@openleash/core 0.2.0 → 0.5.0

package/dist/tokens.js

@@ -2,6 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.issueProofToken = issueProofToken;
 exports.verifyProofToken = verifyProofToken;
+exports.issueSessionToken = issueSessionToken;
+exports.verifySessionToken = verifySessionToken;
+exports.issueApprovalToken = issueApprovalToken;
+exports.verifyApprovalToken = verifyApprovalToken;
 const paseto_1 = require("paseto");
 const keys_js_1 = require("./keys.js");
 async function issueProofToken(params) {
@@ -53,4 +57,82 @@ async function verifyProofToken(token, keys) {
     }
     return { valid: false, reason: 'No matching key found or invalid signature' };
 }
+async function issueSessionToken(params) {
+    const now = new Date();
+    const exp = new Date(now.getTime() + params.ttlSeconds * 1000);
+    const claims = {
+        iss: 'openleash',
+        kid: params.key.kid,
+        sub: params.ownerPrincipalId,
+        iat: now.toISOString(),
+        exp: exp.toISOString(),
+        purpose: 'owner_session',
+    };
+    const privateKey = (0, keys_js_1.getPrivateKeyObject)(params.key);
+    const token = await paseto_1.V4.sign({ ...claims }, privateKey, { expiresIn: `${params.ttlSeconds} seconds` });
+    return { token, expiresAt: exp.toISOString(), claims };
+}
+async function verifySessionToken(token, keys) {
+    for (const key of keys) {
+        try {
+            const publicKey = (0, keys_js_1.getPublicKeyObject)(key);
+            const payload = await paseto_1.V4.verify(token, publicKey);
+            if (payload.purpose !== 'owner_session') {
+                return { valid: false, reason: 'Invalid token purpose' };
+            }
+            if (payload.exp) {
+                const expDate = new Date(payload.exp);
+                if (expDate.getTime() < Date.now()) {
+                    return { valid: false, reason: 'Session expired', claims: payload };
+                }
+            }
+            return { valid: true, claims: payload };
+        }
+        catch {
+            continue;
+        }
+    }
+    return { valid: false, reason: 'No matching key found or invalid signature' };
+}
+async function issueApprovalToken(params) {
+    const now = new Date();
+    const exp = new Date(now.getTime() + params.ttlSeconds * 1000);
+    const claims = {
+        iss: 'openleash',
+        kid: params.key.kid,
+        iat: now.toISOString(),
+        exp: exp.toISOString(),
+        approval_request_id: params.approvalRequestId,
+        owner_principal_id: params.ownerPrincipalId,
+        agent_id: params.agentId,
+        action_type: params.actionType,
+        action_hash: params.actionHash,
+        purpose: 'approval',
+    };
+    const privateKey = (0, keys_js_1.getPrivateKeyObject)(params.key);
+    const token = await paseto_1.V4.sign({ ...claims }, privateKey, { expiresIn: `${params.ttlSeconds} seconds` });
+    return { token, expiresAt: exp.toISOString(), claims };
+}
+async function verifyApprovalToken(token, keys) {
+    for (const key of keys) {
+        try {
+            const publicKey = (0, keys_js_1.getPublicKeyObject)(key);
+            const payload = await paseto_1.V4.verify(token, publicKey);
+            if (payload.purpose !== 'approval') {
+                return { valid: false, reason: 'Invalid token purpose' };
+            }
+            if (payload.exp) {
+                const expDate = new Date(payload.exp);
+                if (expDate.getTime() < Date.now()) {
+                    return { valid: false, reason: 'Approval token expired', claims: payload };
+                }
+            }
+            return { valid: true, claims: payload };
+        }
+        catch {
+            continue;
+        }
+    }
+    return { valid: false, reason: 'No matching key found or invalid signature' };
+}
 //# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;AAiCA,0CAkCC;AAED,4CA0BC;AA9FD,mCAA4B;AAE5B,uCAAoE;AA8B7D,KAAK,UAAU,eAAe,CAAC,MAAwB;IAK5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG;QACnB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,eAAe,EAAE,MAAM,CAAC,aAAa;KACtC,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,6BAAmB,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,WAAE,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAwC,EAAE,UAAU,EAAE;QAC3F,SAAS,EAAE,GAAG,MAAM,CAAC,UAAU,UAAU;KAC1C,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAAqB;IAErB,eAAe;IACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,4BAAkB,EAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,WAAE,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAgB,CAAC;YAEjE,mBAAmB;YACnB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;YACf,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;AAChF,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":";;AAgCA,0CAkCC;AAED,4CA0BC;AAUD,8CAyBC;AAED,gDA2BC;AAcD,gDA6BC;AAED,kDA2BC;AAtOD,mCAA4B;AAE5B,uCAAoE;AA8B7D,KAAK,UAAU,eAAe,CAAC,MAAwB;IAK5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAgB;QAC1B,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG;QACnB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,eAAe,EAAE,MAAM,CAAC,aAAa;KACtC,CAAC;IAEF,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,6BAAmB,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,WAAE,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAwC,EAAE,UAAU,EAAE;QAC3F,SAAS,EAAE,GAAG,MAAM,CAAC,UAAU,UAAU;KAC1C,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,IAAqB;IAErB,eAAe;IACf,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,4BAAkB,EAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,WAAE,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAgB,CAAC;YAEjE,mBAAmB;YACnB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACpE,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;YACf,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;AAChF,CAAC;AAUM,KAAK,UAAU,iBAAiB,CAAC,MAA0B;IAKhE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAkB;QAC5B,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG;QACnB,GAAG,EAAE,MAAM,CAAC,gBAAgB;QAC5B,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,OAAO,EAAE,eAAe;KACzB,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,6BAAmB,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,WAAE,CAAC,IAAI,CACzB,EAAE,GAAG,MAAM,EAAwC,EACnD,UAAU,EACV,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,UAAU,UAAU,EAAE,CAC9C,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,IAAqB;IAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,4BAAkB,EAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,WAAE,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAkB,CAAC;YAEnE,IAAI,OAAO,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;gBACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBACtE,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;AAChF,CAAC;AAcM,KAAK,UAAU,kBAAkB,CAAC,MAAgC;IAKvE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,WAAW;QAChB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG;QACnB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,mBAAmB,EAAE,MAAM,CAAC,iBAAiB;QAC7C,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,WAAW,EAAE,MAAM,CAAC,UAAU;QAC9B,OAAO,EAAE,UAAU;KACpB,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,6BAAmB,EAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,MAAM,WAAE,CAAC,IAAI,CACzB,EAAE,GAAG,MAAM,EAAwC,EACnD,UAAU,EACV,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,UAAU,UAAU,EAAE,CAC9C,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC;AAEM,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,IAAqB;IAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAA,4BAAkB,EAAC,GAAG,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,WAAE,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAwB,CAAC;YAEzE,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;gBACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;YAC3D,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC7E,CAAC;YACH,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;AAChF,CAAC"}

package/dist/totp.d.ts

@@ -0,0 +1,15 @@
+export declare function base32Encode(buffer: Buffer): string;
+export declare function base32Decode(str: string): Buffer;
+export declare function generateTotpSecret(): string;
+export declare function generateTotpUri(secret: string, accountName: string, issuer?: string): string;
+export declare function verifyTotp(secret: string, code: string, window?: number): boolean;
+export declare function generateBackupCodes(count?: number): {
+    codes: string[];
+    hashes: string[];
+};
+export declare function verifyBackupCode(code: string, hashes: string[]): {
+    valid: boolean;
+    remainingHashes: string[];
+};
+export declare function generateTotpQrSvg(uri: string): string;
+//# sourceMappingURL=totp.d.ts.map

package/dist/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":"AAMA,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAmBnD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAkBhD;AAID,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAc,GAAG,MAAM,CAIjG;AAeD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,OAAO,CAS5E;AAID,wBAAgB,mBAAmB,CAAC,KAAK,SAAI,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWpF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAO9G;AAOD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAYrD"}

package/dist/totp.js

@@ -0,0 +1,149 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.base32Encode = base32Encode;
+exports.base32Decode = base32Decode;
+exports.generateTotpSecret = generateTotpSecret;
+exports.generateTotpUri = generateTotpUri;
+exports.verifyTotp = verifyTotp;
+exports.generateBackupCodes = generateBackupCodes;
+exports.verifyBackupCode = verifyBackupCode;
+exports.generateTotpQrSvg = generateTotpQrSvg;
+const crypto = __importStar(require("node:crypto"));
+// ─── Base32 (RFC 4648) ──────────────────────────────────────────────
+const BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+function base32Encode(buffer) {
+    let bits = 0;
+    let value = 0;
+    let output = '';
+    for (const byte of buffer) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            output += BASE32_ALPHABET[(value >>> bits) & 0x1f];
+        }
+    }
+    if (bits > 0) {
+        output += BASE32_ALPHABET[(value << (5 - bits)) & 0x1f];
+    }
+    return output;
+}
+function base32Decode(str) {
+    const cleaned = str.replace(/=+$/, '').toUpperCase();
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const char of cleaned) {
+        const idx = BASE32_ALPHABET.indexOf(char);
+        if (idx === -1)
+            throw new Error(`Invalid base32 character: ${char}`);
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes.push((value >>> bits) & 0xff);
+        }
+    }
+    return Buffer.from(bytes);
+}
+// ─── TOTP (RFC 6238 / RFC 4226) ─────────────────────────────────────
+function generateTotpSecret() {
+    return base32Encode(crypto.randomBytes(20));
+}
+function generateTotpUri(secret, accountName, issuer = 'OpenLeash') {
+    const encodedIssuer = encodeURIComponent(issuer);
+    const encodedAccount = encodeURIComponent(accountName);
+    return `otpauth://totp/${encodedIssuer}:${encodedAccount}?secret=${secret}&issuer=${encodedIssuer}&algorithm=SHA1&digits=6&period=30`;
+}
+function computeHotp(secret, counter) {
+    const buf = Buffer.alloc(8);
+    buf.writeBigUInt64BE(counter);
+    const hmac = crypto.createHmac('sha1', secret).update(buf).digest();
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    const code = ((hmac[offset] & 0x7f) << 24) |
+        ((hmac[offset + 1] & 0xff) << 16) |
+        ((hmac[offset + 2] & 0xff) << 8) |
+        (hmac[offset + 3] & 0xff);
+    return String(code % 1_000_000).padStart(6, '0');
+}
+function verifyTotp(secret, code, window = 1) {
+    if (!/^\d{6}$/.test(code))
+        return false;
+    const key = base32Decode(secret);
+    const counter = BigInt(Math.floor(Date.now() / 30_000));
+    for (let i = -window; i <= window; i++) {
+        if (computeHotp(key, counter + BigInt(i)) === code)
+            return true;
+    }
+    return false;
+}
+// ─── Backup codes ────────────────────────────────────────────────────
+function generateBackupCodes(count = 8) {
+    const codes = [];
+    const hashes = [];
+    for (let i = 0; i < count; i++) {
+        const code = crypto.randomBytes(4).toString('hex'); // 8-char hex
+        codes.push(code);
+        hashes.push(crypto.createHash('sha256').update(code).digest('hex'));
+    }
+    return { codes, hashes };
+}
+function verifyBackupCode(code, hashes) {
+    const hash = crypto.createHash('sha256').update(code).digest('hex');
+    const idx = hashes.indexOf(hash);
+    if (idx === -1)
+        return { valid: false, remainingHashes: hashes };
+    const remainingHashes = [...hashes];
+    remainingHashes.splice(idx, 1);
+    return { valid: true, remainingHashes };
+}
+// ─── QR code SVG generation ──────────────────────────────────────────
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const QRCode = require('qrcode-svg');
+function generateTotpQrSvg(uri) {
+    const qr = new QRCode({
+        content: uri,
+        padding: 4,
+        width: 200,
+        height: 200,
+        color: '#000000',
+        background: '#ffffff',
+        ecl: 'M',
+        join: true,
+    });
+    return qr.svg();
+}
+//# sourceMappingURL=totp.js.map

package/dist/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../src/totp.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMA,oCAmBC;AAED,oCAkBC;AAID,gDAEC;AAED,0CAIC;AAeD,gCASC;AAID,kDAWC;AAED,4CAOC;AAOD,8CAYC;AA5HD,oDAAsC;AAEtC,uEAAuE;AAEvE,MAAM,eAAe,GAAG,kCAAkC,CAAC;AAE3D,SAAgB,YAAY,CAAC,MAAc;IACzC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,YAAY,CAAC,GAAW;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACrE,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,uEAAuE;AAEvE,SAAgB,kBAAkB;IAChC,OAAO,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAgB,eAAe,CAAC,MAAc,EAAE,WAAmB,EAAE,MAAM,GAAG,WAAW;IACvF,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACvD,OAAO,kBAAkB,aAAa,IAAI,cAAc,WAAW,MAAM,WAAW,aAAa,oCAAoC,CAAC;AACxI,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,OAAe;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5C,MAAM,IAAI,GACR,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,SAAgB,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,MAAM,GAAG,CAAC;IACjE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IAExD,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AAExE,SAAgB,mBAAmB,CAAC,KAAK,GAAG,CAAC;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa;QACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAgB,gBAAgB,CAAC,IAAY,EAAE,MAAgB;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IACpC,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;AAC1C,CAAC;AAED,wEAAwE;AAExE,iEAAiE;AACjE,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAErC,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC;QACpB,OAAO,EAAE,GAAG;QACZ,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,GAAG;QACX,KAAK,EAAE,SAAS;QAChB,UAAU,EAAE,SAAS;QACrB,GAAG,EAAE,GAAG;QACR,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IACH,OAAO,EAAE,CAAC,GAAG,EAAY,CAAC;AAC5B,CAAC"}

package/dist/types.d.ts

@@ -1,19 +1,54 @@
 import { z } from 'zod';
-export declare const DecisionResult: z.ZodEnum<["ALLOW", "DENY", "REQUIRE_APPROVAL", "REQUIRE_STEP_UP", "REQUIRE_DEPOSIT"]>;
+import type { IdentityAssuranceLevel, ContactIdentity, GovernmentId, CompanyId, Signatory, SignatoryRule } from './identity.js';
+export declare const DecisionResult: z.ZodEnum<{
+    ALLOW: "ALLOW";
+    DENY: "DENY";
+    REQUIRE_APPROVAL: "REQUIRE_APPROVAL";
+    REQUIRE_STEP_UP: "REQUIRE_STEP_UP";
+    REQUIRE_DEPOSIT: "REQUIRE_DEPOSIT";
+}>;
 export type DecisionResult = z.infer<typeof DecisionResult>;
-export declare const ObligationType: z.ZodEnum<["HUMAN_APPROVAL", "STEP_UP_AUTH", "DEPOSIT", "COUNTERPARTY_ATTESTATION"]>;
+export declare const ObligationType: z.ZodEnum<{
+    HUMAN_APPROVAL: "HUMAN_APPROVAL";
+    STEP_UP_AUTH: "STEP_UP_AUTH";
+    DEPOSIT: "DEPOSIT";
+    COUNTERPARTY_ATTESTATION: "COUNTERPARTY_ATTESTATION";
+}>;
 export type ObligationType = z.infer<typeof ObligationType>;
-export declare const ObligationStatus: z.ZodEnum<["PENDING", "FULFILLED", "WAIVED"]>;
+export declare const ObligationStatus: z.ZodEnum<{
+    PENDING: "PENDING";
+    FULFILLED: "FULFILLED";
+    WAIVED: "WAIVED";
+}>;
 export type ObligationStatus = z.infer<typeof ObligationStatus>;
-export declare const PrincipalType: z.ZodEnum<["HUMAN", "ORG"]>;
+export declare const PrincipalType: z.ZodEnum<{
+    HUMAN: "HUMAN";
+    ORG: "ORG";
+}>;
 export type PrincipalType = z.infer<typeof PrincipalType>;
-export declare const PrincipalStatus: z.ZodEnum<["ACTIVE", "SUSPENDED", "REVOKED"]>;
+export declare const PrincipalStatus: z.ZodEnum<{
+    ACTIVE: "ACTIVE";
+    SUSPENDED: "SUSPENDED";
+    REVOKED: "REVOKED";
+}>;
 export type PrincipalStatus = z.infer<typeof PrincipalStatus>;
-export declare const AgentStatus: z.ZodEnum<["ACTIVE", "REVOKED"]>;
+export declare const AgentStatus: z.ZodEnum<{
+    ACTIVE: "ACTIVE";
+    REVOKED: "REVOKED";
+}>;
 export type AgentStatus = z.infer<typeof AgentStatus>;
-export declare const TrustProfile: z.ZodEnum<["LOW", "MEDIUM", "HIGH", "REGULATED"]>;
+export declare const TrustProfile: z.ZodEnum<{
+    LOW: "LOW";
+    MEDIUM: "MEDIUM";
+    HIGH: "HIGH";
+    REGULATED: "REGULATED";
+}>;
 export type TrustProfile = z.infer<typeof TrustProfile>;
-export declare const AssuranceLevel: z.ZodEnum<["LOW", "SUBSTANTIAL", "HIGH"]>;
+export declare const AssuranceLevel: z.ZodEnum<{
+    LOW: "LOW";
+    HIGH: "HIGH";
+    SUBSTANTIAL: "SUBSTANTIAL";
+}>;
 export type AssuranceLevel = z.infer<typeof AssuranceLevel>;
 export declare const ActionRequestSchema: z.ZodObject<{
     action_id: z.ZodString;
@@ -21,82 +56,38 @@ export declare const ActionRequestSchema: z.ZodObject<{
     requested_at: z.ZodString;
     principal: z.ZodObject<{
         agent_id: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        agent_id: string;
-    }, {
-        agent_id: string;
-    }>;
+    }, z.core.$strip>;
     subject: z.ZodObject<{
         principal_id: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        principal_id: string;
-    }, {
-        principal_id: string;
-    }>;
+    }, z.core.$strip>;
     relying_party: z.ZodOptional<z.ZodObject<{
         rp_id: z.ZodOptional<z.ZodString>;
         domain: z.ZodOptional<z.ZodString>;
-        trust_profile: z.ZodOptional<z.ZodEnum<["LOW", "MEDIUM", "HIGH", "REGULATED"]>>;
-    }, "strip", z.ZodTypeAny, {
-        rp_id?: string | undefined;
-        domain?: string | undefined;
-        trust_profile?: "LOW" | "MEDIUM" | "HIGH" | "REGULATED" | undefined;
-    }, {
-        rp_id?: string | undefined;
-        domain?: string | undefined;
-        trust_profile?: "LOW" | "MEDIUM" | "HIGH" | "REGULATED" | undefined;
-    }>>;
+        trust_profile: z.ZodOptional<z.ZodEnum<{
+            LOW: "LOW";
+            MEDIUM: "MEDIUM";
+            HIGH: "HIGH";
+            REGULATED: "REGULATED";
+        }>>;
+    }, z.core.$strip>>;
     payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-}, "strip", z.ZodTypeAny, {
-    action_id: string;
-    action_type: string;
-    requested_at: string;
-    principal: {
-        agent_id: string;
-    };
-    subject: {
-        principal_id: string;
-    };
-    payload: Record<string, unknown>;
-    relying_party?: {
-        rp_id?: string | undefined;
-        domain?: string | undefined;
-        trust_profile?: "LOW" | "MEDIUM" | "HIGH" | "REGULATED" | undefined;
-    } | undefined;
-}, {
-    action_id: string;
-    action_type: string;
-    requested_at: string;
-    principal: {
-        agent_id: string;
-    };
-    subject: {
-        principal_id: string;
-    };
-    payload: Record<string, unknown>;
-    relying_party?: {
-        rp_id?: string | undefined;
-        domain?: string | undefined;
-        trust_profile?: "LOW" | "MEDIUM" | "HIGH" | "REGULATED" | undefined;
-    } | undefined;
-}>;
+}, z.core.$strip>;
 export type ActionRequest = z.infer<typeof ActionRequestSchema>;
 export declare const ObligationSchema: z.ZodObject<{
     obligation_id: z.ZodString;
-    type: z.ZodEnum<["HUMAN_APPROVAL", "STEP_UP_AUTH", "DEPOSIT", "COUNTERPARTY_ATTESTATION"]>;
-    status: z.ZodEnum<["PENDING", "FULFILLED", "WAIVED"]>;
+    type: z.ZodEnum<{
+        HUMAN_APPROVAL: "HUMAN_APPROVAL";
+        STEP_UP_AUTH: "STEP_UP_AUTH";
+        DEPOSIT: "DEPOSIT";
+        COUNTERPARTY_ATTESTATION: "COUNTERPARTY_ATTESTATION";
+    }>;
+    status: z.ZodEnum<{
+        PENDING: "PENDING";
+        FULFILLED: "FULFILLED";
+        WAIVED: "WAIVED";
+    }>;
     details_json: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-}, "strip", z.ZodTypeAny, {
-    type: "HUMAN_APPROVAL" | "STEP_UP_AUTH" | "DEPOSIT" | "COUNTERPARTY_ATTESTATION";
-    status: "PENDING" | "FULFILLED" | "WAIVED";
-    obligation_id: string;
-    details_json?: Record<string, unknown> | undefined;
-}, {
-    type: "HUMAN_APPROVAL" | "STEP_UP_AUTH" | "DEPOSIT" | "COUNTERPARTY_ATTESTATION";
-    status: "PENDING" | "FULFILLED" | "WAIVED";
-    obligation_id: string;
-    details_json?: Record<string, unknown> | undefined;
-}>;
+}, z.core.$strip>;
 export type Obligation = z.infer<typeof ObligationSchema>;
 export interface AuthorizeResponse {
     decision_id: string;
@@ -205,6 +196,8 @@ export interface StateData {
     agents: StateAgentEntry[];
     policies: StatePolicyEntry[];
     bindings: StateBinding[];
+    approval_requests?: StateApprovalRequestEntry[];
+    policy_drafts?: StatePolicyDraftEntry[];
 }
 export interface ServerKeyFile {
     kid: string;
@@ -220,6 +213,19 @@ export interface OwnerFrontmatter {
     status: PrincipalStatus;
     attributes: Record<string, unknown>;
     created_at: string;
+    identity_assurance_level?: IdentityAssuranceLevel;
+    contact_identities?: ContactIdentity[];
+    government_ids?: GovernmentId[];
+    company_ids?: CompanyId[];
+    signatories?: Signatory[];
+    signatory_rules?: SignatoryRule[];
+    passphrase_hash?: string;
+    passphrase_salt?: string;
+    passphrase_set_at?: string;
+    totp_secret_b32?: string;
+    totp_enabled?: boolean;
+    totp_enabled_at?: string;
+    totp_backup_codes_hash?: string[];
 }
 export interface AgentFrontmatter {
     agent_principal_id: string;
@@ -231,7 +237,145 @@ export interface AgentFrontmatter {
     created_at: string;
     revoked_at: string | null;
 }
-export declare const AuditEventType: z.ZodEnum<["OWNER_CREATED", "AGENT_CHALLENGE_ISSUED", "AGENT_REGISTERED", "POLICY_UPSERTED", "AUTHORIZE_CALLED", "DECISION_CREATED", "PROOF_ISSUED", "PROOF_VERIFIED", "PLAYGROUND_RUN", "KEY_ROTATED", "SERVER_STARTED", "POLICY_UPDATED", "POLICY_DELETED", "POLICY_UNBOUND"]>;
+export declare const ApprovalRequestStatus: z.ZodEnum<{
+    PENDING: "PENDING";
+    APPROVED: "APPROVED";
+    DENIED: "DENIED";
+    EXPIRED: "EXPIRED";
+}>;
+export type ApprovalRequestStatus = z.infer<typeof ApprovalRequestStatus>;
+export interface ApprovalRequestFrontmatter {
+    approval_request_id: string;
+    decision_id: string;
+    agent_principal_id: string;
+    agent_id: string;
+    owner_principal_id: string;
+    action_type: string;
+    action_hash: string;
+    action: ActionRequest;
+    justification: string | null;
+    context: Record<string, unknown> | null;
+    status: ApprovalRequestStatus;
+    approval_token: string | null;
+    approval_token_expires_at: string | null;
+    resolved_at: string | null;
+    resolved_by: string | null;
+    denial_reason: string | null;
+    consumed_at: string | null;
+    created_at: string;
+    expires_at: string;
+}
+export interface StateApprovalRequestEntry {
+    approval_request_id: string;
+    owner_principal_id: string;
+    agent_principal_id: string;
+    status: ApprovalRequestStatus;
+    path: string;
+}
+export declare const PolicyDraftStatus: z.ZodEnum<{
+    PENDING: "PENDING";
+    APPROVED: "APPROVED";
+    DENIED: "DENIED";
+}>;
+export type PolicyDraftStatus = z.infer<typeof PolicyDraftStatus>;
+export interface PolicyDraftFrontmatter {
+    policy_draft_id: string;
+    agent_principal_id: string;
+    agent_id: string;
+    owner_principal_id: string;
+    applies_to_agent_principal_id: string | null;
+    policy_yaml: string;
+    justification: string | null;
+    status: PolicyDraftStatus;
+    resulting_policy_id: string | null;
+    resolved_at: string | null;
+    resolved_by: string | null;
+    denial_reason: string | null;
+    created_at: string;
+}
+export interface StatePolicyDraftEntry {
+    policy_draft_id: string;
+    owner_principal_id: string;
+    agent_principal_id: string;
+    status: PolicyDraftStatus;
+    path: string;
+}
+export interface SetupInvite {
+    invite_id: string;
+    owner_principal_id: string;
+    token_hash: string;
+    token_salt: string;
+    expires_at: string;
+    used: boolean;
+    used_at: string | null;
+    created_at: string;
+}
+export interface AgentInvite {
+    invite_id: string;
+    owner_principal_id: string;
+    token_hash: string;
+    token_salt: string;
+    expires_at: string;
+    used: boolean;
+    used_at: string | null;
+    created_at: string;
+}
+export interface SessionClaims {
+    iss: string;
+    kid: string;
+    sub: string;
+    iat: string;
+    exp: string;
+    purpose: 'owner_session';
+}
+export interface ApprovalTokenClaims {
+    iss: string;
+    kid: string;
+    iat: string;
+    exp: string;
+    approval_request_id: string;
+    owner_principal_id: string;
+    agent_id: string;
+    action_type: string;
+    action_hash: string;
+    purpose: 'approval';
+}
+export declare const AuditEventType: z.ZodEnum<{
+    OWNER_CREATED: "OWNER_CREATED";
+    OWNER_UPDATED: "OWNER_UPDATED";
+    OWNER_IDENTITY_UPDATED: "OWNER_IDENTITY_UPDATED";
+    OWNER_SETUP_INVITE_CREATED: "OWNER_SETUP_INVITE_CREATED";
+    OWNER_SETUP_COMPLETED: "OWNER_SETUP_COMPLETED";
+    OWNER_LOGIN: "OWNER_LOGIN";
+    OWNER_LOGOUT: "OWNER_LOGOUT";
+    AGENT_CHALLENGE_ISSUED: "AGENT_CHALLENGE_ISSUED";
+    AGENT_REGISTERED: "AGENT_REGISTERED";
+    POLICY_UPSERTED: "POLICY_UPSERTED";
+    AUTHORIZE_CALLED: "AUTHORIZE_CALLED";
+    DECISION_CREATED: "DECISION_CREATED";
+    PROOF_ISSUED: "PROOF_ISSUED";
+    PROOF_VERIFIED: "PROOF_VERIFIED";
+    PLAYGROUND_RUN: "PLAYGROUND_RUN";
+    KEY_ROTATED: "KEY_ROTATED";
+    SERVER_STARTED: "SERVER_STARTED";
+    POLICY_UPDATED: "POLICY_UPDATED";
+    POLICY_DELETED: "POLICY_DELETED";
+    POLICY_UNBOUND: "POLICY_UNBOUND";
+    APPROVAL_REQUEST_CREATED: "APPROVAL_REQUEST_CREATED";
+    APPROVAL_REQUEST_APPROVED: "APPROVAL_REQUEST_APPROVED";
+    APPROVAL_REQUEST_DENIED: "APPROVAL_REQUEST_DENIED";
+    APPROVAL_REQUEST_EXPIRED: "APPROVAL_REQUEST_EXPIRED";
+    APPROVAL_TOKEN_USED: "APPROVAL_TOKEN_USED";
+    INITIAL_SETUP_COMPLETED: "INITIAL_SETUP_COMPLETED";
+    OWNER_TOTP_ENABLED: "OWNER_TOTP_ENABLED";
+    OWNER_TOTP_DISABLED: "OWNER_TOTP_DISABLED";
+    OWNER_TOTP_BACKUP_USED: "OWNER_TOTP_BACKUP_USED";
+    AGENT_INVITE_CREATED: "AGENT_INVITE_CREATED";
+    AGENT_REGISTERED_VIA_INVITE: "AGENT_REGISTERED_VIA_INVITE";
+    POLICY_DRAFT_CREATED: "POLICY_DRAFT_CREATED";
+    POLICY_DRAFT_APPROVED: "POLICY_DRAFT_APPROVED";
+    POLICY_DRAFT_DENIED: "POLICY_DRAFT_DENIED";
+}>;
 export type AuditEventType = z.infer<typeof AuditEventType>;
 export interface AuditEvent {
     event_id: string;
@@ -254,6 +398,7 @@ export interface OpenleashConfig {
     security: {
         nonce_ttl_seconds: number;
         clock_skew_seconds: number;
+        require_totp?: boolean;
     };
     tokens: {
         format: 'paseto_v4_public';
@@ -263,6 +408,13 @@ export interface OpenleashConfig {
     gui?: {
         enabled: boolean;
     };
+    sessions?: {
+        ttl_seconds: number;
+    };
+    approval?: {
+        request_ttl_seconds: number;
+        token_ttl_seconds: number;
+    };
 }
 export interface RegistrationChallenge {
     challenge_id: string;