@sequenceholdings/agent-spec 0.1.1 → 0.1.3

package/dist/voice-authority-verification.d.ts

@@ -0,0 +1,47 @@
+import { type VoicePublicationToolReview, type VoiceToolBinding, type VoiceTrustedVerifierResult, type VoiceVerificationAttempt, type VoiceVerificationAttemptRequest, type VoiceVerificationState } from './voice-authority-contracts.js';
+type AttemptDenial = 'already_verified' | 'authority_expired' | 'verification_expired' | 'verification_locked' | 'verification_revoked';
+export type BeginVoiceVerificationAttemptResult = {
+    outcome: 'started';
+    state: VoiceVerificationState;
+    attempt: VoiceVerificationAttempt;
+} | {
+    outcome: 'retry';
+    state: VoiceVerificationState;
+    attempt: VoiceVerificationAttempt;
+} | {
+    outcome: 'conflict';
+    reason: 'idempotency_conflict' | 'existing_attempt_key_mismatch';
+} | {
+    outcome: 'denied';
+    reason: AttemptDenial;
+    state: VoiceVerificationState;
+};
+export declare function beginVoiceVerificationAttempt({ state, request, existingAttempt, now }: {
+    state: VoiceVerificationState;
+    request: VoiceVerificationAttemptRequest;
+    existingAttempt: VoiceVerificationAttempt | null;
+    now: string;
+}): BeginVoiceVerificationAttemptResult;
+type ResultRejection = 'authority_expired' | 'verification_already_established' | 'verification_binding_mismatch' | 'verification_expiry_invalid' | 'verification_locked' | 'verification_revoked' | 'verifier_review_stale' | 'verifier_result_untrusted';
+export type ApplyVoiceVerifierResult = {
+    outcome: 'applied';
+    state: VoiceVerificationState;
+    attempt: VoiceVerificationAttempt;
+} | {
+    outcome: 'retry';
+    state: VoiceVerificationState;
+    attempt: VoiceVerificationAttempt;
+} | {
+    outcome: 'rejected';
+    reason: ResultRejection;
+    state: VoiceVerificationState;
+};
+export declare function applyVoiceVerifierResult({ state, attempt, result, verifierReview, currentBinding, now, }: {
+    state: VoiceVerificationState;
+    attempt: VoiceVerificationAttempt;
+    result: VoiceTrustedVerifierResult;
+    verifierReview: VoicePublicationToolReview;
+    currentBinding: VoiceToolBinding;
+    now: string;
+}): ApplyVoiceVerifierResult;
+export {};

package/dist/voice-authority-verification.js

@@ -0,0 +1,184 @@
+import { voiceTimestampSchema } from './voice-common.js';
+import { isVoicePublicationToolReviewCurrent, sameVoiceResource, voicePublicationToolReviewSchema, voiceToolBindingSchema, voiceTrustedVerifierResultSchema, voiceVerificationAttemptRequestSchema, voiceVerificationAttemptSchema, voiceVerificationStateSchema, } from './voice-authority-contracts.js';
+function sameSubject({ left, right }) {
+    return left.tenantId === right.tenantId &&
+        left.environmentId === right.environmentId &&
+        left.agentId === right.agentId &&
+        left.sessionId === right.sessionId &&
+        left.releaseId === right.releaseId;
+}
+function sameAttemptRequest({ attempt, request }) {
+    return attempt.attemptId === request.attemptId &&
+        sameSubject({ left: attempt.subject, right: request.subject }) &&
+        sameVoiceResource({ left: attempt.candidateResource, right: request.candidateResource }) &&
+        attempt.methodKey === request.methodKey &&
+        attempt.idempotencyKey === request.idempotencyKey &&
+        attempt.requestDigest === request.requestDigest;
+}
+function expireState({ state }) {
+    return {
+        ...state,
+        status: 'expired',
+        verifiedResource: null,
+        verificationId: null,
+        verificationMethodKey: null,
+        verificationExpiresAt: null,
+        revision: state.revision + 1,
+    };
+}
+function inactiveAttemptResult({ state }) {
+    if (state.status === 'verified') {
+        return { outcome: 'denied', reason: 'already_verified', state };
+    }
+    if (state.status === 'locked') {
+        return { outcome: 'denied', reason: 'verification_locked', state };
+    }
+    if (state.status === 'revoked') {
+        return { outcome: 'denied', reason: 'verification_revoked', state };
+    }
+    if (state.status === 'expired') {
+        return { outcome: 'denied', reason: 'verification_expired', state };
+    }
+    return null;
+}
+export function beginVoiceVerificationAttempt({ state, request, existingAttempt, now }) {
+    const parsedState = voiceVerificationStateSchema.parse(state);
+    const parsedRequest = voiceVerificationAttemptRequestSchema.parse(request);
+    const parsedNow = voiceTimestampSchema.parse(now);
+    if (!sameSubject({ left: parsedState.subject, right: parsedRequest.subject })) {
+        return { outcome: 'conflict', reason: 'idempotency_conflict' };
+    }
+    if (existingAttempt !== null) {
+        const attempt = voiceVerificationAttemptSchema.parse(existingAttempt);
+        if (attempt.idempotencyKey !== parsedRequest.idempotencyKey) {
+            return { outcome: 'conflict', reason: 'existing_attempt_key_mismatch' };
+        }
+        return sameAttemptRequest({ attempt, request: parsedRequest })
+            ? { outcome: 'retry', state: parsedState, attempt }
+            : { outcome: 'conflict', reason: 'idempotency_conflict' };
+    }
+    if (Date.parse(parsedNow) >= Date.parse(parsedState.authorityExpiresAt)) {
+        return { outcome: 'denied', reason: 'authority_expired', state: expireState({ state: parsedState }) };
+    }
+    const inactive = inactiveAttemptResult({ state: parsedState });
+    if (inactive !== null)
+        return inactive;
+    if (parsedState.attemptBudget.usedAttempts >= parsedState.attemptBudget.maxAttempts) {
+        const locked = { ...parsedState, status: 'locked', revision: parsedState.revision + 1 };
+        return { outcome: 'denied', reason: 'verification_locked', state: locked };
+    }
+    const attemptNumber = parsedState.attemptBudget.usedAttempts + 1;
+    return {
+        outcome: 'started',
+        state: {
+            ...parsedState,
+            attemptBudget: { ...parsedState.attemptBudget, usedAttempts: attemptNumber },
+            revision: parsedState.revision + 1,
+        },
+        attempt: {
+            ...parsedRequest, attemptNumber, status: 'pending', completedAt: null,
+            verifierInvocationId: null, verificationId: null,
+        },
+    };
+}
+function resultMatchesAttempt({ result, attempt }) {
+    return result.attemptId === attempt.attemptId &&
+        sameSubject({ left: result.subject, right: attempt.subject }) &&
+        sameVoiceResource({ left: result.candidateResource, right: attempt.candidateResource }) &&
+        result.methodKey === attempt.methodKey &&
+        result.idempotencyKey === attempt.idempotencyKey &&
+        result.requestDigest === attempt.requestDigest;
+}
+function trustedResultReason({ state, result, review, currentBinding }) {
+    const correctReview = review.requirement.authority === 'authentication' &&
+        review.requirement.resourceKind === result.candidateResource.kind &&
+        result.verifierReviewId === review.reviewId &&
+        result.observedFunctionVersionId === review.binding.functionVersionId &&
+        review.releaseId === state.subject.releaseId &&
+        review.scope.tenantId === state.subject.tenantId &&
+        review.scope.environmentId === state.subject.environmentId &&
+        review.scope.agentId === state.subject.agentId;
+    if (!correctReview)
+        return 'verifier_result_untrusted';
+    return isVoicePublicationToolReviewCurrent({
+        review, currentBinding,
+        currentRequirement: { authority: 'authentication', effect: 'resource_verification', resourceKind: result.candidateResource.kind },
+    }) ? null : 'verifier_review_stale';
+}
+function completedAttemptResult({ state, attempt, result }) {
+    if (attempt.status === 'pending' || attempt.status === 'uncertain')
+        return null;
+    const matches = attempt.verificationId === result.verificationId &&
+        attempt.verifierInvocationId === result.verifierInvocationId &&
+        attempt.status === result.verdict;
+    return matches
+        ? { outcome: 'retry', state, attempt }
+        : { outcome: 'rejected', reason: 'verification_binding_mismatch', state };
+}
+function appliedVerifiedResult({ state, attempt, result, now }) {
+    const invalidExpiry = Date.parse(result.verificationExpiresAt) <= Date.parse(now) ||
+        Date.parse(result.verificationExpiresAt) > Date.parse(state.authorityExpiresAt);
+    if (invalidExpiry) {
+        return { outcome: 'rejected', reason: 'verification_expiry_invalid', state };
+    }
+    return {
+        outcome: 'applied',
+        state: {
+            ...state, status: 'verified', verifiedResource: result.candidateResource,
+            verificationId: result.verificationId, verificationMethodKey: result.methodKey,
+            verificationExpiresAt: result.verificationExpiresAt, revision: state.revision + 1,
+        },
+        attempt: {
+            ...attempt, status: 'verified', completedAt: result.completedAt,
+            verifierInvocationId: result.verifierInvocationId, verificationId: result.verificationId,
+        },
+    };
+}
+function appliedRejectedResult({ state, attempt, result }) {
+    const locked = state.attemptBudget.usedAttempts >= state.attemptBudget.maxAttempts;
+    return {
+        outcome: 'applied',
+        state: { ...state, status: locked ? 'locked' : 'unverified', revision: state.revision + 1 },
+        attempt: {
+            ...attempt, status: 'rejected', completedAt: result.completedAt,
+            verifierInvocationId: result.verifierInvocationId, verificationId: result.verificationId,
+        },
+    };
+}
+export function applyVoiceVerifierResult({ state, attempt, result, verifierReview, currentBinding, now, }) {
+    const parsedState = voiceVerificationStateSchema.parse(state);
+    const parsedAttempt = voiceVerificationAttemptSchema.parse(attempt);
+    const parsedResult = voiceTrustedVerifierResultSchema.parse(result);
+    const review = voicePublicationToolReviewSchema.parse(verifierReview);
+    const binding = voiceToolBindingSchema.parse(currentBinding);
+    const parsedNow = voiceTimestampSchema.parse(now);
+    const mismatched = !sameSubject({ left: parsedState.subject, right: parsedAttempt.subject }) ||
+        !resultMatchesAttempt({ result: parsedResult, attempt: parsedAttempt });
+    if (mismatched) {
+        return { outcome: 'rejected', reason: 'verification_binding_mismatch', state: parsedState };
+    }
+    const trustReason = trustedResultReason({ state: parsedState, result: parsedResult, review,
+        currentBinding: binding });
+    if (trustReason !== null)
+        return { outcome: 'rejected', reason: trustReason, state: parsedState };
+    const completed = completedAttemptResult({ state: parsedState, attempt: parsedAttempt,
+        result: parsedResult });
+    if (completed !== null)
+        return completed;
+    if (parsedState.status === 'verified') {
+        return { outcome: 'rejected', reason: 'verification_already_established', state: parsedState };
+    }
+    if (Date.parse(parsedNow) >= Date.parse(parsedState.authorityExpiresAt)) {
+        return { outcome: 'rejected', reason: 'authority_expired', state: expireState({ state: parsedState }) };
+    }
+    if (parsedState.status === 'revoked') {
+        return { outcome: 'rejected', reason: 'verification_revoked', state: parsedState };
+    }
+    if (parsedState.status === 'locked' || parsedState.status === 'expired') {
+        return { outcome: 'rejected', reason: 'verification_locked', state: parsedState };
+    }
+    return parsedResult.verdict === 'verified'
+        ? appliedVerifiedResult({ state: parsedState, attempt: parsedAttempt, result: parsedResult,
+            now: parsedNow })
+        : appliedRejectedResult({ state: parsedState, attempt: parsedAttempt, result: parsedResult });
+}

package/dist/voice-authority.d.ts

@@ -0,0 +1,3 @@
+export * from './voice-authority-contracts.js';
+export * from './voice-authority-verification.js';
+export * from './voice-authority-evaluation.js';

package/dist/voice-authority.js

@@ -0,0 +1,3 @@
+export * from './voice-authority-contracts.js';
+export * from './voice-authority-verification.js';
+export * from './voice-authority-evaluation.js';

package/dist/voice-common.d.ts

@@ -0,0 +1,21 @@
+import { z } from 'zod';
+export declare const voiceIdSchema: z.ZodString;
+export declare const voiceHashSchema: z.ZodString;
+export declare const voiceRevisionSchema: z.ZodNumber;
+export declare const voiceTimestampSchema: z.ZodISODateTime;
+export declare const voiceScopeSchema: z.ZodObject<{
+    tenantId: z.ZodString;
+    environmentId: z.ZodString;
+}, z.core.$strict>;
+export type VoiceScope = z.infer<typeof voiceScopeSchema>;
+export declare const voiceAgentScopeSchema: z.ZodObject<{
+    tenantId: z.ZodString;
+    environmentId: z.ZodString;
+    agentId: z.ZodString;
+}, z.core.$strict>;
+export type VoiceAgentScope = z.infer<typeof voiceAgentScopeSchema>;
+export declare const voiceLocalKeySchema: z.ZodString;
+export declare const VOICE_RESERVED_VARIABLES: readonly ["secret__atlas_demo_call_grant", "voice_session_id", "atlas_session_id", "sessionId", "releaseId", "tenantId", "environmentId", "runtimeAccountId", "initiatingStaffPrincipalId", "verifiedResource", "customerVerified", "customerId", "verifiedCustomerId", "candidateCustomerId", "syntheticResource", "candidateResource", "verificationId", "actorPrincipalId", "runtimeServiceAccountId", "serviceAccountId", "principalId", "systemRunner", "assertedBy", "authority", "grant", "namespace", "functionId", "managedFunctionId"];
+export declare function isReservedVoiceVariable({ name }: {
+    name: string;
+}): boolean;

package/dist/voice-common.js

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+export const voiceIdSchema = z.string().trim().min(1).max(200);
+export const voiceHashSchema = z.string().regex(/^[a-f0-9]{64}$/);
+export const voiceRevisionSchema = z.number().int().nonnegative().safe();
+export const voiceTimestampSchema = z.iso.datetime({ offset: true });
+export const voiceScopeSchema = z.strictObject({
+    tenantId: voiceIdSchema,
+    environmentId: voiceIdSchema,
+});
+export const voiceAgentScopeSchema = voiceScopeSchema.extend({ agentId: voiceIdSchema });
+export const voiceLocalKeySchema = z.string().regex(/^[a-z][a-z0-9_]{0,63}$/);
+export const VOICE_RESERVED_VARIABLES = [
+    'secret__atlas_demo_call_grant', 'voice_session_id', 'atlas_session_id',
+    'sessionId', 'releaseId', 'tenantId', 'environmentId', 'runtimeAccountId',
+    'initiatingStaffPrincipalId', 'verifiedResource', 'customerVerified',
+    'customerId', 'verifiedCustomerId', 'candidateCustomerId', 'syntheticResource', 'candidateResource', 'verificationId', 'actorPrincipalId',
+    'runtimeServiceAccountId', 'serviceAccountId', 'principalId', 'systemRunner',
+    'assertedBy', 'authority', 'grant', 'namespace', 'functionId', 'managedFunctionId',
+];
+export function isReservedVoiceVariable({ name }) {
+    return name.startsWith('secret__') || name.startsWith('system__') ||
+        VOICE_RESERVED_VARIABLES.some((reserved) => reserved === name);
+}