@openleash/core 0.0.3 → 0.1.0

package/dist/tokens.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.issueProofToken = issueProofToken;
+exports.verifyProofToken = verifyProofToken;
+const paseto_1 = require("paseto");
+const keys_js_1 = require("./keys.js");
+async function issueProofToken(params) {
+    const now = new Date();
+    const exp = new Date(now.getTime() + params.ttlSeconds * 1000);
+    const claims = {
+        iss: 'openleash',
+        kid: params.key.kid,
+        iat: now.toISOString(),
+        exp: exp.toISOString(),
+        decision_id: params.decisionId,
+        owner_principal_id: params.ownerPrincipalId,
+        agent_id: params.agentId,
+        action_type: params.actionType,
+        action_hash: params.actionHash,
+        matched_rule_id: params.matchedRuleId,
+    };
+    if (params.trustProfile) {
+        claims.trust_profile = params.trustProfile;
+    }
+    if (params.constraintsSnapshot) {
+        claims.constraints_snapshot = params.constraintsSnapshot;
+    }
+    const privateKey = (0, keys_js_1.getPrivateKeyObject)(params.key);
+    const token = await paseto_1.V4.sign({ ...claims }, privateKey, {
+        expiresIn: `${params.ttlSeconds} seconds`,
+    });
+    return { token, expiresAt: exp.toISOString(), claims };
+}
+async function verifyProofToken(token, keys) {
+    // Try each key
+    for (const key of keys) {
+        try {
+            const publicKey = (0, keys_js_1.getPublicKeyObject)(key);
+            const payload = await paseto_1.V4.verify(token, publicKey);
+            // Check expiration
+            if (payload.exp) {
+                const expDate = new Date(payload.exp);
+                if (expDate.getTime() < Date.now()) {
+                    return { valid: false, reason: 'Token expired', claims: payload };
+                }
+            }
+            return { valid: true, claims: payload };
+        }
+        catch {
+            // Try next key
+            continue;
+        }
+    }
+    return { valid: false, reason: 'No matching key found or invalid signature' };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;AAiCA,0CAkCC;AAED,4CA0BC;AA9FD,mCAA4B;AAE5B,uCAAoE;AA8B7D,KAAK,UAAU,eAAe,CAAC,MAAwB;IAK5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG;QACnB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,eAAe,EAAE,MAAM,CAAC,aAAa;KACtC,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,6BAAmB,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,WAAE,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAwC,EAAE,UAAU,EAAE;QAC3F,SAAS,EAAE,GAAG,MAAM,CAAC,UAAU,UAAU;KAC1C,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAAqB;IAErB,eAAe;IACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,4BAAkB,EAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,WAAE,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAgB,CAAC;YAEjE,mBAAmB;YACnB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;YACf,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;AAChF,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,273 @@
+import { z } from 'zod';
+export declare const DecisionResult: z.ZodEnum<["ALLOW", "DENY", "REQUIRE_APPROVAL", "REQUIRE_STEP_UP", "REQUIRE_DEPOSIT"]>;
+export type DecisionResult = z.infer<typeof DecisionResult>;
+export declare const ObligationType: z.ZodEnum<["HUMAN_APPROVAL", "STEP_UP_AUTH", "DEPOSIT", "COUNTERPARTY_ATTESTATION"]>;
+export type ObligationType = z.infer<typeof ObligationType>;
+export declare const ObligationStatus: z.ZodEnum<["PENDING", "FULFILLED", "WAIVED"]>;
+export type ObligationStatus = z.infer<typeof ObligationStatus>;
+export declare const PrincipalType: z.ZodEnum<["HUMAN", "ORG"]>;
+export type PrincipalType = z.infer<typeof PrincipalType>;
+export declare const PrincipalStatus: z.ZodEnum<["ACTIVE", "SUSPENDED", "REVOKED"]>;
+export type PrincipalStatus = z.infer<typeof PrincipalStatus>;
+export declare const AgentStatus: z.ZodEnum<["ACTIVE", "REVOKED"]>;
+export type AgentStatus = z.infer<typeof AgentStatus>;
+export declare const TrustProfile: z.ZodEnum<["LOW", "MEDIUM", "HIGH", "REGULATED"]>;
+export type TrustProfile = z.infer<typeof TrustProfile>;
+export declare const AssuranceLevel: z.ZodEnum<["LOW", "SUBSTANTIAL", "HIGH"]>;
+export type AssuranceLevel = z.infer<typeof AssuranceLevel>;
+export declare const ActionRequestSchema: z.ZodObject<{
+    action_id: z.ZodString;
+    action_type: z.ZodString;
+    requested_at: z.ZodString;
+    principal: z.ZodObject<{
+        agent_id: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        agent_id: string;
+    }, {
+        agent_id: string;
+    }>;
+    subject: z.ZodObject<{
+        principal_id: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        principal_id: string;
+    }, {
+        principal_id: string;
+    }>;
+    relying_party: z.ZodOptional<z.ZodObject<{
+        rp_id: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        trust_profile: z.ZodOptional<z.ZodEnum<["LOW", "MEDIUM", "HIGH", "REGULATED"]>>;
+    }, "strip", z.ZodTypeAny, {
+        rp_id?: string | undefined;
+        domain?: string | undefined;
+        trust_profile?: "LOW" | "MEDIUM" | "HIGH" | "REGULATED" | undefined;
+    }, {
+        rp_id?: string | undefined;
+        domain?: string | undefined;
+        trust_profile?: "LOW" | "MEDIUM" | "HIGH" | "REGULATED" | undefined;
+    }>>;
+    payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, "strip", z.ZodTypeAny, {
+    action_id: string;
+    action_type: string;
+    requested_at: string;
+    principal: {
+        agent_id: string;
+    };
+    subject: {
+        principal_id: string;
+    };
+    payload: Record<string, unknown>;
+    relying_party?: {
+        rp_id?: string | undefined;
+        domain?: string | undefined;
+        trust_profile?: "LOW" | "MEDIUM" | "HIGH" | "REGULATED" | undefined;
+    } | undefined;
+}, {
+    action_id: string;
+    action_type: string;
+    requested_at: string;
+    principal: {
+        agent_id: string;
+    };
+    subject: {
+        principal_id: string;
+    };
+    payload: Record<string, unknown>;
+    relying_party?: {
+        rp_id?: string | undefined;
+        domain?: string | undefined;
+        trust_profile?: "LOW" | "MEDIUM" | "HIGH" | "REGULATED" | undefined;
+    } | undefined;
+}>;
+export type ActionRequest = z.infer<typeof ActionRequestSchema>;
+export declare const ObligationSchema: z.ZodObject<{
+    obligation_id: z.ZodString;
+    type: z.ZodEnum<["HUMAN_APPROVAL", "STEP_UP_AUTH", "DEPOSIT", "COUNTERPARTY_ATTESTATION"]>;
+    status: z.ZodEnum<["PENDING", "FULFILLED", "WAIVED"]>;
+    details_json: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    type: "HUMAN_APPROVAL" | "STEP_UP_AUTH" | "DEPOSIT" | "COUNTERPARTY_ATTESTATION";
+    status: "PENDING" | "FULFILLED" | "WAIVED";
+    obligation_id: string;
+    details_json?: Record<string, unknown> | undefined;
+}, {
+    type: "HUMAN_APPROVAL" | "STEP_UP_AUTH" | "DEPOSIT" | "COUNTERPARTY_ATTESTATION";
+    status: "PENDING" | "FULFILLED" | "WAIVED";
+    obligation_id: string;
+    details_json?: Record<string, unknown> | undefined;
+}>;
+export type Obligation = z.infer<typeof ObligationSchema>;
+export interface AuthorizeResponse {
+    decision_id: string;
+    action_id: string;
+    action_hash: string;
+    result: DecisionResult;
+    matched_rule_id: string | null;
+    reason: string;
+    proof_token: string | null;
+    proof_expires_at: string | null;
+    obligations: Obligation[];
+}
+export interface PolicyExprMatch {
+    path: string;
+    op: 'eq' | 'neq' | 'in' | 'nin' | 'lt' | 'lte' | 'gt' | 'gte' | 'regex' | 'exists';
+    value?: unknown;
+}
+export type PolicyExpr = {
+    all: PolicyExpr[];
+} | {
+    any: PolicyExpr[];
+} | {
+    not: PolicyExpr;
+} | {
+    match: PolicyExprMatch;
+};
+export interface PolicyConstraints {
+    amount_max?: number;
+    amount_min?: number;
+    currency?: string[];
+    merchant_domain?: string[];
+    allowed_domains?: string[];
+    blocked_domains?: string[];
+}
+export interface PolicyRequirements {
+    min_assurance_level?: 'LOW' | 'SUBSTANTIAL' | 'HIGH';
+    credential_scheme?: string;
+}
+export interface PolicyObligation {
+    type: string;
+    params?: Record<string, unknown>;
+}
+export interface PolicyProof {
+    required?: boolean;
+    ttl_seconds?: number;
+}
+export interface PolicyRule {
+    id: string;
+    effect: 'allow' | 'deny';
+    action: string;
+    description?: string;
+    when?: PolicyExpr;
+    constraints?: PolicyConstraints;
+    requirements?: PolicyRequirements;
+    obligations?: PolicyObligation[];
+    proof?: PolicyProof;
+}
+export interface Policy {
+    version: 1;
+    default: 'allow' | 'deny';
+    rules: PolicyRule[];
+}
+export interface RuleTrace {
+    rule_id: string;
+    pattern_match: boolean;
+    when_match: boolean | null;
+    constraints_match: boolean | null;
+    final_match: boolean;
+}
+export interface EvaluationTrace {
+    rules: RuleTrace[];
+}
+export interface StateKeyEntry {
+    kid: string;
+    path: string;
+}
+export interface StateOwnerEntry {
+    owner_principal_id: string;
+    path: string;
+}
+export interface StateAgentEntry {
+    agent_principal_id: string;
+    agent_id: string;
+    owner_principal_id: string;
+    path: string;
+}
+export interface StatePolicyEntry {
+    policy_id: string;
+    owner_principal_id: string;
+    applies_to_agent_principal_id: string | null;
+    path: string;
+}
+export interface StateBinding {
+    owner_principal_id: string;
+    policy_id: string;
+    applies_to_agent_principal_id: string | null;
+}
+export interface StateData {
+    version: 1;
+    created_at: string;
+    server_keys: {
+        active_kid: string;
+        keys: StateKeyEntry[];
+    };
+    owners: StateOwnerEntry[];
+    agents: StateAgentEntry[];
+    policies: StatePolicyEntry[];
+    bindings: StateBinding[];
+}
+export interface ServerKeyFile {
+    kid: string;
+    public_key_b64: string;
+    private_key_b64: string;
+    created_at: string;
+    revoked_at: string | null;
+}
+export interface OwnerFrontmatter {
+    owner_principal_id: string;
+    principal_type: PrincipalType;
+    display_name: string;
+    status: PrincipalStatus;
+    attributes: Record<string, unknown>;
+    created_at: string;
+}
+export interface AgentFrontmatter {
+    agent_principal_id: string;
+    agent_id: string;
+    owner_principal_id: string;
+    public_key_b64: string;
+    status: AgentStatus;
+    attributes: Record<string, unknown>;
+    created_at: string;
+    revoked_at: string | null;
+}
+export declare const AuditEventType: z.ZodEnum<["OWNER_CREATED", "AGENT_CHALLENGE_ISSUED", "AGENT_REGISTERED", "POLICY_UPSERTED", "AUTHORIZE_CALLED", "DECISION_CREATED", "PROOF_ISSUED", "PROOF_VERIFIED", "PLAYGROUND_RUN", "KEY_ROTATED", "SERVER_STARTED"]>;
+export type AuditEventType = z.infer<typeof AuditEventType>;
+export interface AuditEvent {
+    event_id: string;
+    timestamp: string;
+    event_type: string;
+    principal_id: string | null;
+    action_id: string | null;
+    decision_id: string | null;
+    metadata_json: Record<string, unknown>;
+}
+export interface OpenleashConfig {
+    server: {
+        bind_address: string;
+    };
+    admin: {
+        mode: 'localhost' | 'token' | 'localhost_or_token';
+        token: string;
+        allow_remote_admin: boolean;
+    };
+    security: {
+        nonce_ttl_seconds: number;
+        clock_skew_seconds: number;
+    };
+    tokens: {
+        format: 'paseto_v4_public';
+        default_ttl_seconds: number;
+        max_ttl_seconds: number;
+    };
+}
+export interface RegistrationChallenge {
+    challenge_id: string;
+    challenge_b64: string;
+    agent_id: string;
+    agent_pubkey_b64: string;
+    owner_principal_id?: string;
+    agent_attributes_json?: Record<string, unknown>;
+    expires_at: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,cAAc,wFAMzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAG5D,eAAO,MAAM,cAAc,sFAKzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB,+CAA6C,CAAC;AAC3E,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAGhE,eAAO,MAAM,aAAa,6BAA2B,CAAC;AACtD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe,+CAA6C,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,WAAW,kCAAgC,CAAC;AACzD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGtD,eAAO,MAAM,YAAY,mDAAiD,CAAC;AAC3E,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,cAAc,2CAAyC,CAAC;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAG5D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAGhE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;EAK3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAG1D,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAGD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,GAAG,EAAE,UAAU,EAAE,CAAA;CAAE,GACrB;IAAE,GAAG,EAAE,UAAU,EAAE,CAAA;CAAE,GACrB;IAAE,GAAG,EAAE,UAAU,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AAE/B,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,mBAAmB,CAAC,EAAE,KAAK,GAAG,aAAa,GAAG,MAAM,CAAC;IACrD,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAGD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAGD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,6BAA6B,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,aAAa,EAAE,CAAC;KACvB,CAAC;IACF,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAGD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAGD,MAAM,WAAW,gBAAgB;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,aAAa,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,WAAW,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAGD,eAAO,MAAM,cAAc,4NAYzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAGD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE;QACN,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,KAAK,EAAE;QACL,IAAI,EAAE,WAAW,GAAG,OAAO,GAAG,oBAAoB,CAAC;QACnD,KAAK,EAAE,MAAM,CAAC;QACd,kBAAkB,EAAE,OAAO,CAAC;KAC7B,CAAC;IACF,QAAQ,EAAE;QACR,iBAAiB,EAAE,MAAM,CAAC;QAC1B,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,kBAAkB,CAAC;QAC3B,mBAAmB,EAAE,MAAM,CAAC;QAC5B,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAGD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChD,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/types.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditEventType = exports.ObligationSchema = exports.ActionRequestSchema = exports.AssuranceLevel = exports.TrustProfile = exports.AgentStatus = exports.PrincipalStatus = exports.PrincipalType = exports.ObligationStatus = exports.ObligationType = exports.DecisionResult = void 0;
+const zod_1 = require("zod");
+// ─── Decision results ────────────────────────────────────────────────
+exports.DecisionResult = zod_1.z.enum([
+    'ALLOW',
+    'DENY',
+    'REQUIRE_APPROVAL',
+    'REQUIRE_STEP_UP',
+    'REQUIRE_DEPOSIT',
+]);
+// ─── Obligation types ────────────────────────────────────────────────
+exports.ObligationType = zod_1.z.enum([
+    'HUMAN_APPROVAL',
+    'STEP_UP_AUTH',
+    'DEPOSIT',
+    'COUNTERPARTY_ATTESTATION',
+]);
+exports.ObligationStatus = zod_1.z.enum(['PENDING', 'FULFILLED', 'WAIVED']);
+// ─── Principal types ─────────────────────────────────────────────────
+exports.PrincipalType = zod_1.z.enum(['HUMAN', 'ORG']);
+exports.PrincipalStatus = zod_1.z.enum(['ACTIVE', 'SUSPENDED', 'REVOKED']);
+exports.AgentStatus = zod_1.z.enum(['ACTIVE', 'REVOKED']);
+// ─── Trust profiles ──────────────────────────────────────────────────
+exports.TrustProfile = zod_1.z.enum(['LOW', 'MEDIUM', 'HIGH', 'REGULATED']);
+exports.AssuranceLevel = zod_1.z.enum(['LOW', 'SUBSTANTIAL', 'HIGH']);
+// ─── ActionRequest ───────────────────────────────────────────────────
+exports.ActionRequestSchema = zod_1.z.object({
+    action_id: zod_1.z.string().uuid(),
+    action_type: zod_1.z.string().min(1),
+    requested_at: zod_1.z.string(), // RFC3339
+    principal: zod_1.z.object({
+        agent_id: zod_1.z.string().min(1),
+    }),
+    subject: zod_1.z.object({
+        principal_id: zod_1.z.string().uuid(),
+    }),
+    relying_party: zod_1.z.object({
+        rp_id: zod_1.z.string().uuid().optional(),
+        domain: zod_1.z.string().optional(),
+        trust_profile: exports.TrustProfile.optional(),
+    }).optional(),
+    payload: zod_1.z.record(zod_1.z.unknown()),
+});
+// ─── Obligation ──────────────────────────────────────────────────────
+exports.ObligationSchema = zod_1.z.object({
+    obligation_id: zod_1.z.string().uuid(),
+    type: exports.ObligationType,
+    status: exports.ObligationStatus,
+    details_json: zod_1.z.record(zod_1.z.unknown()).optional(),
+});
+// ─── Audit event ─────────────────────────────────────────────────────
+exports.AuditEventType = zod_1.z.enum([
+    'OWNER_CREATED',
+    'AGENT_CHALLENGE_ISSUED',
+    'AGENT_REGISTERED',
+    'POLICY_UPSERTED',
+    'AUTHORIZE_CALLED',
+    'DECISION_CREATED',
+    'PROOF_ISSUED',
+    'PROOF_VERIFIED',
+    'PLAYGROUND_RUN',
+    'KEY_ROTATED',
+    'SERVER_STARTED',
+]);
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAExB,wEAAwE;AAC3D,QAAA,cAAc,GAAG,OAAC,CAAC,IAAI,CAAC;IACnC,OAAO;IACP,MAAM;IACN,kBAAkB;IAClB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC,CAAC;AAGH,wEAAwE;AAC3D,QAAA,cAAc,GAAG,OAAC,CAAC,IAAI,CAAC;IACnC,gBAAgB;IAChB,cAAc;IACd,SAAS;IACT,0BAA0B;CAC3B,CAAC,CAAC;AAGU,QAAA,gBAAgB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG3E,wEAAwE;AAC3D,QAAA,aAAa,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAGzC,QAAA,eAAe,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAG7D,QAAA,WAAW,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAGzD,wEAAwE;AAC3D,QAAA,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAG9D,QAAA,cAAc,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;AAGrE,wEAAwE;AAC3D,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,UAAU;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,CAAC;QAClB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC5B,CAAC;IACF,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC;QAChB,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;KAChC,CAAC;IACF,aAAa,EAAE,OAAC,CAAC,MAAM,CAAC;QACtB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,aAAa,EAAE,oBAAY,CAAC,QAAQ,EAAE;KACvC,CAAC,CAAC,QAAQ,EAAE;IACb,OAAO,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC;CAC/B,CAAC,CAAC;AAGH,wEAAwE;AAC3D,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAChC,IAAI,EAAE,sBAAc;IACpB,MAAM,EAAE,wBAAgB;IACxB,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AA+JH,wEAAwE;AAC3D,QAAA,cAAc,GAAG,OAAC,CAAC,IAAI,CAAC;IACnC,eAAe;IACf,wBAAwB;IACxB,kBAAkB;IAClB,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;CACjB,CAAC,CAAC"}

package/package.json

@@ -1,27 +1,28 @@
 {
-  "private": false,
-  "publishConfig": {
-    "access": "public"
-  },
   "name": "@openleash/core",
-  "version": "0.0.3",
-  "description": "Core authorization and proof engine for OpenLeash — policy evaluation, cryptographic proof tokens, and audit logging for AI agents.",
-  "main": "index.js",
-  "types": "index.d.ts",
-  "license": "MIT",
+  "version": "0.1.0",
+  "description": "Core authorization engine for openleash",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": ["dist", "LICENSE"],
+  "scripts": {
+    "build": "tsc -b"
+  },
+  "dependencies": {
+    "ajv": "^8.12.0",
+    "json-canonicalize": "^1.0.6",
+    "paseto": "^3.1.4",
+    "yaml": "^2.3.4",
+    "zod": "^3.22.4"
+  },
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/openleash/openleash.git",
     "directory": "packages/core"
   },
-  "homepage": "https://openleash.ai",
-  "keywords": [
-    "openleash",
-    "authorization",
-    "ai-agents",
-    "policy-engine",
-    "paseto",
-    "proof-tokens",
-    "security"
-  ]
+  "homepage": "https://github.com/openleash/openleash/tree/main/packages/core",
+  "bugs": {
+    "url": "https://github.com/openleash/openleash/issues"
+  }
 }

package/README.md

@@ -1,46 +0,0 @@
-# @openleash/core
-
-Core authorization and proof engine for [OpenLeash](https://openleash.ai).
-
-> **This package is a placeholder.** The full implementation is under active development.
-
-## What is OpenLeash?
-
-OpenLeash is a local-first authorization and proof sidecar for AI agents. It answers two questions:
-
-1. **Is this agent allowed to do this action right now?**
-2. **Can the agent produce a cryptographic proof that others can verify?**
-
-## What does `@openleash/core` provide?
-
-This package contains the core logic that powers OpenLeash:
-
-- **Policy engine** — Evaluates structured `ActionRequest` objects against YAML policies and returns a `DecisionResult` (`ALLOW`, `DENY`, `REQUIRE_APPROVAL`, `REQUIRE_STEP_UP`, `REQUIRE_DEPOSIT`).
-- **Expression evaluator** — A safe, sandboxed expression language for policy `when` clauses supporting `all`, `any`, `not`, and `match` operators with JSONPath-lite accessors.
-- **Constraints evaluation** — Built-in constraint shortcuts for `amount_max`, `amount_min`, `currency`, `merchant_domain`, `allowed_domains`, and `blocked_domains`.
-- **Obligations & precedence** — Computes obligations from matched rules and maps them to the final decision using blocking precedence (`HUMAN_APPROVAL` > `STEP_UP_AUTH` > `DEPOSIT` > `COUNTERPARTY_ATTESTATION`).
-- **Canonical hashing** — RFC 8785 JSON Canonicalization Scheme (JCS) for deterministic `action_hash` computation.
-- **Proof token issuance & verification** — PASETO v4.public (Ed25519) tokens bound to `action_hash`.
-- **File-based state management** — Read/write for `state.md`, owner/agent markdown files, and policy YAML.
-- **Audit logging** — Append-only JSONL audit log.
-- **Nonce replay cache** — In-memory TTL cache to prevent request replay.
-
-## Installation
-
-```bash
-npm install @openleash/core
-```
-
-## Status
-
-This package is under active development. See the [OpenLeash repository](https://github.com/openleash/openleash) for progress and documentation.
-
-## Links
-
-- [OpenLeash website](https://openleash.ai)
-- [GitHub repository](https://github.com/openleash/openleash)
-- [OpenClaw](https://openclaw.ai) — agent runtime that integrates with OpenLeash
-
-## License
-
-MIT

package/index.js

@@ -1,3 +0,0 @@
-// @openleash/core — placeholder
-// Full implementation coming soon. See https://github.com/openleash/openleash
-throw new Error('@openleash/core is not yet implemented. This is a placeholder package.');