@axtary/cli 0.1.0 → 0.3.0

package/dist/index.d.ts

@@ -1,24 +1,60 @@
-import { type JsonValue, type AxtaryDecision, type PolicyDecision } from "@axtary/actionpass";
-import { type FakeAdapterState } from "@axtary/adapters";
-import { type LedgerExport, type LedgerExportFormat, type LedgerSyncResult } from "@axtary/ledger";
-import { type PolicyConfig } from "@axtary/policy";
+import { LocalCaepMappingStore, issuerJwks, type SsfSubjectIdentifier, type ActionPassRevocation, type JsonValue, type AxtaryDecision, type PolicyDecision } from "@axtary/actionpass";
+import { type FakeAdapterState, type PostgresQueryClient } from "@axtary/adapters";
+import { type LedgerAttestationBundle, type LedgerConsistencyProof, type LedgerEquivalenceReport, type LedgerExport, type LedgerExportFormat, type OtelTraceExportResult, type ForensicReport, type LedgerInclusionProof, type LedgerSyncResult, type ProofVerificationResult, type VerifyLedgerAttestationResult } from "@axtary/ledger";
+import { type McpConformanceReceipt, type McpChainVerdict, type McpPinReconcileEntry, type McpSignedDefinitionVerification } from "@axtary/mcp";
+import { type PolicyConfig, type PolicyFixtureResult as PolicyTemplateFixtureResult, type PolicyTemplate, type PolicySimulation } from "@axtary/policy";
+import { type AcsInterventionPoint } from "@axtary/policy/acs";
 import { type ProxyHandleResult } from "@axtary/proxy";
+import { type CredentialMetadata, type CredentialStore } from "./credentials.js";
+export { HOOK_INSTALL_SCHEMA_VERSION, installRuntimeHook, type HookInstallRuntime, type HookInstallResult, } from "./hook-install.js";
 export { CLAUDE_CODE_HOOK_SCHEMA_VERSION, normalizeClaudeCodeToolCall, parseClaudeCodeHookPayload, runClaudeCodeHook, type ClaudeCodeHookPayload, type ClaudeCodeHookRunInput, type ClaudeCodeHookRunResult, } from "./claude-code-hook.js";
+export { CURSOR_HOOK_SCHEMA_VERSION, normalizeCursorToolCall, parseCursorHookPayload, runCursorHook, type CursorHookPayload, type CursorHookRunInput, type CursorHookRunResult, } from "./cursor-hook.js";
+export { CODEX_HOOK_SCHEMA_VERSION, classifyShellCommand, normalizeCodexToolCall, parseCodexHookPayload, runCodexHook, type CodexHookPayload, type CodexHookRunInput, type CodexHookRunResult, } from "./codex-hook.js";
 export declare const DEMO_SCHEMA_VERSION = "axtary.demo.v0";
+export declare const TEMPLATE_DEMO_SCHEMA_VERSION = "axtary.template_demo.v0";
 export declare const POLICY_TEST_SCHEMA_VERSION = "axtary.policy_test.v0";
+export declare const POLICY_HARNESS_SCHEMA_VERSION = "axtary.policy_harness.v0";
+export declare const POLICY_SIMULATE_RUN_SCHEMA_VERSION = "axtary.policy_simulate_run.v0";
 export declare const LOCAL_PROXY_SCHEMA_VERSION = "axtary.local_proxy.v0";
 export declare const LEDGER_EXPORT_RUN_SCHEMA_VERSION = "axtary.ledger_export_run.v0";
 export declare const LEDGER_SYNC_RUN_SCHEMA_VERSION = "axtary.ledger_sync_run.v0";
+export declare const LEDGER_OTEL_EXPORT_RUN_SCHEMA_VERSION = "axtary.ledger_otel_export_run.v0";
+export declare const LEDGER_ATTEST_RUN_SCHEMA_VERSION = "axtary.ledger_attest_run.v0";
+export declare const LEDGER_VERIFY_EXPORT_RUN_SCHEMA_VERSION = "axtary.ledger_verify_export_run.v0";
+export declare const LEDGER_PROVE_INCLUSION_RUN_SCHEMA_VERSION = "axtary.ledger_prove_inclusion_run.v0";
+export declare const LEDGER_PROVE_EQUIVALENCE_RUN_SCHEMA_VERSION = "axtary.ledger_prove_equivalence_run.v0";
+export declare const LEDGER_PROVE_CONSISTENCY_RUN_SCHEMA_VERSION = "axtary.ledger_prove_consistency_run.v0";
+export declare const LEDGER_VERIFY_PROOF_RUN_SCHEMA_VERSION = "axtary.ledger_verify_proof_run.v0";
+export declare const LEDGER_FORENSICS_RUN_SCHEMA_VERSION = "axtary.ledger_forensics_run.v0";
+export declare const ATTESTATION_KEY_SCHEMA_VERSION = "axtary.attestation_key.v0";
 export declare const CONNECTOR_DOCTOR_SCHEMA_VERSION = "axtary.connector_doctor.v0";
 export declare const REAL_WORKFLOW_RUN_SCHEMA_VERSION = "axtary.real_workflow_run.v0";
+export declare const CONNECT_RUN_SCHEMA_VERSION = "axtary.connect_run.v0";
+export declare const CONNECTIONS_SCHEMA_VERSION = "axtary.connections.v0";
+export declare const ACTIONPASS_REVOCATION_RUN_SCHEMA_VERSION = "axtary.actionpass_revocation_run.v0";
+export declare const DEFAULT_ACTIONPASS_TRUST_STORE_PATH = ".axtary/actionpass-trust-store.json";
+export declare const DEFAULT_DPOP_REPLAY_STORE_PATH = ".axtary/dpop-replay-store.jsonl";
+export declare const ACTIONPASS_STATUS_RUN_SCHEMA_VERSION = "axtary.actionpass_status_run.v0";
+export declare const CAEP_MAPPING_RUN_SCHEMA_VERSION = "axtary.caep_mapping_run.v0";
 export type DemoRunInput = {
     configPath?: string;
     ledgerPath?: string;
+    trustStorePath?: string;
+    dpopReplayStorePath?: string;
+    statusListUri?: string;
     cwd?: string;
 };
+export type TemplateDemoRunInput = {
+    configPath?: string;
+    cwd?: string;
+    templateId: string;
+};
 export type ProxyServerInput = DemoRunInput & {
     host?: string;
     port?: number;
+    otlpEndpoint?: string;
+    otlpServiceName?: string;
+    otlpTimeoutMs?: number;
 };
 export type ProxyServerHandle = {
     schemaVersion: typeof LOCAL_PROXY_SCHEMA_VERSION;
@@ -26,14 +62,33 @@ export type ProxyServerHandle = {
     host: string;
     port: number;
     ledgerPath: string;
+    trustStorePath: string;
+    dpopReplayStorePath: string;
+    issuerKeyringPath: string;
+    statusStorePath: string;
+    statusListUri: string;
+    caep: {
+        enabled: boolean;
+        mappingPath: string;
+        replayPath: string;
+        issuer: string | null;
+    };
+    otel: {
+        enabled: boolean;
+        endpoint: string | null;
+        serviceName: string | null;
+    };
     adapters: FakeAdapterState;
     adapterModes: {
-        github: "fake" | "rest";
+        github: "fake" | "rest" | "app";
         slack: "fake" | "web";
         linear: "fake" | "graphql";
+        jira: "fake" | "rest";
         aws: "off" | "rest";
         gcp: "off" | "rest";
         docs: "off" | "local";
+        postgres: "off" | "postgres";
+        drive: "off" | "rest";
         mcp: "fixture";
     };
     close: () => Promise<void>;
@@ -70,6 +125,45 @@ export type PolicyTestRunResult = {
     failed: number;
     results: PolicyFixtureResult[];
 };
+export type PolicySimulateRunInput = {
+    actionPath: string;
+    configPath?: string;
+    cwd?: string;
+};
+export type PolicySimulateRunResult = {
+    schemaVersion: typeof POLICY_SIMULATE_RUN_SCHEMA_VERSION;
+    config: {
+        filePath: string | null;
+        policyVersion: string;
+    };
+    actionPath: string;
+    simulation: PolicySimulation;
+};
+export type PolicyHarnessRunInput = {
+    harnessPath: string;
+    configPath?: string;
+    cwd?: string;
+};
+export type PolicyHarnessRunResult = {
+    schemaVersion: typeof POLICY_HARNESS_SCHEMA_VERSION;
+    config: {
+        filePath: string | null;
+        policyVersion: string;
+    };
+    harnessPath: string;
+    passed: boolean;
+    total: number;
+    failed: number;
+    results: Array<{
+        name: string;
+        passed: boolean;
+        expectedDecision: string;
+        actualDecision: string;
+        expectedRule: string | null;
+        actualRule: string | null;
+        actualReasons: string[];
+    }>;
+};
 export type DemoActionResult = {
     name: string;
     tool: string;
@@ -94,8 +188,12 @@ export type DemoRunResult = {
         github: "fake";
         slack: "fake";
         linear: "fake";
+        jira: "fake";
         aws: "off";
         gcp: "off";
+        docs: "local";
+        postgres: "off";
+        drive: "off";
         mcp: "fixture";
     };
     ledger: {
@@ -105,6 +203,23 @@ export type DemoRunResult = {
         failure: string | null;
     };
 };
+export type TemplateDemoRunResult = {
+    schemaVersion: typeof TEMPLATE_DEMO_SCHEMA_VERSION;
+    template: {
+        id: string;
+        name: string;
+        decisionModel: PolicyTemplate["decisionModel"];
+    };
+    config: {
+        filePath: string | null;
+        policyVersion: string;
+    };
+    mode: "policy_only";
+    passed: boolean;
+    total: number;
+    failed: number;
+    results: PolicyTemplateFixtureResult[];
+};
 export type CliIo = {
     stdout?: (text: string) => void;
     stderr?: (text: string) => void;
@@ -115,10 +230,11 @@ export declare function authorizeDecisionHints(decision: PolicyDecision, policy:
 type SmokeTestInput = DemoRunInput & {
     env?: Record<string, string | undefined>;
     fetch?: typeof fetch;
+    store?: CredentialStore;
 };
 type ConnectorDoctorInput = SmokeTestInput;
 export type ConnectorDoctorProviderStatus = {
-    provider: "github" | "slack" | "linear" | "aws" | "gcp" | "docs";
+    provider: "github" | "slack" | "linear" | "jira" | "aws" | "gcp" | "docs" | "drive" | "postgres";
     mode: string;
     status: "ready" | "missing" | "failed" | "skipped";
     capability: "real-write" | "read-only" | "local-read" | "fake" | "off";
@@ -138,6 +254,74 @@ export type ConnectorDoctorResult = {
     status: "ready" | "needs_setup";
     providers: ConnectorDoctorProviderStatus[];
 };
+export declare const POLICY_PARITY_SCHEMA_VERSION = "axtary.policy_parity.v0";
+export declare const ACS_CONFORMANCE_SCHEMA_VERSION = "axtary.acs_conformance.v0";
+export type PolicyParityRunInput = {
+    configPath?: string;
+    cwd?: string;
+    fixturesPath?: string;
+    cedarPath?: string;
+    regoWasmPath?: string;
+};
+export type PolicyParityFixtureResult = {
+    id: string;
+    passed: boolean;
+    expected: {
+        decision: string;
+        reasons: string[];
+    };
+    engines: Record<string, {
+        decision: string;
+        reasons: string[];
+    }>;
+};
+export type PolicyParityRunResult = {
+    schemaVersion: typeof POLICY_PARITY_SCHEMA_VERSION;
+    engines: string[];
+    fixturesPath: string;
+    cedarPath: string;
+    regoWasmPath: string;
+    agentCore: {
+        schemaVersion: string;
+        status: "offline_mapping";
+        gatewayResource: string;
+        fixtureCount: number;
+        sample: JsonValue | null;
+    };
+    passed: boolean;
+    total: number;
+    failed: number;
+    results: PolicyParityFixtureResult[];
+};
+export type AcsConformanceVectorResult = {
+    id: string;
+    interventionPoint: AcsInterventionPoint;
+    expectedVerdict: string;
+    actualVerdict: string;
+    expectedProxyStatus: string;
+    actualProxyStatus: string | null;
+    passed: boolean;
+    reasons: string[];
+    actionHash: string | null;
+    payloadHash: string | null;
+    actionPassId: string | null;
+    ledgerLine: number | null;
+    executionLedgerLine: number | null;
+};
+export type AcsConformanceRunInput = {
+    configPath?: string;
+    cwd?: string;
+    ledgerPath?: string;
+};
+export type AcsConformanceRunResult = {
+    schemaVersion: typeof ACS_CONFORMANCE_SCHEMA_VERSION;
+    manifestVersion: string;
+    ledgerPath: string;
+    passed: boolean;
+    total: number;
+    failed: number;
+    vectors: AcsConformanceVectorResult[];
+};
 export type LedgerExportRunInput = DemoRunInput & {
     from?: string;
     to?: string;
@@ -173,6 +357,22 @@ export type LedgerSyncRunResult = {
     endpoint: string;
     sync: LedgerSyncResult;
 };
+export type LedgerOtelExportRunInput = LedgerExportRunInput & {
+    endpoint: string;
+    serviceName?: string;
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+};
+export type LedgerOtelExportRunResult = {
+    schemaVersion: typeof LEDGER_OTEL_EXPORT_RUN_SCHEMA_VERSION;
+    config: {
+        filePath: string | null;
+        tenant: string;
+    };
+    ledgerPath: string;
+    endpoint: string;
+    export: OtelTraceExportResult;
+};
 export type RealWorkflowRunInput = DemoRunInput & {
     env?: Record<string, string | undefined>;
     fetch?: typeof fetch;
@@ -186,7 +386,26 @@ export type RealWorkflowRunInput = DemoRunInput & {
     prTitle?: string;
     approvedBy?: string;
     approveStepUp?: boolean;
+    hostedApproval?: boolean;
+    approvalEndpoint?: string;
+    approvalTokenEnv?: string;
+    approvalPollIntervalSeconds?: number;
+    approvalTimeoutSeconds?: number;
+    onApprovalPending?: (info: {
+        requestId: string;
+        endpoint: string;
+    }) => void;
+    store?: CredentialStore;
     tamper?: boolean;
+    checkName?: string;
+    reviewLine?: number;
+    databaseResource?: string;
+    sqlStatement?: string;
+    sqlParameters?: JsonValue[];
+    maxRows?: number;
+    postgresClientFactory?: (connectionString: string) => PostgresQueryClient;
+    driveFileId?: string;
+    maxReadBytes?: number;
 };
 export type RealWorkflowTamperEvidence = {
     step: string;
@@ -194,6 +413,29 @@ export type RealWorkflowTamperEvidence = {
     mutation: string;
     approvedPayloadHash: string;
     attemptedPayloadHash: string;
+    /**
+     * The scoped-authority contrast: the agent still held a valid, exact-payload
+     * human approval for this tool + resource when it attempted the mutated
+     * payload. `scopeUnchanged` is computed by comparing the approved and
+     * attempted actions' tool + resource — when true, an authorizer that checks
+     * scope alone (a held, valid scoped token) would still authorize the call,
+     * and only the payload-hash binding caught the swap.
+     */
+    scopedAuthority: {
+        tool: string;
+        resource: string;
+        approvedBy: string;
+        artifactId: string;
+        scopeUnchanged: boolean;
+    };
+    /**
+     * Whether the tamper step actually ran. A prior step failing (e.g. a
+     * GitHub branch collision on re-run) aborts the workflow before the Slack
+     * step, leaving the tamper unexercised. This must be distinguished from a
+     * step that ran and was not blocked, so a benign prior failure can never
+     * be misreported as "the tampered payload executed".
+     */
+    reached: boolean;
     blocked: boolean;
     blockReasons: string[];
 };
@@ -240,48 +482,675 @@ export type RealWorkflowRunResult = {
 };
 export declare function startProxyServer(input?: ProxyServerInput): Promise<ProxyServerHandle>;
 export declare const INIT_SCHEMA_VERSION = "axtary.init.v0";
-export declare const INIT_CONFIG_TEMPLATE: string;
+export declare const INIT_CONFIG_TEMPLATE = "schemaVersion: axtary.config.v0\nissuer: https://local.axtary.dev\ntenant: org:local\nledger:\n  path: .axtary/actions.jsonl\nruntime:\n  allowUnsignedExecution: false\n  handlerTimeoutMs: 10000\n  status:\n    enabled: true\n    keyringPath: .axtary/keys/actionpass-issuer-keyring.json\n    storePath: .axtary/actionpass-status.json\n    ttlSeconds: 60\n    expiresInSeconds: 120\n  caep:\n    enabled: false\n    mappingPath: .axtary/caep-mappings.json\n    replayPath: .axtary/ssf-replay.json\nadapters:\n  # Start in fake mode: deterministic local adapters, no credentials needed.\n  # Switch a provider to its real mode (rest/web/graphql) once its env token is set.\n  github:\n    mode: fake\n    tokenEnv: GITHUB_TOKEN\n    apiBaseUrl: https://api.github.com\n    userAgent: axtary-local-proxy\n  slack:\n    mode: fake\n    tokenEnv: SLACK_BOT_TOKEN\n    apiBaseUrl: https://slack.com/api\n  linear:\n    mode: fake\n    tokenEnv: LINEAR_API_KEY\n    apiUrl: https://api.linear.app/graphql\n  docs:\n    mode: local\n    # Local docs the agent may search. `axtary init` creates the docs/ root;\n    # add or remove roots to match your project.\n    roots:\n      - docs\npolicy:\n  version: \"starter-v0\"\n  github:\n    pullRequests:\n      requiredBaseBranch: main\n      maxFilesChanged: 12\n      denyPathPrefixes:\n        - .env\n        - secrets/\n      stepUpPathPrefixes:\n        - infra/prod/\n        - billing/\n        - auth/\n      requiresTests: true\n    contents:\n      denyReadPathPrefixes:\n        - .env\n        - secrets/\n        - infra/prod/\n  slack:\n    messages:\n      allowedChannels:\n        - \"#axtary-dev\"\n      stepUpExternalRecipients: true\ndemo:\n  scenario: coding-agent\n";
 export type InitRunInput = {
     cwd?: string;
     configPath?: string;
     force?: boolean;
+    templateId?: string;
 };
 export type InitRunResult = {
     schemaVersion: typeof INIT_SCHEMA_VERSION;
     status: "created" | "exists";
     configPath: string;
+    templateId: string | null;
+    policyTestPath: string | null;
 };
 export declare function runInit(input?: InitRunInput): Promise<InitRunResult>;
 export declare function formatInitResult(result: InitRunResult): string;
 export declare const MCP_SERVE_SCHEMA_VERSION = "axtary.mcp_serve.v0";
+export declare const MCP_CONFORMANCE_RUN_SCHEMA_VERSION = "axtary.mcp_conformance_run.v0";
 export type McpServeInput = {
     configPath?: string;
     cwd?: string;
     ledgerPath?: string;
+    trustStorePath?: string;
+    dpopReplayStorePath?: string;
+    pinsPath?: string;
+    /**
+     * When true, a tool with no existing pin is quarantined until reviewed
+     * instead of trusted-on-first-use. Drift is always quarantined regardless.
+     */
+    strict?: boolean;
     wrap?: string;
+    wrapUrl?: string;
+    headers?: Record<string, string>;
+    oauth?: boolean;
+    oauthStore?: CredentialStore;
+    oauthFetch?: typeof fetch;
     owner?: string;
     input?: NodeJS.ReadableStream;
     output?: NodeJS.WritableStream;
     log?: (text: string) => void;
 };
+export type McpServeQuarantine = {
+    serverIdentity: string;
+    toolName: string;
+    reason: "definition_drifted" | "unpinned_strict";
+    discoveredHash: string;
+    pinnedHash: string | null;
+};
 export type McpServeHandle = {
     schemaVersion: typeof MCP_SERVE_SCHEMA_VERSION;
     ledgerPath: string;
+    trustStorePath: string;
+    dpopReplayStorePath: string;
+    pinsPath: string;
     tools: Array<{
         name: string;
         serverIdentity: string;
         definitionHash: string;
     }>;
+    provenance: {
+        pinned: number;
+        pinnedOnFirstUse: number;
+        quarantined: McpServeQuarantine[];
+    };
     done: Promise<void>;
     close: () => Promise<void>;
 };
 export declare function startMcpServe(input?: McpServeInput): Promise<McpServeHandle>;
-export declare function runDemo(input?: DemoRunInput): Promise<DemoRunResult>;
+export declare function resolveActionPassTrustStorePath(cwd: string, trustStorePath?: string): string;
+export declare function resolveDpopReplayStorePath(cwd: string, dpopReplayStorePath?: string): string;
+export type McpWrapTarget = {
+    /** stdio command line (whitespace-split, no shell quoting). */
+    wrap?: string;
+    /** Streamable HTTP MCP endpoint URL. */
+    wrapUrl?: string;
+    /** Extra HTTP headers (e.g. Authorization) for the HTTP transport. */
+    headers?: Record<string, string>;
+    /**
+     * Resolve the upstream bearer from the local OAuth broker for this remote MCP
+     * server (RFC 9728/8707 session created by `axtary mcp login`). The token is
+     * injected only into the upstream request header — never persisted to pins,
+     * ledger, or status. Requires `wrapUrl`.
+     */
+    oauth?: boolean;
+    /** Credential store + fetch overrides for OAuth bearer resolution (tests). */
+    oauthStore?: CredentialStore;
+    oauthFetch?: typeof fetch;
+};
+export declare const MCP_PINS_REPORT_SCHEMA_VERSION = "axtary.mcp_pins_report.v0";
+export declare const MCP_PUBLISHER_TRUST_REPORT_SCHEMA_VERSION = "axtary.mcp_publisher_trust_report.v0";
+export declare const MCP_SIGNED_DEFINITION_VERIFY_SCHEMA_VERSION = "axtary.mcp_signed_definition_verify.v0";
+export type McpPublisherTrustResult = {
+    schemaVersion: typeof MCP_PUBLISHER_TRUST_REPORT_SCHEMA_VERSION;
+    trustPath: string;
+    registered: string | null;
+    publishers: Array<{
+        publisher: string;
+        keys: Array<{
+            kid: string;
+            alg: string;
+            kty: string;
+            crv: string;
+        }>;
+    }>;
+};
+export declare function runMcpTrustPublisher(input: {
+    publisher: string;
+    jwksPath: string;
+    trustPath?: string;
+    cwd?: string;
+}): Promise<McpPublisherTrustResult>;
+export declare function runMcpPublishers(input?: {
+    trustPath?: string;
+    cwd?: string;
+}): Promise<McpPublisherTrustResult>;
+export declare function formatMcpPublishers(result: McpPublisherTrustResult): string;
+export type McpSignedDefinitionVerifyResult = {
+    schemaVersion: typeof MCP_SIGNED_DEFINITION_VERIFY_SCHEMA_VERSION;
+    trustPath: string;
+    definitionPath: string;
+    statementPath: string;
+    verification: McpSignedDefinitionVerification;
+};
+export declare function runMcpVerifyDefinition(input: {
+    definitionPath: string;
+    statementPath: string;
+    publisher: string;
+    trustPath?: string;
+    cwd?: string;
+}): Promise<McpSignedDefinitionVerifyResult>;
+export declare function formatMcpVerifyDefinition(result: McpSignedDefinitionVerifyResult): string;
+export type McpPinsResult = {
+    schemaVersion: typeof MCP_PINS_REPORT_SCHEMA_VERSION;
+    pinsPath: string;
+    servers: Array<{
+        serverIdentity: string;
+        serverVersion: string | null;
+        tools: Array<{
+            toolName: string;
+            definitionHash: string;
+            schemaVersion: string;
+            pinnedAt: string;
+            publisher: string | null;
+            kid: string | null;
+            semver: string | null;
+            priorDefinitionHash: string | null;
+        }>;
+    }>;
+};
+export declare function runMcpPins(input: {
+    configPath?: string;
+    pinsPath?: string;
+    cwd?: string;
+}): Promise<McpPinsResult>;
+export declare function formatMcpPins(result: McpPinsResult): string;
+export declare const MCP_REVIEW_SCHEMA_VERSION = "axtary.mcp_review.v0";
+export type McpPublisherEvidence = {
+    trust: "verified" | "unsigned" | "untrusted" | "invalid";
+    publisher: string | null;
+    kid: string | null;
+    semver: string | null;
+    priorDefinitionHash: string | null;
+    chainVerdict: McpChainVerdict | null;
+    reason: string | null;
+};
+export type McpReviewEntry = McpPinReconcileEntry & {
+    publisherEvidence: McpPublisherEvidence;
+};
+export type McpReviewResult = {
+    schemaVersion: typeof MCP_REVIEW_SCHEMA_VERSION;
+    pinsPath: string;
+    trustPath: string;
+    signedDefinitionsPath: string;
+    accepted: boolean;
+    pinned: number;
+    pending: McpReviewEntry[];
+    tools: McpReviewEntry[];
+};
+export declare function runMcpReview(input: {
+    configPath?: string;
+    pinsPath?: string;
+    wrap?: string;
+    wrapUrl?: string;
+    headers?: Record<string, string>;
+    oauth?: boolean;
+    oauthStore?: CredentialStore;
+    oauthFetch?: typeof fetch;
+    publisherTrustPath?: string;
+    signedDefinitionsPath?: string;
+    accept?: boolean;
+    cwd?: string;
+}): Promise<McpReviewResult>;
+export declare function formatMcpReview(result: McpReviewResult): string;
+export type McpConformanceRunInput = McpWrapTarget & {
+    configPath?: string;
+    pinsPath?: string;
+    ledgerPath?: string;
+    statusPath?: string;
+    attestationPath?: string;
+    keyPath?: string;
+    publisherTrustPath?: string;
+    signedDefinitionsPath?: string;
+    toolName: string;
+    arguments: Record<string, JsonValue>;
+    accept?: boolean;
+    owner?: string;
+    cwd?: string;
+};
+export type McpConformanceRunResult = {
+    schemaVersion: typeof MCP_CONFORMANCE_RUN_SCHEMA_VERSION;
+    pinsPath: string;
+    ledgerPath: string;
+    statusPath: string;
+    receipt: McpConformanceReceipt;
+};
+/**
+ * Exercise one explicitly selected live tool through the complete governed MCP
+ * path and persist a compact, secret-free receipt for operator surfaces.
+ */
+export declare function runMcpConformance(input: McpConformanceRunInput): Promise<McpConformanceRunResult>;
+export declare function formatMcpConformance(result: McpConformanceRunResult): string;
+export declare const MCP_DRIFT_DEMO_SCHEMA_VERSION = "axtary.mcp_drift_demo.v0";
+export type McpDriftDemoPhase = {
+    isError: boolean;
+    text: string;
+};
+export type McpDriftDemoResult = {
+    schemaVersion: typeof MCP_DRIFT_DEMO_SCHEMA_VERSION;
+    tool: {
+        serverIdentity: string;
+        name: string;
+    };
+    approved: {
+        definitionHash: string;
+        description: string;
+    };
+    mutated: {
+        definitionHash: string;
+        description: string;
+        injectedInstruction: string;
+    };
+    phases: {
+        approvedCall: McpDriftDemoPhase;
+        driftedCall: McpDriftDemoPhase;
+    };
+    blocked: boolean;
+    blockReasons: string[];
+    mutatedInvokerCalled: boolean;
+    ledger: {
+        path: string;
+        valid: boolean;
+        records: Array<{
+            decision: string;
+            reasons: string[];
+            definitionHash: string | null;
+        }>;
+    };
+};
+/**
+ * The tool-poisoning counter, reproducible in one command: a wrapped MCP tool
+ * executes at its reviewed definition hash, then the definition mutates (a
+ * hidden instruction lands in the description) and the identical call is
+ * denied before the invoker runs — both hashes end up in the ledger.
+ */
+export declare function runMcpDriftDemo(input?: DemoRunInput): Promise<McpDriftDemoResult>;
+export declare function runDemo(input?: DemoRunInput & {
+    approveStepUp?: boolean;
+    approvedBy?: string;
+}): Promise<DemoRunResult>;
+export declare function runTemplateDemo(input: TemplateDemoRunInput): Promise<TemplateDemoRunResult>;
 export declare function runSmokeTest(input?: SmokeTestInput, io?: CliIo): Promise<number>;
 export declare function runConnectorDoctor(input?: ConnectorDoctorInput): Promise<ConnectorDoctorResult>;
 export declare function runTestPolicy(input: PolicyTestRunInput): Promise<PolicyTestRunResult>;
+export declare function runPolicySimulate(input: PolicySimulateRunInput): Promise<PolicySimulateRunResult>;
+export declare function runPolicyHarness(input: PolicyHarnessRunInput): Promise<PolicyHarnessRunResult>;
+/**
+ * Three-engine parity: evaluates every shared fixture through the native
+ * evaluator, the Cedar policy set, and the compiled Rego bundle, and reports
+ * whether decisions and reason sets agree. Cedar/Rego run via optional wasm
+ * engines (repo devDependencies) loaded through @axtary/policy/parity.
+ */
+export declare function runPolicyParity(input?: PolicyParityRunInput): Promise<PolicyParityRunResult>;
+export declare function runAcsConformance(input?: AcsConformanceRunInput): Promise<AcsConformanceRunResult>;
 export declare function runLedgerExport(input?: LedgerExportRunInput): Promise<LedgerExportRunResult>;
 export declare function runLedgerSync(input: LedgerSyncRunInput): Promise<LedgerSyncRunResult>;
+export declare function runLedgerOtelExport(input: LedgerOtelExportRunInput): Promise<LedgerOtelExportRunResult>;
+export type LedgerAttestRunInput = LedgerExportRunInput & {
+    /** Where to persist the local attestation key (defaults beside the ledger). */
+    keyPath?: string;
+};
+export type LedgerAttestRunResult = {
+    schemaVersion: typeof LEDGER_ATTEST_RUN_SCHEMA_VERSION;
+    config: {
+        filePath: string | null;
+        tenant: string;
+    };
+    ledgerPath: string;
+    keyPath: string;
+    keyId: string;
+    outputPath: string | null;
+    bundle: LedgerAttestationBundle;
+};
+export type LedgerVerifyExportRunInput = {
+    bundlePath: string;
+    issuer?: string;
+    cwd?: string;
+    json?: boolean;
+};
+export type LedgerVerifyExportRunResult = {
+    schemaVersion: typeof LEDGER_VERIFY_EXPORT_RUN_SCHEMA_VERSION;
+    bundlePath: string;
+    result: VerifyLedgerAttestationResult;
+    /**
+     * Approval↔execution equivalence summary over the verified export's
+     * execution records; null when the bundle did not verify. Verification
+     * itself already fails closed on any failed pair, so a valid result can
+     * only contain proved and unproven entries.
+     */
+    equivalence: LedgerEquivalenceReport | null;
+};
+/**
+ * `axtary attest-ledger` — export the verified ledger and emit a signed,
+ * self-contained attestation bundle (export + JWS token + public key) that any
+ * third party can verify offline with only a JOSE library.
+ */
+export declare function runLedgerAttest(input?: LedgerAttestRunInput): Promise<LedgerAttestRunResult>;
+/**
+ * `axtary verify-export` — the standalone verifier. Reads an attestation bundle
+ * and confirms the signature, the canonical export digest, and the record chain
+ * using only the bundle's embedded public key.
+ */
+export declare function runLedgerVerifyExport(input: LedgerVerifyExportRunInput): Promise<LedgerVerifyExportRunResult>;
+export type LedgerProveEquivalenceRunInput = {
+    configPath?: string;
+    ledgerPath?: string;
+    cwd?: string;
+    from?: string;
+    to?: string;
+    decisions?: AxtaryDecision[];
+    outputPath?: string;
+};
+export type LedgerProveEquivalenceRunResult = {
+    schemaVersion: typeof LEDGER_PROVE_EQUIVALENCE_RUN_SCHEMA_VERSION;
+    config: {
+        filePath: string | null;
+        tenant: string;
+    };
+    ledgerPath: string;
+    outputPath: string | null;
+    report: LedgerEquivalenceReport;
+};
+/**
+ * `axtary prove-equivalence` — the queryable, exportable approval↔execution
+ * equivalence proof. Reads the ledger through the fail-closed export path
+ * (a tampered chain refuses to export at all), then reports, per execution
+ * record, the approved payload hash, the executed payload hash, and whether
+ * they are equal. Executions without approval evidence report `unproven`,
+ * never fake-proved.
+ */
+export declare function runLedgerProveEquivalence(input?: LedgerProveEquivalenceRunInput): Promise<LedgerProveEquivalenceRunResult>;
+export type LedgerProveInclusionRunInput = {
+    bundlePath: string;
+    recordId?: string;
+    index?: number;
+    outputPath?: string;
+    cwd?: string;
+    json?: boolean;
+};
+export type LedgerProveInclusionRunResult = {
+    schemaVersion: typeof LEDGER_PROVE_INCLUSION_RUN_SCHEMA_VERSION;
+    bundlePath: string;
+    outputPath: string | null;
+    proof: LedgerInclusionProof;
+};
+/**
+ * `axtary prove-inclusion` — emit an RFC 6962 inclusion proof for one record in
+ * an attestation bundle. The proof's `merkleRoot` matches the bundle's signed
+ * tree head, so a third party can verify it against the signed attestation.
+ */
+export declare function runLedgerProveInclusion(input: LedgerProveInclusionRunInput): Promise<LedgerProveInclusionRunResult>;
+export type LedgerProveConsistencyRunInput = {
+    firstBundlePath: string;
+    secondBundlePath: string;
+    outputPath?: string;
+    cwd?: string;
+    json?: boolean;
+};
+export type LedgerProveConsistencyRunResult = {
+    schemaVersion: typeof LEDGER_PROVE_CONSISTENCY_RUN_SCHEMA_VERSION;
+    firstBundlePath: string;
+    secondBundlePath: string;
+    outputPath: string | null;
+    proof: LedgerConsistencyProof;
+};
+/**
+ * `axtary prove-consistency` — emit an RFC 6962 consistency proof showing the
+ * second attestation's log append-only-extends the first. The proof binds both
+ * bundles' signed tree-head roots.
+ */
+export declare function runLedgerProveConsistency(input: LedgerProveConsistencyRunInput): Promise<LedgerProveConsistencyRunResult>;
+export type LedgerVerifyProofRunInput = {
+    proofPath: string;
+    bundlePath?: string;
+    firstBundlePath?: string;
+    secondBundlePath?: string;
+    issuer?: string;
+    cwd?: string;
+    json?: boolean;
+};
+export type LedgerVerifyProofRunResult = {
+    schemaVersion: typeof LEDGER_VERIFY_PROOF_RUN_SCHEMA_VERSION;
+    proofType: "inclusion" | "consistency";
+    attestationValid: boolean;
+    proofResult: ProofVerificationResult;
+    valid: boolean;
+};
+/**
+ * `axtary verify-proof` — the standalone proof verifier. It re-verifies the
+ * signed tree head(s) from the bundle(s), then binds the inclusion/consistency
+ * proof to those signed roots, failing closed on any mismatch.
+ */
+export declare function runLedgerVerifyProof(input: LedgerVerifyProofRunInput): Promise<LedgerVerifyProofRunResult>;
+export type LedgerForensicsRunInput = {
+    bundlePath?: string;
+    ledgerPath?: string;
+    configPath?: string;
+    cwd?: string;
+    json?: boolean;
+};
+export type LedgerForensicsRunResult = {
+    schemaVersion: typeof LEDGER_FORENSICS_RUN_SCHEMA_VERSION;
+    source: string;
+    evidence: "verified_attestation_bundle" | "verified_local_ledger";
+    report: ForensicReport;
+};
+/**
+ * `axtary forensics` — offline reconstruction of a delegation+execution incident
+ * from the ledger alone, asserting attenuation / reconstructibility / cascade
+ * containment. Reads an attestation bundle when given (so analysis runs over
+ * attested evidence), otherwise the local ledger.
+ */
+export declare function runLedgerForensics(input: LedgerForensicsRunInput): Promise<LedgerForensicsRunResult>;
+export type ConnectRunInput = {
+    provider: string;
+    clientId?: string;
+    clientIdEnv?: string;
+    clientSecretEnv?: string;
+    redirectPort?: number;
+    redirectUri?: string;
+    cloudId?: string;
+    json?: boolean;
+    env?: Record<string, string | undefined>;
+    fetch?: typeof fetch;
+    store?: CredentialStore;
+    openBrowser?: (url: string) => void | Promise<void>;
+    onListening?: (port: number) => void;
+    stdout?: (text: string) => void;
+};
+export type ConnectRunResult = {
+    schemaVersion: typeof CONNECT_RUN_SCHEMA_VERSION;
+    provider: string;
+    account: string | null;
+    scopes: string[];
+    expiresAt: string | null;
+    secretBackend: "keychain" | "file";
+    context?: Record<string, string>;
+};
+/**
+ * `axtary connect <provider>` — local-loopback OAuth so a customer clicks
+ * "Allow" in the browser instead of hand-pasting a bot token. The customer
+ * brings their own OAuth app (client id/secret stay in local env, never reach
+ * Axtary); the obtained token is stored in the local credential broker (OS
+ * keychain or a 0600 file), never echoed.
+ */
+export declare function runConnect(input: ConnectRunInput): Promise<ConnectRunResult>;
+export declare function runDisconnect(input: {
+    provider: string;
+    store?: CredentialStore;
+}): Promise<{
+    provider: string;
+    removed: boolean;
+}>;
+export type ConnectionsRunResult = {
+    schemaVersion: typeof CONNECTIONS_SCHEMA_VERSION;
+    connections: CredentialMetadata[];
+};
+export declare function runConnections(input?: {
+    store?: CredentialStore;
+}): Promise<ConnectionsRunResult>;
+export type ActionPassRevokeRunInput = {
+    passId: string;
+    trustStorePath?: string;
+    statusStorePath?: string;
+    ledgerPath?: string;
+    configPath?: string;
+    cwd?: string;
+    revokedBy?: string;
+    reason?: string;
+    revokedAt?: Date;
+};
+export type ActionPassRevokeRunResult = {
+    schemaVersion: typeof ACTIONPASS_REVOCATION_RUN_SCHEMA_VERSION;
+    trustStorePath: string;
+    revocation: ActionPassRevocation;
+    statusStorePath: string | null;
+    ledgerPath: string | null;
+    ledgerEventId: string | null;
+};
+export declare function runActionPassRevoke(input: ActionPassRevokeRunInput): Promise<ActionPassRevokeRunResult>;
+export declare function runActionPassRevocations(input?: {
+    trustStorePath?: string;
+    cwd?: string;
+}): Promise<{
+    schemaVersion: typeof ACTIONPASS_REVOCATION_RUN_SCHEMA_VERSION;
+    trustStorePath: string;
+    revocations: ActionPassRevocation[];
+}>;
+export declare function runIssuerKeyring(input?: {
+    keyringPath?: string;
+    cwd?: string;
+    rotate?: boolean;
+    retireAfterSeconds?: number;
+}): Promise<{
+    schemaVersion: typeof ACTIONPASS_STATUS_RUN_SCHEMA_VERSION;
+    keyringPath: string;
+    activeKid: string;
+    keys: Array<{
+        kid: string;
+        status: "active" | "retired";
+        createdAt: string;
+        retireAfter: string | null;
+    }>;
+    jwks: ReturnType<typeof issuerJwks>;
+}>;
+export declare function runActionPassStatus(input?: {
+    statusStorePath?: string;
+    cwd?: string;
+}): Promise<{
+    schemaVersion: typeof ACTIONPASS_STATUS_RUN_SCHEMA_VERSION;
+    statusStorePath: string;
+    uri: string;
+    entries: Array<{
+        passId: string;
+        index: number;
+        status: number;
+        updatedAt: string;
+    }>;
+}>;
+export declare function runCaepMap(input: {
+    issuer: string;
+    subject: SsfSubjectIdentifier;
+    rootPassIds: string[];
+    mappingPath?: string;
+    cwd?: string;
+}): Promise<{
+    schemaVersion: typeof CAEP_MAPPING_RUN_SCHEMA_VERSION;
+    mappingPath: string;
+    mapping: Awaited<ReturnType<LocalCaepMappingStore["put"]>>;
+}>;
 export declare function runRealWorkflow(input?: RealWorkflowRunInput): Promise<RealWorkflowRunResult>;
+export declare const GITHUB_DEPTH_RUN_SCHEMA_VERSION = "axtary.github_depth_run.v0";
+export type GitHubDepthRunResult = {
+    schemaVersion: typeof GITHUB_DEPTH_RUN_SCHEMA_VERSION;
+    workflow: "github-depth";
+    config: {
+        filePath: string | null;
+        tenant: string;
+    };
+    ledgerPath: string;
+    status: "completed" | "blocked" | "failed";
+    requiredModes: {
+        github: "app";
+    };
+    inputs: {
+        repoResource: string;
+        issueKey: string;
+        baseBranch: string;
+        headBranch: string;
+        prTitle: string;
+        checkName: string;
+        reviewLine: number;
+    };
+    target: {
+        pullNumber: number;
+        headSha: string;
+        path: string;
+        line: number;
+    } | null;
+    steps: RealWorkflowStepResult[];
+    ledger: DemoRunResult["ledger"];
+};
+/**
+ * GitHub-only depth proof: open a draft PR in the sandbox repo, then exercise
+ * the three M7.3 write tools against that PR — an inline review comment, a check
+ * run on its head commit, and a conversation comment — each governed by policy,
+ * payload-bound by an ActionPass, and written to the ledger as a decision +
+ * execution-outcome pair. Requires only the GitHub credential.
+ */
+export declare function runGitHubDepthWorkflow(input?: RealWorkflowRunInput): Promise<GitHubDepthRunResult>;
+export declare const POSTGRES_READ_RUN_SCHEMA_VERSION = "axtary.postgres_read_run.v0";
+export type PostgresReadRunResult = {
+    schemaVersion: typeof POSTGRES_READ_RUN_SCHEMA_VERSION;
+    workflow: "postgres-read";
+    config: {
+        filePath: string | null;
+        tenant: string;
+    };
+    ledgerPath: string;
+    status: "completed" | "blocked" | "failed";
+    requiredModes: {
+        postgres: "postgres";
+    };
+    inputs: {
+        databaseResource: string;
+        statementHash: string | null;
+        predicateHash: string | null;
+        tables: string[];
+        parameterCount: number;
+        parameterHash: string;
+        maxRows: number;
+    };
+    step: RealWorkflowStepResult;
+    ledger: DemoRunResult["ledger"];
+};
+export declare function runPostgresReadWorkflow(input?: RealWorkflowRunInput): Promise<PostgresReadRunResult>;
+export declare const DRIVE_READ_RUN_SCHEMA_VERSION = "axtary.drive_read_run.v0";
+export type DriveReadRunResult = {
+    schemaVersion: typeof DRIVE_READ_RUN_SCHEMA_VERSION;
+    workflow: "drive-read";
+    config: {
+        filePath: string | null;
+        tenant: string;
+    };
+    ledgerPath: string;
+    status: "completed" | "blocked" | "failed";
+    requiredModes: {
+        drive: "rest";
+    };
+    inputs: {
+        fileId: string;
+        resource: string;
+        maxBytes: number;
+        source: "argument" | "picker_context" | "config";
+    };
+    step: RealWorkflowStepResult;
+    ledger: DemoRunResult["ledger"];
+};
+export declare function runDriveReadWorkflow(input?: RealWorkflowRunInput): Promise<DriveReadRunResult>;
 export declare function runAxtaryCli(argv?: string[], io?: CliIo): Promise<number>;
+/**
+ * One line summarizing the approval↔execution equivalence over a set of
+ * execution records. Verification fails closed on any failed pair, so a
+ * summary rendered for a VALID export can only contain proved + unproven.
+ */
+export declare function equivalenceSummaryLine(report: LedgerEquivalenceReport): string;
+/**
+ * The tamper-outcome line, with the three states kept distinct: blocked
+ * (the win), not-blocked (a real security failure), and not-reached (a prior
+ * step failed before Slack, so the tamper was never exercised — must never be
+ * reported as the tampered payload executing).
+ */
+/**
+ * The scoped-authority contrast line — the differentiation beat spelled out:
+ * the agent still held a valid, exact-payload human approval whose tool +
+ * resource scope matched the attempted call, so an authorizer that checks
+ * scope alone would have let the swapped payload through. Only claim that
+ * when `scopeUnchanged` was actually computed true; otherwise state the
+ * scope changed too, which any authorizer should reject.
+ */
+export declare function scopedAuthorityLine(authority: RealWorkflowTamperEvidence["scopedAuthority"]): string;
+export declare function tamperOutcomeLine(tamper: RealWorkflowTamperEvidence): string;
 //# sourceMappingURL=index.d.ts.map