@oxdeai/sdk 1.3.1 → 2.0.0

package/dist/guard.d.ts

@@ -1,9 +1,9 @@
-import type { Intent, PolicyEngine, State, Authorization } from "@oxdeai/core";
+import type { Intent, PolicyEngine, State, AuthorizationV1 } from "@oxdeai/core";
 import type { AuditAdapter, ClockAdapter, MaybePromise, StateAdapter, IntentBuilderInput } from "./types.js";
 export type GuardDecision = {
     decision: "ALLOW";
     reasons: [];
-    authorization: Authorization;
+    authorization: AuthorizationV1;
 } | {
     decision: "DENY";
     reasons: string[];
@@ -12,7 +12,7 @@ export type GuardAllowResult<T> = {
     output: GuardDecision & {
         decision: "ALLOW";
         reasons: [];
-        authorization: Authorization;
+        authorization: AuthorizationV1;
     };
     intent: Intent;
     state: State;
@@ -38,13 +38,27 @@ export type GuardOptions = {
     auditAdapter?: AuditAdapter;
     clock?: ClockAdapter;
     mode?: "fail-fast" | "collect-all";
+    /**
+     * Engine-level HMAC binding check between the issued intent and authorization.
+     * This is the PDP's own internal consistency check — distinct from PEP-side
+     * cryptographic signature verification via `verifyAuthorization` from @oxdeai/core.
+     * Defaults to true. Set to false only in test scenarios.
+     */
     verifyAuthorization?: boolean;
 };
 type GuardExecuteContext = {
     intent: Intent;
-    authorization: Authorization;
+    authorization: AuthorizationV1;
     state: State;
 };
 export type GuardFn = <T>(input: GuardInputIntent, execute: (ctx: GuardExecuteContext) => MaybePromise<T>) => Promise<GuardResult<T>>;
+/**
+ * Creates a guard that evaluates intents against policy and executes the callback
+ * only when the decision is ALLOW (PDP + inline PEP path).
+ *
+ * This is the issuing side of the authorization boundary: it evaluates policy and
+ * produces authorizations. For relying-party (PEP) verification of artifacts issued
+ * by an external party, use `createVerifier` with explicit `trustedKeySets` instead.
+ */
 export declare function createGuard(opts: GuardOptions): GuardFn;
 export {};

package/dist/guard.js

@@ -9,21 +9,38 @@ function isIntent(value) {
         typeof value.action_type === "string" &&
         typeof value.signature === "string");
 }
+/**
+ * Creates a guard that evaluates intents against policy and executes the callback
+ * only when the decision is ALLOW (PDP + inline PEP path).
+ *
+ * This is the issuing side of the authorization boundary: it evaluates policy and
+ * produces authorizations. For relying-party (PEP) verification of artifacts issued
+ * by an external party, use `createVerifier` with explicit `trustedKeySets` instead.
+ */
 export function createGuard(opts) {
     const clock = opts.clock ?? { now: () => Math.floor(Date.now() / 1000) };
     let auditCursor = 0;
     return async function guard(input, execute) {
         const state = await opts.stateAdapter.load();
+        // Single clock sample, reused for both the timestamp fallback below and
+        // evaluationTime — the trusted-time freshness gate requires evaluationTime
+        // to be sampled exactly once per evaluation (spec §2.1), and clock is the
+        // same trusted-context boundary already responsible for the timestamp
+        // fallback. Never derived from intent.timestamp itself (which may be
+        // attacker-supplied). Note: clock defaults to Date.now()/1000 unless the
+        // caller supplies an independent ClockAdapter; an explicitly supplied
+        // value here is not necessarily independently trusted time.
+        const evaluationTime = clock.now();
         const intent = isIntent(input)
             ? {
                 ...input,
-                timestamp: input.timestamp === 0 ? clock.now() : input.timestamp,
+                timestamp: input.timestamp === 0 ? evaluationTime : input.timestamp,
             }
             : buildIntent({
                 ...input,
-                timestamp: input.timestamp ?? clock.now(),
+                timestamp: input.timestamp ?? evaluationTime,
             });
-        const out = opts.engine.evaluatePure(intent, state, { mode: opts.mode ?? "fail-fast" });
+        const out = opts.engine.evaluatePure(intent, state, evaluationTime, { mode: opts.mode ?? "fail-fast" });
         const emitted = collectNewEvents(opts.engine, auditCursor);
         auditCursor = emitted.nextCursor;
         if (opts.auditAdapter)
@@ -47,7 +64,12 @@ export function createGuard(opts) {
             };
         }
         if (opts.verifyAuthorization !== false) {
-            const authCheck = opts.engine.verifyAuthorization(intent, out.authorization, out.nextState, intent.timestamp);
+            // Cast as Authorization: runtime object retains internal engine fields even
+            // though the TypeScript type was narrowed to AuthorizationV1 at the evaluatePure boundary.
+            // Verifier time is the single trusted `evaluationTime` sample taken above, never
+            // intent.timestamp — that value is attacker-supplied, so reading it as "now" would
+            // let the intent decide whether its own authorization has expired.
+            const authCheck = opts.engine.verifyAuthorization(intent, out.authorization, out.nextState, evaluationTime);
             if (!authCheck.valid) {
                 return {
                     output: { decision: "DENY", reasons: [`AUTH_INVALID:${authCheck.reason ?? "unknown"}`] },

package/dist/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AA0C5C,SAAS,gBAAgB,CAAC,MAAoB,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAe,CAAC;IACjD,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAuB;IACvC,OAAO,CACL,OAAQ,KAAgB,CAAC,SAAS,KAAK,QAAQ;QAC/C,OAAQ,KAAgB,CAAC,QAAQ,KAAK,QAAQ;QAC9C,OAAQ,KAAgB,CAAC,WAAW,KAAK,QAAQ;QACjD,OAAQ,KAAgB,CAAC,SAAS,KAAK,QAAQ,CAChD,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACzE,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO,KAAK,UAAU,KAAK,CACzB,KAAuB,EACvB,OAAsD;QAEtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAW,QAAQ,CAAC,KAAK,CAAC;YACpC,CAAC,CAAE;gBACC,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;aACtD;YACd,CAAC,CAAC,WAAW,CAAC;gBACV,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,GAAG,EAAE;aAC1C,CAAC,CAAC;QAEP,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACxF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QAEjC,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEtE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;gBAClD,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE;gBAClE,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9G,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;oBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,gBAAgB,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,EAAE;oBACxF,MAAM;oBACN,KAAK;oBACL,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,QAAQ,EAAE,KAAK;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC;YACpC,MAAM;YACN,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,KAAK,EAAE,GAAG,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE5C,OAAO;YACL,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;YAC5E,MAAM;YACN,KAAK,EAAE,GAAG,CAAC,SAAS;YACpB,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI;YACd,eAAe;SAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAgD5C,SAAS,gBAAgB,CAAC,MAAoB,EAAE,MAAc;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAe,CAAC;IACjD,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAuB;IACvC,OAAO,CACL,OAAQ,KAAgB,CAAC,SAAS,KAAK,QAAQ;QAC/C,OAAQ,KAAgB,CAAC,QAAQ,KAAK,QAAQ;QAC9C,OAAQ,KAAgB,CAAC,WAAW,KAAK,QAAQ;QACjD,OAAQ,KAAgB,CAAC,SAAS,KAAK,QAAQ,CAChD,CAAC;AACJ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACzE,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO,KAAK,UAAU,KAAK,CACzB,KAAuB,EACvB,OAAsD;QAEtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAC7C,wEAAwE;QACxE,2EAA2E;QAC3E,0EAA0E;QAC1E,sEAAsE;QACtE,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QACnC,MAAM,MAAM,GAAW,QAAQ,CAAC,KAAK,CAAC;YACpC,CAAC,CAAE;gBACC,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;aACzD;YACd,CAAC,CAAC,WAAW,CAAC;gBACV,GAAG,KAAK;gBACR,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,cAAc;aAC7C,CAAC,CAAC;QAEP,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QAEjC,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAEtE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;gBAClD,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO;gBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,yBAAyB,CAAC,EAAE;gBAClE,MAAM;gBACN,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,MAAM;gBAC3B,QAAQ,EAAE,KAAK;aAChB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACvC,4EAA4E;YAC5E,2FAA2F;YAC3F,iFAAiF;YACjF,mFAAmF;YACnF,mEAAmE;YACnE,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,aAA8B,EAAE,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAC7H,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;oBACL,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,gBAAgB,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,EAAE;oBACxF,MAAM;oBACN,KAAK;oBACL,WAAW,EAAE,OAAO,CAAC,MAAM;oBAC3B,QAAQ,EAAE,KAAK;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC;YACpC,MAAM;YACN,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,KAAK,EAAE,GAAG,CAAC,SAAS;SACrB,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE5C,OAAO;YACL,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE;YAC5E,MAAM;YACN,KAAK,EAAE,GAAG,CAAC,SAAS;YACpB,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI;YACd,eAAe;SAChB,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,12 @@
-/** OxDeAI SDK — integration layer on top of @oxdeai/core. */
+/**
+ * OxDeAI SDK — integration layer on top of @oxdeai/core.
+ *
+ * For PEP-side verification of externally issued authorization artifacts, use
+ * `createVerifier` (re-exported from @oxdeai/core below) with explicit `trustedKeySets`.
+ * In strict mode, verification fails closed when `trustedKeySets` is not configured
+ * (`TRUSTED_KEYSETS_REQUIRED`). A cryptographically valid artifact is not trusted by
+ * default — trust is configured explicitly by the verifier.
+ */
 export * from "@oxdeai/core";
 export * from "./types.js";
 export * from "./builders.js";

package/dist/index.js

@@ -1,4 +1,13 @@
-/** OxDeAI SDK — integration layer on top of @oxdeai/core. */
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * OxDeAI SDK — integration layer on top of @oxdeai/core.
+ *
+ * For PEP-side verification of externally issued authorization artifacts, use
+ * `createVerifier` (re-exported from @oxdeai/core below) with explicit `trustedKeySets`.
+ * In strict mode, verification fails closed when `trustedKeySets` is not configured
+ * (`TRUSTED_KEYSETS_REQUIRED`). A cryptographically valid artifact is not trusted by
+ * default — trust is configured explicitly by the verifier.
+ */
 export * from "@oxdeai/core";
 export * from "./types.js";
 export * from "./builders.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;;GAQG;AACH,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/types.d.ts

@@ -1,9 +1,9 @@
-import type { Authorization, Intent, State, VerificationResult } from "@oxdeai/core";
+import type { AuthorizationV1, Intent, State, VerificationResult } from "@oxdeai/core";
 export type MaybePromise<T> = T | Promise<T>;
 export type EvaluateDecision = {
     decision: "ALLOW";
     reasons: [];
-    authorization: Authorization;
+    authorization: AuthorizationV1;
 } | {
     decision: "DENY";
     reasons: string[];

package/package.json

@@ -1,15 +1,33 @@
 {
   "name": "@oxdeai/sdk",
-  "version": "1.3.1",
+  "version": "2.0.0",
+  "license": "Apache-2.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/oxdeai/oxdeai.git",
+    "directory": "packages/sdk"
+  },
+  "homepage": "https://github.com/oxdeai/oxdeai",
+  "bugs": {
+    "url": "https://github.com/oxdeai/oxdeai/issues"
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.test.*",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
   "dependencies": {
-    "@oxdeai/core": "^1.3.0"
+    "@oxdeai/core": "2.0.0"
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "build": "rm -rf dist && tsc -p tsconfig.json",
-    "test": "pnpm build && node --test \"dist/**/*.test.js\""
+    "build:test": "rm -rf dist && tsc -p tsconfig.test.json",
+    "test": "pnpm build:test && node --test \"dist/**/*.test.js\""
   }
-}
+}

package/dist/guard.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/guard.test.js

@@ -1,139 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { PolicyEngine } from "@oxdeai/core";
-import { InMemoryAuditAdapter, InMemoryStateAdapter } from "./adapters.js";
-import { buildIntent, buildState } from "./builders.js";
-import { createGuard } from "./guard.js";
-function makeEngine() {
-    return new PolicyEngine({
-        policy_version: "v1",
-        engine_secret: "dev-secret",
-        authorization_ttl_seconds: 60,
-        authorization_issuer: "issuer-A",
-        authorization_audience: "rp-A",
-        policyId: "a".repeat(64),
-    });
-}
-function makeAllowState() {
-    return buildState({
-        policy_version: "v1",
-        agent_id: "agent-1",
-        allow_action_types: ["PROVISION"],
-        allow_targets: ["us-east-1"],
-        budget_limit: 1000n,
-        spent_in_period: 0n,
-        max_amount_per_action: 500n,
-    });
-}
-test("guard executes callback on ALLOW", async () => {
-    const engine = makeEngine();
-    const stateAdapter = new InMemoryStateAdapter(makeAllowState());
-    const auditAdapter = new InMemoryAuditAdapter();
-    const guard = createGuard({
-        engine,
-        stateAdapter,
-        auditAdapter,
-        clock: { now: () => 1_770_000_000 },
-    });
-    let called = 0;
-    const result = await guard(buildIntent({
-        intent_id: "intent-allow-1",
-        agent_id: "agent-1",
-        action_type: "PROVISION",
-        amount: 500n,
-        target: "us-east-1",
-        nonce: 1n,
-    }), async () => {
-        called++;
-        return "ok";
-    });
-    assert.equal(called, 1);
-    assert.equal(result.executed, true);
-    assert.equal(result.output.decision, "ALLOW");
-    if (result.executed)
-        assert.equal(result.executionResult, "ok");
-    assert.ok(auditAdapter.snapshot().length > 0);
-});
-test("guard does not execute callback on DENY", async () => {
-    const engine = makeEngine();
-    const stateAdapter = new InMemoryStateAdapter(makeAllowState());
-    const guard = createGuard({
-        engine,
-        stateAdapter,
-        clock: { now: () => 1_770_000_000 },
-    });
-    let called = 0;
-    const result = await guard(buildIntent({
-        intent_id: "intent-deny-1",
-        agent_id: "agent-1",
-        action_type: "PROVISION",
-        amount: 900n,
-        target: "us-east-1",
-        nonce: 2n,
-    }), async () => {
-        called++;
-        return "should-not-run";
-    });
-    assert.equal(called, 0);
-    assert.equal(result.executed, false);
-    assert.equal(result.output.decision, "DENY");
-});
-test("guard enforces authorization verification at callback boundary", async () => {
-    const engine = makeEngine();
-    const original = engine.verifyAuthorization.bind(engine);
-    engine.verifyAuthorization = () => ({ valid: false, reason: "forced-test-failure" });
-    const stateAdapter = new InMemoryStateAdapter(makeAllowState());
-    const guard = createGuard({
-        engine,
-        stateAdapter,
-        clock: { now: () => 1_770_000_000 },
-    });
-    let called = 0;
-    const result = await guard(buildIntent({
-        intent_id: "intent-allow-auth-check",
-        agent_id: "agent-1",
-        action_type: "PROVISION",
-        amount: 500n,
-        target: "us-east-1",
-        nonce: 3n,
-    }), async () => {
-        called++;
-        return "should-not-run";
-    });
-    assert.equal(called, 0);
-    assert.equal(result.executed, false);
-    assert.equal(result.output.decision, "DENY");
-    assert.ok(result.output.reasons.some((r) => r.startsWith("AUTH_INVALID:")));
-    engine.verifyAuthorization = original;
-});
-test("guard output is deterministic for equivalent inputs", async () => {
-    const intent = buildIntent({
-        intent_id: "intent-deterministic-1",
-        agent_id: "agent-1",
-        action_type: "PROVISION",
-        amount: 500n,
-        target: "us-east-1",
-        nonce: 10n,
-        timestamp: 1_770_000_000,
-    });
-    const g1 = createGuard({
-        engine: makeEngine(),
-        stateAdapter: new InMemoryStateAdapter(makeAllowState()),
-        clock: { now: () => 1_770_000_000 },
-    });
-    const g2 = createGuard({
-        engine: makeEngine(),
-        stateAdapter: new InMemoryStateAdapter(makeAllowState()),
-        clock: { now: () => 1_770_000_000 },
-    });
-    const r1 = await g1(intent, async () => "ok");
-    const r2 = await g2(intent, async () => "ok");
-    assert.equal(r1.output.decision, "ALLOW");
-    assert.equal(r2.output.decision, "ALLOW");
-    if (r1.output.decision === "ALLOW" && r2.output.decision === "ALLOW") {
-        assert.equal(r1.output.authorization.auth_id, r2.output.authorization.auth_id);
-        assert.equal(r1.output.authorization.state_hash, r2.output.authorization.state_hash);
-        assert.equal(r1.output.authorization.intent_hash, r2.output.authorization.intent_hash);
-    }
-});
-//# sourceMappingURL=guard.test.js.map

package/dist/guard.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guard.test.js","sourceRoot":"","sources":["../src/guard.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,SAAS,UAAU;IACjB,OAAO,IAAI,YAAY,CAAC;QACtB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,YAAY;QAC3B,yBAAyB,EAAE,EAAE;QAC7B,oBAAoB,EAAE,UAAU;QAChC,sBAAsB,EAAE,MAAM;QAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,UAAU,CAAC;QAChB,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;QAC5B,YAAY,EAAE,KAAM;QACpB,eAAe,EAAE,EAAE;QACnB,qBAAqB,EAAE,IAAI;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,IAAI,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;IAClD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,MAAM;QACN,YAAY;QACZ,YAAY;QACZ,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,WAAW,CAAC;QACV,SAAS,EAAE,gBAAgB;QAC3B,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;KACV,CAAC,EACF,KAAK,IAAI,EAAE;QACT,MAAM,EAAE,CAAC;QACT,OAAO,IAAI,CAAC;IACd,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;IACzD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,MAAM;QACN,YAAY;QACZ,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,WAAW,CAAC;QACV,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;KACV,CAAC,EACF,KAAK,IAAI,EAAE;QACT,MAAM,EAAE,CAAC;QACT,OAAO,gBAAgB,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;IAChF,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,MAAc,CAAC,mBAAmB,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAE9F,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,MAAM;QACN,YAAY;QACZ,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,WAAW,CAAC;QACV,SAAS,EAAE,yBAAyB;QACpC,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;KACV,CAAC,EACF,KAAK,IAAI,EAAE;QACT,MAAM,EAAE,CAAC;QACT,OAAO,gBAAgB,CAAC;IAC1B,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAE3E,MAAc,CAAC,mBAAmB,GAAG,QAAQ,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC;QACzB,SAAS,EAAE,wBAAwB;QACnC,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,GAAG;QACV,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,WAAW,CAAC;QACrB,MAAM,EAAE,UAAU,EAAE;QACpB,YAAY,EAAE,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC;QACxD,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,WAAW,CAAC;QACrB,MAAM,EAAE,UAAU,EAAE;QACpB,YAAY,EAAE,IAAI,oBAAoB,CAAC,cAAc,EAAE,CAAC;QACxD,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IAE9C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACrF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;IACzF,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/sdk.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/sdk.test.js

@@ -1,71 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import { PolicyEngine } from "@oxdeai/core";
-import { InMemoryAuditAdapter, InMemoryStateAdapter } from "./adapters.js";
-import { buildIntent, buildState } from "./builders.js";
-import { OxDeAIClient } from "./client.js";
-test("builder helpers create engine-compatible intent/state", () => {
-    const state = buildState({
-        policy_version: "v1",
-        agent_id: "agent-1",
-        allow_action_types: ["PROVISION"],
-        allow_targets: ["us-east-1"]
-    });
-    const intent = buildIntent({
-        intent_id: "intent-1",
-        agent_id: "agent-1",
-        action_type: "PROVISION",
-        amount: 100n,
-        target: "us-east-1",
-        nonce: 1n,
-        timestamp: 1_770_000_000
-    });
-    const engine = new PolicyEngine({
-        policy_version: "v1",
-        engine_secret: "dev-secret",
-        authorization_ttl_seconds: 60
-    });
-    const out = engine.evaluatePure(intent, state, { mode: "fail-fast" });
-    assert.equal(out.decision, "ALLOW");
-});
-test("OxDeAIClient evaluate+persist+verify flow", async () => {
-    const engine = new PolicyEngine({
-        policy_version: "v1",
-        engine_secret: "dev-secret",
-        authorization_ttl_seconds: 60
-    });
-    const stateAdapter = new InMemoryStateAdapter(buildState({
-        policy_version: "v1",
-        agent_id: "agent-1",
-        allow_action_types: ["PROVISION"],
-        allow_targets: ["us-east-1"]
-    }));
-    const auditAdapter = new InMemoryAuditAdapter();
-    const client = new OxDeAIClient({
-        engine,
-        stateAdapter,
-        auditAdapter,
-        clock: { now: () => 1_770_000_000 }
-    });
-    const intent = buildIntent({
-        intent_id: "intent-2",
-        agent_id: "agent-1",
-        action_type: "PROVISION",
-        amount: 320n,
-        target: "us-east-1",
-        nonce: 2n
-    });
-    const res = await client.evaluateAndCommit(intent);
-    assert.equal(res.output.decision, "ALLOW");
-    if (res.output.decision !== "ALLOW")
-        return;
-    assert.ok(res.auditEvents.length >= 3);
-    assert.equal(auditAdapter.snapshot().length, res.auditEvents.length);
-    const auth = await client.verifyAuthorization({ ...intent, timestamp: 1_770_000_000 }, res.output.authorization);
-    assert.equal(auth.valid, true);
-    const verify = await client.verifyCurrentArtifacts({ mode: "best-effort" });
-    assert.equal(verify.snapshot.status, "ok");
-    assert.equal(verify.audit.status, "ok");
-    assert.equal(verify.envelope.status, "ok");
-});
-//# sourceMappingURL=sdk.test.js.map

package/dist/sdk.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sdk.test.js","sourceRoot":"","sources":["../src/sdk.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,IAAI,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACjE,MAAM,KAAK,GAAG,UAAU,CAAC;QACvB,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC;QACzB,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,aAAa;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,YAAY;QAC3B,yBAAyB,EAAE,EAAE;KAC9B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;IAC3D,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,YAAY;QAC3B,yBAAyB,EAAE,EAAE;KAC9B,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,oBAAoB,CAC3C,UAAU,CAAC;QACT,cAAc,EAAE,IAAI;QACpB,QAAQ,EAAE,SAAS;QACnB,kBAAkB,EAAE,CAAC,WAAW,CAAC;QACjC,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B,CAAC,CACH,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC;QAC9B,MAAM;QACN,YAAY;QACZ,YAAY;QACZ,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE;KACpC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,WAAW,CAAC;QACzB,SAAS,EAAE,UAAU;QACrB,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,WAAW;QACxB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,EAAE;KACV,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEnD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IAC5C,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAC3C,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,EACvC,GAAG,CAAC,MAAM,CAAC,aAAa,CACzB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAE/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC"}

package/src/adapters.ts

@@ -1,109 +0,0 @@
-import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname } from "node:path";
-import { randomUUID } from "node:crypto";
-
-import type { State } from "@oxdeai/core";
-
-import type { AuditAdapter, StateAdapter } from "./types.js";
-
-function canonicalize(value: unknown): unknown {
-  if (value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string") return value;
-  if (typeof value === "bigint") return `${value.toString()}n`;
-  if (Array.isArray(value)) return value.map((v) => canonicalize(v));
-  if (typeof value === "object") {
-    const obj = value as Record<string, unknown>;
-    const out: Record<string, unknown> = {};
-    for (const key of Object.keys(obj).sort()) out[key] = canonicalize(obj[key]);
-    return out;
-  }
-  return String(value);
-}
-
-function stringifyCanonical(value: unknown): string {
-  return JSON.stringify(canonicalize(value));
-}
-
-function parseBigIntLike(value: unknown): bigint {
-  if (typeof value === "bigint") return value;
-  if (typeof value === "number") return BigInt(value);
-  if (typeof value === "string") {
-    const s = value.endsWith("n") ? value.slice(0, -1) : value;
-    return BigInt(s);
-  }
-  throw new Error("invalid bigint-like value");
-}
-
-function mapRecordBigInt(input: unknown): Record<string, bigint> {
-  const rec = (input ?? {}) as Record<string, unknown>;
-  const out: Record<string, bigint> = {};
-  for (const key of Object.keys(rec)) out[key] = parseBigIntLike(rec[key]);
-  return out;
-}
-
-function normalizeStateBigInts(raw: unknown): State {
-  const s = raw as State;
-  return {
-    ...s,
-    budget: {
-      ...s.budget,
-      budget_limit: mapRecordBigInt((s as any).budget?.budget_limit),
-      spent_in_period: mapRecordBigInt((s as any).budget?.spent_in_period)
-    },
-    max_amount_per_action: mapRecordBigInt((s as any).max_amount_per_action)
-  };
-}
-
-export class InMemoryStateAdapter implements StateAdapter {
-  private state: State;
-
-  constructor(initial: State) {
-    this.state = structuredClone(initial);
-  }
-
-  load(): State {
-    return structuredClone(this.state);
-  }
-
-  save(state: State): void {
-    this.state = structuredClone(state);
-  }
-}
-
-export class InMemoryAuditAdapter implements AuditAdapter {
-  private readonly events: unknown[] = [];
-
-  append(events: readonly unknown[]): void {
-    for (const event of events) this.events.push(structuredClone(event));
-  }
-
-  snapshot(): unknown[] {
-    return structuredClone(this.events);
-  }
-}
-
-export class JsonFileStateAdapter implements StateAdapter {
-  constructor(private readonly path: string) {}
-
-  async load(): Promise<State> {
-    const txt = await readFile(this.path, "utf8");
-    return normalizeStateBigInts(JSON.parse(txt));
-  }
-
-  async save(state: State): Promise<void> {
-    await mkdir(dirname(this.path), { recursive: true });
-    const tmp = `${this.path}.tmp-${randomUUID()}`;
-    await writeFile(tmp, `${stringifyCanonical(state)}\n`, "utf8");
-    await rename(tmp, this.path);
-  }
-}
-
-export class NdjsonFileAuditAdapter implements AuditAdapter {
-  constructor(private readonly path: string) {}
-
-  async append(events: readonly unknown[]): Promise<void> {
-    if (events.length === 0) return;
-    await mkdir(dirname(this.path), { recursive: true });
-    const body = events.map((e) => stringifyCanonical(e)).join("\n") + "\n";
-    await appendFile(this.path, body, "utf8");
-  }
-}

package/src/builders.ts

@@ -1,80 +0,0 @@
-import type { Intent, State } from "@oxdeai/core";
-import type { IntentBuilderInput, StateBuilderInput } from "./types.js";
-
-export function buildIntent(input: IntentBuilderInput): Intent {
-  const base = {
-    intent_id: input.intent_id,
-    agent_id: input.agent_id,
-    action_type: input.action_type,
-    amount: input.amount,
-    asset: input.asset,
-    target: input.target,
-    timestamp: input.timestamp ?? 0,
-    metadata_hash: input.metadata_hash ?? "0x" + "0".repeat(64),
-    nonce: input.nonce,
-    signature: input.signature ?? "sdk-signature-placeholder",
-    depth: input.depth,
-    tool: input.tool,
-    tool_call: input.tool_call
-  };
-
-  if (input.type === "RELEASE") {
-    if (!input.authorization_id) throw new Error("authorization_id is required for RELEASE intent");
-    return {
-      ...base,
-      type: "RELEASE",
-      authorization_id: input.authorization_id
-    };
-  }
-
-  return {
-    ...base,
-    type: "EXECUTE",
-    authorization_id: input.authorization_id
-  };
-}
-
-export function buildState(input: StateBuilderInput): State {
-  const agent = input.agent_id;
-  return {
-    policy_version: input.policy_version ?? "v1",
-    period_id: input.period_id ?? "default-period",
-    kill_switch: { global: false, agents: {} },
-    allowlists: {
-      action_types: input.allow_action_types ?? ["PROVISION"],
-      assets: input.allow_assets ?? [],
-      targets: input.allow_targets ?? []
-    },
-    budget: {
-      budget_limit: { [agent]: input.budget_limit ?? 1_000_000n },
-      spent_in_period: { [agent]: input.spent_in_period ?? 0n }
-    },
-    max_amount_per_action: { [agent]: input.max_amount_per_action ?? 1_000_000n },
-    velocity: {
-      config: {
-        window_seconds: input.velocity_window_seconds ?? 60,
-        max_actions: input.velocity_max_actions ?? 1000
-      },
-      counters: {}
-    },
-    replay: {
-      window_seconds: input.replay_window_seconds ?? 3600,
-      max_nonces_per_agent: input.replay_max_nonces_per_agent ?? 256,
-      nonces: {}
-    },
-    concurrency: {
-      max_concurrent: { [agent]: input.max_concurrent ?? 16 },
-      active: {},
-      active_auths: {}
-    },
-    recursion: {
-      max_depth: { [agent]: input.max_depth ?? 8 }
-    },
-    tool_limits: {
-      window_seconds: input.tool_window_seconds ?? 60,
-      max_calls: { [agent]: input.tool_max_calls ?? 1000 },
-      max_calls_by_tool: {},
-      calls: {}
-    }
-  };
-}