@predicatesystems/authority 0.3.1

package/LICENSE

@@ -0,0 +1,24 @@
+# License
+
+This project is dual-licensed under your choice of either:
+
+* **MIT License** ([LICENSE-MIT](./LICENSE-MIT))
+* **Apache License 2.0** ([LICENSE-APACHE](./LICENSE-APACHE))
+
+## Choosing a License
+
+You may use this software under the terms of either license, at your option.
+
+### MIT License
+The MIT License is a permissive license that is short and to the point. It lets people do almost anything they want with your project, like making and distributing closed source versions.
+
+### Apache License 2.0
+The Apache License 2.0 is also a permissive license, similar to MIT, but it also provides an express grant of patent rights from contributors to users.
+
+## Contribution
+
+Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this project by you shall be dual-licensed as above, without any additional terms or conditions.
+
+---
+
+Copyright (c) 2026 Predicate Systems Contributors

package/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Predicate Systems Contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Predicate Systems Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,267 @@
+# Predicate Authority (TypeScript SDK)
+
+**Deterministic Authority for AI Agents: secure sensitive actions with sidecar-backed, pre-execution authorization.**
+
+[![License](https://img.shields.io/badge/License-MIT%2FApache--2.0-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/@predicatesystems/authority.svg)](https://www.npmjs.com/package/@predicatesystems/authority)
+
+`@predicatesystems/authority` is the TypeScript SDK companion to the Python
+`predicate-authorityd` sidecar from [predicate-authority (Python)](https://github.com/PredicateSystems/predicate-authority). It keeps authority
+decisions in the sidecar and gives Node/TS runtimes a thin, typed client for
+fail-closed pre-execution checks.
+
+## Why Predicate Authority?
+
+Most agent security failures come from over-broad delegated credentials and lack
+of per-action runtime checks. Predicate Authority introduces short-lived mandates
+bound to policy, identity, and evidence-backed state/intent checks.
+
+- **Bridge, do not replace**: keep enterprise identity stacks (Entra/Okta/OIDC).
+- **Fail-closed by default**: deny before execution when checks fail.
+- **Deterministic binding**: decisions are tied to runtime evidence.
+- **Provable controls**: reason codes and mandate IDs propagate to audit systems.
+
+## Repository Scope
+
+This TS repository currently focuses on:
+
+- typed sidecar transport for `POST /v1/authorize`,
+- request/response contracts for authorization flows,
+- runtime wrapper primitives (incremental),
+- CI/release scaffolding for npm package delivery.
+
+Out of scope for this package:
+
+- re-implementing policy engine or mandate logic in TypeScript,
+- replacing Python sidecar/control-plane authority logic.
+
+## Known Python Parity Baseline
+
+This package targets compatibility with the current Python authority baseline in
+[predicate-authority (Python)](https://github.com/PredicateSystems/predicate-authority):
+
+- sidecar authorize route: `POST /v1/authorize` (`/authorize` compat alias),
+- mandate/token baseline: ES256-default signing + standard JWT claim envelope,
+- revocation baseline: explicit cascade semantics and global kill-switch runtime behavior,
+- control-plane baseline: long-poll policy/revocation sync (runtime baseline),
+- control-plane write hardening: replay freshness headers/signature support on Python client paths.
+
+The TS SDK should preserve compatibility with these runtime behaviors before
+adding TS-specific extensions.
+
+## Installation
+
+```bash
+npm install @predicatesystems/authority
+```
+
+## Quick Start
+
+```ts
+import { AuthorityClient, type AuthorizationRequest } from "@predicatesystems/authority";
+
+const client = new AuthorityClient({
+  baseUrl: "http://127.0.0.1:8787",
+});
+
+const request: AuthorizationRequest = {
+  principal: "agent:payments",
+  action: "http.post",
+  resource: "https://finance.example.com/transfers",
+  intent_hash: "intent-hash-placeholder",
+  labels: ["verified:user_presence"],
+};
+
+const decision = await client.authorize(request);
+if (!decision.allowed) {
+  throw new Error(`Authority denied: ${decision.reason}`);
+}
+```
+
+### Sidecar client retry/timeout tuning
+
+```ts
+import { AuthorityClient } from "@predicatesystems/authority";
+
+const client = new AuthorityClient({
+  baseUrl: "http://127.0.0.1:8787",
+  timeoutMs: 2000,        // per-attempt timeout
+  maxRetries: 2,          // retry budget on network/5xx failures
+  backoffInitialMs: 200,  // linear backoff base (attempt * base)
+});
+```
+
+### Choose your runtime mode
+
+- **Sidecar client mode (recommended):** use `AuthorityClient` to call
+  `predicate-authorityd` (`/v1/authorize`) as the authority source of truth.
+- **Local guard mode (optional):** use `PolicyEngine + ActionGuard` for local
+  evaluation in TS runtime flows (useful for tests/dev or controlled deployments).
+
+### Local guard mode example (`PolicyEngine + ActionGuard`)
+
+```ts
+import {
+  ActionGuard,
+  PolicyEngine,
+  type ActionRequest,
+  type PolicyRule,
+} from "@predicatesystems/authority";
+
+const rules: PolicyRule[] = [
+  {
+    name: "allow-transfer-submit",
+    effect: "allow",
+    principals: ["agent:payments"],
+    actions: ["http.post"],
+    resources: ["https://finance.example.com/transfers"],
+    required_labels: ["verified:user_presence"],
+  },
+];
+
+const guard = new ActionGuard({
+  policyEngine: new PolicyEngine(rules),
+});
+
+const request: ActionRequest = {
+  principal: { principal_id: "agent:payments" },
+  action_spec: {
+    action: "http.post",
+    resource: "https://finance.example.com/transfers",
+    intent: "submit transfer #123",
+  },
+  state_evidence: { source: "browser", state_hash: "state_abc" },
+  verification_evidence: {
+    signals: [{ label: "verified:user_presence", status: "passed" }],
+  },
+};
+
+const decision = guard.authorize(request);
+if (!decision.allowed) {
+  throw new Error(`Local guard denied: ${decision.reason}`);
+}
+```
+
+### Runtime adapter examples (TS frameworks)
+
+See `docs/runtime-adapters.md` for copy-paste adapter patterns that map common
+agent/tool runtime operations to authority checks in both:
+
+- sidecar-first mode (`AuthorityClient`), and
+- local wrapper mode (`ActionGuard` + `guardedShell`/`guardedFile*`/`guardedHttp`).
+
+### Web-first state evidence helper
+
+Use `buildWebStateEvidence(...)` to map browser snapshot artifacts into canonical
+`state_evidence`:
+
+```ts
+import { buildWebStateEvidence } from "@predicatesystems/authority";
+
+const stateEvidence = buildWebStateEvidence({
+  snapshot: {
+    url: "https://app.example.com/transfer",
+    title: "Transfer Funds",
+    dom_hash: "dom_hash_here",
+    visible_text_hash: "text_hash_here",
+    observed_at: new Date().toISOString(),
+  },
+});
+```
+
+If your runtime already produces `sdk-ts` snapshots, use
+`buildWebStateEvidenceFromRuntimeSnapshot(...)` to map `timestamp`,
+`dominant_group_key`, and diagnostics confidence directly.
+
+Non-web evidence contracts are also available for Phase 4 adapter work:
+`TerminalEvidenceProvider`, `DesktopAccessibilityEvidenceProvider`, and
+`VerificationSignalProvider` (see `docs/runtime-adapters.md`).
+
+## Local Development
+
+```bash
+npm install
+npm run typecheck
+npm test
+npm run build
+```
+
+### Optional: sidecar integration tests
+
+Run integration tests against a live `predicate-authorityd`:
+
+```bash
+export SIDECAR_BASE_URL="http://127.0.0.1:8787"
+npm run test:integration
+```
+
+GitHub Actions `test.yml` also supports optional integration execution via
+manual `workflow_dispatch` inputs (`run_integration`, `sidecar_base_url`).
+
+For explicit allow/deny integration assertions, you can pass request fixtures:
+
+```bash
+export RUN_SIDECAR_INTEGRATION_TESTS=true
+export SIDECAR_BASE_URL="http://127.0.0.1:8787"
+export SIDECAR_ALLOW_REQUEST_JSON='{"principal":"agent:allow","action":"http.get","resource":"https://example.com","intent_hash":"ih_allow"}'
+export SIDECAR_DENY_REQUEST_JSON='{"principal":"agent:deny","action":"http.post","resource":"https://example.com/admin","intent_hash":"ih_deny"}'
+export SIDECAR_EXPECTED_DENY_REASON="missing_required_verification"
+export SIDECAR_REQUIRE_MANDATE_ON_ALLOW=false
+npm run test:integration
+```
+
+## Release
+
+GitHub Actions workflows are included for:
+
+- test/build checks on push/PR: `.github/workflows/test.yml`
+- npm release on `v*` tags or manual dispatch: `.github/workflows/release.yml`
+  - prerelease path: `rc-v*` tags publish to npm `next` dist-tag
+- manual post-publish smoke evidence: `.github/workflows/post-publish-smoke.yml`
+
+Required GitHub secret:
+
+- `NPM_TOKEN` with publish access for `@predicatesystems`.
+
+Release docs:
+
+- `CHANGELOG.md`
+- `docs/release-checklist.md`
+
+Post-publish smoke:
+
+```bash
+npm run smoke:npm -- latest
+# optional live sidecar authorize check
+SIDECAR_BASE_URL=http://127.0.0.1:8787 npm run smoke:npm -- latest
+```
+
+## Contributing
+
+See `CONTRIBUTING.md` for branch, test, integration, and release conventions.
+
+## Troubleshooting
+
+Common failure modes and first checks:
+
+- `AuthorityClientError: timeout`
+  - sidecar may be unreachable or overloaded; verify sidecar health and increase `timeoutMs` for slow environments.
+- `AuthorityClientError: network_error`
+  - check `baseUrl`, local networking, and whether `predicate-authorityd` is listening on expected host/port.
+- `AuthorityClientError: protocol_error`
+  - sidecar returned non-JSON or unexpected payload shape; verify sidecar version compatibility.
+- `AuthorityClientError: bad_request`
+  - request payload is invalid for `/v1/authorize`; compare fields with the fixture examples in `tests/fixtures/`.
+- Frequent retries before success
+  - tune `maxRetries` and `backoffInitialMs`; investigate sidecar/host resource pressure.
+
+## License
+
+Dual-licensed under **MIT** and **Apache 2.0**:
+
+- `LICENSE-MIT`
+- `LICENSE-APACHE`
+
+---
+
+Copyright (c) 2026 Predicate Systems Contributors

package/dist/src/contracts/action-request.d.ts

@@ -0,0 +1,43 @@
+import type { VerificationStatus } from "./enums.js";
+export interface PrincipalRef {
+    principal_id: string;
+    tenant_id?: string;
+    session_id?: string;
+}
+export interface ActionSpec {
+    action: string;
+    resource: string;
+    intent: string;
+}
+export interface StateEvidence {
+    source: string;
+    state_hash: string;
+    schema_version?: string;
+    confidence?: number;
+}
+export interface VerificationSignal {
+    label: string;
+    status: VerificationStatus;
+    required?: boolean;
+    reason?: string;
+}
+export interface VerificationEvidence {
+    signals?: VerificationSignal[];
+}
+export interface ActionRequest {
+    principal: PrincipalRef;
+    action_spec: ActionSpec;
+    state_evidence: StateEvidence;
+    verification_evidence?: VerificationEvidence;
+}
+export interface SidecarAuthorizeRequest {
+    principal: string;
+    action: string;
+    resource: string;
+    intent_hash?: string;
+    context?: Record<string, unknown>;
+    labels?: string[];
+}
+export type AuthorizeRequest = ActionRequest | SidecarAuthorizeRequest;
+export declare function toSidecarAuthorizeRequest(request: AuthorizeRequest): SidecarAuthorizeRequest;
+//# sourceMappingURL=action-request.d.ts.map

package/dist/src/contracts/action-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-request.d.ts","sourceRoot":"","sources":["../../../src/contracts/action-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAGD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,YAAY,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,aAAa,CAAC;IAC9B,qBAAqB,CAAC,EAAE,oBAAoB,CAAC;CAC9C;AAGD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,uBAAuB,CAqB5F"}

package/dist/src/contracts/action-request.js

@@ -0,0 +1,32 @@
+import { passedLabels } from "./verification.js";
+export function toSidecarAuthorizeRequest(request) {
+    if (isSidecarAuthorizeRequest(request)) {
+        return request;
+    }
+    const labels = passedLabels(request.verification_evidence);
+    const intentHash = stableIntentHashFromIntent(request.action_spec.intent);
+    return {
+        principal: request.principal.principal_id,
+        action: request.action_spec.action,
+        resource: request.action_spec.resource,
+        intent_hash: intentHash,
+        context: {
+            state_source: request.state_evidence.source,
+            state_hash: request.state_evidence.state_hash,
+            schema_version: request.state_evidence.schema_version ?? "v1",
+            confidence: request.state_evidence.confidence,
+            tenant_id: request.principal.tenant_id,
+            session_id: request.principal.session_id,
+        },
+        labels,
+    };
+}
+function isSidecarAuthorizeRequest(value) {
+    return typeof value.principal === "string";
+}
+function stableIntentHashFromIntent(intent) {
+    // Phase 0 compatibility placeholder: deterministic, local hash surrogate.
+    // Final parity helper will be replaced with python-compatible canonical hash.
+    return `ih_${intent.trim().toLowerCase().replace(/\s+/g, "_")}`;
+}
+//# sourceMappingURL=action-request.js.map

package/dist/src/contracts/action-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-request.js","sourceRoot":"","sources":["../../../src/contracts/action-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAoDjD,MAAM,UAAU,yBAAyB,CAAC,OAAyB;IACjE,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1E,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY;QACzC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;QAClC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;QACtC,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE;YACP,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,MAAM;YAC3C,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,UAAU;YAC7C,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,cAAc,IAAI,IAAI;YAC7D,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,UAAU;YAC7C,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS;YACtC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU;SACzC;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAuB;IACxD,OAAO,OAAQ,KAAiC,CAAC,SAAS,KAAK,QAAQ,CAAC;AAC1E,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc;IAChD,0EAA0E;IAC1E,8EAA8E;IAC9E,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC"}

package/dist/src/contracts/authorization-decision.d.ts

@@ -0,0 +1,11 @@
+import type { AuthorizationReason } from "./enums.js";
+import { type SignedMandate } from "./mandate.js";
+export interface AuthorizationDecision {
+    allowed: boolean;
+    reason: AuthorizationReason | string;
+    mandate?: SignedMandate | null;
+    violated_rule?: string | null;
+    missing_labels?: string[];
+}
+export declare function isAuthorizationDecision(value: unknown): value is AuthorizationDecision;
+//# sourceMappingURL=authorization-decision.d.ts.map

package/dist/src/contracts/authorization-decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-decision.d.ts","sourceRoot":"","sources":["../../../src/contracts/authorization-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,cAAc,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrC,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAgBtF"}

package/dist/src/contracts/authorization-decision.js

@@ -0,0 +1,17 @@
+import { isSignedMandate } from "./mandate.js";
+export function isAuthorizationDecision(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const obj = value;
+    return (typeof obj.allowed === "boolean" &&
+        typeof obj.reason === "string" &&
+        (obj.mandate === undefined || obj.mandate === null || isSignedMandate(obj.mandate)) &&
+        (obj.violated_rule === undefined ||
+            obj.violated_rule === null ||
+            typeof obj.violated_rule === "string") &&
+        (obj.missing_labels === undefined ||
+            (Array.isArray(obj.missing_labels) &&
+                obj.missing_labels.every((label) => typeof label === "string"))));
+}
+//# sourceMappingURL=authorization-decision.js.map

package/dist/src/contracts/authorization-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-decision.js","sourceRoot":"","sources":["../../../src/contracts/authorization-decision.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,eAAe,EAAE,MAAM,cAAc,CAAC;AAUnE,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAChC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnF,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;YAC9B,GAAG,CAAC,aAAa,KAAK,IAAI;YAC1B,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC;QACxC,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBAChC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC"}

package/dist/src/contracts/decision.d.ts

@@ -0,0 +1,10 @@
+import type { AuthorizationReason } from "./enums.js";
+export interface AuthorizationResponse {
+    allowed: boolean;
+    reason: AuthorizationReason | string;
+    mandate_id: string | null;
+    violated_rule: string | null;
+    missing_labels: string[];
+}
+export declare function isAuthorizationResponse(value: unknown): value is AuthorizationResponse;
+//# sourceMappingURL=decision.d.ts.map

package/dist/src/contracts/decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../../src/contracts/decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAatF"}

package/dist/src/contracts/decision.js

@@ -0,0 +1,13 @@
+export function isAuthorizationResponse(value) {
+    if (typeof value !== "object" || value === null) {
+        return false;
+    }
+    const obj = value;
+    return (typeof obj.allowed === "boolean" &&
+        typeof obj.reason === "string" &&
+        (obj.mandate_id === null || typeof obj.mandate_id === "string") &&
+        (obj.violated_rule === null || typeof obj.violated_rule === "string") &&
+        Array.isArray(obj.missing_labels) &&
+        obj.missing_labels.every((label) => typeof label === "string"));
+}
+//# sourceMappingURL=decision.js.map