@oxdeai/sdk 1.3.1 → 2.0.0

package/src/client.ts

@@ -1,106 +0,0 @@
-import {
-  PolicyEngine,
-  encodeCanonicalState,
-  encodeEnvelope,
-  verifyAuditEvents,
-  verifyEnvelope,
-  verifySnapshot
-} from "@oxdeai/core";
-import type { Authorization, Intent } from "@oxdeai/core";
-
-import type {
-  AuditAdapter,
-  ClockAdapter,
-  EvaluateAndCommitResult,
-  EvaluateDecision,
-  StateAdapter,
-  VerifyBundleResult
-} from "./types.js";
-
-type ClientOptions = {
-  engine: PolicyEngine;
-  stateAdapter: StateAdapter;
-  auditAdapter?: AuditAdapter;
-  clock?: ClockAdapter;
-};
-
-type EvaluateInput = Omit<Intent, "timestamp"> & { timestamp?: number };
-
-function collectNewEvents(engine: PolicyEngine, cursor: number): { nextCursor: number; events: unknown[] } {
-  const all = engine.audit.snapshot() as unknown[];
-  const events = all.slice(cursor);
-  return { nextCursor: all.length, events };
-}
-
-export class OxDeAIClient {
-  private readonly engine: PolicyEngine;
-  private readonly stateAdapter: StateAdapter;
-  private readonly auditAdapter?: AuditAdapter;
-  private readonly clock: ClockAdapter;
-  private auditCursor = 0;
-
-  constructor(opts: ClientOptions) {
-    this.engine = opts.engine;
-    this.stateAdapter = opts.stateAdapter;
-    this.auditAdapter = opts.auditAdapter;
-    this.clock = opts.clock ?? { now: () => Math.floor(Date.now() / 1000) };
-  }
-
-  async evaluateAndCommit(input: EvaluateInput): Promise<EvaluateAndCommitResult> {
-    const state = await this.stateAdapter.load();
-    const resolvedTimestamp = input.timestamp === undefined || input.timestamp === 0
-      ? this.clock.now()
-      : input.timestamp;
-    const intent: Intent = {
-      ...input,
-      timestamp: resolvedTimestamp
-    } as Intent;
-
-    const out = this.engine.evaluatePure(intent, state, { mode: "fail-fast" });
-    const emitted = collectNewEvents(this.engine, this.auditCursor);
-    this.auditCursor = emitted.nextCursor;
-
-    if (this.auditAdapter) await this.auditAdapter.append(emitted.events);
-
-    if (out.decision === "ALLOW") {
-      await this.stateAdapter.save(out.nextState);
-      const output: EvaluateDecision = {
-        decision: "ALLOW",
-        reasons: [],
-        authorization: out.authorization
-      };
-      return { output, state: out.nextState, auditEvents: emitted.events };
-    }
-
-    const output: EvaluateDecision = {
-      decision: "DENY",
-      reasons: out.reasons
-    };
-    return { output, state, auditEvents: emitted.events };
-  }
-
-  async verifyAuthorization(intent: Intent, authorization: Authorization): Promise<{ valid: boolean; reason?: string }> {
-    const state = await this.stateAdapter.load();
-    const result = this.engine.verifyAuthorization(intent, authorization, state, intent.timestamp);
-    return result.valid ? { valid: true } : { valid: false, reason: result.reason };
-  }
-
-  async verifyCurrentArtifacts(opts?: { mode?: "strict" | "best-effort" }): Promise<VerifyBundleResult> {
-    const state = await this.stateAdapter.load();
-    const snapshotBytes = encodeCanonicalState(this.engine.exportState(state));
-    const snapshot = verifySnapshot(snapshotBytes);
-
-    const allEvents = this.engine.audit.snapshot();
-    const audit = verifyAuditEvents(allEvents as Parameters<typeof verifyAuditEvents>[0], {
-      mode: opts?.mode ?? "best-effort"
-    });
-
-    const envelopeBytes = encodeEnvelope({
-      formatVersion: 1,
-      snapshot: snapshotBytes,
-      events: allEvents as any
-    });
-    const envelope = verifyEnvelope(envelopeBytes, { mode: opts?.mode ?? "best-effort" });
-    return { snapshot, audit, envelope };
-  }
-}

package/src/guard.test.ts

@@ -1,165 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import { PolicyEngine } from "@oxdeai/core";
-
-import { InMemoryAuditAdapter, InMemoryStateAdapter } from "./adapters.js";
-import { buildIntent, buildState } from "./builders.js";
-import { createGuard } from "./guard.js";
-
-function makeEngine() {
-  return new PolicyEngine({
-    policy_version: "v1",
-    engine_secret: "dev-secret",
-    authorization_ttl_seconds: 60,
-    authorization_issuer: "issuer-A",
-    authorization_audience: "rp-A",
-    policyId: "a".repeat(64),
-  });
-}
-
-function makeAllowState() {
-  return buildState({
-    policy_version: "v1",
-    agent_id: "agent-1",
-    allow_action_types: ["PROVISION"],
-    allow_targets: ["us-east-1"],
-    budget_limit: 1_000n,
-    spent_in_period: 0n,
-    max_amount_per_action: 500n,
-  });
-}
-
-test("guard executes callback on ALLOW", async () => {
-  const engine = makeEngine();
-  const stateAdapter = new InMemoryStateAdapter(makeAllowState());
-  const auditAdapter = new InMemoryAuditAdapter();
-  const guard = createGuard({
-    engine,
-    stateAdapter,
-    auditAdapter,
-    clock: { now: () => 1_770_000_000 },
-  });
-
-  let called = 0;
-  const result = await guard(
-    buildIntent({
-      intent_id: "intent-allow-1",
-      agent_id: "agent-1",
-      action_type: "PROVISION",
-      amount: 500n,
-      target: "us-east-1",
-      nonce: 1n,
-    }),
-    async () => {
-      called++;
-      return "ok";
-    }
-  );
-
-  assert.equal(called, 1);
-  assert.equal(result.executed, true);
-  assert.equal(result.output.decision, "ALLOW");
-  if (result.executed) assert.equal(result.executionResult, "ok");
-  assert.ok(auditAdapter.snapshot().length > 0);
-});
-
-test("guard does not execute callback on DENY", async () => {
-  const engine = makeEngine();
-  const stateAdapter = new InMemoryStateAdapter(makeAllowState());
-  const guard = createGuard({
-    engine,
-    stateAdapter,
-    clock: { now: () => 1_770_000_000 },
-  });
-
-  let called = 0;
-  const result = await guard(
-    buildIntent({
-      intent_id: "intent-deny-1",
-      agent_id: "agent-1",
-      action_type: "PROVISION",
-      amount: 900n,
-      target: "us-east-1",
-      nonce: 2n,
-    }),
-    async () => {
-      called++;
-      return "should-not-run";
-    }
-  );
-
-  assert.equal(called, 0);
-  assert.equal(result.executed, false);
-  assert.equal(result.output.decision, "DENY");
-});
-
-test("guard enforces authorization verification at callback boundary", async () => {
-  const engine = makeEngine();
-  const original = engine.verifyAuthorization.bind(engine);
-  (engine as any).verifyAuthorization = () => ({ valid: false, reason: "forced-test-failure" });
-
-  const stateAdapter = new InMemoryStateAdapter(makeAllowState());
-  const guard = createGuard({
-    engine,
-    stateAdapter,
-    clock: { now: () => 1_770_000_000 },
-  });
-
-  let called = 0;
-  const result = await guard(
-    buildIntent({
-      intent_id: "intent-allow-auth-check",
-      agent_id: "agent-1",
-      action_type: "PROVISION",
-      amount: 500n,
-      target: "us-east-1",
-      nonce: 3n,
-    }),
-    async () => {
-      called++;
-      return "should-not-run";
-    }
-  );
-
-  assert.equal(called, 0);
-  assert.equal(result.executed, false);
-  assert.equal(result.output.decision, "DENY");
-  assert.ok(result.output.reasons.some((r) => r.startsWith("AUTH_INVALID:")));
-
-  (engine as any).verifyAuthorization = original;
-});
-
-test("guard output is deterministic for equivalent inputs", async () => {
-  const intent = buildIntent({
-    intent_id: "intent-deterministic-1",
-    agent_id: "agent-1",
-    action_type: "PROVISION",
-    amount: 500n,
-    target: "us-east-1",
-    nonce: 10n,
-    timestamp: 1_770_000_000,
-  });
-
-  const g1 = createGuard({
-    engine: makeEngine(),
-    stateAdapter: new InMemoryStateAdapter(makeAllowState()),
-    clock: { now: () => 1_770_000_000 },
-  });
-  const g2 = createGuard({
-    engine: makeEngine(),
-    stateAdapter: new InMemoryStateAdapter(makeAllowState()),
-    clock: { now: () => 1_770_000_000 },
-  });
-
-  const r1 = await g1(intent, async () => "ok");
-  const r2 = await g2(intent, async () => "ok");
-
-  assert.equal(r1.output.decision, "ALLOW");
-  assert.equal(r2.output.decision, "ALLOW");
-  if (r1.output.decision === "ALLOW" && r2.output.decision === "ALLOW") {
-    assert.equal(r1.output.authorization.auth_id, r2.output.authorization.auth_id);
-    assert.equal(r1.output.authorization.state_hash, r2.output.authorization.state_hash);
-    assert.equal(r1.output.authorization.intent_hash, r2.output.authorization.intent_hash);
-  }
-});

package/src/guard.ts

@@ -1,138 +0,0 @@
-import type { Intent, PolicyEngine, State, Authorization } from "@oxdeai/core";
-import type { AuditAdapter, ClockAdapter, MaybePromise, StateAdapter, IntentBuilderInput } from "./types.js";
-import { buildIntent } from "./builders.js";
-
-export type GuardDecision =
-  | { decision: "ALLOW"; reasons: []; authorization: Authorization }
-  | { decision: "DENY"; reasons: string[] };
-
-export type GuardAllowResult<T> = {
-  output: GuardDecision & { decision: "ALLOW"; reasons: []; authorization: Authorization };
-  intent: Intent;
-  state: State;
-  auditEvents: unknown[];
-  executed: true;
-  executionResult: T;
-};
-
-export type GuardDenyResult = {
-  output: GuardDecision & { decision: "DENY"; reasons: string[] };
-  intent: Intent;
-  state: State;
-  auditEvents: unknown[];
-  executed: false;
-};
-
-export type GuardResult<T> = GuardAllowResult<T> | GuardDenyResult;
-
-export type GuardInputIntent = Intent | IntentBuilderInput;
-
-export type GuardOptions = {
-  engine: PolicyEngine;
-  stateAdapter: StateAdapter;
-  auditAdapter?: AuditAdapter;
-  clock?: ClockAdapter;
-  mode?: "fail-fast" | "collect-all";
-  verifyAuthorization?: boolean;
-};
-
-type GuardExecuteContext = {
-  intent: Intent;
-  authorization: Authorization;
-  state: State;
-};
-
-function collectNewEvents(engine: PolicyEngine, cursor: number): { nextCursor: number; events: unknown[] } {
-  const all = engine.audit.snapshot() as unknown[];
-  return { nextCursor: all.length, events: all.slice(cursor) };
-}
-
-function isIntent(value: GuardInputIntent): value is Intent {
-  return (
-    typeof (value as Intent).intent_id === "string" &&
-    typeof (value as Intent).agent_id === "string" &&
-    typeof (value as Intent).action_type === "string" &&
-    typeof (value as Intent).signature === "string"
-  );
-}
-
-export type GuardFn = <T>(
-  input: GuardInputIntent,
-  execute: (ctx: GuardExecuteContext) => MaybePromise<T>
-) => Promise<GuardResult<T>>;
-
-export function createGuard(opts: GuardOptions): GuardFn {
-  const clock = opts.clock ?? { now: () => Math.floor(Date.now() / 1000) };
-  let auditCursor = 0;
-
-  return async function guard<T>(
-    input: GuardInputIntent,
-    execute: (ctx: GuardExecuteContext) => MaybePromise<T>
-  ): Promise<GuardResult<T>> {
-    const state = await opts.stateAdapter.load();
-    const intent: Intent = isIntent(input)
-      ? ({
-          ...input,
-          timestamp: input.timestamp === 0 ? clock.now() : input.timestamp,
-        } as Intent)
-      : buildIntent({
-          ...input,
-          timestamp: input.timestamp ?? clock.now(),
-        });
-
-    const out = opts.engine.evaluatePure(intent, state, { mode: opts.mode ?? "fail-fast" });
-    const emitted = collectNewEvents(opts.engine, auditCursor);
-    auditCursor = emitted.nextCursor;
-
-    if (opts.auditAdapter) await opts.auditAdapter.append(emitted.events);
-
-    if (out.decision === "DENY") {
-      return {
-        output: { decision: "DENY", reasons: out.reasons },
-        intent,
-        state,
-        auditEvents: emitted.events,
-        executed: false,
-      };
-    }
-
-    if (!out.authorization || !out.nextState) {
-      return {
-        output: { decision: "DENY", reasons: ["PEP_INVARIANT_VIOLATION"] },
-        intent,
-        state,
-        auditEvents: emitted.events,
-        executed: false,
-      };
-    }
-
-    if (opts.verifyAuthorization !== false) {
-      const authCheck = opts.engine.verifyAuthorization(intent, out.authorization, out.nextState, intent.timestamp);
-      if (!authCheck.valid) {
-        return {
-          output: { decision: "DENY", reasons: [`AUTH_INVALID:${authCheck.reason ?? "unknown"}`] },
-          intent,
-          state,
-          auditEvents: emitted.events,
-          executed: false,
-        };
-      }
-    }
-
-    const executionResult = await execute({
-      intent,
-      authorization: out.authorization,
-      state: out.nextState,
-    });
-    await opts.stateAdapter.save(out.nextState);
-
-    return {
-      output: { decision: "ALLOW", reasons: [], authorization: out.authorization },
-      intent,
-      state: out.nextState,
-      auditEvents: emitted.events,
-      executed: true,
-      executionResult,
-    };
-  };
-}

package/src/index.ts

@@ -1,7 +0,0 @@
-/** OxDeAI SDK — integration layer on top of @oxdeai/core. */
-export * from "@oxdeai/core";
-export * from "./types.js";
-export * from "./builders.js";
-export * from "./adapters.js";
-export * from "./client.js";
-export * from "./guard.js";

package/src/sdk.test.ts

@@ -1,83 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-
-import { PolicyEngine } from "@oxdeai/core";
-
-import { InMemoryAuditAdapter, InMemoryStateAdapter } from "./adapters.js";
-import { buildIntent, buildState } from "./builders.js";
-import { OxDeAIClient } from "./client.js";
-
-test("builder helpers create engine-compatible intent/state", () => {
-  const state = buildState({
-    policy_version: "v1",
-    agent_id: "agent-1",
-    allow_action_types: ["PROVISION"],
-    allow_targets: ["us-east-1"]
-  });
-  const intent = buildIntent({
-    intent_id: "intent-1",
-    agent_id: "agent-1",
-    action_type: "PROVISION",
-    amount: 100n,
-    target: "us-east-1",
-    nonce: 1n,
-    timestamp: 1_770_000_000
-  });
-
-  const engine = new PolicyEngine({
-    policy_version: "v1",
-    engine_secret: "dev-secret",
-    authorization_ttl_seconds: 60
-  });
-  const out = engine.evaluatePure(intent, state, { mode: "fail-fast" });
-  assert.equal(out.decision, "ALLOW");
-});
-
-test("OxDeAIClient evaluate+persist+verify flow", async () => {
-  const engine = new PolicyEngine({
-    policy_version: "v1",
-    engine_secret: "dev-secret",
-    authorization_ttl_seconds: 60
-  });
-  const stateAdapter = new InMemoryStateAdapter(
-    buildState({
-      policy_version: "v1",
-      agent_id: "agent-1",
-      allow_action_types: ["PROVISION"],
-      allow_targets: ["us-east-1"]
-    })
-  );
-  const auditAdapter = new InMemoryAuditAdapter();
-  const client = new OxDeAIClient({
-    engine,
-    stateAdapter,
-    auditAdapter,
-    clock: { now: () => 1_770_000_000 }
-  });
-
-  const intent = buildIntent({
-    intent_id: "intent-2",
-    agent_id: "agent-1",
-    action_type: "PROVISION",
-    amount: 320n,
-    target: "us-east-1",
-    nonce: 2n
-  });
-  const res = await client.evaluateAndCommit(intent);
-
-  assert.equal(res.output.decision, "ALLOW");
-  if (res.output.decision !== "ALLOW") return;
-  assert.ok(res.auditEvents.length >= 3);
-  assert.equal(auditAdapter.snapshot().length, res.auditEvents.length);
-
-  const auth = await client.verifyAuthorization(
-    { ...intent, timestamp: 1_770_000_000 },
-    res.output.authorization
-  );
-  assert.equal(auth.valid, true);
-
-  const verify = await client.verifyCurrentArtifacts({ mode: "best-effort" });
-  assert.equal(verify.snapshot.status, "ok");
-  assert.equal(verify.audit.status, "ok");
-  assert.equal(verify.envelope.status, "ok");
-});

package/src/types.ts

@@ -1,70 +0,0 @@
-import type { Authorization, Intent, State, VerificationResult } from "@oxdeai/core";
-
-export type MaybePromise<T> = T | Promise<T>;
-
-export type EvaluateDecision =
-  | { decision: "ALLOW"; reasons: []; authorization: Authorization }
-  | { decision: "DENY"; reasons: string[] };
-
-export type EvaluateAndCommitResult = {
-  output: EvaluateDecision;
-  state: State;
-  auditEvents: unknown[];
-};
-
-export type VerifyBundleResult = {
-  snapshot: VerificationResult;
-  audit: VerificationResult;
-  envelope: VerificationResult;
-};
-
-export interface StateAdapter {
-  load(): MaybePromise<State>;
-  save(state: State): MaybePromise<void>;
-}
-
-export interface AuditAdapter {
-  append(events: readonly unknown[]): MaybePromise<void>;
-}
-
-export interface ClockAdapter {
-  now(): number;
-}
-
-export type IntentBuilderInput = {
-  intent_id: string;
-  agent_id: string;
-  action_type: Intent["action_type"];
-  amount: bigint;
-  target: string;
-  nonce: bigint;
-  timestamp?: number;
-  type?: "EXECUTE" | "RELEASE";
-  authorization_id?: string;
-  asset?: string;
-  metadata_hash?: string;
-  signature?: string;
-  depth?: number;
-  tool?: string;
-  tool_call?: boolean;
-};
-
-export type StateBuilderInput = {
-  policy_version?: string;
-  period_id?: string;
-  agent_id: string;
-  allow_action_types?: Intent["action_type"][];
-  allow_assets?: string[];
-  allow_targets?: string[];
-  budget_limit?: bigint;
-  spent_in_period?: bigint;
-  max_amount_per_action?: bigint;
-  velocity_window_seconds?: number;
-  velocity_max_actions?: number;
-  replay_window_seconds?: number;
-  replay_max_nonces_per_agent?: number;
-  max_concurrent?: number;
-  max_depth?: number;
-  tool_window_seconds?: number;
-  tool_max_calls?: number;
-};

package/tsconfig.json

@@ -1,9 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "outDir": "dist",
-    "rootDir": "src",
-    "types": ["node"]
-  },
-  "include": ["src"]
-}