@predicatesystems/authority 0.3.1 → 0.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (126) hide show
  1. package/dist/canonicalization/desktop.d.ts +115 -0
  2. package/dist/canonicalization/desktop.d.ts.map +1 -0
  3. package/dist/canonicalization/desktop.js +187 -0
  4. package/dist/canonicalization/desktop.js.map +1 -0
  5. package/dist/canonicalization/index.d.ts +39 -0
  6. package/dist/canonicalization/index.d.ts.map +1 -0
  7. package/dist/canonicalization/index.js +68 -0
  8. package/dist/canonicalization/index.js.map +1 -0
  9. package/dist/canonicalization/terminal.d.ts +69 -0
  10. package/dist/canonicalization/terminal.d.ts.map +1 -0
  11. package/dist/canonicalization/terminal.js +98 -0
  12. package/dist/canonicalization/terminal.js.map +1 -0
  13. package/dist/canonicalization/utils.d.ts +108 -0
  14. package/dist/canonicalization/utils.d.ts.map +1 -0
  15. package/dist/canonicalization/utils.js +250 -0
  16. package/dist/canonicalization/utils.js.map +1 -0
  17. package/dist/contracts/action-request.d.ts.map +1 -0
  18. package/dist/contracts/action-request.js.map +1 -0
  19. package/dist/contracts/authorization-decision.d.ts.map +1 -0
  20. package/dist/contracts/authorization-decision.js.map +1 -0
  21. package/dist/contracts/decision.d.ts.map +1 -0
  22. package/dist/contracts/decision.js.map +1 -0
  23. package/dist/contracts/enums.d.ts.map +1 -0
  24. package/dist/contracts/enums.js.map +1 -0
  25. package/dist/contracts/index.d.ts.map +1 -0
  26. package/dist/contracts/index.js.map +1 -0
  27. package/dist/contracts/mandate.d.ts.map +1 -0
  28. package/dist/contracts/mandate.js.map +1 -0
  29. package/dist/contracts/policy-rule.d.ts.map +1 -0
  30. package/dist/contracts/policy-rule.js.map +1 -0
  31. package/dist/contracts/proof-event.d.ts.map +1 -0
  32. package/dist/contracts/proof-event.js.map +1 -0
  33. package/dist/contracts/verification.d.ts.map +1 -0
  34. package/dist/contracts/verification.js.map +1 -0
  35. package/dist/errors.d.ts.map +1 -0
  36. package/dist/errors.js.map +1 -0
  37. package/dist/{src/evidence → evidence}/non-web.d.ts +14 -0
  38. package/dist/evidence/non-web.d.ts.map +1 -0
  39. package/dist/evidence/non-web.js +95 -0
  40. package/dist/evidence/non-web.js.map +1 -0
  41. package/dist/evidence/web-state.d.ts.map +1 -0
  42. package/dist/evidence/web-state.js.map +1 -0
  43. package/dist/guard/action-guard.d.ts.map +1 -0
  44. package/dist/guard/action-guard.js.map +1 -0
  45. package/dist/{src/index.d.ts → index.d.ts} +1 -0
  46. package/dist/index.d.ts.map +1 -0
  47. package/dist/{src/index.js → index.js} +8 -0
  48. package/dist/index.js.map +1 -0
  49. package/dist/policy/engine.d.ts.map +1 -0
  50. package/dist/policy/engine.js.map +1 -0
  51. package/dist/policy/matching.d.ts.map +1 -0
  52. package/dist/policy/matching.js.map +1 -0
  53. package/dist/types.d.ts.map +1 -0
  54. package/dist/types.js.map +1 -0
  55. package/dist/wrappers/sensitive-operations.d.ts.map +1 -0
  56. package/dist/wrappers/sensitive-operations.js.map +1 -0
  57. package/package.json +1 -1
  58. package/dist/src/contracts/action-request.d.ts.map +0 -1
  59. package/dist/src/contracts/action-request.js.map +0 -1
  60. package/dist/src/contracts/authorization-decision.d.ts.map +0 -1
  61. package/dist/src/contracts/authorization-decision.js.map +0 -1
  62. package/dist/src/contracts/decision.d.ts.map +0 -1
  63. package/dist/src/contracts/decision.js.map +0 -1
  64. package/dist/src/contracts/enums.d.ts.map +0 -1
  65. package/dist/src/contracts/enums.js.map +0 -1
  66. package/dist/src/contracts/index.d.ts.map +0 -1
  67. package/dist/src/contracts/index.js.map +0 -1
  68. package/dist/src/contracts/mandate.d.ts.map +0 -1
  69. package/dist/src/contracts/mandate.js.map +0 -1
  70. package/dist/src/contracts/policy-rule.d.ts.map +0 -1
  71. package/dist/src/contracts/policy-rule.js.map +0 -1
  72. package/dist/src/contracts/proof-event.d.ts.map +0 -1
  73. package/dist/src/contracts/proof-event.js.map +0 -1
  74. package/dist/src/contracts/verification.d.ts.map +0 -1
  75. package/dist/src/contracts/verification.js.map +0 -1
  76. package/dist/src/errors.d.ts.map +0 -1
  77. package/dist/src/errors.js.map +0 -1
  78. package/dist/src/evidence/non-web.d.ts.map +0 -1
  79. package/dist/src/evidence/non-web.js +0 -58
  80. package/dist/src/evidence/non-web.js.map +0 -1
  81. package/dist/src/evidence/web-state.d.ts.map +0 -1
  82. package/dist/src/evidence/web-state.js.map +0 -1
  83. package/dist/src/guard/action-guard.d.ts.map +0 -1
  84. package/dist/src/guard/action-guard.js.map +0 -1
  85. package/dist/src/index.d.ts.map +0 -1
  86. package/dist/src/index.js.map +0 -1
  87. package/dist/src/policy/engine.d.ts.map +0 -1
  88. package/dist/src/policy/engine.js.map +0 -1
  89. package/dist/src/policy/matching.d.ts.map +0 -1
  90. package/dist/src/policy/matching.js.map +0 -1
  91. package/dist/src/types.d.ts.map +0 -1
  92. package/dist/src/types.js.map +0 -1
  93. package/dist/src/wrappers/sensitive-operations.d.ts.map +0 -1
  94. package/dist/src/wrappers/sensitive-operations.js.map +0 -1
  95. /package/dist/{src/contracts → contracts}/action-request.d.ts +0 -0
  96. /package/dist/{src/contracts → contracts}/action-request.js +0 -0
  97. /package/dist/{src/contracts → contracts}/authorization-decision.d.ts +0 -0
  98. /package/dist/{src/contracts → contracts}/authorization-decision.js +0 -0
  99. /package/dist/{src/contracts → contracts}/decision.d.ts +0 -0
  100. /package/dist/{src/contracts → contracts}/decision.js +0 -0
  101. /package/dist/{src/contracts → contracts}/enums.d.ts +0 -0
  102. /package/dist/{src/contracts → contracts}/enums.js +0 -0
  103. /package/dist/{src/contracts → contracts}/index.d.ts +0 -0
  104. /package/dist/{src/contracts → contracts}/index.js +0 -0
  105. /package/dist/{src/contracts → contracts}/mandate.d.ts +0 -0
  106. /package/dist/{src/contracts → contracts}/mandate.js +0 -0
  107. /package/dist/{src/contracts → contracts}/policy-rule.d.ts +0 -0
  108. /package/dist/{src/contracts → contracts}/policy-rule.js +0 -0
  109. /package/dist/{src/contracts → contracts}/proof-event.d.ts +0 -0
  110. /package/dist/{src/contracts → contracts}/proof-event.js +0 -0
  111. /package/dist/{src/contracts → contracts}/verification.d.ts +0 -0
  112. /package/dist/{src/contracts → contracts}/verification.js +0 -0
  113. /package/dist/{src/errors.d.ts → errors.d.ts} +0 -0
  114. /package/dist/{src/errors.js → errors.js} +0 -0
  115. /package/dist/{src/evidence → evidence}/web-state.d.ts +0 -0
  116. /package/dist/{src/evidence → evidence}/web-state.js +0 -0
  117. /package/dist/{src/guard → guard}/action-guard.d.ts +0 -0
  118. /package/dist/{src/guard → guard}/action-guard.js +0 -0
  119. /package/dist/{src/policy → policy}/engine.d.ts +0 -0
  120. /package/dist/{src/policy → policy}/engine.js +0 -0
  121. /package/dist/{src/policy → policy}/matching.d.ts +0 -0
  122. /package/dist/{src/policy → policy}/matching.js +0 -0
  123. /package/dist/{src/types.d.ts → types.d.ts} +0 -0
  124. /package/dist/{src/types.js → types.js} +0 -0
  125. /package/dist/{src/wrappers → wrappers}/sensitive-operations.d.ts +0 -0
  126. /package/dist/{src/wrappers → wrappers}/sensitive-operations.js +0 -0
@@ -0,0 +1,108 @@
1
+ /**
2
+ * Shared canonicalization utilities for non-web contexts.
3
+ *
4
+ * These utilities provide consistent normalization for terminal and desktop
5
+ * accessibility snapshots, ensuring reproducible state hashes.
6
+ */
7
+ export type Platform = "darwin" | "linux" | "win32";
8
+ /**
9
+ * Normalize text for canonical comparison.
10
+ *
11
+ * Transforms:
12
+ * - Trims leading/trailing whitespace
13
+ * - Collapses internal whitespace to single spaces
14
+ * - Lowercases (for non-command text)
15
+ * - Caps length
16
+ *
17
+ * @param text - Input text (may be null/undefined)
18
+ * @param maxLen - Maximum length to retain (default: 80)
19
+ * @returns Normalized text string (empty string if input is null/undefined)
20
+ */
21
+ export declare function normalizeText(text: string | null | undefined, maxLen?: number): string;
22
+ /**
23
+ * Normalize a command string.
24
+ *
25
+ * Unlike normalizeText, this preserves case (commands are case-sensitive)
26
+ * but still trims and collapses whitespace.
27
+ *
28
+ * @param cmd - Command string
29
+ * @returns Normalized command
30
+ */
31
+ export declare function normalizeCommand(cmd: string | null | undefined): string;
32
+ /**
33
+ * Remove all ANSI escape sequences from text.
34
+ *
35
+ * Handles:
36
+ * - Color codes: \x1b[31m (red), \x1b[0m (reset)
37
+ * - Cursor movement: \x1b[2J (clear screen)
38
+ * - Terminal control sequences
39
+ *
40
+ * @param text - Text potentially containing ANSI codes
41
+ * @returns Text with ANSI codes removed
42
+ */
43
+ export declare function stripAnsi(text: string): string;
44
+ /**
45
+ * Replace common timestamp patterns with placeholder.
46
+ *
47
+ * This ensures that transcript hashes remain stable across runs
48
+ * even when timestamps differ.
49
+ *
50
+ * @param text - Text potentially containing timestamps
51
+ * @returns Text with timestamps replaced by [TIMESTAMP]
52
+ */
53
+ export declare function normalizeTimestamps(text: string): string;
54
+ /**
55
+ * Normalize a terminal transcript for canonical hashing.
56
+ *
57
+ * Steps:
58
+ * 1. Strip ANSI escape codes
59
+ * 2. Normalize timestamps
60
+ * 3. For each line: trim trailing whitespace, collapse internal whitespace
61
+ * 4. Remove empty trailing lines
62
+ * 5. Cap total length
63
+ *
64
+ * @param transcript - Raw terminal transcript
65
+ * @returns Normalized transcript
66
+ */
67
+ export declare function normalizeTranscript(transcript: string | null | undefined): string;
68
+ /**
69
+ * Normalize a file system path for canonical hashing.
70
+ *
71
+ * Handles:
72
+ * - Home directory expansion (~ on Unix, %USERPROFILE% on Windows)
73
+ * - Resolution of . and ..
74
+ * - Conversion to absolute path
75
+ * - Lowercase drive letter on Windows
76
+ *
77
+ * Note: Symlink resolution is not performed (would require async fs.realpath).
78
+ *
79
+ * @param inputPath - Path to normalize
80
+ * @returns Normalized absolute path in OS-native format
81
+ */
82
+ export declare function normalizePath(inputPath: string | null | undefined): string;
83
+ /**
84
+ * Check if an environment variable key indicates a secret value.
85
+ *
86
+ * @param key - Environment variable name
87
+ * @returns True if the key matches a secret pattern
88
+ */
89
+ export declare function isSecretKey(key: string): boolean;
90
+ /**
91
+ * Hash environment variables for canonical representation.
92
+ *
93
+ * - Redacts values for keys matching secret patterns
94
+ * - Sorts keys for determinism
95
+ * - Returns SHA-256 hash of canonical representation
96
+ *
97
+ * @param env - Environment variables
98
+ * @returns SHA-256 hash of canonical env representation
99
+ */
100
+ export declare function hashEnvironment(env: Record<string, string> | null | undefined): string;
101
+ /**
102
+ * Compute SHA-256 hash of input string.
103
+ *
104
+ * @param input - String to hash
105
+ * @returns Hex-encoded SHA-256 hash
106
+ */
107
+ export declare function sha256(input: string): string;
108
+ //# sourceMappingURL=utils.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/canonicalization/utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;AAMpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,SAAK,GAAG,MAAM,CAelF;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAKvE;AAaD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAeD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMxD;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CA8BjF;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CA4B1E;AAgBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAkBtF;AAMD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE5C"}
@@ -0,0 +1,250 @@
1
+ /**
2
+ * Shared canonicalization utilities for non-web contexts.
3
+ *
4
+ * These utilities provide consistent normalization for terminal and desktop
5
+ * accessibility snapshots, ensuring reproducible state hashes.
6
+ */
7
+ import { createHash } from "node:crypto";
8
+ import path from "node:path";
9
+ // =============================================================================
10
+ // Text Normalization
11
+ // =============================================================================
12
+ /**
13
+ * Normalize text for canonical comparison.
14
+ *
15
+ * Transforms:
16
+ * - Trims leading/trailing whitespace
17
+ * - Collapses internal whitespace to single spaces
18
+ * - Lowercases (for non-command text)
19
+ * - Caps length
20
+ *
21
+ * @param text - Input text (may be null/undefined)
22
+ * @param maxLen - Maximum length to retain (default: 80)
23
+ * @returns Normalized text string (empty string if input is null/undefined)
24
+ */
25
+ export function normalizeText(text, maxLen = 80) {
26
+ if (!text)
27
+ return "";
28
+ // Trim and collapse whitespace
29
+ let normalized = text.split(/\s+/).join(" ").trim();
30
+ // Lowercase
31
+ normalized = normalized.toLowerCase();
32
+ // Cap length
33
+ if (normalized.length > maxLen) {
34
+ normalized = normalized.slice(0, maxLen);
35
+ }
36
+ return normalized;
37
+ }
38
+ /**
39
+ * Normalize a command string.
40
+ *
41
+ * Unlike normalizeText, this preserves case (commands are case-sensitive)
42
+ * but still trims and collapses whitespace.
43
+ *
44
+ * @param cmd - Command string
45
+ * @returns Normalized command
46
+ */
47
+ export function normalizeCommand(cmd) {
48
+ if (!cmd)
49
+ return "";
50
+ // Trim and collapse whitespace only (preserve case)
51
+ return cmd.split(/\s+/).join(" ").trim();
52
+ }
53
+ // =============================================================================
54
+ // ANSI Escape Code Handling
55
+ // =============================================================================
56
+ /**
57
+ * ANSI escape sequence pattern.
58
+ * Matches color codes, cursor movement, and terminal control sequences.
59
+ */
60
+ // biome-ignore lint/suspicious/noControlCharactersInRegex: ANSI escape codes require matching control characters
61
+ const ANSI_PATTERN = /\x1b\[[0-9;]*[a-zA-Z]/g;
62
+ /**
63
+ * Remove all ANSI escape sequences from text.
64
+ *
65
+ * Handles:
66
+ * - Color codes: \x1b[31m (red), \x1b[0m (reset)
67
+ * - Cursor movement: \x1b[2J (clear screen)
68
+ * - Terminal control sequences
69
+ *
70
+ * @param text - Text potentially containing ANSI codes
71
+ * @returns Text with ANSI codes removed
72
+ */
73
+ export function stripAnsi(text) {
74
+ return text.replace(ANSI_PATTERN, "");
75
+ }
76
+ // =============================================================================
77
+ // Timestamp Normalization
78
+ // =============================================================================
79
+ /**
80
+ * Common timestamp patterns to normalize.
81
+ */
82
+ const TIMESTAMP_PATTERNS = [
83
+ /\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:?\d{2})?/g, // ISO 8601
84
+ /\d{2}:\d{2}:\d{2}/g, // HH:MM:SS
85
+ /\[\d+\.\d+s\]/g, // Duration [1.23s]
86
+ ];
87
+ /**
88
+ * Replace common timestamp patterns with placeholder.
89
+ *
90
+ * This ensures that transcript hashes remain stable across runs
91
+ * even when timestamps differ.
92
+ *
93
+ * @param text - Text potentially containing timestamps
94
+ * @returns Text with timestamps replaced by [TIMESTAMP]
95
+ */
96
+ export function normalizeTimestamps(text) {
97
+ let result = text;
98
+ for (const pattern of TIMESTAMP_PATTERNS) {
99
+ result = result.replace(pattern, "[TIMESTAMP]");
100
+ }
101
+ return result;
102
+ }
103
+ // =============================================================================
104
+ // Transcript Normalization
105
+ // =============================================================================
106
+ /** Maximum transcript length in bytes (10KB) */
107
+ const MAX_TRANSCRIPT_LENGTH = 10 * 1024;
108
+ /**
109
+ * Normalize a terminal transcript for canonical hashing.
110
+ *
111
+ * Steps:
112
+ * 1. Strip ANSI escape codes
113
+ * 2. Normalize timestamps
114
+ * 3. For each line: trim trailing whitespace, collapse internal whitespace
115
+ * 4. Remove empty trailing lines
116
+ * 5. Cap total length
117
+ *
118
+ * @param transcript - Raw terminal transcript
119
+ * @returns Normalized transcript
120
+ */
121
+ export function normalizeTranscript(transcript) {
122
+ if (!transcript)
123
+ return "";
124
+ // Strip ANSI codes first
125
+ let normalized = stripAnsi(transcript);
126
+ // Normalize timestamps
127
+ normalized = normalizeTimestamps(normalized);
128
+ // Process line by line
129
+ const lines = normalized.split("\n").map((line) => {
130
+ // Trim trailing whitespace
131
+ let processed = line.trimEnd();
132
+ // Collapse internal whitespace (tabs -> space, multiple spaces -> single)
133
+ processed = processed.replace(/\t/g, " ").replace(/ +/g, " ");
134
+ return processed;
135
+ });
136
+ // Remove empty trailing lines
137
+ while (lines.length > 0 && lines[lines.length - 1] === "") {
138
+ lines.pop();
139
+ }
140
+ // Join and cap length
141
+ let result = lines.join("\n");
142
+ if (result.length > MAX_TRANSCRIPT_LENGTH) {
143
+ result = result.slice(0, MAX_TRANSCRIPT_LENGTH);
144
+ }
145
+ return result;
146
+ }
147
+ // =============================================================================
148
+ // Path Normalization
149
+ // =============================================================================
150
+ /**
151
+ * Normalize a file system path for canonical hashing.
152
+ *
153
+ * Handles:
154
+ * - Home directory expansion (~ on Unix, %USERPROFILE% on Windows)
155
+ * - Resolution of . and ..
156
+ * - Conversion to absolute path
157
+ * - Lowercase drive letter on Windows
158
+ *
159
+ * Note: Symlink resolution is not performed (would require async fs.realpath).
160
+ *
161
+ * @param inputPath - Path to normalize
162
+ * @returns Normalized absolute path in OS-native format
163
+ */
164
+ export function normalizePath(inputPath) {
165
+ if (!inputPath)
166
+ return "";
167
+ let normalized = inputPath;
168
+ // Expand home directory (cross-platform)
169
+ if (normalized.startsWith("~")) {
170
+ // Unix/macOS: ~/foo -> /Users/name/foo
171
+ normalized = normalized.replace(/^~/, process.env.HOME || "");
172
+ }
173
+ else if (normalized.includes("%USERPROFILE%")) {
174
+ // Windows: %USERPROFILE%\foo -> C:\Users\name\foo
175
+ normalized = normalized.replace(/%USERPROFILE%/gi, process.env.USERPROFILE || "");
176
+ }
177
+ // Resolve . and .. (uses OS-native separators)
178
+ normalized = path.normalize(normalized);
179
+ // Convert to absolute if relative
180
+ if (!path.isAbsolute(normalized)) {
181
+ normalized = path.resolve(normalized);
182
+ }
183
+ // Windows: lowercase drive letter for consistency (C: -> c:)
184
+ if (process.platform === "win32" && /^[A-Z]:/.test(normalized)) {
185
+ normalized = normalized[0].toLowerCase() + normalized.slice(1);
186
+ }
187
+ return normalized;
188
+ }
189
+ // =============================================================================
190
+ // Environment Variable Hashing
191
+ // =============================================================================
192
+ /**
193
+ * Patterns that indicate an environment variable contains a secret.
194
+ */
195
+ const SECRET_PATTERNS = [
196
+ /^(AWS_|AZURE_|GCP_|GOOGLE_)/i, // Cloud providers
197
+ /(_KEY|_SECRET|_TOKEN|_PASSWORD)$/i, // Common suffixes
198
+ /^(API_KEY|AUTH_TOKEN|PRIVATE_KEY)$/i, // Common names
199
+ /^(DATABASE_URL|REDIS_URL)$/i, // Connection strings
200
+ ];
201
+ /**
202
+ * Check if an environment variable key indicates a secret value.
203
+ *
204
+ * @param key - Environment variable name
205
+ * @returns True if the key matches a secret pattern
206
+ */
207
+ export function isSecretKey(key) {
208
+ return SECRET_PATTERNS.some((p) => p.test(key));
209
+ }
210
+ /**
211
+ * Hash environment variables for canonical representation.
212
+ *
213
+ * - Redacts values for keys matching secret patterns
214
+ * - Sorts keys for determinism
215
+ * - Returns SHA-256 hash of canonical representation
216
+ *
217
+ * @param env - Environment variables
218
+ * @returns SHA-256 hash of canonical env representation
219
+ */
220
+ export function hashEnvironment(env) {
221
+ if (!env)
222
+ return sha256("");
223
+ // Filter out secrets
224
+ const safeEnv = {};
225
+ for (const [key, value] of Object.entries(env)) {
226
+ if (isSecretKey(key)) {
227
+ safeEnv[key] = "[REDACTED]";
228
+ }
229
+ else {
230
+ safeEnv[key] = value;
231
+ }
232
+ }
233
+ // Sort keys for determinism
234
+ const sortedKeys = Object.keys(safeEnv).sort();
235
+ const canonical = sortedKeys.map((k) => `${k}=${safeEnv[k]}`).join("\n");
236
+ return sha256(canonical);
237
+ }
238
+ // =============================================================================
239
+ // Hashing
240
+ // =============================================================================
241
+ /**
242
+ * Compute SHA-256 hash of input string.
243
+ *
244
+ * @param input - String to hash
245
+ * @returns Hex-encoded SHA-256 hash
246
+ */
247
+ export function sha256(input) {
248
+ return createHash("sha256").update(input, "utf8").digest("hex");
249
+ }
250
+ //# sourceMappingURL=utils.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/canonicalization/utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,IAA+B,EAAE,MAAM,GAAG,EAAE;IACxE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IAErB,+BAA+B;IAC/B,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAEpD,YAAY;IACZ,UAAU,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAEtC,aAAa;IACb,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC/B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA8B;IAC7D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IAEpB,oDAAoD;IACpD,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,iHAAiH;AACjH,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,gFAAgF;AAChF,0BAA0B;AAC1B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,sEAAsE,EAAE,WAAW;IACnF,oBAAoB,EAAE,WAAW;IACjC,gBAAgB,EAAE,mBAAmB;CACtC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,gDAAgD;AAChD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAqC;IACvE,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAC;IAE3B,yBAAyB;IACzB,IAAI,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAEvC,uBAAuB;IACvB,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAE7C,uBAAuB;IACvB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,2BAA2B;QAC3B,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,0EAA0E;QAC1E,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAC1C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,SAAoC;IAChE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAE1B,IAAI,UAAU,GAAG,SAAS,CAAC;IAE3B,yCAAyC;IACzC,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,uCAAuC;QACvC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;SAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAChD,kDAAkD;QAClD,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,+CAA+C;IAC/C,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAExC,kCAAkC;IAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/D,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF;;GAEG;AACH,MAAM,eAAe,GAAG;IACtB,8BAA8B,EAAE,kBAAkB;IAClD,mCAAmC,EAAE,kBAAkB;IACvD,qCAAqC,EAAE,eAAe;IACtD,6BAA6B,EAAE,qBAAqB;CACrD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,GAA8C;IAC5E,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;IAE5B,qBAAqB;IACrB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"action-request.d.ts","sourceRoot":"","sources":["../../src/contracts/action-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGrD,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,kBAAkB,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAGD,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,YAAY,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,aAAa,CAAC;IAC9B,qBAAqB,CAAC,EAAE,oBAAoB,CAAC;CAC9C;AAGD,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,uBAAuB,CAAC;AAEvE,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,uBAAuB,CAqB5F"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"action-request.js","sourceRoot":"","sources":["../../src/contracts/action-request.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAoDjD,MAAM,UAAU,yBAAyB,CAAC,OAAyB;IACjE,IAAI,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1E,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY;QACzC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,MAAM;QAClC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;QACtC,WAAW,EAAE,UAAU;QACvB,OAAO,EAAE;YACP,YAAY,EAAE,OAAO,CAAC,cAAc,CAAC,MAAM;YAC3C,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,UAAU;YAC7C,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,cAAc,IAAI,IAAI;YAC7D,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,UAAU;YAC7C,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS;YACtC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU;SACzC;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAuB;IACxD,OAAO,OAAQ,KAAiC,CAAC,SAAS,KAAK,QAAQ,CAAC;AAC1E,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAc;IAChD,0EAA0E;IAC1E,8EAA8E;IAC9E,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"authorization-decision.d.ts","sourceRoot":"","sources":["../../src/contracts/authorization-decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,cAAc,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrC,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAgBtF"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"authorization-decision.js","sourceRoot":"","sources":["../../src/contracts/authorization-decision.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,eAAe,EAAE,MAAM,cAAc,CAAC;AAUnE,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAChC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnF,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS;YAC9B,GAAG,CAAC,aAAa,KAAK,IAAI;YAC1B,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC;QACxC,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBAChC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/contracts/decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAatF"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"decision.js","sourceRoot":"","sources":["../../src/contracts/decision.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAChC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC;QAC/D,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC;QACrE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACjC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAC/D,CAAC;AACJ,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../../src/contracts/enums.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,yKAQxB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,qBAAqB,0CAA2C,CAAC;AAC9E,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,eAAO,MAAM,cAAc,4BAA6B,CAAC;AACzD,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"enums.js","sourceRoot":"","sources":["../../src/contracts/enums.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,SAAS;IACT,oBAAoB;IACpB,eAAe;IACf,+BAA+B;IAC/B,+BAA+B;IAC/B,iBAAiB;IACjB,qBAAqB;CACb,CAAC;AAIX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAU,CAAC;AAG9E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,YAAY,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC1F,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/contracts/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE1F,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../../src/contracts/mandate.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAetE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,aAAa,CAUtE"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"mandate.js","sourceRoot":"","sources":["../../src/contracts/mandate.ts"],"names":[],"mappings":"AA4BA,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QACzC,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAC3C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAC5B,CAAC;AACJ,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"policy-rule.d.ts","sourceRoot":"","sources":["../../src/contracts/policy-rule.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;IACrB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAchE"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"policy-rule.js","sourceRoot":"","sources":["../../src/contracts/policy-rule.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,CAAC,GAAG,CAAC,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;QACjD,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7B,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;QAC1B,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC;QAC5B,CAAC,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACzE,CAAC,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AACjF,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"proof-event.d.ts","sourceRoot":"","sources":["../../src/contracts/proof-event.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAAC;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAehE"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"proof-event.js","sourceRoot":"","sources":["../../src/contracts/proof-event.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,CACL,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;QACpC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAChC,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAChC,CAAC,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC;QAC/D,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAC3C,CAAC;AACJ,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"verification.d.ts","sourceRoot":"","sources":["../../src/contracts/verification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,oBAAoB,GAAG,SAAS,EAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAOT;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,oBAAoB,GAAG,SAAS,GAAG,MAAM,EAAE,CAOjF"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"verification.js","sourceRoot":"","sources":["../../src/contracts/verification.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,aAAa,CAC3B,QAA0C,EAC1C,KAAa;IAEb,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC1B,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAA0C;IACrE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO;SACpB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;SAC9C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,wBAAwB,GAChC,SAAS,GACT,eAAe,GACf,gBAAgB,GAChB,aAAa,GACb,cAAc,GACd,WAAW,GACX,cAAc,CAAC;AAEnB,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,IAAI,EAAE,wBAAwB,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB;CAWJ"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAA2B;IAC/B,MAAM,CAAU;IAChB,OAAO,CAAW;IAE3B,YACE,OAAe,EACf,OAKC;QAED,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAoC,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC9D,CAAC;IACH,CAAC;CACF"}
@@ -33,6 +33,13 @@ export interface TerminalStateEvidenceOptions {
33
33
  schemaVersion?: string;
34
34
  confidence?: number;
35
35
  hasher?: EvidenceHasher;
36
+ /**
37
+ * Use canonical hashing with proper normalization.
38
+ * When true, applies ANSI stripping, timestamp normalization, whitespace
39
+ * collapsing, and other canonicalization rules for reproducible hashes.
40
+ * @default false (legacy mode for backward compatibility)
41
+ */
42
+ useCanonicalHash?: boolean;
36
43
  }
37
44
  export interface DesktopStateEvidenceOptions {
38
45
  snapshot: DesktopAccessibilitySnapshot;
@@ -40,6 +47,13 @@ export interface DesktopStateEvidenceOptions {
40
47
  schemaVersion?: string;
41
48
  confidence?: number;
42
49
  hasher?: EvidenceHasher;
50
+ /**
51
+ * Use canonical hashing with proper normalization.
52
+ * When true, applies text normalization, tree sorting, and other
53
+ * canonicalization rules for reproducible hashes.
54
+ * @default false (legacy mode for backward compatibility)
55
+ */
56
+ useCanonicalHash?: boolean;
43
57
  }
44
58
  export declare function buildTerminalStateEvidence(options: TerminalStateEvidenceOptions): StateEvidence;
45
59
  export declare function buildDesktopAccessibilityStateEvidence(options: DesktopStateEvidenceOptions): StateEvidence;
@@ -0,0 +1 @@
1
+ {"version":3,"file":"non-web.d.ts","sourceRoot":"","sources":["../../src/evidence/non-web.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAE9G,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;AAE1D,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,WAAW,wBAAwB;IACvC,uBAAuB,IAAI,OAAO,CAAC,uBAAuB,CAAC,GAAG,uBAAuB,CAAC;CACvF;AAED,MAAM,WAAW,oCAAoC;IACnD,4BAA4B,IACxB,OAAO,CAAC,4BAA4B,CAAC,GACrC,4BAA4B,CAAC;CAClC;AAED,MAAM,WAAW,0BAA0B;IACzC,0BAA0B,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC;CACpF;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,uBAAuB,CAAC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,4BAA4B,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,4BAA4B,GAAG,aAAa,CA2B/F;AAED,wBAAgB,sCAAsC,CACpD,OAAO,EAAE,2BAA2B,GACnC,aAAa,CA2Bf;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAE/B"}
@@ -0,0 +1,95 @@
1
+ import { DESKTOP_SCHEMA_VERSION, TERMINAL_SCHEMA_VERSION, computeDesktopStateHash, computeTerminalStateHash, } from "../canonicalization/index.js";
2
+ export function buildTerminalStateEvidence(options) {
3
+ let stateHash;
4
+ let schemaVersion;
5
+ if (options.useCanonicalHash) {
6
+ // Use canonical hashing with proper normalization
7
+ const canonicalInput = {
8
+ session_id: options.snapshot.session_id ?? "",
9
+ terminal_id: options.snapshot.terminal_id,
10
+ cwd: options.snapshot.cwd,
11
+ command: options.snapshot.command,
12
+ transcript: options.snapshot.transcript_hash, // Note: expects raw transcript, not pre-hashed
13
+ };
14
+ stateHash = options.stateHash ?? computeTerminalStateHash(canonicalInput);
15
+ schemaVersion = options.schemaVersion ?? TERMINAL_SCHEMA_VERSION;
16
+ }
17
+ else {
18
+ // Legacy mode for backward compatibility
19
+ stateHash = options.stateHash ?? hashMaterial(materializeTerminalSnapshot(options.snapshot), options.hasher);
20
+ schemaVersion = options.schemaVersion ?? "terminal-v1";
21
+ }
22
+ return {
23
+ source: "terminal",
24
+ state_hash: stateHash,
25
+ schema_version: schemaVersion,
26
+ confidence: options.confidence ?? options.snapshot.confidence,
27
+ };
28
+ }
29
+ export function buildDesktopAccessibilityStateEvidence(options) {
30
+ let stateHash;
31
+ let schemaVersion;
32
+ if (options.useCanonicalHash) {
33
+ // Use canonical hashing with proper normalization
34
+ const canonicalInput = {
35
+ app_name: options.snapshot.app_name,
36
+ window_title: options.snapshot.window_title,
37
+ focused_role: options.snapshot.focused_role,
38
+ focused_name: options.snapshot.focused_name,
39
+ ui_tree_text: options.snapshot.ui_tree_hash, // Note: expects raw text, not pre-hashed
40
+ };
41
+ stateHash = options.stateHash ?? computeDesktopStateHash(canonicalInput);
42
+ schemaVersion = options.schemaVersion ?? DESKTOP_SCHEMA_VERSION;
43
+ }
44
+ else {
45
+ // Legacy mode for backward compatibility
46
+ stateHash = options.stateHash ?? hashMaterial(materializeDesktopSnapshot(options.snapshot), options.hasher);
47
+ schemaVersion = options.schemaVersion ?? "desktop-a11y-v1";
48
+ }
49
+ return {
50
+ source: "desktop_accessibility",
51
+ state_hash: stateHash,
52
+ schema_version: schemaVersion,
53
+ confidence: options.confidence ?? options.snapshot.confidence,
54
+ };
55
+ }
56
+ export async function collectVerificationEvidence(provider) {
57
+ return { signals: await provider.collectVerificationSignals() };
58
+ }
59
+ function materializeTerminalSnapshot(snapshot) {
60
+ return JSON.stringify({
61
+ command: snapshot.command ?? "",
62
+ confidence: snapshot.confidence ?? "",
63
+ cwd: snapshot.cwd ?? "",
64
+ observed_at: snapshot.observed_at ?? "",
65
+ session_id: snapshot.session_id ?? "",
66
+ terminal_id: snapshot.terminal_id ?? "",
67
+ transcript_hash: snapshot.transcript_hash ?? "",
68
+ });
69
+ }
70
+ function materializeDesktopSnapshot(snapshot) {
71
+ return JSON.stringify({
72
+ app_name: snapshot.app_name ?? "",
73
+ confidence: snapshot.confidence ?? "",
74
+ focused_name: snapshot.focused_name ?? "",
75
+ focused_role: snapshot.focused_role ?? "",
76
+ observed_at: snapshot.observed_at ?? "",
77
+ ui_tree_hash: snapshot.ui_tree_hash ?? "",
78
+ window_title: snapshot.window_title ?? "",
79
+ });
80
+ }
81
+ function hashMaterial(material, hasher) {
82
+ if (hasher) {
83
+ return hasher(material);
84
+ }
85
+ return `sh_${fnv1a32Hex(material)}`;
86
+ }
87
+ function fnv1a32Hex(input) {
88
+ let hash = 0x811c9dc5;
89
+ for (let i = 0; i < input.length; i += 1) {
90
+ hash ^= input.charCodeAt(i);
91
+ hash = Math.imul(hash, 0x01000193);
92
+ }
93
+ return (hash >>> 0).toString(16).padStart(8, "0");
94
+ }
95
+ //# sourceMappingURL=non-web.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"non-web.js","sourceRoot":"","sources":["../../src/evidence/non-web.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,sBAAsB,EACtB,uBAAuB,EAGvB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AAsEtC,MAAM,UAAU,0BAA0B,CAAC,OAAqC;IAC9E,IAAI,SAAiB,CAAC;IACtB,IAAI,aAAqB,CAAC;IAE1B,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,kDAAkD;QAClD,MAAM,cAAc,GAA2B;YAC7C,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE;YAC7C,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;YACzC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;YACzB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;YACjC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,+CAA+C;SAC9F,CAAC;QACF,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,wBAAwB,CAAC,cAAc,CAAC,CAAC;QAC1E,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,uBAAuB,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,yCAAyC;QACzC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC,2BAA2B,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7G,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC;IACzD,CAAC;IAED,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,SAAS;QACrB,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,OAAoC;IAEpC,IAAI,SAAiB,CAAC;IACtB,IAAI,aAAqB,CAAC;IAE1B,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,kDAAkD;QAClD,MAAM,cAAc,GAA0B;YAC5C,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;YACnC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY;YAC3C,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY;YAC3C,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY;YAC3C,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,yCAAyC;SACvF,CAAC;QACF,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,cAAc,CAAC,CAAC;QACzE,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,yCAAyC;QACzC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,YAAY,CAAC,0BAA0B,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5G,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,iBAAiB,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,uBAAuB;QAC/B,UAAU,EAAE,SAAS;QACrB,cAAc,EAAE,aAAa;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAoC;IAEpC,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC,0BAA0B,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAiC;IACpE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;QAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;QACrC,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,EAAE;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;QACvC,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;QACrC,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;QACvC,eAAe,EAAE,QAAQ,CAAC,eAAe,IAAI,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAsC;IACxE,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;QACrC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;QACzC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;QACzC,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;QACvC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;QACzC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,EAAE;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,MAAuB;IAC7D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"web-state.d.ts","sourceRoot":"","sources":["../../src/evidence/web-state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE;QACZ,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;CACvC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa,CAQrF;AAED,wBAAgB,mCAAmC,CAAC,QAAQ,EAAE,mBAAmB,GAAG,gBAAgB,CASnG;AAED,wBAAgB,wCAAwC,CACtD,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,UAAU,GAAG,YAAY,CAAC,GACjE,aAAa,CASf"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"web-state.js","sourceRoot":"","sources":["../../src/evidence/web-state.ts"],"names":[],"mappings":"AAiCA,MAAM,UAAU,qBAAqB,CAAC,OAAgC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACtH,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,UAAU,EAAE,SAAS;QACrB,cAAc,EAAE,OAAO,CAAC,aAAa,IAAI,QAAQ;QACjD,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,QAA6B;IAC/E,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,SAAS;QAC/B,kBAAkB,EAAE,QAAQ,CAAC,SAAS;QACtC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,UAAU,IAAI,SAAS;QACzD,kBAAkB,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wCAAwC,CACtD,QAA6B,EAC7B,OAAkE;IAElE,MAAM,MAAM,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,qBAAqB,CAAC;QAC3B,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,aAAa,EAAE,OAAO,EAAE,aAAa;QACrC,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,QAA0B;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,EAAE;QACrC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,IAAI,EAAE;QACrD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;QACjC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,IAAI,EAAE;QACrD,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;QACjC,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;QACvC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,IAAI,EAAE;QACrD,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE;QAC3B,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,EAAE;QACvB,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,EAAE;KACpD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB,EAAE,MAAqC;IACtF,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"action-guard.d.ts","sourceRoot":"","sources":["../../src/guard/action-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAExE,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;gBAE7B,QAAQ,EAAE,qBAAqB;CAK5C;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,qBAAqB,CAAC;IAChC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,aAAa,CAAC;CAC3D;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAA4C;gBAE/D,OAAO,EAAE,kBAAkB;IAKvC,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,eAAe,SAAI,GAAG,qBAAqB;IAsB7E,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,SAAI,GAAG,qBAAqB,CAAC,CAAC,CAAC;CAYnG"}
@@ -0,0 +1 @@
1
+ {"version":3,"file":"action-guard.js","sourceRoot":"","sources":["../../src/guard/action-guard.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,QAAQ,CAAwB;IAEzC,YAAY,QAA+B;QACzC,KAAK,CAAC,qBAAqB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAaD,MAAM,OAAO,WAAW;IACL,YAAY,CAAe;IAC3B,aAAa,CAA6C;IAE3E,YAAY,OAA2B;QACrC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED,SAAS,CAAC,OAAsB,EAAE,eAAe,GAAG,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,aAAa,EAAE,UAAU,CAAC,YAAY,IAAI,IAAI;gBAC9C,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,EAAE;gBAC/C,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,SAAS;YACjB,aAAa,EAAE,UAAU,CAAC,YAAY,IAAI,IAAI;YAC9C,cAAc,EAAE,EAAE;YAClB,OAAO;SACR,CAAC;IACJ,CAAC;IAED,OAAO,CAAI,MAAe,EAAE,OAAsB,EAAE,eAAe,GAAG,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC;QACvB,OAAO;YACL,KAAK;YACL,QAAQ;YACR,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;SAClC,CAAC;IACJ,CAAC;CACF"}
@@ -8,6 +8,7 @@ export { ActionGuard, AuthorizationDeniedError, type ActionExecutionResult, type
8
8
  export { guardedFileRead, guardedFileWrite, guardedHttp, guardedShell, type GuardedFileReadOptions, type GuardedFileWriteOptions, type GuardedHttpOptions, type GuardedShellOptions, } from "./wrappers/sensitive-operations.js";
9
9
  export { buildWebStateEvidenceFromRuntimeSnapshot, buildWebStateEvidence, type RuntimeSnapshotLike, type WebStateEvidenceOptions, type WebStateSnapshot, webStateSnapshotFromRuntimeSnapshot, } from "./evidence/web-state.js";
10
10
  export { buildDesktopAccessibilityStateEvidence, buildTerminalStateEvidence, collectVerificationEvidence, type DesktopAccessibilityEvidenceProvider, type DesktopAccessibilitySnapshot, type DesktopStateEvidenceOptions, type EvidenceHasher, type TerminalEvidenceProvider, type TerminalSessionSnapshot, type TerminalStateEvidenceOptions, type VerificationSignalProvider, } from "./evidence/non-web.js";
11
+ export { type Platform, type TerminalSessionSnapshot as CanonicalTerminalInput, type CanonicalTerminalSnapshot, type AccessibilityNode, type DesktopAccessibilitySnapshot as CanonicalDesktopInput, type CanonicalAccessibilityNode, type CanonicalDesktopSnapshot, normalizeText, normalizeCommand, stripAnsi, normalizeTimestamps, normalizeTranscript, normalizePath, isSecretKey, hashEnvironment, sha256, canonicalizeTerminalSnapshot, computeTerminalStateHash, TERMINAL_SCHEMA_VERSION, canonicalizeAccessibilityNode, buildFocusedPath, canonicalizeDesktopSnapshot, computeDesktopStateHash, DESKTOP_SCHEMA_VERSION, } from "./canonicalization/index.js";
11
12
  export interface AuthorityClientOptions {
12
13
  baseUrl: string;
13
14
  timeoutMs?: number;