agentcert 0.2.7 → 0.3.0

package/dist/vendor/onegent-runtime/service.js

@@ -0,0 +1,421 @@
+import { DEFAULT_POLICY_RULES, evaluatePolicy, getPolicyRules } from "./policies.js";
+import { assessRisk } from "./risk.js";
+import { nextId, nowIso, store } from "./store.js";
+import { getPurchaseOrder, submitMockPurchaseOrder } from "./mock-procurement.js";
+export function captureActionIntent(input, options = {}) {
+    const idempotencyKey = input.idempotencyKey?.trim();
+    if (idempotencyKey && idempotencyKey.length > 200)
+        throw new Error("Action idempotencyKey cannot exceed 200 characters.");
+    const action = {
+        id: nextId("act"),
+        idempotencyKey: idempotencyKey || "",
+        workspaceId: input.workspaceId ?? "demo-workspace",
+        workflowId: input.workflowId ?? "demo-workflow",
+        sourceAgentName: input.sourceAgentName,
+        sourceAgentRunId: input.sourceAgentRunId,
+        principal: input.principal ?? { id: input.sourceAgentName, type: "agent" },
+        requestedPermissions: input.requestedPermissions ?? [`${input.targetSystem}:${input.actionType}`],
+        actionType: input.actionType,
+        targetSystem: input.targetSystem,
+        targetUrl: input.targetUrl,
+        environment: input.environment ?? "demo",
+        title: input.title,
+        description: input.description,
+        businessObjectType: input.businessObjectType,
+        businessObjectId: input.businessObjectId,
+        amount: input.amount,
+        currency: input.currency,
+        recipient: input.recipient,
+        vendorName: input.vendorName,
+        beforeState: input.beforeState ?? {},
+        proposedAfterState: input.proposedAfterState ?? {},
+        fieldsChanged: input.fieldsChanged ?? [],
+        rawAgentReasoningSummary: input.rawAgentReasoningSummary,
+        createdAt: nowIso(),
+        status: "CAPTURED",
+    };
+    action.idempotencyKey ||= action.id;
+    store.actions.set(action.id, action);
+    appendAudit(action.id, "ACTION_CAPTURED", "AGENT", action.sourceAgentName, "Action intent captured from agent.", {
+        actionType: action.actionType,
+        targetSystem: action.targetSystem,
+    });
+    const risk = assessRisk(action);
+    store.riskAssessments.set(action.id, risk);
+    appendAudit(action.id, "RISK_ASSESSED", "SYSTEM", "onegent-runtime", "Risk assessment completed.", {
+        riskLevel: risk.riskLevel,
+        riskScore: risk.riskScore,
+    });
+    if (options.authorizationPolicy) {
+        const authorization = evaluateAuthorization(action, options.authorizationPolicy);
+        store.authorizationDecisions.set(action.id, authorization);
+        appendAudit(action.id, "AUTHORIZATION_CHECKED", "SYSTEM", options.authorizationPolicy.name, "Action authorization checked.", {
+            decision: authorization.decision,
+            principalId: authorization.principalId,
+            requestedPermissions: authorization.requestedPermissions,
+            grantedPermissions: authorization.grantedPermissions,
+            policyVersion: authorization.policyVersion,
+        });
+        if (authorization.decision === "DENY") {
+            action.status = "CANCELLED";
+            store.actions.set(action.id, action);
+            store.policyRulesByAction.set(action.id, []);
+            return getActionReview(action.id);
+        }
+    }
+    const configuredRules = options.policyRules ?? DEFAULT_POLICY_RULES;
+    const policy = options.policyEngine?.evaluate(action, risk, configuredRules) ?? evaluatePolicy(action, risk, options.policyRules);
+    store.policyRulesByAction.set(action.id, getPolicyRules(policy.triggeredPolicies, configuredRules === DEFAULT_POLICY_RULES ? DEFAULT_POLICY_RULES : [...configuredRules, ...DEFAULT_POLICY_RULES]));
+    appendAudit(action.id, "POLICY_EVALUATED", "SYSTEM", "onegent-runtime", "Policy evaluation completed.", {
+        effect: policy.effect,
+        triggeredPolicies: policy.triggeredPolicies,
+    });
+    if (policy.blocked) {
+        action.status = "CANCELLED";
+        store.actions.set(action.id, action);
+        return getActionReview(action.id);
+    }
+    if (policy.requiresHumanApproval) {
+        action.status = "NEEDS_REVIEW";
+        store.actions.set(action.id, action);
+        const approvalRequest = {
+            id: nextId("approval"),
+            actionIntentId: action.id,
+            riskAssessmentId: risk.id,
+            requestedBy: action.sourceAgentName,
+            assignedTo: "human-approver@example.local",
+            status: "PENDING",
+            createdAt: nowIso(),
+        };
+        store.approvals.set(action.id, approvalRequest);
+        appendAudit(action.id, "APPROVAL_REQUESTED", "SYSTEM", "onegent-runtime", "Human approval requested.", {
+            assignedTo: approvalRequest.assignedTo,
+        });
+        return getActionReview(action.id);
+    }
+    executeMockAction(action.id);
+    verifyAction(action.id);
+    return getActionReview(action.id);
+}
+export function approveAction(actionId, reviewerId = "human-approver@example.local", reviewerComment = "Approved for local demo execution.", options = {}) {
+    const action = requireAction(actionId);
+    const approval = requireApproval(actionId);
+    if (approval.status !== "PENDING") {
+        throw new Error(`Action ${actionId} does not have a pending approval request.`);
+    }
+    approval.status = "APPROVED";
+    approval.reviewedAt = nowIso();
+    approval.reviewerComment = reviewerComment;
+    store.approvals.set(actionId, approval);
+    action.status = "APPROVED";
+    store.actions.set(actionId, action);
+    appendAudit(action.id, "ACTION_APPROVED", "HUMAN", reviewerId, "Human approver approved the action.", {
+        reviewerComment,
+    });
+    if (options.autoExecute ?? true) {
+        executeMockAction(action.id);
+        verifyAction(action.id);
+    }
+    return getActionReview(action.id);
+}
+export function requestApproval(actionId, assignedTo = "human-approver@example.local", requestedBy = "onegent-runtime") {
+    const action = requireAction(actionId);
+    const existingApproval = store.approvals.get(actionId);
+    if (existingApproval) {
+        return existingApproval;
+    }
+    if (action.status === "REJECTED" || action.status === "EXECUTED" || action.status === "VERIFIED") {
+        throw new Error(`Action ${actionId} cannot request approval from status ${action.status}.`);
+    }
+    const risk = store.riskAssessments.get(actionId) ?? assessRisk(action);
+    store.riskAssessments.set(actionId, risk);
+    const approvalRequest = {
+        id: nextId("approval"),
+        actionIntentId: action.id,
+        riskAssessmentId: risk.id,
+        requestedBy,
+        assignedTo,
+        status: "PENDING",
+        createdAt: nowIso(),
+    };
+    action.status = "NEEDS_REVIEW";
+    store.actions.set(action.id, action);
+    store.approvals.set(action.id, approvalRequest);
+    appendAudit(action.id, "APPROVAL_REQUESTED", "SYSTEM", "onegent-runtime", "Human approval requested.", {
+        assignedTo: approvalRequest.assignedTo,
+    });
+    return approvalRequest;
+}
+export function rejectAction(actionId, reviewerId = "human-approver@example.local", reviewerComment = "Rejected by human approver.") {
+    const action = requireAction(actionId);
+    const approval = requireApproval(actionId);
+    if (approval.status !== "PENDING") {
+        throw new Error(`Action ${actionId} does not have a pending approval request.`);
+    }
+    approval.status = "REJECTED";
+    approval.reviewedAt = nowIso();
+    approval.reviewerComment = reviewerComment;
+    store.approvals.set(actionId, approval);
+    action.status = "REJECTED";
+    store.actions.set(action.id, action);
+    appendAudit(action.id, "ACTION_REJECTED", "HUMAN", reviewerId, "Human approver rejected the action.", {
+        reviewerComment,
+    });
+    return getActionReview(action.id);
+}
+export function executeAfterApproval(actionId) {
+    const action = requireAction(actionId);
+    const approval = store.approvals.get(actionId);
+    assertExecutableAfterApproval(action, approval);
+    if (action.status === "EXECUTED" || action.status === "VERIFIED" || action.status === "FAILED_VERIFICATION") {
+        return buildExecutionSummary(action);
+    }
+    return executeMockAction(actionId);
+}
+export async function executeAfterApprovalWithAdapter(actionId, adapter, context) {
+    const action = requireAction(actionId);
+    const approval = store.approvals.get(actionId);
+    assertExecutableAfterApproval(action, approval);
+    if (action.status === "EXECUTED" || action.status === "VERIFIED" || action.status === "FAILED_VERIFICATION") {
+        return buildExecutionSummary(action);
+    }
+    appendAudit(action.id, "MOCK_EXECUTION_STARTED", "SYSTEM", "onegent-runtime", "Local adapter execution started.", {
+        adapter: adapter.name,
+        targetSystem: action.targetSystem,
+    });
+    const result = await adapter.execute(action, context);
+    action.status = "EXECUTED";
+    store.actions.set(action.id, action);
+    appendAudit(action.id, "MOCK_EXECUTION_COMPLETED", "SYSTEM", "onegent-runtime", "Local adapter execution completed.", {
+        adapter: adapter.name,
+        method: result.method ?? "LOCAL_ADAPTER",
+        observedState: result.observedState,
+    });
+    return {
+        method: result.method ?? "LOCAL_ADAPTER",
+        status: "COMPLETED",
+        targetSystem: result.targetSystem ?? action.targetSystem,
+        previousState: result.previousState ?? action.beforeState,
+        observedState: result.observedState,
+        rollbackToken: result.rollbackToken,
+    };
+}
+export function recordRollback(actionId, adapterName, reason, result) {
+    const action = requireAction(actionId);
+    appendAudit(action.id, "ROLLBACK_STARTED", "SYSTEM", "onegent-runtime", "Compensating rollback started.", {
+        adapter: adapterName,
+        reason,
+        idempotencyKey: action.idempotencyKey,
+    });
+    action.status = result.success ? "ROLLED_BACK" : "ROLLBACK_FAILED";
+    store.actions.set(action.id, action);
+    appendAudit(action.id, result.success ? "ROLLBACK_COMPLETED" : "ROLLBACK_FAILED", "SYSTEM", "onegent-runtime", result.success ? "Compensating rollback completed." : "Compensating rollback failed.", { adapter: adapterName, reason, observedState: result.observedState, message: result.message });
+    return getActionReview(action.id);
+}
+export function executeMockAction(actionId) {
+    const action = requireAction(actionId);
+    if (action.status === "NEEDS_REVIEW") {
+        throw new Error(`Action ${actionId} requires human approval before execution.`);
+    }
+    appendAudit(action.id, "MOCK_EXECUTION_STARTED", "SYSTEM", "onegent-runtime", "Local mock execution started.", {
+        targetSystem: action.targetSystem,
+    });
+    let observedState = action.proposedAfterState;
+    let previousState = action.beforeState;
+    let method = "MOCK";
+    if (action.actionType === "SUBMIT" &&
+        action.businessObjectType === "purchase_order" &&
+        action.targetSystem === "MockERP") {
+        const previousPurchaseOrder = getPurchaseOrder(action.businessObjectId);
+        previousState = previousPurchaseOrder ? purchaseOrderState(previousPurchaseOrder) : action.beforeState;
+        const updatedPurchaseOrder = submitMockPurchaseOrder(action);
+        observedState = purchaseOrderState(updatedPurchaseOrder);
+        method = "LOCAL_MOCK_ERP";
+    }
+    action.status = "EXECUTED";
+    store.actions.set(action.id, action);
+    appendAudit(action.id, "MOCK_EXECUTION_COMPLETED", "SYSTEM", "onegent-runtime", "Local mock execution completed.", {
+        method,
+        observedState,
+    });
+    return {
+        method,
+        status: "COMPLETED",
+        targetSystem: action.targetSystem,
+        previousState,
+        observedState,
+    };
+}
+export function verifyOutcome(actionId, observedState) {
+    return verifyAction(actionId, observedState);
+}
+export function verifyAction(actionId, observedState) {
+    const action = requireAction(actionId);
+    if (action.status !== "EXECUTED" && action.status !== "VERIFIED" && action.status !== "FAILED_VERIFICATION") {
+        throw new Error(`Action ${actionId} must be mock-executed before verification.`);
+    }
+    const effectiveObservedState = observedState ?? observeActionState(action);
+    const differences = diffState(action.proposedAfterState, effectiveObservedState);
+    const success = differences.length === 0;
+    const method = action.businessObjectType === "purchase_order" && action.targetSystem === "MockERP" ? "LOCAL_MOCK_ERP" : "MOCK";
+    const result = {
+        id: nextId("verify"),
+        actionIntentId: action.id,
+        expectedState: action.proposedAfterState,
+        observedState: effectiveObservedState,
+        success,
+        differences,
+        verificationMethod: method,
+        createdAt: nowIso(),
+    };
+    store.verifications.set(action.id, result);
+    action.status = success ? "VERIFIED" : "FAILED_VERIFICATION";
+    store.actions.set(action.id, action);
+    appendAudit(action.id, success ? "VERIFICATION_PASSED" : "VERIFICATION_FAILED", "SYSTEM", "onegent-runtime", success ? "Observed state matched expected state." : "Observed state did not match expected state.", { differences });
+    return result;
+}
+export function getActionReview(actionId) {
+    const action = requireAction(actionId);
+    const riskAssessment = store.riskAssessments.get(actionId);
+    if (!riskAssessment) {
+        throw new Error(`Risk assessment for action ${actionId} was not found.`);
+    }
+    const approvalRequest = store.approvals.get(actionId);
+    const authorizationDecision = store.authorizationDecisions.get(actionId);
+    const verificationResult = store.verifications.get(actionId);
+    const auditEvents = store.auditEvents.filter((event) => event.actionIntentId === actionId);
+    const policyRules = store.policyRulesByAction.get(actionId) ?? getPolicyRules(riskAssessment.triggeredPolicies);
+    return {
+        action,
+        riskAssessment,
+        authorizationDecision,
+        approvalRequest,
+        verificationResult,
+        auditEvents,
+        policyRules,
+        blocked: action.status === "CANCELLED",
+    };
+}
+export function listActionReviews() {
+    return [...store.actions.keys()].map((actionId) => getActionReview(actionId));
+}
+export function writeAuditPacket(actionId) {
+    return generateAuditPacket(actionId);
+}
+export function generateAuditPacket(actionId) {
+    const review = getActionReview(actionId);
+    const execution = buildExecutionSummary(review.action);
+    appendAudit(actionId, "AUDIT_PACKET_GENERATED", "SYSTEM", "onegent-runtime", "Audit packet generated for customer demo.");
+    const refreshedReview = getActionReview(actionId);
+    return {
+        demo: true,
+        product: "AgentCert Onegent Runtime",
+        scenario: refreshedReview.action.businessObjectType === "purchase_order" && refreshedReview.action.targetSystem === "MockERP"
+            ? "Procurement purchase-order approval walkthrough"
+            : `${refreshedReview.action.actionType} ${refreshedReview.action.businessObjectType} action in ${refreshedReview.action.targetSystem}`,
+        actionIntent: refreshedReview.action,
+        riskAssessment: refreshedReview.riskAssessment,
+        authorizationDecision: refreshedReview.authorizationDecision,
+        triggeredPolicies: refreshedReview.policyRules,
+        approvalRequest: refreshedReview.approvalRequest,
+        execution,
+        verificationResult: refreshedReview.verificationResult,
+        auditEvents: refreshedReview.auditEvents,
+        disclaimer: "Local demo only. No real payments, emails, vendor portals, credentials, or production systems are used.",
+    };
+}
+function evaluateAuthorization(action, policy) {
+    const result = policy.authorize(action);
+    const missingPermissions = action.requestedPermissions.filter((permission) => !result.grantedPermissions.includes(permission));
+    const allowed = result.allowed && missingPermissions.length === 0;
+    const suffix = missingPermissions.length > 0 ? ` Missing permissions: ${missingPermissions.join(", ")}.` : "";
+    return {
+        id: nextId("authz"),
+        actionIntentId: action.id,
+        principalId: action.principal.id,
+        decision: allowed ? "ALLOW" : "DENY",
+        requestedPermissions: [...action.requestedPermissions],
+        grantedPermissions: [...result.grantedPermissions],
+        policyName: policy.name,
+        policyVersion: result.policyVersion,
+        reason: `${result.reason}${suffix}`.trim(),
+        createdAt: nowIso(),
+    };
+}
+function observeActionState(action) {
+    if (action.businessObjectType === "purchase_order" &&
+        action.targetSystem === "MockERP" &&
+        action.businessObjectId.length > 0) {
+        const purchaseOrder = getPurchaseOrder(action.businessObjectId);
+        if (purchaseOrder) {
+            return purchaseOrderState(purchaseOrder);
+        }
+    }
+    return action.status === "EXECUTED" ? action.proposedAfterState : action.beforeState;
+}
+function purchaseOrderState(purchaseOrder) {
+    return {
+        id: purchaseOrder.id,
+        vendor: purchaseOrder.vendor,
+        amount: purchaseOrder.amount,
+        currency: purchaseOrder.currency,
+        status: purchaseOrder.status,
+    };
+}
+function diffState(expected, observed) {
+    const differences = [];
+    for (const [key, expectedValue] of Object.entries(expected)) {
+        const observedValue = observed[key];
+        if (JSON.stringify(expectedValue) !== JSON.stringify(observedValue)) {
+            differences.push(`${key}: expected ${JSON.stringify(expectedValue)}, observed ${JSON.stringify(observedValue)}`);
+        }
+    }
+    return differences;
+}
+function buildExecutionSummary(action) {
+    const verification = store.verifications.get(action.id);
+    const method = action.businessObjectType === "purchase_order" && action.targetSystem === "MockERP" ? "LOCAL_MOCK_ERP" : "MOCK";
+    return {
+        method,
+        status: new Set(["EXECUTED", "VERIFIED", "FAILED_VERIFICATION", "ROLLED_BACK", "ROLLBACK_FAILED"]).has(action.status) ? "COMPLETED" : "NOT_EXECUTED",
+        targetSystem: action.targetSystem,
+        previousState: action.beforeState,
+        observedState: verification?.observedState,
+    };
+}
+function assertExecutableAfterApproval(action, approval) {
+    if (approval && approval.status !== "APPROVED") {
+        throw new Error(`Action ${action.id} cannot execute while approval status is ${approval.status}.`);
+    }
+    if (action.status === "REJECTED" || action.status === "CANCELLED") {
+        throw new Error(`Action ${action.id} cannot execute from status ${action.status}.`);
+    }
+}
+function appendAudit(actionIntentId, eventType, actorType, actorId, message, metadata) {
+    const event = {
+        id: nextId("audit"),
+        actionIntentId,
+        eventType,
+        actorType,
+        actorId,
+        message,
+        metadata,
+        createdAt: nowIso(),
+    };
+    store.auditEvents.push(event);
+    return event;
+}
+function requireAction(actionId) {
+    const action = store.actions.get(actionId);
+    if (!action) {
+        throw new Error(`Action ${actionId} was not found.`);
+    }
+    return action;
+}
+function requireApproval(actionId) {
+    const approval = store.approvals.get(actionId);
+    if (!approval) {
+        throw new Error(`Approval request for action ${actionId} was not found.`);
+    }
+    return approval;
+}

package/dist/vendor/onegent-runtime/store.d.ts

@@ -0,0 +1,16 @@
+import type { ActionIntent, AuthorizationDecision, ApprovalRequest, AuditEvent, MockPurchaseOrder, PolicyRule, RiskAssessment, VerificationResult } from "./types.js";
+export interface ActionGatewayStore {
+    actions: Map<string, ActionIntent>;
+    riskAssessments: Map<string, RiskAssessment>;
+    authorizationDecisions: Map<string, AuthorizationDecision>;
+    approvals: Map<string, ApprovalRequest>;
+    verifications: Map<string, VerificationResult>;
+    auditEvents: AuditEvent[];
+    purchaseOrders: Map<string, MockPurchaseOrder>;
+    policyRulesByAction: Map<string, PolicyRule[]>;
+}
+export declare const store: ActionGatewayStore;
+export declare function nextId(prefix: string): string;
+export declare function nowIso(): string;
+export declare function resetActionGatewayStore(): void;
+//# sourceMappingURL=store.d.ts.map

package/dist/vendor/onegent-runtime/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC7C,sBAAsB,EAAE,GAAG,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC3D,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACxC,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;CAChD;AAED,eAAO,MAAM,KAAK,EAAE,kBASnB,CAAC;AAIF,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG7C;AAED,wBAAgB,MAAM,IAAI,MAAM,CAE/B;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAU9C"}

package/dist/vendor/onegent-runtime/store.js

@@ -0,0 +1,29 @@
+export const store = {
+    actions: new Map(),
+    riskAssessments: new Map(),
+    authorizationDecisions: new Map(),
+    approvals: new Map(),
+    verifications: new Map(),
+    auditEvents: [],
+    purchaseOrders: new Map(),
+    policyRulesByAction: new Map(),
+};
+let sequence = 0;
+export function nextId(prefix) {
+    sequence += 1;
+    return `${prefix}_${String(sequence).padStart(6, "0")}`;
+}
+export function nowIso() {
+    return new Date().toISOString();
+}
+export function resetActionGatewayStore() {
+    sequence = 0;
+    store.actions.clear();
+    store.riskAssessments.clear();
+    store.authorizationDecisions.clear();
+    store.approvals.clear();
+    store.verifications.clear();
+    store.auditEvents = [];
+    store.purchaseOrders.clear();
+    store.policyRulesByAction.clear();
+}