@oxdeai/sdk 1.3.1 → 1.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (31) hide show
  1. package/CHANGELOG.md +33 -0
  2. package/LICENSE +17 -0
  3. package/README.md +20 -4
  4. package/dist/adapters.js +1 -0
  5. package/dist/adapters.js.map +1 -1
  6. package/dist/builders.js.map +1 -1
  7. package/dist/client.d.ts +10 -0
  8. package/dist/client.js +11 -0
  9. package/dist/client.js.map +1 -1
  10. package/dist/guard.d.ts +14 -0
  11. package/dist/guard.js +8 -0
  12. package/dist/guard.js.map +1 -1
  13. package/dist/index.d.ts +9 -1
  14. package/dist/index.js +10 -1
  15. package/dist/index.js.map +1 -1
  16. package/package.json +9 -3
  17. package/dist/guard.test.d.ts +0 -1
  18. package/dist/guard.test.js +0 -139
  19. package/dist/guard.test.js.map +0 -1
  20. package/dist/sdk.test.d.ts +0 -1
  21. package/dist/sdk.test.js +0 -71
  22. package/dist/sdk.test.js.map +0 -1
  23. package/src/adapters.ts +0 -109
  24. package/src/builders.ts +0 -80
  25. package/src/client.ts +0 -106
  26. package/src/guard.test.ts +0 -165
  27. package/src/guard.ts +0 -138
  28. package/src/index.ts +0 -7
  29. package/src/sdk.test.ts +0 -83
  30. package/src/types.ts +0 -70
  31. package/tsconfig.json +0 -9
package/CHANGELOG.md CHANGED
@@ -7,6 +7,39 @@ This project follows Semantic Versioning.
7
7
 
8
8
  ---
9
9
 
10
+ ## [1.3.2] - 2026-03-30
11
+
12
+ ### Security
13
+
14
+ - `engine_secret` minimum-length and entropy requirements now enforced at runtime — insecure defaults removed.
15
+ - Timing-safe HMAC comparison (`timingSafeEqual`) applied in domain verification.
16
+
17
+ ### Added
18
+
19
+ - Explicit verifier trust boundary with strict-mode enforcement in the trust model.
20
+ - DelegationV1 protocol artifact: full implementation, verification, and conformance vectors (139 assertions).
21
+
22
+ ### Fixed
23
+
24
+ - `deepMerge` is now non-mutating; property-based tests added.
25
+ - `tool_limits` marked required in `State` type, aligning type with runtime behavior.
26
+ - PolicyEngine output types exported; decision-path property surfaced correctly.
27
+ - TypeScript type error for `engine_secret` resolved across examples and packages.
28
+ - Conformance vectors regenerated with 32-char secret and CI environment aligned.
29
+
30
+ ### Changed
31
+
32
+ - Protocol-stack version alignment with:
33
+ - `@oxdeai/core@1.6.1`
34
+ - `@oxdeai/conformance@1.4.0`
35
+ - Trust boundary made explicit across SDK and documentation.
36
+
37
+ ### Notes
38
+
39
+ - `@oxdeai/cli` remains on a separate tooling version line.
40
+
41
+ ---
42
+
10
43
  ## [1.3.1] - 2026-03-08
11
44
 
12
45
  ### Changed
package/LICENSE ADDED
@@ -0,0 +1,17 @@
1
+ Apache License
2
+ Version 2.0, January 2004
3
+ http://www.apache.org/licenses/
4
+
5
+ Copyright 2026 OxDeAI
6
+
7
+ Licensed under the Apache License, Version 2.0 (the "License");
8
+ you may not use this file except in compliance with the License.
9
+ You may obtain a copy of the License at
10
+
11
+ http://www.apache.org/licenses/LICENSE-2.0
12
+
13
+ Unless required by applicable law or agreed to in writing, software
14
+ distributed under the License is distributed on an "AS IS" BASIS,
15
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16
+ See the License for the specific language governing permissions and
17
+ limitations under the License.
package/README.md CHANGED
@@ -1,10 +1,12 @@
1
1
  # @oxdeai/sdk
2
-
3
- Developer-facing integration layer on top of `@oxdeai/core`.
2
+ Developer toolkit for the OxDeAI execution-time authorization protocol (ETA).
3
+ Builds intents/states and guard boundaries that remain non-bypassable and fail-closed at execution.
4
4
 
5
5
  ## Status
6
6
 
7
- Current protocol stack line: **v1.3.x** (`@oxdeai/core`, `@oxdeai/sdk`, `@oxdeai/conformance`).
7
+ Release policy note: OxDeAI uses package-scoped versions and package-scoped tags. `@oxdeai/sdk` has its own package version line; coordinated release commits do not imply shared package versions across `core`, `sdk`, or `conformance`. See [`docs/release/RELEASE.md`](../../docs/release/RELEASE.md).
8
+
9
+ Current `@oxdeai/sdk` package line: `1.3.x`.
8
10
 
9
11
  The SDK is an integration surface and does not redefine protocol semantics.
10
12
 
@@ -15,6 +17,19 @@ The SDK is an integration surface and does not redefine protocol semantics.
15
17
  - Public guard API for callback-boundary enforcement (`createGuard`)
16
18
  - Runtime adapters (in-memory and file-based)
17
19
 
20
+ ## Architecture Overview
21
+
22
+ ![PDP and PEP flow](../../docs/diagrams/pdp-pep-flow.svg)
23
+
24
+ OxDeAI SDK sits at the runtime integration boundary:
25
+
26
+ - runtime/adapter proposes action input
27
+ - PDP evaluates policy and emits `AuthorizationV1` on `ALLOW`
28
+ - PEP callback gate executes only after authorization enforcement
29
+
30
+ Diagram source/editing policy:
31
+ - [`docs/diagrams/README.md`](../../docs/diagrams/README.md)
32
+
18
33
  ## Guard API (v1.3 adoption layer)
19
34
 
20
35
  The SDK exposes a framework-agnostic guard boundary:
@@ -51,7 +66,7 @@ import {
51
66
 
52
67
  const engine = new PolicyEngine({
53
68
  policy_version: "v1",
54
- engine_secret: "dev-secret",
69
+ engine_secret: "example-secret-must-be-32-chars!",
55
70
  authorization_ttl_seconds: 120
56
71
  });
57
72
 
@@ -101,6 +116,7 @@ await guard(intent, async () => {
101
116
 
102
117
  - `buildIntent`, `buildState`
103
118
  - `OxDeAIClient`
119
+ - `createGuard`
104
120
  - `InMemoryStateAdapter`, `InMemoryAuditAdapter`
105
121
  - `JsonFileStateAdapter`, `NdjsonFileAuditAdapter`
106
122
 
package/dist/adapters.js CHANGED
@@ -1,3 +1,4 @@
1
+ // SPDX-License-Identifier: Apache-2.0
1
2
  import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
2
3
  import { dirname } from "node:path";
3
4
  import { randomUUID } from "node:crypto";
package/dist/adapters.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzH,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,CAAC,GAAG,GAAY,CAAC;IACvB,OAAO;QACL,GAAG,CAAC;QACJ,MAAM,EAAE;YACN,GAAG,CAAC,CAAC,MAAM;YACX,YAAY,EAAE,eAAe,CAAE,CAAS,CAAC,MAAM,EAAE,YAAY,CAAC;YAC9D,eAAe,EAAE,eAAe,CAAE,CAAS,CAAC,MAAM,EAAE,eAAe,CAAC;SACrE;QACD,qBAAqB,EAAE,eAAe,CAAE,CAAS,CAAC,qBAAqB,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,oBAAoB;IACvB,KAAK,CAAQ;IAErB,YAAY,OAAc;QACxB,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,IAAI;QACF,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,KAAY;QACf,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACd,MAAM,GAAc,EAAE,CAAC;IAExC,MAAM,CAAC,MAA0B;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,QAAQ;QACN,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAY;QACrB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,QAAQ,UAAU,EAAE,EAAE,CAAC;QAC/C,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACxE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;CACF"}
1
+ {"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAMzC,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzH,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,CAAC,GAAG,GAAY,CAAC;IACvB,OAAO;QACL,GAAG,CAAC;QACJ,MAAM,EAAE;YACN,GAAG,CAAC,CAAC,MAAM;YACX,YAAY,EAAE,eAAe,CAAE,CAAS,CAAC,MAAM,EAAE,YAAY,CAAC;YAC9D,eAAe,EAAE,eAAe,CAAE,CAAS,CAAC,MAAM,EAAE,eAAe,CAAC;SACrE;QACD,qBAAqB,EAAE,eAAe,CAAE,CAAS,CAAC,qBAAqB,CAAC;KACzE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,oBAAoB;IACvB,KAAK,CAAQ;IAErB,YAAY,OAAc;QACxB,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,IAAI;QACF,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,KAAY;QACf,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACd,MAAM,GAAc,EAAE,CAAC;IAExC,MAAM,CAAC,MAA0B;QAC/B,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,QAAQ;QACN,OAAO,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAY;QACrB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,QAAQ,UAAU,EAAE,EAAE,CAAC;QAC/C,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,sBAAsB;IACJ;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,MAAM,CAAC,MAA0B;QACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAChC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACxE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;CACF"}
package/dist/builders.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"builders.js","sourceRoot":"","sources":["../src/builders.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;QAC/B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,2BAA2B;QACzD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IAEF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAChG,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,SAAS;YACf,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,SAAS;QACf,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAwB;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC7B,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;QAC9C,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1C,UAAU,EAAE;YACV,YAAY,EAAE,KAAK,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC;YACvD,MAAM,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YAChC,OAAO,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;SACnC;QACD,MAAM,EAAE;YACN,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,YAAY,IAAI,QAAU,EAAE;YAC3D,eAAe,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE,EAAE;SAC1D;QACD,qBAAqB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,qBAAqB,IAAI,QAAU,EAAE;QAC7E,QAAQ,EAAE;YACR,MAAM,EAAE;gBACN,cAAc,EAAE,KAAK,CAAC,uBAAuB,IAAI,EAAE;gBACnD,WAAW,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;aAChD;YACD,QAAQ,EAAE,EAAE;SACb;QACD,MAAM,EAAE;YACN,cAAc,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;YACnD,oBAAoB,EAAE,KAAK,CAAC,2BAA2B,IAAI,GAAG;YAC9D,MAAM,EAAE,EAAE;SACX;QACD,WAAW,EAAE;YACX,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE,EAAE;YACvD,MAAM,EAAE,EAAE;YACV,YAAY,EAAE,EAAE;SACjB;QACD,SAAS,EAAE;YACT,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,EAAE;SAC7C;QACD,WAAW,EAAE;YACX,cAAc,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;YAC/C,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE;YACpD,iBAAiB,EAAE,EAAE;YACrB,KAAK,EAAE,EAAE;SACV;KACF,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"builders.js","sourceRoot":"","sources":["../src/builders.ts"],"names":[],"mappings":"AAIA,MAAM,UAAU,WAAW,CAAC,KAAyB;IACnD,MAAM,IAAI,GAAG;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;QAC/B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,2BAA2B;QACzD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IAEF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAChG,OAAO;YACL,GAAG,IAAI;YACP,IAAI,EAAE,SAAS;YACf,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;SACzC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,SAAS;QACf,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAwB;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC7B,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC5C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB;QAC9C,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1C,UAAU,EAAE;YACV,YAAY,EAAE,KAAK,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC;YACvD,MAAM,EAAE,KAAK,CAAC,YAAY,IAAI,EAAE;YAChC,OAAO,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;SACnC;QACD,MAAM,EAAE;YACN,YAAY,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,YAAY,IAAI,QAAU,EAAE;YAC3D,eAAe,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,eAAe,IAAI,EAAE,EAAE;SAC1D;QACD,qBAAqB,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,qBAAqB,IAAI,QAAU,EAAE;QAC7E,QAAQ,EAAE;YACR,MAAM,EAAE;gBACN,cAAc,EAAE,KAAK,CAAC,uBAAuB,IAAI,EAAE;gBACnD,WAAW,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;aAChD;YACD,QAAQ,EAAE,EAAE;SACb;QACD,MAAM,EAAE;YACN,cAAc,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI;YACnD,oBAAoB,EAAE,KAAK,CAAC,2BAA2B,IAAI,GAAG;YAC9D,MAAM,EAAE,EAAE;SACX;QACD,WAAW,EAAE;YACX,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE,EAAE;YACvD,MAAM,EAAE,EAAE;YACV,YAAY,EAAE,EAAE;SACjB;QACD,SAAS,EAAE;YACT,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,EAAE;SAC7C;QACD,WAAW,EAAE;YACX,cAAc,EAAE,KAAK,CAAC,mBAAmB,IAAI,EAAE;YAC/C,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE;YACpD,iBAAiB,EAAE,EAAE;YACrB,KAAK,EAAE,EAAE;SACV;KACF,CAAC;AACJ,CAAC"}
package/dist/client.d.ts CHANGED
@@ -22,6 +22,16 @@ export declare class OxDeAIClient {
22
22
  valid: boolean;
23
23
  reason?: string;
24
24
  }>;
25
+ /**
26
+ * Verifies the current in-memory snapshot, audit log, and envelope.
27
+ *
28
+ * Defaults to `mode: "best-effort"` — structural checks only, no `trustedKeySets`
29
+ * required. Passing `mode: "strict"` additionally requires a signed envelope with a
30
+ * STATE_CHECKPOINT; without `trustedKeySets` it will return `TRUSTED_KEYSETS_REQUIRED`.
31
+ *
32
+ * For PEP-side trust verification of artifacts issued by an external party, use
33
+ * `createVerifier` with explicit `trustedKeySets` rather than this method.
34
+ */
25
35
  verifyCurrentArtifacts(opts?: {
26
36
  mode?: "strict" | "best-effort";
27
37
  }): Promise<VerifyBundleResult>;
package/dist/client.js CHANGED
@@ -1,3 +1,4 @@
1
+ // SPDX-License-Identifier: Apache-2.0
1
2
  import { encodeCanonicalState, encodeEnvelope, verifyAuditEvents, verifyEnvelope, verifySnapshot } from "@oxdeai/core";
2
3
  function collectNewEvents(engine, cursor) {
3
4
  const all = engine.audit.snapshot();
@@ -50,6 +51,16 @@ export class OxDeAIClient {
50
51
  const result = this.engine.verifyAuthorization(intent, authorization, state, intent.timestamp);
51
52
  return result.valid ? { valid: true } : { valid: false, reason: result.reason };
52
53
  }
54
+ /**
55
+ * Verifies the current in-memory snapshot, audit log, and envelope.
56
+ *
57
+ * Defaults to `mode: "best-effort"` — structural checks only, no `trustedKeySets`
58
+ * required. Passing `mode: "strict"` additionally requires a signed envelope with a
59
+ * STATE_CHECKPOINT; without `trustedKeySets` it will return `TRUSTED_KEYSETS_REQUIRED`.
60
+ *
61
+ * For PEP-side trust verification of artifacts issued by an external party, use
62
+ * `createVerifier` with explicit `trustedKeySets` rather than this method.
63
+ */
53
64
  async verifyCurrentArtifacts(opts) {
54
65
  const state = await this.stateAdapter.load();
55
66
  const snapshotBytes = encodeCanonicalState(this.engine.exportState(state));
package/dist/client.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACf,MAAM,cAAc,CAAC;AAqBtB,SAAS,gBAAgB,CAAC,MAAoB,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAe,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,OAAO,YAAY;IACN,MAAM,CAAe;IACrB,YAAY,CAAe;IAC3B,YAAY,CAAgB;IAC5B,KAAK,CAAe;IAC7B,WAAW,GAAG,CAAC,CAAC;IAExB,YAAY,IAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAoB;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,iBAAiB,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC;YAC9E,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAClB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;QACpB,MAAM,MAAM,GAAW;YACrB,GAAG,KAAK;YACR,SAAS,EAAE,iBAAiB;SACnB,CAAC;QAEZ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QAEtC,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEtE,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAqB;gBAC/B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE;gBACX,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAqB;YAC/B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,aAA4B;QACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,IAA0C;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAoD,EAAE;YACpF,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa;SAClC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,cAAc,CAAC;YACnC,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,SAAgB;SACzB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;CACF"}
1
+ {"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAEL,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,cAAc,EACf,MAAM,cAAc,CAAC;AAqBtB,SAAS,gBAAgB,CAAC,MAAoB,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAe,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,OAAO,YAAY;IACN,MAAM,CAAe;IACrB,YAAY,CAAe;IAC3B,YAAY,CAAgB;IAC5B,KAAK,CAAe;IAC7B,WAAW,GAAG,CAAC,CAAC;IAExB,YAAY,IAAmB;QAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAoB;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,iBAAiB,GAAG,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC;YAC9E,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAClB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;QACpB,MAAM,MAAM,GAAW;YACrB,GAAG,KAAK;YACR,SAAS,EAAE,iBAAiB;SACnB,CAAC;QAEZ,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QAEtC,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEtE,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAqB;gBAC/B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,EAAE;gBACX,aAAa,EAAE,GAAG,CAAC,aAAa;aACjC,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAqB;YAC/B,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,aAA4B;QACpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAClF,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,sBAAsB,CAAC,IAA0C;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAoD,EAAE;YACpF,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa;SAClC,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,cAAc,CAAC;YACnC,aAAa,EAAE,CAAC;YAChB,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,SAAgB;SACzB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,cAAc,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC;QACtF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;CACF"}
package/dist/guard.d.ts CHANGED
@@ -38,6 +38,12 @@ export type GuardOptions = {
38
38
  auditAdapter?: AuditAdapter;
39
39
  clock?: ClockAdapter;
40
40
  mode?: "fail-fast" | "collect-all";
41
+ /**
42
+ * Engine-level HMAC binding check between the issued intent and authorization.
43
+ * This is the PDP's own internal consistency check — distinct from PEP-side
44
+ * cryptographic signature verification via `verifyAuthorization` from @oxdeai/core.
45
+ * Defaults to true. Set to false only in test scenarios.
46
+ */
41
47
  verifyAuthorization?: boolean;
42
48
  };
43
49
  type GuardExecuteContext = {
@@ -46,5 +52,13 @@ type GuardExecuteContext = {
46
52
  state: State;
47
53
  };
48
54
  export type GuardFn = <T>(input: GuardInputIntent, execute: (ctx: GuardExecuteContext) => MaybePromise<T>) => Promise<GuardResult<T>>;
55
+ /**
56
+ * Creates a guard that evaluates intents against policy and executes the callback
57
+ * only when the decision is ALLOW (PDP + inline PEP path).
58
+ *
59
+ * This is the issuing side of the authorization boundary: it evaluates policy and
60
+ * produces authorizations. For relying-party (PEP) verification of artifacts issued
61
+ * by an external party, use `createVerifier` with explicit `trustedKeySets` instead.
62
+ */
49
63
  export declare function createGuard(opts: GuardOptions): GuardFn;
50
64
  export {};
package/dist/guard.js CHANGED
@@ -9,6 +9,14 @@ function isIntent(value) {
9
9
  typeof value.action_type === "string" &&
10
10
  typeof value.signature === "string");
11
11
  }
12
+ /**
13
+ * Creates a guard that evaluates intents against policy and executes the callback
14
+ * only when the decision is ALLOW (PDP + inline PEP path).
15
+ *
16
+ * This is the issuing side of the authorization boundary: it evaluates policy and
17
+ * produces authorizations. For relying-party (PEP) verification of artifacts issued
18
+ * by an external party, use `createVerifier` with explicit `trustedKeySets` instead.
19
+ */
12
20
  export function createGuard(opts) {
13
21
  const clock = opts.clock ?? { now: () => Math.floor(Date.now() / 1000) };
14
22
  let auditCursor = 0;
package/dist/guard.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA0C5C,SAAS,gBAAgB,CAAC,MAAoB,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAe,CAAC;IACjD,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAuB;IACvC,OAAO,CACL,OAAQ,KAAgB,CAAC,SAAS,KAAK,QAAQ;QAC/C,OAAQ,KAAgB,CAAC,QAAQ,KAAK,QAAQ;QAC9C,OAAQ,KAAgB,CAAC,WAAW,KAAK,QAAQ;QACjD,OAAQ,KAAgB,CAAC,SAAS,KAAK,QAAQ,CAChD,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACzE,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO,KAAK,UAAU,KAAK,CACzB,KAAuB,EACvB,OAAsD;QAEtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAW,QAAQ,CAAC,KAAK,CAAC;YACpC,CAAC,CAAE;gBACC,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;aACtD;YACd,CAAC,CAAC,WAAW,CAAC;gBACV,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE;aAC1C,CAAC,CAAC;QAEP,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QAEjC,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEtE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;gBAClD,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE;gBAClE,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9G,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;oBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,gBAAgB,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,EAAE;oBACxF,MAAM;oBACN,KAAK;oBACL,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,QAAQ,EAAE,KAAK;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC;YACpC,MAAM;YACN,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,KAAK,EAAE,GAAG,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE5C,OAAO;YACL,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;YAC5E,MAAM;YACN,KAAK,EAAE,GAAG,CAAC,SAAS;YACpB,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI;YACd,eAAe;SAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAgD5C,SAAS,gBAAgB,CAAC,MAAoB,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAe,CAAC;IACjD,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAuB;IACvC,OAAO,CACL,OAAQ,KAAgB,CAAC,SAAS,KAAK,QAAQ;QAC/C,OAAQ,KAAgB,CAAC,QAAQ,KAAK,QAAQ;QAC9C,OAAQ,KAAgB,CAAC,WAAW,KAAK,QAAQ;QACjD,OAAQ,KAAgB,CAAC,SAAS,KAAK,QAAQ,CAChD,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACzE,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO,KAAK,UAAU,KAAK,CACzB,KAAuB,EACvB,OAAsD;QAEtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAW,QAAQ,CAAC,KAAK,CAAC;YACpC,CAAC,CAAE;gBACC,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;aACtD;YACd,CAAC,CAAC,WAAW,CAAC;gBACV,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE;aAC1C,CAAC,CAAC;QAEP,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QAEjC,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEtE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;gBAClD,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE;gBAClE,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9G,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;oBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,gBAAgB,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,EAAE;oBACxF,MAAM;oBACN,KAAK;oBACL,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,QAAQ,EAAE,KAAK;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC;YACpC,MAAM;YACN,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,KAAK,EAAE,GAAG,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE5C,OAAO;YACL,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;YAC5E,MAAM;YACN,KAAK,EAAE,GAAG,CAAC,SAAS;YACpB,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI;YACd,eAAe;SAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
package/dist/index.d.ts CHANGED
@@ -1,4 +1,12 @@
1
- /** OxDeAI SDK — integration layer on top of @oxdeai/core. */
1
+ /**
2
+ * OxDeAI SDK — integration layer on top of @oxdeai/core.
3
+ *
4
+ * For PEP-side verification of externally issued authorization artifacts, use
5
+ * `createVerifier` (re-exported from @oxdeai/core below) with explicit `trustedKeySets`.
6
+ * In strict mode, verification fails closed when `trustedKeySets` is not configured
7
+ * (`TRUSTED_KEYSETS_REQUIRED`). A cryptographically valid artifact is not trusted by
8
+ * default — trust is configured explicitly by the verifier.
9
+ */
2
10
  export * from "@oxdeai/core";
3
11
  export * from "./types.js";
4
12
  export * from "./builders.js";
package/dist/index.js CHANGED
@@ -1,4 +1,13 @@
1
- /** OxDeAI SDK — integration layer on top of @oxdeai/core. */
1
+ // SPDX-License-Identifier: Apache-2.0
2
+ /**
3
+ * OxDeAI SDK — integration layer on top of @oxdeai/core.
4
+ *
5
+ * For PEP-side verification of externally issued authorization artifacts, use
6
+ * `createVerifier` (re-exported from @oxdeai/core below) with explicit `trustedKeySets`.
7
+ * In strict mode, verification fails closed when `trustedKeySets` is not configured
8
+ * (`TRUSTED_KEYSETS_REQUIRED`). A cryptographically valid artifact is not trusted by
9
+ * default — trust is configured explicitly by the verifier.
10
+ */
2
11
  export * from "@oxdeai/core";
3
12
  export * from "./types.js";
4
13
  export * from "./builders.js";
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;GAQG;AACH,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
package/package.json CHANGED
@@ -1,15 +1,21 @@
1
1
  {
2
2
  "name": "@oxdeai/sdk",
3
- "version": "1.3.1",
3
+ "version": "1.3.3",
4
4
  "type": "module",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",
7
7
  "dependencies": {
8
- "@oxdeai/core": "^1.3.0"
8
+ "@oxdeai/core": "1.7.0"
9
9
  },
10
+ "files": [
11
+ "dist",
12
+ "README.md",
13
+ "CHANGELOG.md",
14
+ "LICENSE"
15
+ ],
10
16
  "scripts": {
11
17
  "typecheck": "tsc -p tsconfig.json --noEmit",
12
18
  "build": "rm -rf dist && tsc -p tsconfig.json",
13
19
  "test": "pnpm build && node --test \"dist/**/*.test.js\""
14
20
  }
15
- }
21
+ }
package/dist/guard.test.d.ts DELETED
@@ -1 +0,0 @@
1
- export {};
package/dist/guard.test.js DELETED
@@ -1,139 +0,0 @@
1
- import test from "node:test";
2
- import assert from "node:assert/strict";
3
- import { PolicyEngine } from "@oxdeai/core";
4
- import { InMemoryAuditAdapter, InMemoryStateAdapter } from "./adapters.js";
5
- import { buildIntent, buildState } from "./builders.js";
6
- import { createGuard } from "./guard.js";
7
- function makeEngine() {
8
- return new PolicyEngine({
9
- policy_version: "v1",
10
- engine_secret: "dev-secret",
11
- authorization_ttl_seconds: 60,
12
- authorization_issuer: "issuer-A",
13
- authorization_audience: "rp-A",
14
- policyId: "a".repeat(64),
15
- });
16
- }
17
- function makeAllowState() {
18
- return buildState({
19
- policy_version: "v1",
20
- agent_id: "agent-1",
21
- allow_action_types: ["PROVISION"],
22
- allow_targets: ["us-east-1"],
23
- budget_limit: 1000n,
24
- spent_in_period: 0n,
25
- max_amount_per_action: 500n,
26
- });
27
- }
28
- test("guard executes callback on ALLOW", async () => {
29
- const engine = makeEngine();
30
- const stateAdapter = new InMemoryStateAdapter(makeAllowState());
31
- const auditAdapter = new InMemoryAuditAdapter();
32
- const guard = createGuard({
33
- engine,
34
- stateAdapter,
35
- auditAdapter,
36
- clock: { now: () => 1_770_000_000 },
37
- });
38
- let called = 0;
39
- const result = await guard(buildIntent({
40
- intent_id: "intent-allow-1",
41
- agent_id: "agent-1",
42
- action_type: "PROVISION",
43
- amount: 500n,
44
- target: "us-east-1",
45
- nonce: 1n,
46
- }), async () => {
47
- called++;
48
- return "ok";
49
- });
50
- assert.equal(called, 1);
51
- assert.equal(result.executed, true);
52
- assert.equal(result.output.decision, "ALLOW");
53
- if (result.executed)
54
- assert.equal(result.executionResult, "ok");
55
- assert.ok(auditAdapter.snapshot().length > 0);
56
- });
57
- test("guard does not execute callback on DENY", async () => {
58
- const engine = makeEngine();
59
- const stateAdapter = new InMemoryStateAdapter(makeAllowState());
60
- const guard = createGuard({
61
- engine,
62
- stateAdapter,
63
- clock: { now: () => 1_770_000_000 },
64
- });
65
- let called = 0;
66
- const result = await guard(buildIntent({
67
- intent_id: "intent-deny-1",
68
- agent_id: "agent-1",
69
- action_type: "PROVISION",
70
- amount: 900n,
71
- target: "us-east-1",
72
- nonce: 2n,
73
- }), async () => {
74
- called++;
75
- return "should-not-run";
76
- });
77
- assert.equal(called, 0);
78
- assert.equal(result.executed, false);
79
- assert.equal(result.output.decision, "DENY");
80
- });
81
- test("guard enforces authorization verification at callback boundary", async () => {
82
- const engine = makeEngine();
83
- const original = engine.verifyAuthorization.bind(engine);
84
- engine.verifyAuthorization = () => ({ valid: false, reason: "forced-test-failure" });
85
- const stateAdapter = new InMemoryStateAdapter(makeAllowState());
86
- const guard = createGuard({
87
- engine,
88
- stateAdapter,
89
- clock: { now: () => 1_770_000_000 },
90
- });
91
- let called = 0;
92
- const result = await guard(buildIntent({
93
- intent_id: "intent-allow-auth-check",
94
- agent_id: "agent-1",
95
- action_type: "PROVISION",
96
- amount: 500n,
97
- target: "us-east-1",
98
- nonce: 3n,
99
- }), async () => {
100
- called++;
101
- return "should-not-run";
102
- });
103
- assert.equal(called, 0);
104
- assert.equal(result.executed, false);
105
- assert.equal(result.output.decision, "DENY");
106
- assert.ok(result.output.reasons.some((r) => r.startsWith("AUTH_INVALID:")));
107
- engine.verifyAuthorization = original;
108
- });
109
- test("guard output is deterministic for equivalent inputs", async () => {
110
- const intent = buildIntent({
111
- intent_id: "intent-deterministic-1",
112
- agent_id: "agent-1",
113
- action_type: "PROVISION",
114
- amount: 500n,
115
- target: "us-east-1",
116
- nonce: 10n,
117
- timestamp: 1_770_000_000,
118
- });
119
- const g1 = createGuard({
120
- engine: makeEngine(),
121
- stateAdapter: new InMemoryStateAdapter(makeAllowState()),
122
- clock: { now: () => 1_770_000_000 },
123
- });
124
- const g2 = createGuard({
125
- engine: makeEngine(),
126
- stateAdapter: new InMemoryStateAdapter(makeAllowState()),
127
- clock: { now: () => 1_770_000_000 },
128
- });
129
- const r1 = await g1(intent, async () => "ok");
130
- const r2 = await g2(intent, async () => "ok");
131
- assert.equal(r1.output.decision, "ALLOW");
132
- assert.equal(r2.output.decision, "ALLOW");
133
- if (r1.output.decision === "ALLOW" && r2.output.decision === "ALLOW") {
134
- assert.equal(r1.output.authorization.auth_id, r2.output.authorization.auth_id);
135
- assert.equal(r1.output.authorization.state_hash, r2.output.authorization.state_hash);
136
- assert.equal(r1.output.authorization.intent_hash, r2.output.authorization.intent_hash);
137
- }
138
- });
139
- //# sourceMappingURL=guard.test.js.map
package/dist/guard.test.js.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"file":"guard.test.js","sourceRoot":"","sources":["../src/guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,SAAS,UAAU;IACjB,OAAO,IAAI,YAAY,CAAC;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,YAAY;QAC3B,yBAAyB,EAAE,EAAE;QAC7B,oBAAoB,EAAE,UAAU;QAChC,sBAAsB,EAAE,MAAM;QAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,UAAU,CAAC;QAChB,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,YAAY,EAAE,KAAM;QACpB,eAAe,EAAE,EAAE;QACnB,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;IAClD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,MAAM;QACN,YAAY;QACZ,YAAY;QACZ,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,WAAW,CAAC;QACV,SAAS,EAAE,gBAAgB;QAC3B,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;KACV,CAAC,EACF,KAAK,IAAI,EAAE;QACT,MAAM,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;IACzD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,MAAM;QACN,YAAY;QACZ,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,WAAW,CAAC;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;KACV,CAAC,EACF,KAAK,IAAI,EAAE;QACT,MAAM,EAAE,CAAC;QACT,OAAO,gBAAgB,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;IAChF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,MAAc,CAAC,mBAAmB,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAE9F,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,MAAM;QACN,YAAY;QACZ,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,WAAW,CAAC;QACV,SAAS,EAAE,yBAAyB;QACpC,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;KACV,CAAC,EACF,KAAK,IAAI,EAAE;QACT,MAAM,EAAE,CAAC;QACT,OAAO,gBAAgB,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAc,CAAC,mBAAmB,GAAG,QAAQ,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC;QACzB,SAAS,EAAE,wBAAwB;QACnC,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,WAAW,CAAC;QACrB,MAAM,EAAE,UAAU,EAAE;QACpB,YAAY,EAAE,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC;QACxD,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,WAAW,CAAC;QACrB,MAAM,EAAE,UAAU,EAAE;QACpB,YAAY,EAAE,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC;QACxD,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACrF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACzF,CAAC;AACH,CAAC,CAAC,CAAC"}
package/dist/sdk.test.d.ts DELETED
@@ -1 +0,0 @@
1
- export {};
package/dist/sdk.test.js DELETED
@@ -1,71 +0,0 @@
1
- import test from "node:test";
2
- import assert from "node:assert/strict";
3
- import { PolicyEngine } from "@oxdeai/core";
4
- import { InMemoryAuditAdapter, InMemoryStateAdapter } from "./adapters.js";
5
- import { buildIntent, buildState } from "./builders.js";
6
- import { OxDeAIClient } from "./client.js";
7
- test("builder helpers create engine-compatible intent/state", () => {
8
- const state = buildState({
9
- policy_version: "v1",
10
- agent_id: "agent-1",
11
- allow_action_types: ["PROVISION"],
12
- allow_targets: ["us-east-1"]
13
- });
14
- const intent = buildIntent({
15
- intent_id: "intent-1",
16
- agent_id: "agent-1",
17
- action_type: "PROVISION",
18
- amount: 100n,
19
- target: "us-east-1",
20
- nonce: 1n,
21
- timestamp: 1_770_000_000
22
- });
23
- const engine = new PolicyEngine({
24
- policy_version: "v1",
25
- engine_secret: "dev-secret",
26
- authorization_ttl_seconds: 60
27
- });
28
- const out = engine.evaluatePure(intent, state, { mode: "fail-fast" });
29
- assert.equal(out.decision, "ALLOW");
30
- });
31
- test("OxDeAIClient evaluate+persist+verify flow", async () => {
32
- const engine = new PolicyEngine({
33
- policy_version: "v1",
34
- engine_secret: "dev-secret",
35
- authorization_ttl_seconds: 60
36
- });
37
- const stateAdapter = new InMemoryStateAdapter(buildState({
38
- policy_version: "v1",
39
- agent_id: "agent-1",
40
- allow_action_types: ["PROVISION"],
41
- allow_targets: ["us-east-1"]
42
- }));
43
- const auditAdapter = new InMemoryAuditAdapter();
44
- const client = new OxDeAIClient({
45
- engine,
46
- stateAdapter,
47
- auditAdapter,
48
- clock: { now: () => 1_770_000_000 }
49
- });
50
- const intent = buildIntent({
51
- intent_id: "intent-2",
52
- agent_id: "agent-1",
53
- action_type: "PROVISION",
54
- amount: 320n,
55
- target: "us-east-1",
56
- nonce: 2n
57
- });
58
- const res = await client.evaluateAndCommit(intent);
59
- assert.equal(res.output.decision, "ALLOW");
60
- if (res.output.decision !== "ALLOW")
61
- return;
62
- assert.ok(res.auditEvents.length >= 3);
63
- assert.equal(auditAdapter.snapshot().length, res.auditEvents.length);
64
- const auth = await client.verifyAuthorization({ ...intent, timestamp: 1_770_000_000 }, res.output.authorization);
65
- assert.equal(auth.valid, true);
66
- const verify = await client.verifyCurrentArtifacts({ mode: "best-effort" });
67
- assert.equal(verify.snapshot.status, "ok");
68
- assert.equal(verify.audit.status, "ok");
69
- assert.equal(verify.envelope.status, "ok");
70
- });
71
- //# sourceMappingURL=sdk.test.js.map
package/dist/sdk.test.js.map DELETED
@@ -1 +0,0 @@
1
- {"version":3,"file":"sdk.test.js","sourceRoot":"","sources":["../src/sdk.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC;QACzB,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,YAAY;QAC3B,yBAAyB,EAAE,EAAE;KAC9B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,YAAY;QAC3B,yBAAyB,EAAE,EAAE;KAC9B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAC3C,UAAU,CAAC;QACT,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B,CAAC,CACH,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,MAAM;QACN,YAAY;QACZ,YAAY;QACZ,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,WAAW,CAAC;QACzB,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;KACV,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEnD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IAC5C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAC3C,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,EACvC,GAAG,CAAC,MAAM,CAAC,aAAa,CACzB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAE/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC"}