@catp-protocol/cli 0.1.0 → 0.2.0

package/dist/commands/witness.js

@@ -0,0 +1,164 @@
+import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { auditRoot } from "../audit/paths.js";
+import { findPolicyFile, loadPolicy } from "../policy/loader.js";
+const MAX_U64 = (1n << 64n) - 1n;
+const ACTION_TYPE = {
+    swap: "0",
+    transfer: "1",
+    deposit: "2",
+    withdraw: "3",
+};
+export function buildGroth16Witness(policy, action, opts = {}) {
+    if (!policy.authorization) {
+        throw new Error("catp-policy.toml is missing [authorization]");
+    }
+    const auth = normalizeAuthorization(policy.authorization);
+    const actionType = normalizeActionType(action.actionType, "actionType");
+    const value = normalizeU64(action.value, "value");
+    const currentTimestamp = normalizeU64(opts.currentTimestamp ?? action.currentTimestamp ?? Math.floor(Date.now() / 1000), "currentTimestamp");
+    const cumulativeSpend = normalizeU64(opts.cumulativeSpend ?? action.cumulativeSpend ?? "0", "cumulativeSpend");
+    const protocol = normalizeBytes32(action.protocol, "protocol");
+    const token = normalizeBytes32(action.token, "token");
+    if (actionType !== auth.allowedAction) {
+        throw new Error("actionType must match authorization.allowed_action");
+    }
+    if (protocol.toLowerCase() !== auth.allowedProtocol.toLowerCase()) {
+        throw new Error("protocol must match authorization.allowed_protocol");
+    }
+    if (token.toLowerCase() !== auth.allowedToken.toLowerCase()) {
+        throw new Error("token must match authorization.allowed_token");
+    }
+    return {
+        actionType,
+        protocol,
+        token,
+        value,
+        currentTimestamp,
+        cumulativeSpend,
+        allowedAction: auth.allowedAction,
+        allowedProtocol: auth.allowedProtocol,
+        allowedToken: auth.allowedToken,
+        maxValuePerTx: auth.maxValuePerTx,
+        maxValueTotal: auth.maxValueTotal,
+        validFrom: auth.validFrom,
+        validUntil: auth.validUntil,
+    };
+}
+export function cmdWitness(opts) {
+    const witness = buildGroth16WitnessFromSources(opts);
+    const encoded = `${JSON.stringify(witness, null, 2)}\n`;
+    if (opts.out) {
+        writeFileSync(opts.out, encoded, "utf8");
+        process.stdout.write(`Wrote Groth16 witness to ${opts.out}\n`);
+    }
+    else {
+        process.stdout.write(encoded);
+    }
+}
+export function buildGroth16WitnessFromSources(opts) {
+    if (!opts.action && !opts.auditCommitment) {
+        throw new Error("missing --action <path> or --audit-commitment <hex>");
+    }
+    if (opts.action && opts.auditCommitment) {
+        throw new Error("use only one of --action or --audit-commitment");
+    }
+    const policyPath = opts.file ?? findPolicyFile();
+    if (!policyPath) {
+        throw new Error("Could not find catp-policy.toml. Specify --file <path>.");
+    }
+    const policy = loadPolicy(policyPath);
+    const action = opts.action
+        ? JSON.parse(readFileSync(opts.action, "utf8"))
+        : readAuthorizationActionFromAudit(resolveAgentId(policy, opts.agent), opts.auditCommitment);
+    return buildGroth16Witness(policy, action, {
+        currentTimestamp: opts.currentTimestamp,
+        cumulativeSpend: opts.cumulativeSpend,
+    });
+}
+function resolveAgentId(policy, agent) {
+    return agent ?? policy.agent.id;
+}
+function readAuthorizationActionFromAudit(agentId, commitment) {
+    if (!/^[0-9a-fA-F]{64}$/.test(commitment)) {
+        throw new Error("--audit-commitment must be a 64-character hex commitment");
+    }
+    const entry = findAuditEntry(agentId, commitment);
+    if (!entry) {
+        throw new Error(`No audit entry found for commitment ${commitment}`);
+    }
+    if (!entry.authorization) {
+        throw new Error(`Audit entry ${commitment} does not contain authorization action data`);
+    }
+    return entry.authorization;
+}
+function findAuditEntry(agentId, commitment) {
+    const root = auditRoot(agentId);
+    if (!existsSync(root))
+        return null;
+    for (const date of readdirSync(root).sort()) {
+        const file = join(root, date, "actions.jsonl");
+        if (!existsSync(file))
+            continue;
+        const lines = readFileSync(file, "utf8").trimEnd().split("\n").filter(Boolean);
+        for (const line of lines) {
+            try {
+                const entry = JSON.parse(line);
+                if (entry.commitment.toLowerCase() === commitment.toLowerCase()) {
+                    return entry;
+                }
+            }
+            catch {
+                // skip malformed audit lines
+            }
+        }
+    }
+    return null;
+}
+function normalizeAuthorization(auth) {
+    return {
+        allowedAction: normalizeActionType(auth.allowed_action, "authorization.allowed_action"),
+        allowedProtocol: normalizeBytes32(auth.allowed_protocol, "authorization.allowed_protocol"),
+        allowedToken: normalizeBytes32(auth.allowed_token, "authorization.allowed_token"),
+        maxValuePerTx: normalizeU64(auth.max_value_per_tx, "authorization.max_value_per_tx"),
+        maxValueTotal: normalizeU64(auth.max_value_total, "authorization.max_value_total"),
+        validFrom: normalizeU64(auth.valid_from, "authorization.valid_from"),
+        validUntil: normalizeU64(auth.valid_until, "authorization.valid_until"),
+    };
+}
+function normalizeActionType(value, field) {
+    if (typeof value === "string" && ACTION_TYPE[value.toLowerCase()] !== undefined) {
+        return ACTION_TYPE[value.toLowerCase()];
+    }
+    const parsed = normalizeU64(value, field);
+    if (!["0", "1", "2", "3"].includes(parsed)) {
+        throw new Error(`${field} must be Swap, Transfer, Deposit, Withdraw, or 0..3`);
+    }
+    return parsed;
+}
+function normalizeBytes32(value, field) {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(value)) {
+        throw new Error(`${field} must be a 0x-prefixed 32-byte hex string`);
+    }
+    return value;
+}
+function normalizeU64(value, field) {
+    let parsed;
+    if (typeof value === "number") {
+        if (!Number.isSafeInteger(value)) {
+            throw new Error(`${field} must be a safe integer`);
+        }
+        parsed = BigInt(value);
+    }
+    else if (/^0x[0-9a-fA-F]+$/.test(value) || /^[0-9]+$/.test(value)) {
+        parsed = BigInt(value);
+    }
+    else {
+        throw new Error(`${field} must be an integer string`);
+    }
+    if (parsed < 0n || parsed > MAX_U64) {
+        throw new Error(`${field} must fit in u64`);
+    }
+    return parsed.toString();
+}
+//# sourceMappingURL=witness.js.map

package/dist/commands/witness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"witness.js","sourceRoot":"","sources":["../../src/commands/witness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGjE,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;AAEjC,MAAM,WAAW,GAA2B;IAC1C,IAAI,EAAE,GAAG;IACT,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,GAAG;IACZ,QAAQ,EAAE,GAAG;CACd,CAAC;AAoBF,MAAM,UAAU,mBAAmB,CACjC,MAAkB,EAClB,MAA0B,EAC1B,OAAkF,EAAE;IAEpF,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,YAAY,CACnC,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EACjF,kBAAkB,CACnB,CAAC;IACF,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,eAAe,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC/G,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAEtD,IAAI,UAAU,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,UAAU;QACV,QAAQ;QACR,KAAK;QACL,KAAK;QACL,gBAAgB;QAChB,eAAe;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAQ1B;IACC,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAExD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,IAO9C;IACC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;IACjD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM;QACxB,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAwB;QACvE,CAAC,CAAC,gCAAgC,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,eAAyB,CAAC,CAAC;IAEzG,OAAO,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE;QACzC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,eAAe,EAAE,IAAI,CAAC,eAAe;KACtC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAAkB,EAAE,KAAc;IACxD,OAAO,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,gCAAgC,CAAC,OAAe,EAAE,UAAkB;IAC3E,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,6CAA6C,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,CAAC,aAAa,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,UAAkB;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC/E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;oBAChE,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,6BAA6B;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAyB;IACvD,OAAO;QACL,aAAa,EAAE,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,8BAA8B,CAAC;QACvF,eAAe,EAAE,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;QAC1F,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,6BAA6B,CAAC;QACjF,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;QACpF,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,eAAe,EAAE,+BAA+B,CAAC;QAClF,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,0BAA0B,CAAC;QACpE,UAAU,EAAE,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,2BAA2B,CAAC;KACxE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAsB,EAAE,KAAa;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;QAChF,OAAO,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qDAAqD,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2CAA2C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,KAAsB,EAAE,KAAa;IACzD,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;SAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,IAAI,MAAM,GAAG,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC"}

package/dist/policy/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,wBAAgB,cAAc,CAAC,QAAQ,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAS9E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAIzD"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,UAAU,EAAE,MAAM,YAAY,CAAC;AAIlE,wBAAgB,cAAc,CAAC,QAAQ,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAS9E;AAED,wBAAgB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAIzD"}

package/dist/policy/loader.js

@@ -57,7 +57,11 @@ function validate(raw, path) {
             reason: typeof rule.reason === "string" ? rule.reason : undefined,
         };
     });
-    return { agent: { id: agent.id, version: agent.version }, rules };
+    return {
+        agent: { id: agent.id, version: agent.version },
+        rules,
+        authorization: validateAuthorization(obj.authorization, path),
+    };
 }
 function toStringArray(v) {
     if (v === undefined || v === null)
@@ -66,4 +70,35 @@ function toStringArray(v) {
         return undefined;
     return v.filter((x) => typeof x === "string");
 }
+function validateAuthorization(raw, path) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (typeof raw !== "object") {
+        throw new Error(`${path}: [authorization] must be an object`);
+    }
+    const auth = raw;
+    const required = [
+        "allowed_action",
+        "allowed_protocol",
+        "allowed_token",
+        "max_value_per_tx",
+        "max_value_total",
+        "valid_from",
+        "valid_until",
+    ];
+    for (const field of required) {
+        if (typeof auth[field] !== "string" || auth[field] === "") {
+            throw new Error(`${path}: authorization.${field} must be a non-empty string`);
+        }
+    }
+    return {
+        allowed_action: auth.allowed_action,
+        allowed_protocol: auth.allowed_protocol,
+        allowed_token: auth.allowed_token,
+        max_value_per_tx: auth.max_value_per_tx,
+        max_value_total: auth.max_value_total,
+        valid_from: auth.valid_from,
+        valid_until: auth.valid_until,
+    };
+}
 //# sourceMappingURL=loader.js.map

package/dist/policy/loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGlC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,MAAM,UAAU,cAAc,CAAC,WAAmB,OAAO,CAAC,GAAG,EAAE;IAC7D,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,OAAO,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,IAAY;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;IACnD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE;QACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,GAAG,CAA4B,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,mCAAmC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,KAAK,EAAE,IAAI,CAAC,KAAgB;YAC5B,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC;YAClD,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;YAChD,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAiB,EAAE,EAAE,KAAK,EAAE,CAAC;AACxF,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/policy/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGlC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAE3C,MAAM,UAAU,cAAc,CAAC,WAAmB,OAAO,CAAC,GAAG,EAAE;IAC7D,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,OAAO,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAY,EAAE,IAAY;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;IACnD,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,CAAS,EAAE,EAAE;QACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,GAAG,CAA4B,CAAC;QAC1C,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,mCAAmC,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,2BAA2B,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAc;YACzB,KAAK,EAAE,IAAI,CAAC,KAAgB;YAC5B,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC;YAClD,aAAa,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC;YAChD,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAiB,EAAE;QACnE,KAAK;QACL,aAAa,EAAE,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY,EAAE,IAAY;IACvD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,GAA8B,CAAC;IAC5C,MAAM,QAAQ,GAAG;QACf,gBAAgB;QAChB,kBAAkB;QAClB,eAAe;QACf,kBAAkB;QAClB,iBAAiB;QACjB,YAAY;QACZ,aAAa;KACL,CAAC;IACX,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,mBAAmB,KAAK,6BAA6B,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO;QACL,cAAc,EAAE,IAAI,CAAC,cAAwB;QAC7C,gBAAgB,EAAE,IAAI,CAAC,gBAA0B;QACjD,aAAa,EAAE,IAAI,CAAC,aAAuB;QAC3C,gBAAgB,EAAE,IAAI,CAAC,gBAA0B;QACjD,eAAe,EAAE,IAAI,CAAC,eAAyB;QAC/C,UAAU,EAAE,IAAI,CAAC,UAAoB;QACrC,WAAW,EAAE,IAAI,CAAC,WAAqB;KACxC,CAAC;AACJ,CAAC"}

package/dist/policy/types.d.ts

@@ -13,6 +13,7 @@ export interface Rule {
 export interface CatpPolicy {
     agent: AgentMeta;
     rules: Rule[];
+    authorization?: AuthorizationConfig;
 }
 export interface HookInput {
     session_id?: string;
@@ -26,5 +27,23 @@ export interface AuditEntry {
     rule_matched: string | null;
     commitment: string;
     input_summary: string;
+    authorization?: AuthorizationAction;
+}
+export interface AuthorizationConfig {
+    allowed_action: string;
+    allowed_protocol: string;
+    allowed_token: string;
+    max_value_per_tx: string;
+    max_value_total: string;
+    valid_from: string;
+    valid_until: string;
+}
+export interface AuthorizationAction {
+    actionType: string | number;
+    protocol: string;
+    token: string;
+    value: string | number;
+    currentTimestamp?: string | number;
+    cumulativeSpend?: string | number;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/policy/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,IAAI,EAAE,CAAC;CACf;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/policy/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,SAAS;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC"}

package/package.json

@@ -1,37 +1,48 @@
 {
   "name": "@catp-protocol/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Cryptographic Agent Trust Protocol — local enforcement plugin for Claude Code with TOML policy and tamper-evident audit log",
-  "keywords": ["claude-code", "ai-agents", "policy", "audit", "hooks", "trust", "zk"],
+  "keywords": [
+    "claude-code",
+    "ai-agents",
+    "policy",
+    "audit",
+    "hooks",
+    "trust",
+    "zk"
+  ],
   "license": "MIT",
   "homepage": "https://github.com/lfzkoala/catp#readme",
   "bugs": "https://github.com/lfzkoala/catp/issues",
   "repository": {
     "type": "git",
-    "url": "https://github.com/lfzkoala/catp.git"
+    "url": "git+https://github.com/lfzkoala/catp.git"
   },
   "type": "module",
   "bin": {
-    "catp": "./dist/cli.js"
+    "catp": "dist/cli.js"
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "engines": {
     "node": ">=20"
   },
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc --noEmit",
-    "test": "node --experimental-vm-modules node_modules/.bin/jest",
-    "test:coverage": "node --experimental-vm-modules node_modules/.bin/jest --coverage --ci"
+    "test": "node --experimental-vm-modules ../node_modules/.bin/jest --config jest.config.cjs",
+    "test:coverage": "node --experimental-vm-modules ../node_modules/.bin/jest --config jest.config.cjs --coverage --ci"
   },
   "dependencies": {
     "commander": "^12.0.0",
     "micromatch": "^4.0.5",
-    "smol-toml": "^1.3.0"
+    "smol-toml": "^1.3.0",
+    "viem": "^2"
   },
   "devDependencies": {
     "@types/micromatch": "^4.0.6",
-    "@types/node": "^20.0.0",
+    "@types/node": "^20.19.39",
     "jest": "^29.0.0",
     "ts-jest": "^29.0.0",
     "typescript": "^5.4.0"