so
+ * the on-disk set stays bounded to the in-flight window rather than growing
+ * unboundedly.
+ *
+ * This is a single-file local store, not a cross-host distributed one: it
+ * defends one machine's verifiers (shared across handlers/processes on that
+ * host). Authenticated cross-host distribution is out of scope here.
+ *
+ * Durability mirrors the local ledger: a `proper-lockfile` lease serializes the
+ * read-modify-write so `consume` is atomic across processes, appended lines are
+ * `fsync`ed before the lease releases, and the file is compacted in place once
+ * expired lines outnumber live ones so it cannot grow without bound.
+ */
+export class FileDpopReplayStore {
+    filePath;
+    options;
+    constructor(filePath, options = {}) {
+        this.filePath = filePath;
+        this.options = options;
+    }
+    async consume(proofId, expiresAt, currentDate = new Date()) {
+        await mkdir(dirname(this.filePath), { recursive: true });
+        const release = await this.acquireLock();
+        try {
+            const now = currentDate.getTime();
+            const { live, deadCount } = await this.readLiveEntries(now);
+            if (live.has(proofId)) {
+                return false;
+            }
+            live.set(proofId, expiresAt.getTime());
+            // Compact when expired tombstones dominate, otherwise append O(1). This
+            // keeps the file proportional to the in-flight proof window.
+            if (deadCount > live.size) {
+                await this.compact(live);
+            }
+            else {
+                await this.append({ i: proofId, e: expiresAt.getTime() });
+            }
+            return true;
+        }
+        finally {
+            await release();
+        }
+    }
+    async acquireLock() {
+        const lockOptions = this.options.lock ?? {};
+        let compromisedReason = null;
+        const release = await lock(this.filePath, {
+            realpath: false,
+            lockfilePath: `${this.filePath}.lock`,
+            stale: lockOptions.staleMs ?? 10_000,
+            update: lockOptions.updateMs ?? 5_000,
+            retries: {
+                retries: lockOptions.retries ?? 100,
+                factor: 1.2,
+                minTimeout: lockOptions.minTimeoutMs ?? 10,
+                maxTimeout: lockOptions.maxTimeoutMs ?? 100,
+            },
+            onCompromised: (error) => {
+                compromisedReason = error.message;
+            },
+        });
+        if (compromisedReason !== null) {
+            await release();
+            throw new Error(`dpop_replay_store_lock_compromised:${compromisedReason}`);
+        }
+        return release;
+    }
+    async readLiveEntries(now) {
+        const live = new Map();
+        let deadCount = 0;
+        let text;
+        try {
+            text = await readFile(this.filePath, "utf8");
+        }
+        catch (error) {
+            if (isNodeError(error) && error.code === "ENOENT") {
+                return { live, deadCount };
+            }
+            throw error;
+        }
+        for (const line of text.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                // A torn final line from a crash mid-append is ignored; the lease
+                // holder rewrites a clean file on the next compaction.
+                deadCount += 1;
+                continue;
+            }
+            if (typeof entry?.i !== "string" ||
+                typeof entry?.e !== "number" ||
+                entry.e <= now) {
+                deadCount += 1;
+                continue;
+            }
+            // Last write wins for a repeated id; the older line becomes a tombstone.
+            if (live.has(entry.i)) {
+                deadCount += 1;
+            }
+            live.set(entry.i, entry.e);
+        }
+        return { live, deadCount };
+    }
+    async append(entry) {
+        const handle = await open(this.filePath, "a", 0o600);
+        try {
+            await handle.chmod(0o600);
+            await handle.writeFile(`${JSON.stringify(entry)}\n`, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async compact(live) {
+        const lines = [...live.entries()]
+            .map(([i, e]) => `${JSON.stringify({ i, e })}\n`)
+            .join("");
+        const tmpPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+        let renamed = false;
+        try {
+            const handle = await open(tmpPath, "wx", 0o600);
+            try {
+                await handle.writeFile(lines, "utf8");
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await rename(tmpPath, this.filePath);
+            renamed = true;
+        }
+        finally {
+            if (!renamed) {
+                await rm(tmpPath, { force: true });
+            }
+        }
+    }
+}
+export async function verifyActionPass(input) {
+    return verifyActionPassInternal(input, true);
+}
+async function verifyActionPassInternal(input, requireDpop) {
+    try {
+        const action = parseNormalizedAction(input.action);
+        const verificationKey = await resolveVerificationKey(input);
+        const { payload } = await jwtVerify(input.token, verificationKey, {
+            issuer: input.issuer,
+            audience: input.audience ?? action.capability.resource,
+            algorithms: input.algorithms ?? [DEFAULT_SIGNING_ALGORITHM],
+            clockTolerance: input.clockTolerance,
+            currentDate: input.currentDate,
+        });
+        const claims = ActionPassClaimsSchema.parse(payload);
+        const payloadHash = hashPayload(action.capability.payload);
+        const bindingError = validatePassBinding(claims, action, payloadHash);
+        if (bindingError) {
+            return {
+                valid: false,
+                reason: bindingError,
+            };
+        }
+        if ((claims.apv === ACTIONPASS_V1_VERSION ||
+            claims.apv === ACTIONPASS_V2_VERSION) &&
+            requireDpop) {
+            const dpopError = await validateDpopProof(input, claims);
+            if (dpopError) {
+                return { valid: false, reason: dpopError };
+            }
+        }
+        const revocationError = await validateRevocation(input, claims);
+        if (revocationError) {
+            return {
+                valid: false,
+                reason: revocationError,
+            };
+        }
+        if (claims.apv === ACTIONPASS_V2_VERSION) {
+            const statusError = await validateDistributedStatus(input, claims);
+            if (statusError) {
+                return { valid: false, reason: statusError };
+            }
+        }
+        return {
+            valid: true,
+            claims,
+            payloadHash,
+        };
+    }
+    catch (error) {
+        return {
+            valid: false,
+            reason: error instanceof Error ? error.message : "verification_failed",
+        };
+    }
+}
+export async function verifyDelegationChain(input) {
+    if (input.chain.length === 0) {
+        return { valid: false, reason: "delegation_parent_required" };
+    }
+    const claims = [];
+    const actions = [];
+    for (let index = 0; index < input.chain.length; index += 1) {
+        const entry = input.chain[index];
+        const revocation = input.revocation;
+        const verified = await verifyActionPassInternal({
+            ...entry,
+            currentDate: input.currentDate ??
+                input.chain.at(-1)?.currentDate ??
+                entry.currentDate,
+            revokedPassIds: revocation?.revokedPassIds ?? entry.revokedPassIds,
+            revocations: revocation?.revocations ?? entry.revocations,
+            isRevoked: revocation?.isRevoked ?? entry.isRevoked,
+            getStatus: revocation?.getStatus ?? entry.getStatus,
+        }, index === input.chain.length - 1);
+        if (!verified.valid) {
+            return verified;
+        }
+        if (verified.claims.apv !== ACTIONPASS_V1_VERSION &&
+            verified.claims.apv !== ACTIONPASS_V2_VERSION) {
+            return { valid: false, reason: "delegation_requires_actionpass_v1" };
+        }
+        const action = parseNormalizedAction(entry.action);
+        const currentClaims = verified.claims;
+        if (index === 0) {
+            if (currentClaims.audit.parentPassId !== null ||
+                currentClaims.delegation !== undefined) {
+                return { valid: false, reason: "delegation_chain_root_invalid" };
+            }
+        }
+        else {
+            const parentClaims = claims[index - 1];
+            const parentAction = actions[index - 1];
+            const expectedDepth = index;
+            const expectedRootPassId = claims[0].jti;
+            if (currentClaims.apv !== parentClaims.apv ||
+                currentClaims.audit.parentPassId !== parentClaims.jti ||
+                currentClaims.delegation?.depth !== expectedDepth ||
+                currentClaims.delegation.rootPassId !== expectedRootPassId) {
+                return { valid: false, reason: "delegation_chain_link_invalid" };
+            }
+            const attenuationError = validateDelegationAttenuation(parentAction, action);
+            if (attenuationError) {
+                return { valid: false, reason: attenuationError };
+            }
+        }
+        claims.push(currentClaims);
+        actions.push(action);
+    }
+    return { valid: true, claims, actions };
+}
+export function revokeActionPass(input) {
+    return ActionPassRevocationSchema.parse({
+        schemaVersion: ACTIONPASS_REVOCATION_VERSION,
+        passId: input.passId,
+        revokedAt: (input.revokedAt ?? new Date()).toISOString(),
+        revokedBy: input.revokedBy,
+        reason: input.reason,
+    });
+}
+export class LocalActionPassTrustStore {
+    filePath;
+    constructor(filePath) {
+        this.filePath = filePath;
+    }
+    async read() {
+        return readTrustStore(this.filePath);
+    }
+    async write(dataInput) {
+        const data = ActionPassTrustStoreSchema.parse({
+            schemaVersion: ACTIONPASS_TRUST_STORE_VERSION,
+            keys: dataInput.keys ?? [],
+            revocations: dataInput.revocations ?? [],
+        });
+        await writeTrustStore(this.filePath, data);
+        return data;
+    }
+    async putVerificationKey(keyInput) {
+        const key = ActionPassVerificationKeyRecordSchema.parse(keyInput);
+        const data = await this.read();
+        const nextKeys = [
+            ...data.keys.filter((entry) => entry.kid !== key.kid),
+            key,
+        ].sort((left, right) => left.kid.localeCompare(right.kid));
+        await this.write({
+            ...data,
+            keys: nextKeys,
+        });
+        return key;
+    }
+    async revokeActionPass(input) {
+        const revocation = "schemaVersion" in input
+            ? ActionPassRevocationSchema.parse(input)
+            : revokeActionPass(input);
+        const data = await this.read();
+        const nextRevocations = [
+            ...data.revocations.filter((entry) => entry.passId !== revocation.passId),
+            revocation,
+        ].sort((left, right) => left.passId.localeCompare(right.passId));
+        await this.write({
+            ...data,
+            revocations: nextRevocations,
+        });
+        return revocation;
+    }
+    async getVerificationKey(keyId, now = new Date()) {
+        if (!keyId) {
+            return undefined;
+        }
+        const data = await this.read();
+        const key = data.keys.find((entry) => entry.kid === keyId);
+        if (!key || !isTrustedVerificationKey(key, now)) {
+            return undefined;
+        }
+        return key.publicJwk;
+    }
+    async isPassRevoked(passId) {
+        const data = await this.read();
+        return data.revocations.some((entry) => entry.passId === passId);
+    }
+}
+export async function verifyActionPassWithTrustStore(input) {
+    const store = typeof input.trustStore === "string"
+        ? new LocalActionPassTrustStore(input.trustStore)
+        : input.trustStore;
+    return verifyActionPass({
+        ...input,
+        verificationKeys: (keyId) => store.getVerificationKey(keyId),
+        isRevoked: (claims) => store.isPassRevoked(claims.jti),
+    });
+}
+export function recordDecision(input) {
+    const action = parseNormalizedAction(input.action);
+    const decision = PolicyDecisionSchema.parse(input.decision);
+    const payloadHash = hashPayload(action.capability.payload);
+    const actionHash = hashAction(action);
+    const traceId = input.traceId ?? `trace_${randomUUID()}`;
+    const recordWithoutHash = {
+        schemaVersion: LEDGER_SCHEMA_VERSION,
+        id: `ledger_${randomUUID()}`,
+        occurredAt: (input.occurredAt ?? new Date()).toISOString(),
+        auditContext: {
+            tenant: action.actor.tenant ?? null,
+            agentId: action.actor.agentId,
+            humanOwner: action.actor.humanOwner,
+            taskId: action.intent.taskId,
+            tool: action.capability.tool,
+            resource: action.capability.resource,
+        },
+        actionHash,
+        payloadHash,
+        provenanceHash: action.provenance
+            ? hashProvenance(action.provenance)
+            : undefined,
+        decision: decision.decision,
+        reasons: decision.reasons,
+        policy: decision.policy,
+        providerEvidence: input.providerEvidence ?? providerEvidenceForAction(action),
+        executionOutcome: input.executionOutcome,
+        traceId,
+        actionPassId: input.actionPassId ?? null,
+        delegation: input.delegation
+            ? DelegationLedgerEdgeSchema.parse(input.delegation)
+            : undefined,
+        budget: input.budget
+            ? BudgetLedgerEventSchema.parse(input.budget)
+            : undefined,
+        correlationId: input.correlationId ?? undefined,
+        previousLedgerHash: input.previousLedgerHash ?? null,
+    };
+    return LedgerRecordSchema.parse({
+        ...recordWithoutHash,
+        ledgerHash: hashJson(recordWithoutHash),
+    });
+}
+/**
+ * Canonical reason token marking a ledger record as the tamper-evident
+ * revocation event for its pass. Matches the forensics `cascade_containment`
+ * convention (spec §9.5) and the trust-store revocation authority (spec §7).
+ */
+export const REVOCATION_LEDGER_REASON = "actionpass_revoked";
+/**
+ * Build a tamper-evident revocation event for a previously recorded pass. The
+ * event is a `deny` record naming the pass with `actionpass_revoked`, reusing
+ * the revoked record's action/payload hashes, policy, and audit context so the
+ * revocation is bound to the exact action it cancels. It carries no delegation
+ * edge or budget event (those describe the original action, not the
+ * revocation). The durable enforcement authority remains the trust store (§7);
+ * this record is the auditable logbook entry, not the enforcement source.
+ */
+export function recordActionPassRevocationEvent(input) {
+    const source = LedgerRecordSchema.parse(input.revokedRecord);
+    if (!source.actionPassId) {
+        throw new Error("revocation_requires_action_pass_id");
+    }
+    const reasons = [REVOCATION_LEDGER_REASON];
+    if (input.revokedBy)
+        reasons.push(`revoked_by:${input.revokedBy}`);
+    if (input.reason)
+        reasons.push(`revocation_reason:${input.reason}`);
+    const recordWithoutHash = {
+        schemaVersion: LEDGER_SCHEMA_VERSION,
+        id: `ledger_${randomUUID()}`,
+        occurredAt: (input.occurredAt ?? new Date()).toISOString(),
+        auditContext: source.auditContext,
+        actionHash: source.actionHash,
+        payloadHash: source.payloadHash,
+        provenanceHash: source.provenanceHash,
+        decision: "deny",
+        reasons,
+        policy: source.policy,
+        traceId: `trace_${randomUUID()}`,
+        actionPassId: source.actionPassId,
+        correlationId: source.actionPassId,
+        previousLedgerHash: input.previousLedgerHash ?? null,
+    };
+    return LedgerRecordSchema.parse({
+        ...recordWithoutHash,
+        ledgerHash: hashJson(recordWithoutHash),
+    });
+}
+export function hashPayload(payload) {
+    return hashJson(JsonValueSchema.parse(payload));
+}
+export function hashProvenance(provenance) {
+    return hashJson(ActionProvenanceSchema.parse(provenance));
+}
+function validateDelegationAttenuation(parent, child) {
+    const parentRemaining = parent.intent.maxDelegationDepth ?? 0;
+    const childRemaining = child.intent.maxDelegationDepth ?? 0;
+    if (parentRemaining < 1 || childRemaining > parentRemaining - 1) {
+        return "delegation_depth_exceeded";
+    }
+    if (child.actor.humanOwner !== parent.actor.humanOwner ||
+        child.actor.tenant !== parent.actor.tenant ||
+        child.intent.taskId !== parent.intent.taskId ||
+        child.capability.tool !== parent.capability.tool ||
+        child.capability.resource !== parent.capability.resource ||
+        stableStringify(child.toolDefinition) !==
+            stableStringify(parent.toolDefinition) ||
+        !isJsonScopeSubset(child.capability.payload, parent.capability.payload, []) ||
+        !areConstraintsAttenuated(parent.capability.constraints, child.capability.constraints)) {
+        return "delegation_scope_broadened";
+    }
+    return null;
+}
+function isJsonScopeSubset(child, parent, path) {
+    if (stableStringify(child) === stableStringify(parent)) {
+        return true;
+    }
+    if (typeof child === "string" && typeof parent === "string") {
+        return isPathLikeKey(path.at(-1)) && isPathInsideScope(child, parent);
+    }
+    if (Array.isArray(child) && Array.isArray(parent)) {
+        return child.every((childEntry) => parent.some((parentEntry) => isJsonScopeSubset(childEntry, parentEntry, path)));
+    }
+    if (isJsonObject(child) && isJsonObject(parent)) {
+        return Object.entries(child).every(([key, value]) => key in parent &&
+            isJsonScopeSubset(value, parent[key], [...path, key]));
+    }
+    return false;
+}
+function areConstraintsAttenuated(parent, child) {
+    if (!parent) {
+        return true;
+    }
+    if (!child) {
+        return false;
+    }
+    return Object.entries(parent).every(([key, value]) => key in child &&
+        stableStringify(child[key]) === stableStringify(value));
+}
+function isPathLikeKey(key) {
+    return Boolean(key && /(path|file|directory|prefix)/i.test(key));
+}
+function isPathInsideScope(child, parent) {
+    if (parent.endsWith("/**")) {
+        const prefix = parent.slice(0, -2);
+        return child.startsWith(prefix);
+    }
+    if (parent.endsWith("/")) {
+        return child.startsWith(parent);
+    }
+    return false;
+}
+export function hashAction(action) {
+    return hashJson(parseNormalizedAction(action));
+}
+export const GITHUB_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "github",
+    connector: "github-rest",
+    mode: "rest",
+    configSchema: GitHubNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_GITHUB_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: [
+        "contents:write",
+        "metadata:read",
+        "pull_requests:write",
+        "checks:write",
+        "issues:write",
+    ],
+    smokeCheck: "GET /user + X-Accepted-GitHub-Permissions",
+    tools: [
+        {
+            capability: {
+                id: "github-pr-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create pull request",
+                tool: "github.pull_requests.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: [
+                    "title",
+                    "baseBranch",
+                    "filesChanged",
+                    "testsPassed",
+                    "touchesProduction",
+                ],
+                approvalTriggers: [
+                    "protected path",
+                    "production impact",
+                    "base branch mismatch",
+                    "missing tests",
+                    "large file set",
+                ],
+                credentialBoundary: "GitHub token stays in the proxy/adapter; the agent receives an ActionPass-bound result.",
+                smokeCheck: "GET /user",
+            },
+            normalizeEvidence: (action, payload) => githubPullRequestEvidence(action, payload),
+        },
+        {
+            capability: {
+                id: "github-content-read",
+                provider: "github",
+                connector: "github-rest",
+                label: "Read repository content",
+                tool: "github.contents.read",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["fake", "rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "deny_until_scoped",
+                payloadFields: ["path", "ref"],
+                approvalTriggers: ["denied secret or production path"],
+                credentialBoundary: "Repository content is fetched by the adapter after policy checks deny protected paths.",
+                smokeCheck: "GET /user",
+            },
+            normalizeEvidence: (action, payload) => githubContentEvidence(action, payload, "content_read"),
+        },
+        {
+            capability: {
+                id: "github-branch-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create branch",
+                tool: "github.branches.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["branch", "baseBranch", "sha", "allowExisting"],
+                approvalTriggers: ["base branch mismatch"],
+                credentialBoundary: "Branch creation runs through the proxy and is bound to the same ActionPass verification path.",
+                smokeCheck: "GET /user",
+            },
+            normalizeEvidence: (action, payload) => githubBranchEvidence(action, payload),
+        },
+        {
+            capability: {
+                id: "github-content-write",
+                provider: "github",
+                connector: "github-rest",
+                label: "Write repository content",
+                tool: "github.contents.write",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: ["path", "branch", "message", "sha", "content"],
+                approvalTriggers: ["protected path"],
+                credentialBoundary: "File content is never written until policy and ActionPass verification both pass.",
+                smokeCheck: "GET /user",
+            },
+            normalizeEvidence: (action, payload) => githubContentEvidence(action, payload, "content_write"),
+        },
+        {
+            capability: {
+                id: "github-review-comment-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create inline review comment",
+                tool: "github.pull_request_review_comments.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["app"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: [
+                    "pullNumber",
+                    "body",
+                    "commitId",
+                    "path",
+                    "line",
+                    "side",
+                ],
+                approvalTriggers: ["protected path review"],
+                credentialBoundary: "The exact inline comment target and body are authorized before GitHub receives the write.",
+                smokeCheck: "GET /user + Pull requests: write",
+            },
+            normalizeEvidence: (action, payload) => githubReviewCommentEvidence(action, payload),
+        },
+        {
+            capability: {
+                id: "github-check-run-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create check run",
+                tool: "github.check_runs.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: [
+                    "name",
+                    "headSha",
+                    "status",
+                    "conclusion",
+                    "output",
+                ],
+                approvalTriggers: [],
+                credentialBoundary: "Check name, commit SHA, status, conclusion, and output are payload-bound before execution.",
+                smokeCheck: "GET /user + Checks: write",
+            },
+            normalizeEvidence: (action, payload) => githubCheckRunEvidence(action, payload),
+        },
+        {
+            capability: {
+                id: "github-issue-comment-create",
+                provider: "github",
+                connector: "github-rest",
+                label: "Create issue comment",
+                tool: "github.issue_comments.create",
+                operation: "external_message",
+                status: "supported",
+                supportedModes: ["rest", "app"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueNumber", "body"],
+                approvalTriggers: [],
+                credentialBoundary: "The exact issue number and outbound comment body are bound into the ActionPass.",
+                smokeCheck: "GET /user + Issues: write",
+            },
+            normalizeEvidence: (action, payload) => githubIssueCommentEvidence(action, payload),
+        },
+    ],
+};
+export const LINEAR_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "linear",
+    connector: "linear-graphql",
+    mode: "graphql",
+    configSchema: LinearNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_LINEAR_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: ["read", "write"],
+    smokeCheck: "viewer",
+    tools: [
+        {
+            capability: {
+                id: "linear-issue-read",
+                provider: "linear",
+                connector: "linear-graphql",
+                label: "Read issue",
+                tool: "linear.issues.read",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["fake", "graphql"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueKey", "projectKey"],
+                approvalTriggers: [],
+                credentialBoundary: "Linear API key stays adapter-side; policy pins issue access by project key.",
+                smokeCheck: "viewer",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "linear", "issue_read"),
+        },
+        {
+            capability: {
+                id: "linear-comment-create",
+                provider: "linear",
+                connector: "linear-graphql",
+                label: "Create issue comment",
+                tool: "linear.comments.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "graphql"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueKey", "projectKey", "body"],
+                approvalTriggers: [],
+                credentialBoundary: "Linear comments execute only through proxy policy and ActionPass verification.",
+                smokeCheck: "viewer",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "linear", "comment_create"),
+        },
+        {
+            capability: {
+                id: "linear-issue-update",
+                provider: "linear",
+                connector: "linear-graphql",
+                label: "Update issue",
+                tool: "linear.issues.update",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "graphql"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: [
+                    "issueKey",
+                    "projectKey",
+                    "status",
+                    "title",
+                    "description",
+                    "priority",
+                ],
+                approvalTriggers: ["protected status"],
+                credentialBoundary: "Issue mutations stay behind adapter credentials and project/status policy checks.",
+                smokeCheck: "viewer",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "linear", "issue_update"),
+        },
+    ],
+};
+export const JIRA_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "jira",
+    connector: "jira-rest",
+    mode: "rest",
+    configSchema: JiraNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_JIRA_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: ["read:jira-work", "write:jira-work"],
+    smokeCheck: "GET /myself",
+    tools: [
+        {
+            capability: {
+                id: "jira-issue-read",
+                provider: "jira",
+                connector: "jira-rest",
+                label: "Read issue",
+                tool: "jira.issues.read",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["fake", "rest"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueKey", "projectKey"],
+                approvalTriggers: [],
+                credentialBoundary: "Jira credentials stay adapter-side; policy pins issue access by project key.",
+                smokeCheck: "GET /myself",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "jira", "issue_read"),
+        },
+        {
+            capability: {
+                id: "jira-comment-create",
+                provider: "jira",
+                connector: "jira-rest",
+                label: "Create issue comment",
+                tool: "jira.comments.create",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest"],
+                requiresActionPass: true,
+                defaultPolicy: "allow",
+                payloadFields: ["issueKey", "projectKey", "body"],
+                approvalTriggers: [],
+                credentialBoundary: "Jira comments are converted to Atlassian Document Format only after policy and ActionPass verification.",
+                smokeCheck: "GET /myself",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "jira", "comment_create"),
+        },
+        {
+            capability: {
+                id: "jira-issue-update",
+                provider: "jira",
+                connector: "jira-rest",
+                label: "Update issue",
+                tool: "jira.issues.update",
+                operation: "write",
+                status: "supported",
+                supportedModes: ["fake", "rest"],
+                requiresActionPass: true,
+                defaultPolicy: "step_up",
+                payloadFields: [
+                    "issueKey",
+                    "projectKey",
+                    "status",
+                    "title",
+                    "description",
+                    "priorityId",
+                ],
+                approvalTriggers: ["protected status"],
+                credentialBoundary: "Jira field edits and workflow transitions execute only after exact-payload authorization.",
+                smokeCheck: "GET /myself",
+            },
+            normalizeEvidence: (action, payload) => issueTrackerEvidence(action, payload, "jira", "issue_update"),
+        },
+    ],
+};
+export const POSTGRES_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "postgres",
+    connector: "postgres-native",
+    mode: "postgres",
+    configSchema: PostgresNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_POSTGRES_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: [
+        "LOGIN role",
+        "SELECT on allowed tables",
+        "NOBYPASSRLS",
+        "read-only transactions",
+    ],
+    smokeCheck: "SELECT current_database/current_user + transaction_read_only + table RLS metadata",
+    tools: [
+        {
+            capability: {
+                id: "postgres-query-select",
+                provider: "postgres",
+                connector: "postgres-native",
+                label: "Run scoped SELECT",
+                tool: "postgres.query.select",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["postgres"],
+                requiresActionPass: true,
+                defaultPolicy: "deny_until_scoped",
+                payloadFields: ["statement", "parameters", "maxRows"],
+                approvalTriggers: ["unpredicated table scan"],
+                credentialBoundary: "The DSN stays in the local adapter; only the exact parameterized SELECT and bounded result cross the authorization boundary.",
+                smokeCheck: "current role/database, read-only state, and RLS metadata for configured tables",
+            },
+            normalizeEvidence: (action, payload) => postgresSelectEvidence(action, payload),
+        },
+    ],
+};
+export const DRIVE_NATIVE_CONNECTOR_GOVERNANCE = {
+    provider: "drive",
+    connector: "google-drive-rest",
+    mode: "rest",
+    configSchema: DriveNativeConnectorConfigSchema,
+    defaultConfig: DEFAULT_DRIVE_NATIVE_CONNECTOR_CONFIG,
+    requiredScopes: ["https://www.googleapis.com/auth/drive.file"],
+    smokeCheck: "GET selected file metadata including isAppAuthorized (no content)",
+    tools: [
+        {
+            capability: {
+                id: "drive-file-read",
+                provider: "drive",
+                connector: "google-drive-rest",
+                label: "Read selected Drive file",
+                tool: "drive.files.read",
+                operation: "read",
+                status: "supported",
+                supportedModes: ["rest"],
+                requiresActionPass: true,
+                defaultPolicy: "deny_until_scoped",
+                payloadFields: ["fileId", "maxBytes"],
+                approvalTriggers: [
+                    "file not policy-scoped",
+                    "file not selected through Google Picker",
+                    "byte limit exceeded",
+                ],
+                credentialBoundary: "The OAuth token and file content stay in the local enforcement plane; only a Picker-authorized, policy-scoped file can be returned.",
+                smokeCheck: "selected-file metadata and provider isAppAuthorized state",
+            },
+            normalizeEvidence: (action, payload) => driveFileReadEvidence(action, payload),
+        },
+    ],
+};
+export const NATIVE_CONNECTOR_GOVERNANCE_REGISTRY = [
+    GITHUB_NATIVE_CONNECTOR_GOVERNANCE,
+    LINEAR_NATIVE_CONNECTOR_GOVERNANCE,
+    JIRA_NATIVE_CONNECTOR_GOVERNANCE,
+    POSTGRES_NATIVE_CONNECTOR_GOVERNANCE,
+    DRIVE_NATIVE_CONNECTOR_GOVERNANCE,
+];
+const providerEvidenceNormalizers = new Map([
+    [
+        "slack.chat.postMessage",
+        (action, payload) => slackMessageEvidence(action, payload),
+    ],
+    [
+        "docs.documents.search",
+        (action, payload) => docsEvidence(action, payload, "document_search"),
+    ],
+    [
+        "docs.documents.read",
+        (action, payload) => docsEvidence(action, payload, "document_read"),
+    ],
+    ["mcp.tool.call", (action, payload) => mcpEvidence(action, payload)],
+    [
+        "aws.identity.get",
+        (action, payload) => awsEvidence(action, payload, "identity_get"),
+    ],
+    [
+        "aws.s3.objects.list",
+        (action, payload) => awsEvidence(action, payload, "s3_objects_list"),
+    ],
+    [
+        "gcp.projects.get",
+        (action, payload) => gcpEvidence(action, payload, "project_get"),
+    ],
+    [
+        "gcp.storage.objects.list",
+        (action, payload) => gcpEvidence(action, payload, "storage_objects_list"),
+    ],
+    ...NATIVE_CONNECTOR_GOVERNANCE_REGISTRY.flatMap((descriptor) => descriptor.tools.map((tool) => [
+        tool.capability.tool,
+        tool.normalizeEvidence,
+    ])),
+]);
+export function providerEvidenceForAction(actionInput) {
+    const action = parseNormalizedAction(actionInput);
+    return providerEvidenceNormalizers.get(action.capability.tool)?.(action, action.capability.payload);
+}
+export function hashJson(value) {
+    return `sha256:${createHash("sha256")
+        .update(stableStringify(value))
+        .digest("hex")}`;
+}
+export function stableStringify(value) {
+    return JSON.stringify(canonicalize(value));
+}
+function validatePassBinding(claims, action, payloadHash) {
+    if (claims.sub !== action.actor.agentId) {
+        return "agent_id_mismatch";
+    }
+    if (claims.humanOwner !== action.actor.humanOwner) {
+        return "human_owner_mismatch";
+    }
+    if (claims.agentRuntime !== action.actor.runtime) {
+        return "agent_runtime_mismatch";
+    }
+    if (claims.intent.taskId !== action.intent.taskId) {
+        return "task_id_mismatch";
+    }
+    if (stableStringify(claims.intent) !== stableStringify(action.intent)) {
+        return "intent_mismatch";
+    }
+    if (claims.capability.tool !== action.capability.tool) {
+        return "tool_mismatch";
+    }
+    if (claims.capability.resource !== action.capability.resource) {
+        return "resource_mismatch";
+    }
+    if (stableStringify(claims.capability.constraints) !==
+        stableStringify(action.capability.constraints)) {
+        return "constraints_mismatch";
+    }
+    if (stableStringify(claims.budget) !== stableStringify(action.budget)) {
+        return "budget_mismatch";
+    }
+    if (claims.payloadHash !== payloadHash) {
+        return "payload_hash_mismatch";
+    }
+    const provenanceHash = action.provenance
+        ? hashProvenance(action.provenance)
+        : undefined;
+    if (claims.provenanceHash !== provenanceHash) {
+        return action.provenance
+            ? "provenance_hash_mismatch"
+            : "unexpected_provenance_hash";
+    }
+    if (claims.approval?.payloadHash && claims.approval.payloadHash !== payloadHash) {
+        return "approval_payload_hash_mismatch";
+    }
+    if (claims.approval?.actionHash && claims.approval.actionHash !== hashAction(action)) {
+        return "approval_action_hash_mismatch";
+    }
+    return null;
+}
+async function validateDpopProof(input, claims) {
+    if (!input.dpopProof)
+        return "dpop_proof_required";
+    if (!input.dpopMethod)
+        return "dpop_method_required";
+    if (!input.dpopUri)
+        return "dpop_uri_required";
+    try {
+        const header = decodeProtectedHeader(input.dpopProof);
+        if (header.typ !== DPOP_PROOF_TYP)
+            return "dpop_type_mismatch";
+        if (!header.jwk || typeof header.jwk !== "object") {
+            return "dpop_public_jwk_required";
+        }
+        const proofJwk = publicOnlyJwk(header.jwk);
+        const algorithm = header.alg;
+        const algorithms = input.dpopAlgorithms ?? [DEFAULT_SIGNING_ALGORITHM];
+        if (!algorithms.includes(algorithm))
+            return "dpop_algorithm_not_allowed";
+        const key = await importJWK(proofJwk, algorithm);
+        const { payload } = await jwtVerify(input.dpopProof, key, {
+            algorithms,
+            currentDate: input.currentDate,
+        });
+        const proof = DpopProofClaimsSchema.parse(payload);
+        const proofJkt = await calculateJwkThumbprint(proofJwk, "sha256");
+        if (proofJkt !== claims.cnf.jkt)
+            return "dpop_key_mismatch";
+        if (proof.htm !== normalizeDpopMethod(input.dpopMethod)) {
+            return "dpop_method_mismatch";
+        }
+        if (proof.htu !== normalizeDpopUri(input.dpopUri)) {
+            return "dpop_uri_mismatch";
+        }
+        if (proof.ath !== computeDpopAccessTokenHash(input.token)) {
+            return "dpop_actionpass_hash_mismatch";
+        }
+        if (input.dpopNonce !== undefined && proof.nonce !== input.dpopNonce) {
+            return "dpop_nonce_mismatch";
+        }
+        const nowSeconds = toNumericDate(input.currentDate ?? new Date());
+        const maxAge = input.dpopMaxAgeSeconds ?? DEFAULT_DPOP_MAX_AGE_SECONDS;
+        const skew = input.dpopClockSkewSeconds ?? DEFAULT_DPOP_CLOCK_SKEW_SECONDS;
+        if (proof.iat > nowSeconds + skew)
+            return "dpop_proof_from_future";
+        if (proof.iat < nowSeconds - maxAge - skew)
+            return "dpop_proof_stale";
+        if (!input.dpopReplayStore)
+            return "dpop_replay_store_required";
+        const accepted = await input.dpopReplayStore.consume(proof.jti, new Date((proof.iat + maxAge + skew) * 1000), input.currentDate);
+        if (!accepted)
+            return "dpop_replay_detected";
+        return null;
+    }
+    catch (error) {
+        return error instanceof Error && error.message.startsWith("dpop_")
+            ? error.message
+            : "dpop_proof_invalid";
+    }
+}
+export function computeDpopAccessTokenHash(token) {
+    return createHash("sha256").update(token, "ascii").digest("base64url");
+}
+export function normalizeDpopMethod(method) {
+    const normalized = method.trim().toUpperCase();
+    if (!normalized)
+        throw new Error("dpop_method_required");
+    return normalized;
+}
+export function normalizeDpopUri(uri) {
+    const parsed = new URL(uri);
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+}
+export function actionPassDpopTarget(actionInput) {
+    const action = parseNormalizedAction(actionInput);
+    return {
+        method: "POST",
+        uri: `https://local.axtary.dev/actions/${encodeURIComponent(action.capability.tool)}`,
+    };
+}
+function publicOnlyJwk(jwk) {
+    if (!jwk.kty || jwk.kty === "oct") {
+        throw new Error("dpop_public_jwk_invalid");
+    }
+    const publicJwk = { ...jwk };
+    for (const member of ["d", "p", "q", "dp", "dq", "qi", "oth", "k"]) {
+        if (member in publicJwk) {
+            throw new Error("dpop_public_jwk_invalid");
+        }
+    }
+    return publicJwk;
+}
+async function readTrustStore(filePath) {
+    const text = await readTrustStoreFile(filePath);
+    if (!text.trim()) {
+        return ActionPassTrustStoreSchema.parse({
+            schemaVersion: ACTIONPASS_TRUST_STORE_VERSION,
+        });
+    }
+    return ActionPassTrustStoreSchema.parse(JSON.parse(text));
+}
+async function writeTrustStore(filePath, data) {
+    await mkdir(dirname(filePath), { recursive: true });
+    const tmpPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(tmpPath, `${JSON.stringify(data, null, 2)}\n`, {
+        encoding: "utf8",
+        flag: "wx",
+        mode: 0o600,
+    });
+    await rename(tmpPath, filePath);
+}
+async function readTrustStoreFile(filePath) {
+    try {
+        return await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (isNodeError(error) && error.code === "ENOENT") {
+            return "";
+        }
+        throw error;
+    }
+}
+function isTrustedVerificationKey(key, now) {
+    if (key.status === "revoked") {
+        return false;
+    }
+    if (key.notBefore && Date.parse(key.notBefore) > now.getTime()) {
+        return false;
+    }
+    if (key.expiresAt && Date.parse(key.expiresAt) < now.getTime()) {
+        return false;
+    }
+    return true;
+}
+async function resolveVerificationKey(input) {
+    if (!input.verificationKeys) {
+        if (!input.verificationKey) {
+            throw new Error("verification_key_required");
+        }
+        return input.verificationKey;
+    }
+    const { kid } = decodeProtectedHeader(input.token);
+    const key = typeof input.verificationKeys === "function"
+        ? await input.verificationKeys(kid)
+        : kid
+            ? input.verificationKeys[kid]
+            : undefined;
+    if (!key) {
+        throw new Error(kid ? `verification_key_not_found:${kid}` : "verification_key_id_required");
+    }
+    return key;
+}
+async function validateRevocation(input, claims) {
+    if (input.revokedPassIds) {
+        for (const passId of input.revokedPassIds) {
+            if (passId === claims.jti) {
+                return "actionpass_revoked";
+            }
+        }
+    }
+    if (input.revocations) {
+        for (const revocationInput of input.revocations) {
+            const revocation = ActionPassRevocationSchema.parse(revocationInput);
+            if (revocation.passId === claims.jti) {
+                return "actionpass_revoked";
+            }
+        }
+    }
+    if (input.isRevoked) {
+        let result;
+        try {
+            result = await input.isRevoked(claims);
+        }
+        catch {
+            return "actionpass_revocation_check_failed";
+        }
+        if (result === true) {
+            return "actionpass_revoked";
+        }
+        if (typeof result === "string" && result.length > 0) {
+            return result;
+        }
+    }
+    return null;
+}
+async function validateDistributedStatus(input, claims) {
+    if (!input.getStatus) {
+        return "actionpass_status_check_required";
+    }
+    let status;
+    try {
+        status = await input.getStatus(claims);
+    }
+    catch {
+        return "actionpass_status_check_failed";
+    }
+    if (status === 0)
+        return null;
+    if (status === 1)
+        return "actionpass_revoked";
+    if (status === 2)
+        return "actionpass_suspended";
+    if (typeof status === "string" && status.length > 0)
+        return status;
+    return "actionpass_status_invalid";
+}
+function bindApproval(input) {
+    const approval = input.approval
+        ? ApprovalSchema.parse(input.approval)
+        : undefined;
+    const artifact = input.approvalArtifact
+        ? ApprovalArtifactSchema.parse(input.approvalArtifact)
+        : undefined;
+    if (!approval && !artifact) {
+        return undefined;
+    }
+    if (approval && approval.mode !== "none" && !approval.approvedBy && !artifact) {
+        throw new Error("approval_approver_required");
+    }
+    if (approval?.payloadHash && approval.payloadHash !== input.payloadHash) {
+        throw new Error("approval_payload_hash_mismatch");
+    }
+    if (approval?.actionHash && approval.actionHash !== input.actionHash) {
+        throw new Error("approval_action_hash_mismatch");
+    }
+    if (approval &&
+        approval.mode !== "none" &&
+        !approval.payloadHash &&
+        !approval.actionHash &&
+        !artifact) {
+        throw new Error("approval_binding_required");
+    }
+    if (!artifact) {
+        return approval;
+    }
+    const artifactError = validateApprovalArtifact(artifact, input.action, input.now);
+    if (artifactError) {
+        throw new Error(artifactError);
+    }
+    const artifactHash = hashJson(artifact);
+    if (approval?.approvalArtifactHash &&
+        approval.approvalArtifactHash !== artifactHash) {
+        throw new Error("approval_artifact_hash_mismatch");
+    }
+    return ApprovalSchema.parse({
+        mode: approval?.mode ?? artifact.mode,
+        approvedBy: approval?.approvedBy ?? artifact.approvedBy,
+        approverRoles: approval?.approverRoles ?? artifact.approverRoles,
+        approvedAt: approval?.approvedAt ?? artifact.approvedAt,
+        approvalArtifact: approval?.approvalArtifact ?? artifact.id,
+        approvalArtifactHash: artifactHash,
+        actionHash: artifact.actionHash,
+        payloadHash: artifact.payloadHash,
+    });
+}
+export function validateApprovalArtifact(artifactInput, actionInput, now = new Date()) {
+    const artifact = ApprovalArtifactSchema.parse(artifactInput);
+    const action = parseNormalizedAction(actionInput);
+    if (artifact.actionHash !== hashAction(action)) {
+        return "approval_action_hash_mismatch";
+    }
+    if (artifact.payloadHash !== hashPayload(action.capability.payload)) {
+        return "approval_payload_hash_mismatch";
+    }
+    if (artifact.taskId !== action.intent.taskId) {
+        return "approval_task_id_mismatch";
+    }
+    if (artifact.tool !== action.capability.tool) {
+        return "approval_tool_mismatch";
+    }
+    if (artifact.resource !== action.capability.resource) {
+        return "approval_resource_mismatch";
+    }
+    if (artifact.expiresAt && Date.parse(artifact.expiresAt) < now.getTime()) {
+        return "approval_artifact_expired";
+    }
+    return null;
+}
+function githubPullRequestEvidence(action, payload) {
+    const files = changedFilesFromPayload(payload);
+    const diff = providerDiffFromPayload("github", payload) ?? {
+        provider: "github",
+        summary: `${files.length} changed ${files.length === 1 ? "file" : "files"}`,
+        files: files.map((path) => ({
+            path,
+            status: "modified",
+            additions: 0,
+            deletions: 0,
+            hunks: [],
+        })),
+    };
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "pull_request_create",
+        resource: providerResource("github", "repo", action.capability.resource),
+        normalized: compactJsonRecord({
+            title: getString(payload.title) ?? action.intent.declaredGoal,
+            baseBranch: getString(payload.baseBranch),
+            headBranch: getString(payload.headBranch) ?? getString(payload.branch),
+            filesChanged: files,
+            touchesProduction: getBoolean(payload.touchesProduction),
+            testsPassed: getBoolean(payload.testsPassed),
+            draft: getBoolean(payload.draft),
+        }),
+        diff,
+    });
+}
+function githubContentEvidence(action, payload, operation) {
+    const path = getString(payload.path) ?? "unknown";
+    const diff = operation === "content_write"
+        ? providerDiffFromPayload("github", payload) ?? {
+            provider: "github",
+            summary: "1 changed file",
+            files: [
+                {
+                    path,
+                    status: "modified",
+                    additions: 0,
+                    deletions: 0,
+                    hunks: [],
+                },
+            ],
+        }
+        : undefined;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource("github", "file", `${action.capability.resource}:${path}`),
+        normalized: compactJsonRecord({
+            path,
+            branch: getString(payload.branch) ?? getString(payload.ref),
+            message: getString(payload.message),
+            contentLength: operation === "content_write"
+                ? getString(payload.content)?.length ?? null
+                : null,
+        }),
+        diff,
+    });
+}
+function githubBranchEvidence(action, payload) {
+    const branch = getString(payload.branch) ?? "unknown";
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "branch_create",
+        resource: providerResource("github", "branch", `${action.capability.resource}:${branch}`),
+        normalized: compactJsonRecord({
+            branch,
+            baseBranch: getString(payload.baseBranch),
+            sha: getString(payload.sha),
+        }),
+    });
+}
+function githubReviewCommentEvidence(action, payload) {
+    const path = getString(payload.path) ?? "unknown";
+    const pullNumber = getNumber(payload.pullNumber);
+    const line = getNumber(payload.line);
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "pull_request_review_comment_create",
+        resource: providerResource("github", "pull_request_line", `${action.capability.resource}:pull:${pullNumber ?? "unknown"}:${path}:${line ?? "unknown"}`),
+        normalized: compactJsonRecord({
+            pullNumber,
+            commitId: getString(payload.commitId),
+            path,
+            line,
+            side: getString(payload.side),
+            startLine: getNumber(payload.startLine),
+            startSide: getString(payload.startSide),
+            body: redactCredentialLikeText(getString(payload.body) ?? ""),
+        }),
+    });
+}
+function githubCheckRunEvidence(action, payload) {
+    const name = getString(payload.name) ?? "unknown";
+    const headSha = getString(payload.headSha) ?? "unknown";
+    const output = isJsonObject(payload.output) ? payload.output : {};
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "check_run_create",
+        resource: providerResource("github", "commit", `${action.capability.resource}:${headSha}`, name),
+        normalized: compactJsonRecord({
+            name,
+            headSha,
+            status: getString(payload.status),
+            conclusion: getString(payload.conclusion),
+            detailsUrl: getString(payload.detailsUrl),
+            externalId: getString(payload.externalId),
+            outputTitle: getString(output.title),
+            outputSummary: redactCredentialLikeText(getString(output.summary) ?? ""),
+        }),
+    });
+}
+function githubIssueCommentEvidence(action, payload) {
+    const issueNumber = getNumber(payload.issueNumber);
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "github",
+        tool: action.capability.tool,
+        operation: "issue_comment_create",
+        resource: providerResource("github", "issue", `${action.capability.resource}:issue:${issueNumber ?? "unknown"}`),
+        normalized: compactJsonRecord({
+            issueNumber,
+            body: redactCredentialLikeText(getString(payload.body) ?? ""),
+        }),
+    });
+}
+function postgresSelectEvidence(action, payload) {
+    const statement = typeof payload.statement === "string" ? payload.statement : "";
+    const analysis = analyzePostgresSelect(statement);
+    const parameters = Array.isArray(payload.parameters) ? payload.parameters : [];
+    const maxRows = typeof payload.maxRows === "number" && Number.isInteger(payload.maxRows)
+        ? payload.maxRows
+        : null;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "postgres",
+        tool: action.capability.tool,
+        operation: "query_select",
+        resource: providerResource("postgres", "database", action.capability.resource),
+        normalized: {
+            statementHash: analysis.ok ? analysis.analysis.statementHash : null,
+            predicateHash: analysis.ok ? analysis.analysis.predicateHash : null,
+            tables: analysis.ok ? analysis.analysis.tables : [],
+            functions: analysis.ok ? analysis.analysis.functions : [],
+            parameterCount: analysis.ok ? analysis.analysis.parameterCount : 0,
+            parameterHash: hashPayload(parameters),
+            maxRows,
+        },
+    });
+}
+function driveFileReadEvidence(action, payload) {
+    const fileId = getString(payload.fileId) ?? "unknown";
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "drive",
+        tool: action.capability.tool,
+        operation: "file_read",
+        resource: providerResource("drive", "file", `drive:file:${fileId}`, fileId),
+        normalized: compactJsonRecord({
+            fileId,
+            scope: "https://www.googleapis.com/auth/drive.file",
+            maxBytes: getNumber(payload.maxBytes),
+        }),
+    });
+}
+function slackMessageEvidence(action, payload) {
+    const channel = getString(payload.channel) ?? "unknown";
+    const message = getString(payload.text) ?? getString(payload.message) ?? "";
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "slack",
+        tool: action.capability.tool,
+        operation: "message_post",
+        resource: providerResource("slack", "channel", `${action.capability.resource}:${channel}`, channel),
+        normalized: compactJsonRecord({
+            channel,
+            message: redactCredentialLikeText(message),
+            messageLength: message.length,
+            threadTs: getString(payload.threadTs),
+            externalRecipients: getStringArray(payload.externalRecipients),
+            mentionedUsers: getStringArray(payload.mentionedUsers),
+            mentionedGroups: getStringArray(payload.mentionedGroups),
+            links: getStringArray(payload.links),
+            attachmentCount: getArrayLength(payload.attachments),
+            unfurlLinks: getBoolean(payload.unfurlLinks),
+            unfurlMedia: getBoolean(payload.unfurlMedia),
+        }),
+    });
+}
+function issueTrackerEvidence(action, payload, provider, operation) {
+    const issueKey = getString(payload.issueKey) ?? getString(payload.issueId) ?? "unknown";
+    const projectKey = getString(payload.projectKey) ?? issueKey.split("-", 1)[0];
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider,
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource(provider, "issue", `${action.capability.resource}:${issueKey}`, issueKey),
+        normalized: compactJsonRecord({
+            issueKey,
+            projectKey,
+            title: getString(payload.title),
+            status: getString(payload.status),
+            stateId: getString(payload.stateId),
+            priority: getNumber(payload.priority),
+            priorityId: getString(payload.priorityId),
+            commentBody: operation === "comment_create"
+                ? redactCredentialLikeText(getString(payload.body) ?? "")
+                : null,
+        }),
+        fieldChanges: issueTrackerFieldChanges(payload),
+    });
+}
+function docsEvidence(action, payload, operation) {
+    const workspace = getString(payload.workspace) ?? "local";
+    const path = getString(payload.path);
+    const query = getString(payload.query);
+    const resourceId = path
+        ? `${action.capability.resource}:${workspace}:${path}`
+        : `${action.capability.resource}:${workspace}:search`;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "docs",
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource("docs", path ? "document" : "workspace", resourceId, path ?? workspace),
+        normalized: compactJsonRecord({
+            workspace,
+            path,
+            query,
+            maxResults: getNumber(payload.maxResults),
+            maxBytes: getNumber(payload.maxBytes),
+        }),
+    });
+}
+function mcpEvidence(action, payload) {
+    const serverIdentity = action.toolDefinition?.serverIdentity ??
+        getString(payload.serverIdentity) ??
+        "mcp:unknown";
+    const toolName = getString(payload.toolName) ?? action.capability.tool;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "mcp",
+        tool: action.capability.tool,
+        operation: "tool_call",
+        resource: providerResource("mcp", "tool", `${serverIdentity}:${toolName}`, toolName),
+        normalized: compactJsonRecord({
+            serverIdentity,
+            schemaVersion: action.toolDefinition?.schemaVersion,
+            definitionHash: action.toolDefinition?.definitionHash,
+            toolName,
+        }),
+    });
+}
+function awsEvidence(action, payload, operation) {
+    const bucket = getString(payload.bucket);
+    const accountId = getString(payload.accountId);
+    const region = getString(payload.region);
+    const resourceId = bucket
+        ? `aws:s3:${region ?? "unknown"}:${bucket}`
+        : accountId
+            ? `aws:account:${accountId}`
+            : action.capability.resource;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "aws",
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource("aws", bucket ? "s3_bucket" : "identity", resourceId, bucket ?? accountId),
+        normalized: compactJsonRecord({
+            accountId,
+            region,
+            bucket,
+            prefix: getString(payload.prefix),
+            maxKeys: getNumber(payload.maxKeys),
+        }),
+    });
+}
+function gcpEvidence(action, payload, operation) {
+    const projectId = getString(payload.projectId);
+    const bucket = getString(payload.bucket);
+    const resourceId = bucket
+        ? `gcp:storage:${bucket}`
+        : projectId
+            ? `gcp:project:${projectId}`
+            : action.capability.resource;
+    return LedgerProviderEvidenceSchema.parse({
+        schemaVersion: LEDGER_PROVIDER_EVIDENCE_VERSION,
+        provider: "gcp",
+        tool: action.capability.tool,
+        operation,
+        resource: providerResource("gcp", bucket ? "storage_bucket" : "project", resourceId, bucket ?? projectId),
+        normalized: compactJsonRecord({
+            projectId,
+            bucket,
+            prefix: getString(payload.prefix),
+            maxResults: getNumber(payload.maxResults),
+        }),
+    });
+}
+function providerResource(provider, kind, id, label) {
+    return {
+        provider,
+        kind,
+        id,
+        ...(label ? { label } : {}),
+    };
+}
+function providerDiffFromPayload(provider, payload) {
+    const diff = isJsonObject(payload.diff) ? payload.diff : null;
+    if (!diff)
+        return undefined;
+    return LedgerProviderEvidenceDiffSchema.parse({
+        provider,
+        summary: getString(diff.summary) ?? undefined,
+        files: getObjectArray(diff.files).map((file) => ({
+            path: getString(file.path) ?? "unknown",
+            oldPath: getString(file.oldPath) ?? undefined,
+            status: parseDiffStatus(getString(file.status)),
+            additions: getNumber(file.additions) ?? 0,
+            deletions: getNumber(file.deletions) ?? 0,
+            hunks: getObjectArray(file.hunks).map((hunk) => ({
+                header: getString(hunk.header) ?? "@@",
+                lines: getObjectArray(hunk.lines).map((line) => ({
+                    type: parseDiffLineType(getString(line.type)),
+                    content: redactCredentialLikeText(getString(line.content) ?? ""),
+                    oldLine: getNumber(line.oldLine) ?? undefined,
+                    newLine: getNumber(line.newLine) ?? undefined,
+                })),
+            })),
+        })),
+    });
+}
+function changedFilesFromPayload(payload) {
+    const changes = getObjectArray(payload.changes)
+        .map((change) => getString(change.path))
+        .filter((path) => Boolean(path));
+    return [...new Set([...getStringArray(payload.filesChanged), ...changes])];
+}
+function issueTrackerFieldChanges(payload) {
+    return [
+        fieldChange("title", payload.fromTitle, payload.title),
+        fieldChange("description", payload.fromDescription, payload.description),
+        fieldChange("status", payload.fromStatus, payload.status),
+        fieldChange("stateId", payload.fromStateId, payload.stateId),
+        fieldChange("priority", payload.fromPriority, payload.priority),
+        fieldChange("priorityId", payload.fromPriorityId, payload.priorityId),
+    ].filter((change) => change !== null);
+}
+function fieldChange(field, before, after) {
+    if (before === undefined && after === undefined)
+        return null;
+    return LedgerProviderEvidenceFieldChangeSchema.parse({
+        field,
+        before: sanitizeJsonValue(before),
+        after: sanitizeJsonValue(after),
+    });
+}
+function compactJsonRecord(input) {
+    return Object.fromEntries(Object.entries(input)
+        .map(([key, value]) => [key, sanitizeJsonValue(value)])
+        .filter((entry) => entry[1] !== undefined));
+}
+function sanitizeJsonValue(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === "string")
+        return redactCredentialLikeText(value);
+    if (Array.isArray(value)) {
+        return value
+            .map((item) => sanitizeJsonValue(item))
+            .filter((item) => item !== undefined);
+    }
+    if (isJsonObject(value)) {
+        return compactJsonRecord(value);
+    }
+    return value;
+}
+function redactCredentialLikeText(value) {
+    return value
+        .replace(/\bgh[pousr]_[A-Za-z0-9_]{20,}\b/g, "[redacted-github-token]")
+        .replace(/\bxox[baprs]-[A-Za-z0-9-]{20,}\b/g, "[redacted-slack-token]")
+        .replace(/\bsk-[A-Za-z0-9_-]{20,}\b/g, "[redacted-api-key]")
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, "[redacted-aws-access-key]")
+        .replace(/\b[A-Za-z0-9+/]{40}\b/g, "[redacted-token-like-value]");
+}
+function parseDiffStatus(value) {
+    if (value === "added" ||
+        value === "modified" ||
+        value === "deleted" ||
+        value === "renamed") {
+        return value;
+    }
+    return "modified";
+}
+function parseDiffLineType(value) {
+    if (value === "addition" || value === "deletion" || value === "context") {
+        return value;
+    }
+    return "context";
+}
+function getString(value) {
+    return typeof value === "string" ? value : null;
+}
+function getStringArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((item) => typeof item === "string");
+}
+function getNumber(value) {
+    return typeof value === "number" ? value : null;
+}
+function getBoolean(value) {
+    return typeof value === "boolean" ? value : null;
+}
+function getArrayLength(value) {
+    return Array.isArray(value) ? value.length : null;
+}
+function getObjectArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((item) => isJsonObject(item));
+}
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toNumericDate(date) {
+    return Math.floor(date.getTime() / 1000);
+}
+function canonicalize(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => canonicalize(item));
+    }
+    if (isPlainObject(value)) {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, entryValue]) => entryValue !== undefined)
+            // UTF-16 code unit order per RFC 8785 (JCS); locale-sensitive sorts
+            // would make hashes non-portable across environments.
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([key, entryValue]) => [key, canonicalize(entryValue)]));
+    }
+    return value;
+}
+function isPlainObject(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.getPrototypeOf(value) === Object.prototype);
+}
+function isNodeError(error) {
+    return error instanceof Error && "code" in error;
+}
+// ─────────────────────────────────────────────────────────────────────────────
+// SDK facade (PRD §8.2)
+//
+// The ergonomic developer entry point. It exposes the five PRD verbs —
+// `authorize`, `verify`, `record`, `revoke`, `explain` — over a flat request
+// shape and delegates to the tested core functions above. It adds no new
+// authorization logic and changes no token/ledger/policy shape; it only maps the
+// flat request to a NormalizedAction, threads a local hash-linked ledger head,
+// and promotes the deterministic reason prose (`explainDecision`).
+//
+// Keys: if no signing key is configured, the facade resolves a persistent dev
+// keypair (`devKeypair()` — env-backed or a 0600 local keyring file) so the
+// quickstart runs with zero key plumbing and its passes verify across process
+// restarts. Configure { signingKey, verificationKey } (or a hosted issuer) for
+// production.
+// ─────────────────────────────────────────────────────────────────────────────
+export const AXTARY_DEFAULT_ISSUER = "axtary-dev";
+export const AXTARY_DEFAULT_TENANT = "local";
+export const AXTARY_DEFAULT_RUNTIME = "sdk";
+function isNormalizedActionShape(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "actor" in value &&
+        "capability" in value &&
+        "intent" in value);
+}
+function isAuthorizeResultShape(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "action" in value &&
+        "decision" in value &&
+        typeof value.decision === "object");
+}
+function isAxtaryPassShape(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        "token" in value &&
+        "claims" in value);
+}
+export class Axtary {
+    issuer;
+    tenant;
+    runtime;
+    defaultPolicy;
+    algorithm;
+    quiet;
+    configuredSigningKey;
+    configuredKeyId;
+    configuredVerificationKey;
+    keyPath;
+    signerPromise;
+    ledgerHead = null;
+    revocations = new Map();
+    constructor(config = {}) {
+        this.issuer = config.issuer ?? AXTARY_DEFAULT_ISSUER;
+        this.tenant = config.tenant ?? AXTARY_DEFAULT_TENANT;
+        this.runtime = config.runtime ?? AXTARY_DEFAULT_RUNTIME;
+        this.defaultPolicy = config.policy;
+        this.algorithm = config.algorithm ?? DEFAULT_SIGNING_ALGORITHM;
+        this.quiet = config.quiet ?? false;
+        this.configuredSigningKey = config.signingKey;
+        this.configuredKeyId = config.signingKeyId;
+        this.configuredVerificationKey = config.verificationKey;
+        this.keyPath = config.keyPath;
+    }
+    /** Current local ledger head (hash of the last record this instance wrote). */
+    get ledgerHash() {
+        return this.ledgerHead;
+    }
+    async resolveSigner() {
+        if (!this.signerPromise) {
+            this.signerPromise = (async () => {
+                if (this.configuredSigningKey) {
+                    return {
+                        signingKey: this.configuredSigningKey,
+                        keyId: this.configuredKeyId,
+                        verificationKey: this.configuredVerificationKey,
+                        algorithm: this.algorithm,
+                    };
+                }
+                const dev = await devKeypair({ path: this.keyPath });
+                if (!this.quiet) {
+                    const origin = dev.source === "env"
+                        ? `from ${AXTARY_DEV_SIGNING_KEY_ENV}`
+                        : `at ${dev.path}`;
+                    console.warn("[axtary] No signing key configured — issuing ActionPasses with a " +
+                        `persistent local dev key (${origin}). These passes verify across ` +
+                        "process restarts on this machine. Pass { signingKey, " +
+                        "verificationKey } to createAxtary() (or use a hosted issuer) for " +
+                        "production.");
+                }
+                return {
+                    signingKey: dev.signingKey,
+                    keyId: dev.signingKeyId,
+                    verificationKey: dev.verificationKey,
+                    algorithm: dev.algorithm,
+                };
+            })();
+        }
+        return this.signerPromise;
+    }
+    toNormalizedAction(request) {
+        if (isNormalizedActionShape(request)) {
+            return parseNormalizedAction(request);
+        }
+        return parseNormalizedAction({
+            schemaVersion: ACTION_SCHEMA_VERSION,
+            actor: {
+                agentId: request.agent,
+                humanOwner: request.human,
+                runtime: request.runtime ?? this.runtime,
+                tenant: request.tenant ?? this.tenant,
+            },
+            intent: {
+                taskId: request.task ?? `task_${randomUUID()}`,
+                declaredGoal: request.intent,
+                maxDelegationDepth: request.maxDelegationDepth,
+            },
+            capability: {
+                tool: request.tool,
+                resource: request.resource,
+                payload: request.payload ?? {},
+                constraints: request.constraints,
+            },
+            toolDefinition: request.toolDefinition,
+            provenance: request.provenance,
+            budget: request.budget,
+        });
+    }
+    /**
+     * Decide an action and, for an allow, issue an ActionPass. Always returns a
+     * decision (the policy evaluation is keyless); a deny/step-up returns
+     * `pass: null`. Threads the local ledger head so successive calls chain.
+     */
+    async authorize(request, options = {}) {
+        const signer = await this.resolveSigner();
+        const action = this.toNormalizedAction(request);
+        const result = await authorize({
+            action,
+            issuer: this.issuer,
+            tenant: this.tenant,
+            signingKey: signer.signingKey,
+            keyId: signer.keyId,
+            algorithm: signer.algorithm,
+            policy: options.policy ?? this.defaultPolicy,
+            approval: options.approval,
+            approvalArtifact: options.approvalArtifact,
+            previousLedgerHash: this.ledgerHead,
+            now: options.now,
+        });
+        this.ledgerHead = result.ledger.ledgerHash;
+        return {
+            status: result.decision.decision,
+            decision: result.decision,
+            reasons: result.decision.reasons,
+            explanation: explainDecision(result.decision),
+            payloadHash: result.payloadHash,
+            action: result.action,
+            pass: result.actionPass,
+            ledger: result.ledger,
+        };
+    }
+    /**
+     * Verify a previously issued pass against an action. Accepts an authorize
+     * result, a pass object, or a raw token; the action defaults to the result's
+     * action when one is supplied. Fails closed for a pass this instance revoked.
+     */
+    async verify(pass, action) {
+        let token;
+        let actionInput = action;
+        if (typeof pass === "string") {
+            token = pass;
+        }
+        else if (isAuthorizeResultShape(pass)) {
+            token = pass.pass?.token ?? null;
+            actionInput = actionInput ?? pass.action;
+        }
+        else if (isAxtaryPassShape(pass)) {
+            token = pass.token;
+        }
+        else {
+            token = null;
+        }
+        if (!token) {
+            return { valid: false, reason: "actionpass_not_issued" };
+        }
+        if (!actionInput) {
+            return { valid: false, reason: "verify_requires_action" };
+        }
+        const signer = await this.resolveSigner();
+        if (!signer.verificationKey) {
+            return { valid: false, reason: "verification_key_required" };
+        }
+        return verifyActionPass({
+            token,
+            action: this.toNormalizedAction(actionInput),
+            verificationKey: signer.verificationKey,
+            issuer: this.issuer,
+            algorithms: [signer.algorithm],
+            revocations: this.revocations.values(),
+        });
+    }
+    /**
+     * Append an execution result to the local ledger, chained after the decision
+     * record from `authorize`. Returns the tamper-evident record; durable
+     * persistence is the proxy/CLI's responsibility.
+     */
+    record(input) {
+        const action = this.toNormalizedAction(input.action);
+        const passId = typeof input.pass === "string"
+            ? input.pass
+            : (input.pass?.claims.jti ?? null);
+        const executionOutcome = input.outcome
+            ? LedgerExecutionOutcomeSchema.parse({
+                schemaVersion: LEDGER_EXECUTION_OUTCOME_VERSION,
+                ...input.outcome,
+            })
+            : undefined;
+        const record = recordDecision({
+            action,
+            decision: input.decision,
+            actionPassId: passId,
+            executionOutcome,
+            previousLedgerHash: input.previousLedgerHash ?? this.ledgerHead,
+            correlationId: input.correlationId ?? passId,
+        });
+        this.ledgerHead = record.ledgerHash;
+        return record;
+    }
+    /**
+     * Revoke a pass by id. The revocation is held in this instance so a later
+     * `verify` of that pass fails closed. Durable cross-process revocation is the
+     * CLI/trust-store path (`axtary revoke`).
+     */
+    revoke(passId, options = {}) {
+        const revocation = revokeActionPass({
+            passId,
+            revokedBy: options.revokedBy,
+            reason: options.reason,
+            revokedAt: options.revokedAt,
+        });
+        this.revocations.set(passId, revocation);
+        return revocation;
+    }
+    /** Deterministic, human-readable explanation of a decision (no model call). */
+    explain(decision) {
+        const policyDecision = isAuthorizeResultShape(decision)
+            ? decision.decision
+            : decision;
+        return explainDecision(policyDecision);
+    }
+}
+/** Create an Axtary SDK instance. */
+export function createAxtary(config = {}) {
+    return new Axtary(config);
+}
+/** Default Axtary SDK instance (PRD §8.2 `import { axtary }`). */
+export const axtary = createAxtary();
+//# sourceMappingURL=index.js.map