@yiaany/ghostapi 0.1.9 → 0.2.1

package/dist/actions/gateway.js

@@ -1,11 +1,11 @@
-import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, KeyObject, randomUUID, sign, verify } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, KeyObject, randomUUID, sign, verify, } from "node:crypto";
 import { lstat, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { getDataPaths } from "../config/dataPaths.js";
-import { createLocalSafetyController } from "../safety/index.js";
+import { createLocalSafetyController, } from "../safety/index.js";
 import { sanitizeSecretString } from "../security/secrets.js";
-import { atomicWriteJson, ensurePrivateDirectory, withFileLock } from "../storage/fileStore.js";
-import { inspectWorld, runSubscriptionFailureWorkflow } from "../worlds/index.js";
+import { atomicWriteJson, ensurePrivateDirectory, withFileLock, } from "../storage/fileStore.js";
+import { inspectWorld, runSubscriptionFailureWorkflow, } from "../worlds/index.js";
 const ACTION_SCHEMA_VERSION = 1;
 const ACTION_KIND = "ghostapi.action";
 const APPROVAL_KIND = "ghostapi.action-approval";
@@ -31,8 +31,27 @@ export function actionApprovalHash(value) {
 }
 export function validateActionEnvelope(value) {
     const action = object(value, "Action envelope must be an object.");
-    exactKeys(action, ["schemaVersion", "kind", "actionId", "idempotencyKey", "actor", "project", "provider", "operation", "resource", "arguments", "expectedSideEffects", "riskClass", "reversibility", "policy", "evidence", "expiresAt", "nonce"], "Action envelope");
-    if (action.schemaVersion !== ACTION_SCHEMA_VERSION || action.kind !== ACTION_KIND)
+    exactKeys(action, [
+        "schemaVersion",
+        "kind",
+        "actionId",
+        "idempotencyKey",
+        "actor",
+        "project",
+        "provider",
+        "operation",
+        "resource",
+        "arguments",
+        "expectedSideEffects",
+        "riskClass",
+        "reversibility",
+        "policy",
+        "evidence",
+        "expiresAt",
+        "nonce",
+    ], "Action envelope");
+    if (action.schemaVersion !== ACTION_SCHEMA_VERSION ||
+        action.kind !== ACTION_KIND)
         throw new ActionGatewayError("Unsupported action envelope schema.");
     const actor = object(action.actor, "Action actor is invalid.");
     exactKeys(actor, ["id", "workloadId", "type"], "Action actor");
@@ -52,14 +71,32 @@ export function validateActionEnvelope(value) {
     exactKeys(args, ["worldId"], "Action arguments");
     const operation = identifier(action.operation, "Action operation");
     const sideEffects = action.expectedSideEffects;
-    const expected = ["stripe.subscription.past_due", "email.subscription_payment_failed", "github.recovery_issue", "generic_rest.payment_failed"];
-    if (!Array.isArray(sideEffects) || sideEffects.length > 16 || sideEffects.some((value) => typeof value !== "string" || !IDENTIFIER.test(value) || sanitizeSecretString(value) !== value) || new Set(sideEffects).size !== sideEffects.length)
+    const expected = [
+        "stripe.subscription.past_due",
+        "email.subscription_payment_failed",
+        "github.recovery_issue",
+        "generic_rest.payment_failed",
+    ];
+    if (!Array.isArray(sideEffects) ||
+        sideEffects.length > 16 ||
+        sideEffects.some((value) => typeof value !== "string" ||
+            !IDENTIFIER.test(value) ||
+            sanitizeSecretString(value) !== value) ||
+        new Set(sideEffects).size !== sideEffects.length)
         throw new ActionGatewayError("Action expected side effects must be a bounded unique list of safe identifiers.");
-    if (operation === "synthetic.subscription_failure" && (sideEffects.length !== expected.length || sideEffects.some((value, index) => value !== expected[index])))
+    if (operation === "synthetic.subscription_failure" &&
+        (sideEffects.length !== expected.length ||
+            sideEffects.some((value, index) => value !== expected[index])))
         throw new ActionGatewayError("Action expected side effects are invalid for the synthetic operation.");
-    if (action.riskClass !== "read" && action.riskClass !== "write" && action.riskClass !== "money_movement" && action.riskClass !== "external_communication" && action.riskClass !== "delete" && action.riskClass !== "deploy")
+    if (action.riskClass !== "read" &&
+        action.riskClass !== "write" &&
+        action.riskClass !== "money_movement" &&
+        action.riskClass !== "external_communication" &&
+        action.riskClass !== "delete" &&
+        action.riskClass !== "deploy")
         throw new ActionGatewayError("Action risk class is invalid.");
-    if (action.reversibility !== "none" && action.reversibility !== "compensatable")
+    if (action.reversibility !== "none" &&
+        action.reversibility !== "compensatable")
         throw new ActionGatewayError("Action reversibility is invalid.");
     const policy = object(action.policy, "Action policy reference is invalid.");
     exactKeys(policy, ["version", "hash"], "Action policy reference");
@@ -73,8 +110,15 @@ export function validateActionEnvelope(value) {
         kind: "ghostapi.action",
         actionId: identifier(action.actionId, "Action id"),
         idempotencyKey: identifier(action.idempotencyKey, "Action idempotency key"),
-        actor: { id: identifier(actor.id, "Action actor id"), workloadId: identifier(actor.workloadId, "Action workload id"), type: actor.type },
-        project: { id: identifier(project.id, "Action project id"), environment: "synthetic" },
+        actor: {
+            id: identifier(actor.id, "Action actor id"),
+            workloadId: identifier(actor.workloadId, "Action workload id"),
+            type: actor.type,
+        },
+        project: {
+            id: identifier(project.id, "Action project id"),
+            environment: "synthetic",
+        },
         provider: "ghostapi-synthetic",
         operation,
         resource: { type: "synthetic-world", id: worldId },
@@ -82,16 +126,30 @@ export function validateActionEnvelope(value) {
         expectedSideEffects: [...sideEffects],
         riskClass: action.riskClass,
         reversibility: action.reversibility,
-        policy: { version: positiveInteger(policy.version, "Action policy version"), hash: hash(policy.hash, "Action policy hash") },
+        policy: {
+            version: positiveInteger(policy.version, "Action policy version"),
+            hash: hash(policy.hash, "Action policy hash"),
+        },
         evidence: { hash: hash(evidence.hash, "Action evidence hash") },
         expiresAt: futureTimestamp(action.expiresAt, "Action expiry"),
-        nonce: identifier(action.nonce, "Action nonce")
+        nonce: identifier(action.nonce, "Action nonce"),
     };
 }
 export function validateActionApproval(value) {
     const approval = object(value, "Action approval must be an object.");
-    exactKeys(approval, ["schemaVersion", "kind", "approvalId", "actionHash", "approvedBy", "approvedAt", "expiresAt", "nonce", "provenance"], "Action approval");
-    if (approval.schemaVersion !== ACTION_SCHEMA_VERSION || approval.kind !== APPROVAL_KIND)
+    exactKeys(approval, [
+        "schemaVersion",
+        "kind",
+        "approvalId",
+        "actionHash",
+        "approvedBy",
+        "approvedAt",
+        "expiresAt",
+        "nonce",
+        "provenance",
+    ], "Action approval");
+    if (approval.schemaVersion !== ACTION_SCHEMA_VERSION ||
+        approval.kind !== APPROVAL_KIND)
         throw new ActionGatewayError("Unsupported action approval schema.");
     const approvedAt = timestamp(approval.approvedAt, "Action approval timestamp");
     const expiresAt = futureTimestamp(approval.expiresAt, "Action approval expiry");
@@ -99,9 +157,25 @@ export function validateActionApproval(value) {
         throw new ActionGatewayError("Action approval must expire after it was issued.");
     const provenance = object(approval.provenance, "Action approval provenance is invalid.");
     exactKeys(provenance, ["kind", "keyId", "signature"], "Action approval provenance");
-    if (provenance.kind !== "ghostapi.ed25519-signature" || typeof provenance.signature !== "string" || !/^[A-Za-z0-9_-]{86}$/.test(provenance.signature))
+    if (provenance.kind !== "ghostapi.ed25519-signature" ||
+        typeof provenance.signature !== "string" ||
+        !/^[A-Za-z0-9_-]{86}$/.test(provenance.signature))
         throw new ActionGatewayError("Action approval provenance is invalid.");
-    return { schemaVersion: 1, kind: "ghostapi.action-approval", approvalId: identifier(approval.approvalId, "Action approval id"), actionHash: hash(approval.actionHash, "Action approval hash"), approvedBy: identifier(approval.approvedBy, "Action approver id"), approvedAt, expiresAt, nonce: identifier(approval.nonce, "Action approval nonce"), provenance: { kind: "ghostapi.ed25519-signature", keyId: identifier(provenance.keyId, "Action approval provenance key id"), signature: provenance.signature } };
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.action-approval",
+        approvalId: identifier(approval.approvalId, "Action approval id"),
+        actionHash: hash(approval.actionHash, "Action approval hash"),
+        approvedBy: identifier(approval.approvedBy, "Action approver id"),
+        approvedAt,
+        expiresAt,
+        nonce: identifier(approval.nonce, "Action approval nonce"),
+        provenance: {
+            kind: "ghostapi.ed25519-signature",
+            keyId: identifier(provenance.keyId, "Action approval provenance key id"),
+            signature: provenance.signature,
+        },
+    };
 }
 export function createSyntheticActionAdapter() {
     return {
@@ -116,15 +190,31 @@ export function createSyntheticActionAdapter() {
         },
         async execute(action, controls) {
             const receipt = await runSubscriptionFailureWorkflow(action.arguments.worldId, action.actionId, controls?.commit);
-            return { outcome: "committed", providerRequestId: `synthetic_${receipt.actionId}`, result: { worldId: action.arguments.worldId, subscriptionId: receipt.subscriptionId, syntheticReceiptId: receipt.actionId } };
+            return {
+                outcome: "committed",
+                providerRequestId: `synthetic_${receipt.actionId}`,
+                result: {
+                    worldId: action.arguments.worldId,
+                    subscriptionId: receipt.subscriptionId,
+                    syntheticReceiptId: receipt.actionId,
+                },
+            };
         },
         async verify(action) {
             const world = await inspectWorld(action.arguments.worldId);
             const receipt = world.state.receipts.find((candidate) => candidate.actionId === action.actionId);
             return receipt === undefined
                 ? { committed: false }
-                : { committed: true, providerRequestId: `synthetic_${receipt.actionId}`, result: { worldId: action.arguments.worldId, subscriptionId: receipt.subscriptionId, syntheticReceiptId: receipt.actionId } };
-        }
+                : {
+                    committed: true,
+                    providerRequestId: `synthetic_${receipt.actionId}`,
+                    result: {
+                        worldId: action.arguments.worldId,
+                        subscriptionId: receipt.subscriptionId,
+                        syntheticReceiptId: receipt.actionId,
+                    },
+                };
+        },
     };
 }
 export class LocalActionGateway {
@@ -137,13 +227,18 @@ export class LocalActionGateway {
         this.now = options.now ?? (() => new Date());
         this.pathForAction = options.pathForAction ?? getActionPath;
         this.adapter = options.adapter ?? createSyntheticActionAdapter();
-        this.safetyController = options.safetyController ?? createLocalSafetyController({ now: this.now });
-        this.approvalVerifier = options.approvalVerifier ?? createDisabledActionApprovalVerifier();
+        this.safetyController =
+            options.safetyController ??
+                createLocalSafetyController({ now: this.now });
+        this.approvalVerifier =
+            options.approvalVerifier ?? createDisabledActionApprovalVerifier();
     }
     async submit(actionValue, approvalValue, policy) {
         const action = validateActionEnvelope(actionValue);
         const approval = validateActionApproval(approvalValue);
-        const verification = await this.approvalVerifier.verify(action, approval, { phase: "submit" });
+        const verification = await this.approvalVerifier.verify(action, approval, {
+            phase: "submit",
+        });
         requireApprovalInboxVerification(approval, verification);
         const current = this.now().toISOString();
         verifyPolicy(action, policy);
@@ -152,14 +247,22 @@ export class LocalActionGateway {
         return withFileLock(path, async () => {
             const existing = await readStoredAction(path, false);
             if (existing !== null) {
-                if (existing.actionHash === actionDigest && actionApprovalHash(existing.approval) === actionApprovalHash(approval))
+                if (existing.actionHash === actionDigest &&
+                    actionApprovalHash(existing.approval) === actionApprovalHash(approval))
                     return existing;
                 throw new ActionGatewayError("Action id already exists with a different immutable envelope or approval.");
             }
             if (Date.parse(action.expiresAt) <= Date.parse(current))
                 throw new ActionGatewayError("Action has expired.");
             verifyApproval(action, approval, current);
-            const record = { schemaVersion: 1, kind: "ghostapi.action-record", envelope: action, actionHash: actionDigest, approval, receipts: [] };
+            const record = {
+                schemaVersion: 1,
+                kind: "ghostapi.action-record",
+                envelope: action,
+                actionHash: actionDigest,
+                approval,
+                receipts: [],
+            };
             record.receipts.push(createReceipt(record, "requested", current));
             await writeStoredAction(path, record);
             return record;
@@ -178,11 +281,14 @@ export class LocalActionGateway {
             const approvalVerification = await this.approvalVerifier.verify(record.envelope, record.approval, { phase: "execute" });
             requireApprovalInboxVerification(record.approval, approvalVerification);
             const current = this.now().toISOString();
-            if (actionHash(requested) !== record.actionHash || canonicalizeActionEnvelope(requested) !== canonicalizeActionEnvelope(record.envelope))
+            if (actionHash(requested) !== record.actionHash ||
+                canonicalizeActionEnvelope(requested) !==
+                    canonicalizeActionEnvelope(record.envelope))
                 throw new ActionGatewayError("Action envelope changed after approval; execution is blocked.");
             verifyApproval(record.envelope, record.approval, current, false);
             verifyPolicy(record.envelope, policy);
-            if (identity.actorId !== record.envelope.actor.id || identity.workloadId !== record.envelope.actor.workloadId)
+            if (identity.actorId !== record.envelope.actor.id ||
+                identity.workloadId !== record.envelope.actor.workloadId)
                 throw new ActionGatewayError("Execution identity does not match the approved action.");
             if (!this.adapter.supports(record.envelope.operation))
                 throw new ActionGatewayError(`Execution adapter does not support action operation: ${record.envelope.operation}`);
@@ -192,7 +298,9 @@ export class LocalActionGateway {
             const committed = findLatestReceipt(record.receipts, "committed");
             if (committed !== undefined) {
                 const reconciliation = await this.adapter.verify(record.envelope);
-                if (!reconciliation.committed || reconciliation.providerRequestId === undefined || reconciliation.result === undefined)
+                if (!reconciliation.committed ||
+                    reconciliation.providerRequestId === undefined ||
+                    reconciliation.result === undefined)
                     throw new ActionGatewayError("Committed action verification is incomplete; execution will not retry without idempotency proof.");
                 const verifiedReceipt = createReceipt(record, "verified", current, reconciliation.providerRequestId, reconciliation.result);
                 appendReceipt(record, verifiedReceipt);
@@ -202,7 +310,9 @@ export class LocalActionGateway {
             const attempted = findLatestReceipt(record.receipts, "attempted");
             if (attempted !== undefined) {
                 const reconciliation = await this.adapter.verify(record.envelope);
-                if (!reconciliation.committed || reconciliation.providerRequestId === undefined || reconciliation.result === undefined)
+                if (!reconciliation.committed ||
+                    reconciliation.providerRequestId === undefined ||
+                    reconciliation.result === undefined)
                     throw new ActionGatewayError("Prior action outcome is unknown; execution will not retry without idempotency proof.");
                 appendReceipt(record, createReceipt(record, "committed", current, reconciliation.providerRequestId, reconciliation.result));
                 const verifiedReceipt = createReceipt(record, "verified", current, reconciliation.providerRequestId, reconciliation.result);
@@ -222,17 +332,27 @@ export class LocalActionGateway {
             await writeStoredAction(path, record);
             let execution;
             try {
-                execution = await this.adapter.execute(record.envelope, { commit: safety.commit });
+                execution = await this.adapter.execute(record.envelope, {
+                    commit: safety.commit,
+                });
             }
             catch {
-                await safety.complete({ success: false, latencyMs: 0, reason: "synthetic execution failed or was stopped" });
+                await safety.complete({
+                    success: false,
+                    latencyMs: 0,
+                    reason: "synthetic execution failed or was stopped",
+                });
                 const failed = createReceipt(record, "failed", this.now().toISOString(), undefined, undefined, { code: "execution_error", retrySafe: false });
                 appendReceipt(record, failed);
                 await writeStoredAction(path, record);
                 throw new ActionGatewayError("Action execution failed; it was not automatically retried.");
             }
             if (execution.outcome === "unknown") {
-                await safety.complete({ success: false, latencyMs: 0, reason: "synthetic execution outcome is unknown" });
+                await safety.complete({
+                    success: false,
+                    latencyMs: 0,
+                    reason: "synthetic execution outcome is unknown",
+                });
                 const failed = createReceipt(record, "failed", this.now().toISOString(), undefined, undefined, { code: "unknown_outcome", retrySafe: false });
                 appendReceipt(record, failed);
                 await writeStoredAction(path, record);
@@ -241,8 +361,15 @@ export class LocalActionGateway {
             appendReceipt(record, createReceipt(record, "committed", this.now().toISOString(), execution.providerRequestId, execution.result));
             await writeStoredAction(path, record);
             const verification = await this.adapter.verify(record.envelope);
-            if (!verification.committed || verification.providerRequestId === undefined || verification.result === undefined) {
-                await safety.complete({ success: false, reconciliationMismatch: true, latencyMs: 0, reason: "synthetic verification did not prove the result" });
+            if (!verification.committed ||
+                verification.providerRequestId === undefined ||
+                verification.result === undefined) {
+                await safety.complete({
+                    success: false,
+                    reconciliationMismatch: true,
+                    latencyMs: 0,
+                    reason: "synthetic verification did not prove the result",
+                });
                 const failed = createReceipt(record, "failed", this.now().toISOString(), execution.providerRequestId, execution.result, { code: "verification_failed", retrySafe: false });
                 appendReceipt(record, failed);
                 await writeStoredAction(path, record);
@@ -257,7 +384,8 @@ export class LocalActionGateway {
     }
     async compensate(actionId) {
         const action = await this.inspect(actionId);
-        if (this.adapter.compensate === undefined || action.envelope.reversibility !== "compensatable")
+        if (this.adapter.compensate === undefined ||
+            action.envelope.reversibility !== "compensatable")
             throw new ActionGatewayError("Compensation is unsupported for this action; no rollback is claimed.");
         await this.adapter.compensate(action.envelope);
         throw new ActionGatewayError("Compensation adapters must return a durable compensation receipt before this operation can be exposed.");
@@ -275,32 +403,51 @@ function safetyAction(action, actionDigest) {
         riskClass: action.riskClass,
         idempotencyKey: action.idempotencyKey,
         actionHash: actionDigest,
-        costs: { monetaryAmountMinor: 0, requests: 1, messages: 1, mutations: 1, deletes: 0, tokenCost: 0 }
+        costs: {
+            monetaryAmountMinor: 0,
+            requests: 1,
+            messages: 1,
+            mutations: 1,
+            deletes: 0,
+            tokenCost: 0,
+        },
     };
 }
 export function createLocalActionGateway(options = {}) {
     return new LocalActionGateway(options);
 }
 export function createDisabledActionApprovalVerifier() {
-    return { async verify() { throw new ActionGatewayError("Action approval authenticity could not be verified."); } };
+    return {
+        async verify() {
+            throw new ActionGatewayError("Action approval authenticity could not be verified.");
+        },
+    };
 }
 export function createEd25519ActionApprovalSigner(options) {
     const keyId = identifier(options.keyId, "Action approval signing key id");
-    const privateKey = options.privateKey instanceof KeyObject ? options.privateKey : createPrivateKey(options.privateKey);
-    if (privateKey.type !== "private" || privateKey.asymmetricKeyType !== "ed25519")
+    const privateKey = options.privateKey instanceof KeyObject
+        ? options.privateKey
+        : createPrivateKey(options.privateKey);
+    if (privateKey.type !== "private" ||
+        privateKey.asymmetricKeyType !== "ed25519")
         throw new ActionGatewayError("Action approval signing key must be an Ed25519 private key.");
     return {
         issue(value) {
             const approval = validateUnsignedActionApproval(value);
             const signature = sign(null, Buffer.from(canonicalJson(approval), "utf8"), privateKey).toString("base64url");
-            return { ...approval, provenance: { kind: "ghostapi.ed25519-signature", keyId, signature } };
-        }
+            return {
+                ...approval,
+                provenance: { kind: "ghostapi.ed25519-signature", keyId, signature },
+            };
+        },
     };
 }
 export function createEd25519ActionApprovalVerifier(options) {
     const keys = new Map(Object.entries(options.trustedKeys).map(([keyId, key]) => {
         const parsedId = identifier(keyId, "Action approval verification key id");
-        const publicKey = key instanceof KeyObject && key.type === "public" ? key : createPublicKey(key);
+        const publicKey = key instanceof KeyObject && key.type === "public"
+            ? key
+            : createPublicKey(key);
         if (publicKey.asymmetricKeyType !== "ed25519")
             throw new ActionGatewayError("Action approval verification key must be Ed25519.");
         return [parsedId, publicKey];
@@ -309,20 +456,26 @@ export function createEd25519ActionApprovalVerifier(options) {
         async verify(action, approval) {
             const parsed = validateActionApproval(approval);
             const publicKey = keys.get(parsed.provenance.keyId);
-            const valid = publicKey !== undefined && verify(null, Buffer.from(canonicalJson(unsignedActionApproval(parsed)), "utf8"), publicKey, Buffer.from(parsed.provenance.signature, "base64url"));
+            const valid = publicKey !== undefined &&
+                verify(null, Buffer.from(canonicalJson(unsignedActionApproval(parsed)), "utf8"), publicKey, Buffer.from(parsed.provenance.signature, "base64url"));
             if (!valid || parsed.actionHash !== actionHash(action))
                 throw new ActionGatewayError("Action approval authenticity could not be verified.");
             return { provenance: "verified" };
-        }
+        },
     };
 }
 export function createTestActionApprovalVerifier() {
     const { privateKey, publicKey } = generateKeyPairSync("ed25519");
-    const signer = createEd25519ActionApprovalSigner({ keyId: "test-approval-key", privateKey });
+    const signer = createEd25519ActionApprovalSigner({
+        keyId: "test-approval-key",
+        privateKey,
+    });
     return {
-        verifier: createEd25519ActionApprovalVerifier({ trustedKeys: { "test-approval-key": publicKey } }),
+        verifier: createEd25519ActionApprovalVerifier({
+            trustedKeys: { "test-approval-key": publicKey },
+        }),
         signer,
-        issue: (approval) => signer.issue(approval)
+        issue: (approval) => signer.issue(approval),
     };
 }
 export function getActionPath(actionId) {
@@ -357,7 +510,8 @@ async function writeStoredAction(path, record) {
 export function validateStoredAction(value) {
     const record = object(value, "Action record must be an object.");
     exactKeys(record, ["schemaVersion", "kind", "envelope", "actionHash", "approval", "receipts"], "Action record");
-    if (record.schemaVersion !== ACTION_SCHEMA_VERSION || record.kind !== RECORD_KIND)
+    if (record.schemaVersion !== ACTION_SCHEMA_VERSION ||
+        record.kind !== RECORD_KIND)
         throw new ActionGatewayError("Unsupported action record schema.");
     const envelope = validateActionEnvelope(record.envelope);
     const digest = hash(record.actionHash, "Action record hash");
@@ -366,16 +520,43 @@ export function validateStoredAction(value) {
     const approval = validateActionApproval(record.approval);
     verifyApproval(envelope, approval, new Date(0).toISOString(), false);
     const rawReceipts = record.receipts;
-    if (!Array.isArray(rawReceipts) || rawReceipts.length < 1 || rawReceipts.length > MAX_RECEIPTS)
+    if (!Array.isArray(rawReceipts) ||
+        rawReceipts.length < 1 ||
+        rawReceipts.length > MAX_RECEIPTS)
         throw new ActionGatewayError("Action record receipts are invalid.");
-    const receipts = rawReceipts.map((receipt, index) => validateReceipt(receipt, envelope.actionId, digest, index === 0 ? receiptGenesisHash(digest) : rawReceipts[index - 1].receiptHash));
+    const receipts = rawReceipts.map((receipt, index) => validateReceipt(receipt, envelope.actionId, digest, index === 0
+        ? receiptGenesisHash(digest)
+        : rawReceipts[index - 1].receiptHash));
     if (receipts[0].status !== "requested")
         throw new ActionGatewayError("Action record must begin with a requested receipt.");
-    return { schemaVersion: 1, kind: "ghostapi.action-record", envelope, actionHash: digest, approval, receipts };
+    return {
+        schemaVersion: 1,
+        kind: "ghostapi.action-record",
+        envelope,
+        actionHash: digest,
+        approval,
+        receipts,
+    };
 }
 function createReceipt(record, status, timestamp, providerRequestId, result, failure) {
-    const previousReceiptHash = record.receipts.length === 0 ? receiptGenesisHash(record.actionHash) : record.receipts.at(-1).receiptHash;
-    const base = { receiptId: identifier(`receipt-${randomUUID().replace(/-/g, "")}`, "Receipt id"), actionId: record.envelope.actionId, actionHash: record.actionHash, status, timestamp: timestampValue(timestamp, "Action receipt timestamp"), ...(providerRequestId === undefined ? {} : { providerRequestId: identifier(providerRequestId, "Provider request id") }), ...(result === undefined ? {} : { result }), ...(failure === undefined ? {} : { failure }), previousReceiptHash };
+    const previousReceiptHash = record.receipts.length === 0
+        ? receiptGenesisHash(record.actionHash)
+        : record.receipts.at(-1).receiptHash;
+    const base = {
+        receiptId: identifier(`receipt-${randomUUID().replace(/-/g, "")}`, "Receipt id"),
+        actionId: record.envelope.actionId,
+        actionHash: record.actionHash,
+        status,
+        timestamp: timestampValue(timestamp, "Action receipt timestamp"),
+        ...(providerRequestId === undefined
+            ? {}
+            : {
+                providerRequestId: identifier(providerRequestId, "Provider request id"),
+            }),
+        ...(result === undefined ? {} : { result }),
+        ...(failure === undefined ? {} : { failure }),
+        previousReceiptHash,
+    };
     return { ...base, receiptHash: sha256(canonicalJson(base)) };
 }
 function appendReceipt(record, receipt) {
@@ -385,38 +566,80 @@ function appendReceipt(record, receipt) {
 }
 function validateReceipt(value, actionId, actionDigest, previousReceiptHash) {
     const receipt = object(value, "Action receipt is invalid.");
-    exactKeys(receipt, ["receiptId", "actionId", "actionHash", "status", "timestamp", "providerRequestId", "result", "failure", "previousReceiptHash", "receiptHash"], "Action receipt");
-    if (receipt.actionId !== actionId || receipt.actionHash !== actionDigest || receipt.previousReceiptHash !== previousReceiptHash || (receipt.status !== "requested" && receipt.status !== "attempted" && receipt.status !== "committed" && receipt.status !== "verified" && receipt.status !== "failed"))
+    exactKeys(receipt, [
+        "receiptId",
+        "actionId",
+        "actionHash",
+        "status",
+        "timestamp",
+        "providerRequestId",
+        "result",
+        "failure",
+        "previousReceiptHash",
+        "receiptHash",
+    ], "Action receipt");
+    if (receipt.actionId !== actionId ||
+        receipt.actionHash !== actionDigest ||
+        receipt.previousReceiptHash !== previousReceiptHash ||
+        (receipt.status !== "requested" &&
+            receipt.status !== "attempted" &&
+            receipt.status !== "committed" &&
+            receipt.status !== "verified" &&
+            receipt.status !== "failed"))
         throw new ActionGatewayError("Action receipt linkage is invalid.");
-    const providerRequestId = receipt.providerRequestId === undefined ? undefined : identifier(receipt.providerRequestId, "Provider request id");
+    const providerRequestId = receipt.providerRequestId === undefined
+        ? undefined
+        : identifier(receipt.providerRequestId, "Provider request id");
     const result = receipt.result === undefined ? undefined : normalizeResult(receipt.result);
-    const failure = receipt.failure === undefined ? undefined : normalizeFailure(receipt.failure);
-    if ((receipt.status === "committed" || receipt.status === "verified") && (providerRequestId === undefined || result === undefined))
+    const failure = receipt.failure === undefined
+        ? undefined
+        : normalizeFailure(receipt.failure);
+    if ((receipt.status === "committed" || receipt.status === "verified") &&
+        (providerRequestId === undefined || result === undefined))
         throw new ActionGatewayError("Committed and verified receipts require a provider result.");
     if (receipt.status === "failed" && failure === undefined)
         throw new ActionGatewayError("Failed receipt requires a failure classification.");
     const status = receipt.status;
-    const base = { receiptId: identifier(receipt.receiptId, "Receipt id"), actionId, actionHash: actionDigest, status, timestamp: timestampValue(receipt.timestamp, "Action receipt timestamp"), ...(providerRequestId === undefined ? {} : { providerRequestId }), ...(result === undefined ? {} : { result }), ...(failure === undefined ? {} : { failure }), previousReceiptHash };
-    if (hash(receipt.receiptHash, "Action receipt hash") !== sha256(canonicalJson(base)))
+    const base = {
+        receiptId: identifier(receipt.receiptId, "Receipt id"),
+        actionId,
+        actionHash: actionDigest,
+        status,
+        timestamp: timestampValue(receipt.timestamp, "Action receipt timestamp"),
+        ...(providerRequestId === undefined ? {} : { providerRequestId }),
+        ...(result === undefined ? {} : { result }),
+        ...(failure === undefined ? {} : { failure }),
+        previousReceiptHash,
+    };
+    if (hash(receipt.receiptHash, "Action receipt hash") !==
+        sha256(canonicalJson(base)))
         throw new ActionGatewayError("Action receipt hash is invalid.");
     return { ...base, receiptHash: receipt.receiptHash };
 }
 function normalizeResult(value) {
     const result = object(value, "Action receipt result is invalid.");
     exactKeys(result, ["worldId", "subscriptionId", "syntheticReceiptId"], "Action receipt result");
-    return { worldId: identifier(result.worldId, "Action receipt world id"), subscriptionId: identifier(result.subscriptionId, "Action receipt subscription id"), syntheticReceiptId: identifier(result.syntheticReceiptId, "Action receipt synthetic receipt id") };
+    return {
+        worldId: identifier(result.worldId, "Action receipt world id"),
+        subscriptionId: identifier(result.subscriptionId, "Action receipt subscription id"),
+        syntheticReceiptId: identifier(result.syntheticReceiptId, "Action receipt synthetic receipt id"),
+    };
 }
 function normalizeFailure(value) {
     const failure = object(value, "Action receipt failure is invalid.");
     exactKeys(failure, ["code", "retrySafe"], "Action receipt failure");
-    if ((failure.code !== "execution_error" && failure.code !== "unknown_outcome" && failure.code !== "verification_failed") || failure.retrySafe !== false)
+    if ((failure.code !== "execution_error" &&
+        failure.code !== "unknown_outcome" &&
+        failure.code !== "verification_failed") ||
+        failure.retrySafe !== false)
         throw new ActionGatewayError("Action receipt failure is invalid.");
     return { code: failure.code, retrySafe: false };
 }
 function verifyApproval(action, approval, now, enforceExpiry = true) {
     if (approval.actionHash !== actionHash(action))
         throw new ActionGatewayError("Action approval is not bound to the exact canonical action hash.");
-    if (approval.approvedBy === action.actor.id || approval.approvedBy === action.actor.workloadId)
+    if (approval.approvedBy === action.actor.id ||
+        approval.approvedBy === action.actor.workloadId)
         throw new ActionGatewayError("An action actor cannot approve its own high-risk action.");
     if (enforceExpiry && Date.parse(approval.approvedAt) > Date.parse(now))
         throw new ActionGatewayError("Action approval timestamp is in the future.");
@@ -426,7 +649,8 @@ function verifyApproval(action, approval, now, enforceExpiry = true) {
 function verifyPolicy(action, policy) {
     if (!policy.allowed)
         throw new ActionGatewayError("Current policy denies action execution.");
-    if (policy.version !== action.policy.version || policy.hash !== action.policy.hash)
+    if (policy.version !== action.policy.version ||
+        policy.hash !== action.policy.hash)
         throw new ActionGatewayError("Current policy reference does not match the approved action.");
 }
 function receiptGenesisHash(actionDigest) {
@@ -451,7 +675,9 @@ function exactKeys(value, keys, label) {
             throw new ActionGatewayError(`${label} contains unsupported field: ${key}`);
 }
 function identifier(value, label) {
-    if (typeof value !== "string" || !IDENTIFIER.test(value) || sanitizeSecretString(value) !== value)
+    if (typeof value !== "string" ||
+        !IDENTIFIER.test(value) ||
+        sanitizeSecretString(value) !== value)
         throw new ActionGatewayError(`${label} must be a safe stable identifier.`);
     return value;
 }
@@ -469,7 +695,9 @@ function timestamp(value, label) {
     return timestampValue(value, label);
 }
 function timestampValue(value, label) {
-    if (typeof value !== "string" || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) || !Number.isFinite(Date.parse(value)))
+    if (typeof value !== "string" ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) ||
+        !Number.isFinite(Date.parse(value)))
         throw new ActionGatewayError(`${label} must be an ISO UTC timestamp.`);
     return value;
 }
@@ -488,18 +716,38 @@ function canonicalJson(value) {
         return `[${value.map(canonicalJson).join(",")}]`;
     if (typeof value === "object") {
         const record = value;
-        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+        return `{${Object.keys(record)
+            .sort()
+            .map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`)
+            .join(",")}}`;
     }
     throw new ActionGatewayError("Canonical action values must be JSON data.");
 }
 function requireApprovalInboxVerification(approval, verification) {
-    if (approval.approvedBy === "approval-inbox" && verification.approvalInboxRequestId !== approval.approvalId)
+    if (approval.approvedBy === "approval-inbox" &&
+        verification.approvalInboxRequestId !== approval.approvalId)
         throw new ActionGatewayError("Approval inbox provenance is not active for execution.");
 }
 function validateUnsignedActionApproval(value) {
     const approval = object(value, "Action approval must be an object.");
-    exactKeys(approval, ["schemaVersion", "kind", "approvalId", "actionHash", "approvedBy", "approvedAt", "expiresAt", "nonce"], "Unsigned action approval");
-    return unsignedActionApproval(validateActionApproval({ ...approval, provenance: { kind: "ghostapi.ed25519-signature", keyId: "validation-key", signature: "A".repeat(86) } }));
+    exactKeys(approval, [
+        "schemaVersion",
+        "kind",
+        "approvalId",
+        "actionHash",
+        "approvedBy",
+        "approvedAt",
+        "expiresAt",
+        "nonce",
+    ], "Unsigned action approval");
+    return unsignedActionApproval(validateActionApproval({
+        ...approval,
+        provenance: {
+            kind: "ghostapi.ed25519-signature",
+            keyId: "validation-key",
+            signature: "A".repeat(86),
+        },
+    }));
 }
 function unsignedActionApproval(approval) {
     const { provenance: _provenance, ...unsigned } = approval;