agentcert 0.2.7 → 0.4.0

package/README.md

@@ -57,6 +57,43 @@ or mismatched artifacts remain observable as `partial` or `rejected`.
 Project API keys can create runs, record events, and upload evidence, but
 cannot approve their own runtime actions.
 
+## Sandbox onboarding
+
+Create and certify a synthetic SandboxSystem adapter with the same public CLI:
+
+```bash
+npx agentcert sandbox init
+npx agentcert sandbox certify --adapter ./agentcert.sandbox.mjs
+```
+
+The first command writes one dependency-free JavaScript file. The second runs
+the bundled deterministic adapter contract and writes
+`.agentcert/sandbox/sandbox-adapter-conformance.json`. No `@agentcert` scoped
+package is required.
+
+After `agentcert connect`, certify and upload in one command:
+
+```bash
+npx agentcert sandbox push --adapter ./agentcert.sandbox.mjs
+```
+
+Passing and failing reports are both retained for review, while failed
+certifications return a non-zero exit status. The generated template is
+synthetic and network-denied; it must not contain production credentials or
+connect to live systems.
+
+Run one bounded read against an existing Stripe sandbox PaymentIntent:
+
+```bash
+STRIPE_RESTRICTED_TEST_KEY="rk_test_..." npx agentcert sandbox stripe-readonly --payment-intent pi_...
+```
+
+Add `--push` to retain the redacted report in AgentCert Hosted. The command
+allows only `https://api.stripe.com`, `GET`, and allowlisted PaymentIntent
+routes, with a 5-second timeout and 10-request-per-minute process-local cap.
+The Stripe key is environment-only and is never written to output or evidence.
+See the [Bounded Vendor Sandbox Egress guide](https://github.com/Kakarottoooo/agentcert/blob/main/docs/bounded-vendor-sandbox-egress.md).
+
 Review/export helpers:
 
 ```bash

package/dist/cli.js

@@ -22,6 +22,7 @@ import { parseSchemaId, validateAgentCertSchema } from "./schema-validator.js";
 import { applyRunOverrides, loadRunProfile, profileFromArtifactFlags, renderRunSummary, runAgentCertProfile, } from "./runner.js";
 import { buildRobustnessLabSnapshot, readRobustnessLabConfig, renderRobustnessLabSummary, writeRobustnessLabSnapshot } from "./lab.js";
 import { renderCommandHelp } from "./command-help.js";
+import { runSandboxCommand } from "./sandbox.js";
 process.on("uncaughtException", reportFatalError);
 process.on("unhandledRejection", reportFatalError);
 const command = process.argv[2] ?? "help";
@@ -120,6 +121,10 @@ Saved connections are reused by agentcert push and agentcert run --push.
         process.stdout.write(`Credentials: ${path}\n`);
     }
 }
+else if (command === "sandbox") {
+    const result = await runSandboxCommand(process.argv.slice(3));
+    process.exitCode = result.exitCode;
+}
 else if (command === "report") {
     const config = await loadConfig(readFlag("--config"));
     const subject = readFlag("--subject") ?? config?.subject.name ?? "agentcert-subject";
@@ -546,6 +551,9 @@ else {
     process.stdout.write(`Usage:
   agentcert init --subject my-browser-agent
   agentcert connect --server https://agentcert-control-plane.onrender.com --project <project-id>
+  agentcert sandbox init
+  agentcert sandbox certify --adapter ./agentcert.sandbox.mjs
+  agentcert sandbox push --adapter ./agentcert.sandbox.mjs
   agentcert init --out agentcert.config.json --tripwire-config tripwire.yml --force
   agentcert init --subject my-browser-agent --github-action
   agentcert report --mcpbench .mcpbench/latest/results.json --tripwire .tripwire/latest/tripwire-result.json --onegent .onegent/procurement/audit-packet.json --out .agentcert/latest --subject my-agent

package/dist/command-help.js

@@ -1,4 +1,6 @@
 export function renderCommandHelp(command) {
+    if (command === "sandbox")
+        return undefined;
     if (command === "conformance")
         return `Usage:
   agentcert conformance <evidence.json> --artifact-root <directory> [--implementation <name>] [--out <report.json>]

package/dist/index.js

@@ -2,6 +2,7 @@ export * from "./bundle.js";
 export * from "./corpus.js";
 export * from "./corpus-store.js";
 export * from "./control-plane.js";
+export * from "./sandbox.js";
 export * from "./conformance.js";
 export * from "./credentials.js";
 export * from "./failure-review.js";

package/dist/sandbox.js

@@ -0,0 +1,323 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { resolveConnection } from "./credentials.js";
+const DEFAULT_ADAPTER_PATH = "agentcert.sandbox.mjs";
+const DEFAULT_REPORT_PATH = ".agentcert/sandbox/sandbox-adapter-conformance.json";
+const DEFAULT_STRIPE_REPORT_PATH = ".agentcert/sandbox/stripe-readonly-report.json";
+export async function runSandboxCommand(args) {
+    const action = args[0] ?? "help";
+    if (action === "help" || args.includes("--help") || args.includes("-h")) {
+        process.stdout.write(renderSandboxHelp(action === "help" ? undefined : action));
+        return { exitCode: 0 };
+    }
+    if (action === "init")
+        return initializeSandboxAdapter(args.slice(1));
+    if (action === "certify")
+        return certifySandboxAdapter(args.slice(1));
+    if (action === "push")
+        return pushSandboxCertification(args.slice(1));
+    if (action === "stripe-readonly")
+        return runStripeSandboxReadOnly(args.slice(1));
+    throw new Error(`Unknown sandbox command ${JSON.stringify(action)}. Run \`npx agentcert sandbox --help\`.`);
+}
+export async function initializeSandboxAdapter(args) {
+    const requestedPath = flag(args, "--adapter") ?? flag(args, "--out") ?? DEFAULT_ADAPTER_PATH;
+    const outPath = resolve(requestedPath);
+    await writeStarterFile(outPath, sandboxAdapterTemplate(), args.includes("--force"));
+    process.stdout.write(`Wrote ${outPath}\n\nNext:\n`);
+    process.stdout.write(`  npx agentcert sandbox certify --adapter ${JSON.stringify(requestedPath)}\n`);
+    process.stdout.write("\nReplace the in-memory handlers with your sandbox implementation. Keep production credentials and live systems out of this adapter.\n");
+    return { exitCode: 0 };
+}
+export async function certifySandboxAdapter(args, runtimeOverride) {
+    const runtime = runtimeOverride ?? await loadSandboxRuntime();
+    const adapterPath = resolve(flag(args, "--adapter") ?? DEFAULT_ADAPTER_PATH);
+    const reportPath = resolve(flag(args, "--out") ?? DEFAULT_REPORT_PATH);
+    const system = await loadSandboxAdapter(adapterPath);
+    const report = await runtime.runSandboxAdapterConformanceSuite({
+        system,
+        implementation: flag(args, "--implementation"),
+        targetSystem: flag(args, "--target-system"),
+    });
+    await runtime.writeSandboxAdapterConformanceReport(report, reportPath);
+    renderCertificationResult(report, reportPath);
+    return { exitCode: report.verdict.passed ? 0 : 1, reportPath, report };
+}
+export async function pushSandboxCertification(args, runtimeOverride) {
+    const runtime = runtimeOverride ?? await loadSandboxRuntime();
+    const certified = await certifySandboxAdapter(args, runtime);
+    if (!certified.report || !certified.reportPath)
+        throw new Error("Sandbox certification did not produce a report.");
+    const connection = await resolveConnection({
+        name: flag(args, "--connection"),
+        server: flag(args, "--server"),
+        projectId: flag(args, "--project"),
+        apiKey: flag(args, "--api-key"),
+    });
+    const uploaded = await runtime.uploadSandboxCertificationReport(certified.report, {
+        baseUrl: connection.server,
+        projectId: connection.projectId,
+        apiKey: connection.apiKey,
+        externalId: flag(args, "--external-id"),
+    });
+    process.stdout.write(`Hosted sandbox run: ${String(uploaded.run.id ?? "created")}\n`);
+    process.stdout.write(`Hosted evidence: ${String(uploaded.evidence.id ?? "created")}\n`);
+    return certified;
+}
+export async function runStripeSandboxReadOnly(args, runtimeOverride) {
+    if (args.includes("--stripe-key") || args.includes("--restricted-key")) {
+        throw new Error("Stripe credentials are accepted only through STRIPE_RESTRICTED_TEST_KEY, never a CLI flag.");
+    }
+    const paymentIntentId = flag(args, "--payment-intent");
+    if (!paymentIntentId)
+        throw new Error("Stripe sandbox read requires --payment-intent <pi_...>.");
+    const restrictedApiKey = process.env.STRIPE_RESTRICTED_TEST_KEY?.trim();
+    if (!restrictedApiKey) {
+        throw new Error("Set STRIPE_RESTRICTED_TEST_KEY to a read-only Stripe rk_test_ restricted key.");
+    }
+    const runtime = runtimeOverride ?? await loadSandboxRuntime();
+    if (!runtime.runStripeSandboxReadOnlyCertification) {
+        throw new Error("AgentCert Stripe sandbox runtime is missing. Reinstall the agentcert package and retry.");
+    }
+    const report = await runtime.runStripeSandboxReadOnlyCertification({ restrictedApiKey, paymentIntentId });
+    const reportPath = resolve(flag(args, "--out") ?? DEFAULT_STRIPE_REPORT_PATH);
+    await mkdir(dirname(reportPath), { recursive: true });
+    await writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+    renderVendorReadResult(report, reportPath);
+    if (args.includes("--push")) {
+        const connection = await resolveConnection({
+            name: flag(args, "--connection"),
+            server: flag(args, "--server"),
+            projectId: flag(args, "--project"),
+            apiKey: flag(args, "--api-key"),
+        });
+        const uploaded = await runtime.uploadSandboxCertificationReport(report, {
+            baseUrl: connection.server,
+            projectId: connection.projectId,
+            apiKey: connection.apiKey,
+            externalId: flag(args, "--external-id"),
+        });
+        process.stdout.write(`Hosted sandbox run: ${String(uploaded.run.id ?? "created")}\n`);
+        process.stdout.write(`Hosted evidence: ${String(uploaded.evidence.id ?? "created")}\n`);
+    }
+    return { exitCode: report.verdict.passed ? 0 : 1, reportPath, report };
+}
+export async function loadSandboxAdapter(adapterPath) {
+    let module;
+    try {
+        module = await import(pathToFileURL(adapterPath).href);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`Could not load sandbox adapter ${adapterPath}: ${message}`);
+    }
+    const candidate = module.sandboxSystem ?? module.default ?? module.system;
+    if (!isSandboxSystem(candidate)) {
+        throw new Error(`Sandbox adapter ${adapterPath} must export \`sandboxSystem\`, \`system\`, or a default SandboxSystem object.`);
+    }
+    return candidate;
+}
+export function renderSandboxHelp(action) {
+    if (action === "init")
+        return `Usage:
+  agentcert sandbox init [--adapter agentcert.sandbox.mjs] [--force]
+
+Writes one dependency-free synthetic SandboxSystem adapter template.
+`;
+    if (action === "certify")
+        return `Usage:
+  agentcert sandbox certify --adapter ./my-sandbox-adapter.js [--out .agentcert/sandbox/report.json]
+
+Runs the deterministic sandbox adapter conformance suite locally.
+`;
+    if (action === "push")
+        return `Usage:
+  agentcert sandbox push --adapter ./my-sandbox-adapter.js
+
+Runs certification, writes the local report, and uploads it through the saved AgentCert connection.
+Use \`agentcert connect\` first, or pass --server, --project, and --api-key.
+`;
+    if (action === "stripe-readonly")
+        return `Usage:
+  STRIPE_RESTRICTED_TEST_KEY=rk_test_... agentcert sandbox stripe-readonly --payment-intent pi_...
+  agentcert sandbox stripe-readonly --payment-intent pi_... --push
+
+Reads one Stripe sandbox PaymentIntent through a fixed GET/resource allowlist,
+writes a redacted evidence report, and optionally uploads it to AgentCert Hosted.
+The Stripe key is read only from STRIPE_RESTRICTED_TEST_KEY.
+`;
+    return `Usage:
+  agentcert sandbox init [--adapter agentcert.sandbox.mjs]
+  agentcert sandbox certify --adapter ./my-sandbox-adapter.js
+  agentcert sandbox push --adapter ./my-sandbox-adapter.js
+  agentcert sandbox stripe-readonly --payment-intent pi_... [--push]
+
+Commands:
+  init      Write one dependency-free adapter template
+  certify   Run deterministic local conformance checks
+  push      Certify and upload the report to AgentCert Hosted
+  stripe-readonly  Run one bounded Stripe sandbox read and write evidence
+
+Common options:
+  --adapter <path>        Adapter module (default: agentcert.sandbox.mjs)
+  --out <path>            Local report path
+  --implementation <id>  Stable adapter implementation name
+  --target-system <name> Target system exercised by the suite
+`;
+}
+async function loadSandboxRuntime() {
+    const adapterKitUrl = new URL("./vendor/onegent-runtime/sandbox-adapter-kit.js", import.meta.url);
+    const hostedUrl = new URL("./vendor/onegent-runtime/sandbox-hosted.js", import.meta.url);
+    const stripeUrl = new URL("./vendor/onegent-runtime/stripe-test-readonly.js", import.meta.url);
+    try {
+        const [adapterKit, hosted, stripe] = await Promise.all([
+            import(adapterKitUrl.href),
+            import(hostedUrl.href),
+            import(stripeUrl.href),
+        ]);
+        return { ...adapterKit, ...hosted, ...stripe };
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error ? String(error.code) : undefined;
+        if (code === "ERR_MODULE_NOT_FOUND") {
+            throw new Error("AgentCert sandbox runtime is missing. Reinstall the agentcert package and retry.");
+        }
+        throw error;
+    }
+}
+function isSandboxSystem(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const system = value;
+    const safety = system.safety;
+    return typeof system.name === "string"
+        && safety?.mode === "sandbox"
+        && safety.networkAccess === false
+        && safety.syntheticDataOnly === true
+        && Array.isArray(safety.allowedTargetSystems)
+        && ["createTenant", "deleteTenant", "resetTenant", "seedTenant", "hasTenant", "snapshotTenant", "adapterForTenant"]
+            .every((method) => typeof system[method] === "function");
+}
+function flag(args, name) {
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+async function writeStarterFile(path, content, force) {
+    await mkdir(dirname(path), { recursive: true });
+    try {
+        await writeFile(path, content, { flag: force ? "w" : "wx" });
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "EEXIST") {
+            throw new Error(`${path} already exists. Re-run with --force to overwrite it.`);
+        }
+        throw error;
+    }
+}
+function renderCertificationResult(report, reportPath) {
+    process.stdout.write(`${report.verdict.passed ? "PASS" : "FAIL"} ${report.verdict.score}/100 sandbox adapter conformance\n`);
+    for (const check of report.checks) {
+        process.stdout.write(`- ${check.status === "passed" ? "PASS" : "FAIL"} ${check.id}: ${check.message}\n`);
+    }
+    process.stdout.write(`Report: ${reportPath}\n`);
+}
+function renderVendorReadResult(report, reportPath) {
+    process.stdout.write(`${report.verdict.passed ? "PASS" : "FAIL"} ${report.verdict.score}/100 Stripe sandbox bounded read\n`);
+    for (const check of report.checks) {
+        process.stdout.write(`- ${check.status === "passed" ? "PASS" : "FAIL"} ${check.id}: ${check.message}\n`);
+    }
+    process.stdout.write(`Requests audited: ${report.audit.length}\n`);
+    process.stdout.write(`Report: ${reportPath}\n`);
+}
+function sandboxAdapterTemplate() {
+    return `// Synthetic local state only. Do not import production credentials or call live systems here.
+const tenants = new Map();
+
+export const sandboxSystem = {
+  name: "my-sandbox-adapter",
+  safety: {
+    mode: "sandbox",
+    networkAccess: false,
+    syntheticDataOnly: true,
+    allowedTargetSystems: ["MySandboxSystem"],
+  },
+  createTenant(input) {
+    if (input.synthetic !== true) throw new Error("Synthetic tenants only.");
+    if (tenants.has(input.id)) throw new Error(\`Tenant \${input.id} already exists.\`);
+    const seed = syntheticSeed(input.seed ?? {});
+    tenants.set(input.id, { seed, state: structuredClone(seed) });
+  },
+  deleteTenant(tenantId) {
+    tenants.delete(tenantId);
+  },
+  resetTenant(tenantId) {
+    const tenant = requiredTenant(tenantId);
+    tenant.state = structuredClone(tenant.seed);
+  },
+  seedTenant(tenantId, seed) {
+    const tenant = requiredTenant(tenantId);
+    tenant.seed = syntheticSeed(seed);
+    tenant.state = structuredClone(seed);
+  },
+  hasTenant(tenantId) {
+    return tenants.has(tenantId);
+  },
+  snapshotTenant(tenantId) {
+    return structuredClone(requiredTenant(tenantId).state);
+  },
+  adapterForTenant(tenantId) {
+    requiredTenant(tenantId);
+    return {
+      name: \`my-sandbox-adapter:\${tenantId}\`,
+      safety: { mode: "sandbox", networkAccess: false, allowedTargetSystems: ["MySandboxSystem"] },
+      execute(action) {
+        const tenant = requiredTenant(tenantId);
+        const previousState = structuredClone(tenant.state[action.businessObjectId] ?? action.beforeState);
+        const observedState = structuredClone(action.proposedAfterState);
+        tenant.state[action.businessObjectId] = observedState;
+        return { method: "SYNTHETIC_SANDBOX", targetSystem: action.targetSystem, previousState, observedState };
+      },
+      rollback(action, execution) {
+        const restored = structuredClone(execution.previousState ?? action.beforeState);
+        requiredTenant(tenantId).state[action.businessObjectId] = restored;
+        return { success: true, observedState: restored };
+      },
+    };
+  },
+};
+
+export default sandboxSystem;
+
+function requiredTenant(tenantId) {
+  const tenant = tenants.get(tenantId);
+  if (!tenant) throw new Error(\`Tenant \${tenantId} does not exist.\`);
+  return tenant;
+}
+
+function syntheticSeed(value) {
+  assertSynthetic(value, "seed", new Set());
+  return structuredClone(value);
+}
+
+function assertSynthetic(value, path, seen) {
+  if (value === null || ["boolean", "number"].includes(typeof value)) return;
+  if (typeof value === "string") {
+    if (/^(?:sk-(?:proj-)?|npm_|gh[pousr]_)[A-Za-z0-9_-]{16,}$/.test(value)) {
+      throw new Error(\`Credential-like value is not allowed at \${path}.\`);
+    }
+    return;
+  }
+  if (typeof value !== "object") throw new Error(\`Synthetic data must be JSON-compatible at \${path}.\`);
+  if (seen.has(value)) throw new Error(\`Synthetic data cannot contain cycles at \${path}.\`);
+  seen.add(value);
+  for (const [key, item] of Object.entries(value)) {
+    if (/(?:password|passwd|secret|token|api[_-]?key|credential|authorization|cookie)/i.test(key)) {
+      throw new Error(\`Credential-like field \${path}.\${key} is not allowed.\`);
+    }
+    assertSynthetic(item, \`\${path}.\${key}\`, seen);
+  }
+  seen.delete(value);
+}
+`;
+}

package/dist/vendor/onegent-runtime/mock-procurement.d.ts

@@ -0,0 +1,6 @@
+import type { ActionIntent, MockPurchaseOrder } from "./types.js";
+export declare const PROCUREMENT_DEMO_PO_ID = "PO-DEMO-4850";
+export declare function createProcurementDemoPurchaseOrder(): MockPurchaseOrder;
+export declare function getPurchaseOrder(id: string): MockPurchaseOrder | undefined;
+export declare function submitMockPurchaseOrder(action: ActionIntent): MockPurchaseOrder;
+//# sourceMappingURL=mock-procurement.d.ts.map

package/dist/vendor/onegent-runtime/mock-procurement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-procurement.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/mock-procurement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGlE,eAAO,MAAM,sBAAsB,iBAAiB,CAAC;AAErD,wBAAgB,kCAAkC,IAAI,iBAAiB,CActE;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAE1E;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,iBAAiB,CAc/E"}

package/dist/vendor/onegent-runtime/mock-procurement.js

@@ -0,0 +1,33 @@
+import { nowIso, store } from "./store.js";
+export const PROCUREMENT_DEMO_PO_ID = "PO-DEMO-4850";
+export function createProcurementDemoPurchaseOrder() {
+    const purchaseOrder = {
+        id: PROCUREMENT_DEMO_PO_ID,
+        vendor: "Acme Industrial Supply",
+        amount: 4_850,
+        currency: "USD",
+        status: "DRAFT",
+        vendorApproved: true,
+        lineItem: "Replacement conveyor motor assembly",
+        lastUpdatedAt: nowIso(),
+    };
+    store.purchaseOrders.set(purchaseOrder.id, purchaseOrder);
+    return purchaseOrder;
+}
+export function getPurchaseOrder(id) {
+    return store.purchaseOrders.get(id);
+}
+export function submitMockPurchaseOrder(action) {
+    const purchaseOrder = store.purchaseOrders.get(action.businessObjectId);
+    if (!purchaseOrder) {
+        throw new Error(`Mock purchase order ${action.businessObjectId} was not found.`);
+    }
+    const updated = {
+        ...purchaseOrder,
+        status: "SUBMITTED",
+        lastUpdatedAt: nowIso(),
+        actionIntentId: action.id,
+    };
+    store.purchaseOrders.set(updated.id, updated);
+    return updated;
+}

package/dist/vendor/onegent-runtime/policies.d.ts

@@ -0,0 +1,6 @@
+import type { ActionIntent, PolicyEvaluation, PolicyRule, RiskAssessment } from "./types.js";
+export declare const DEFAULT_POLICY_RULES: PolicyRule[];
+export declare function evaluatePolicy(action: ActionIntent, risk: RiskAssessment, policyRules?: PolicyRule[]): PolicyEvaluation;
+export declare function getPolicyRules(ids: string[], policyRules?: PolicyRule[]): PolicyRule[];
+export declare function matchesRule(action: ActionIntent, rule: PolicyRule): boolean;
+//# sourceMappingURL=policies.d.ts.map

package/dist/vendor/onegent-runtime/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAmB,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE9G,eAAO,MAAM,oBAAoB,EAAE,UAAU,EAmC5C,CAAC;AAEF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,cAAc,EACpB,WAAW,GAAE,UAAU,EAAyB,GAC/C,gBAAgB,CA6ClB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,WAAW,GAAE,UAAU,EAAyB,GAAG,UAAU,EAAE,CAG5G;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAQ3E"}

package/dist/vendor/onegent-runtime/policies.js

@@ -0,0 +1,109 @@
+export const DEFAULT_POLICY_RULES = [
+    {
+        id: "po-over-1000-requires-approval",
+        name: "Purchase orders over $1,000 require approval",
+        description: "High-value purchase order submissions must be reviewed before mock execution.",
+        actionTypes: ["SUBMIT"],
+        effect: "REQUIRE_APPROVAL",
+        enabled: true,
+        conditions: [{ field: "amount", operator: "greaterThan", value: 1_000 }],
+    },
+    {
+        id: "payment-actions-require-approval",
+        name: "Payment actions require approval",
+        description: "The demo runtime never executes real payments and requires approval for mock payment actions.",
+        actionTypes: ["PAY"],
+        effect: "REQUIRE_APPROVAL",
+        enabled: true,
+    },
+    {
+        id: "external-send-requires-approval",
+        name: "External send actions require approval",
+        description: "Outbound communications to non-demo recipients require approval.",
+        actionTypes: ["SEND"],
+        effect: "REQUIRE_APPROVAL",
+        enabled: true,
+    },
+    {
+        id: "production-actions-blocked-in-demo",
+        name: "Production actions are blocked in demo mode",
+        description: "This package is local-only and will not perform production actions.",
+        actionTypes: ["SUBMIT", "PAY", "SEND", "UPDATE"],
+        effect: "BLOCK",
+        enabled: true,
+        conditions: [{ field: "environment", operator: "equals", value: "production" }],
+    },
+];
+export function evaluatePolicy(action, risk, policyRules = DEFAULT_POLICY_RULES) {
+    if (action.environment === "production") {
+        const productionBlock = policyRules.find((rule) => rule.id === "production-actions-blocked-in-demo") ??
+            DEFAULT_POLICY_RULES.find((rule) => rule.id === "production-actions-blocked-in-demo");
+        return {
+            effect: "BLOCK",
+            triggeredPolicies: productionBlock ? [productionBlock.id] : [],
+            reasons: [productionBlock?.description ?? "Production actions are blocked in this local demo runtime."],
+            requiresHumanApproval: false,
+            blocked: true,
+        };
+    }
+    const triggeredRules = policyRules.filter((rule) => matchesRule(action, rule));
+    const blockRules = triggeredRules.filter((rule) => rule.effect === "BLOCK");
+    if (blockRules.length > 0) {
+        return {
+            effect: "BLOCK",
+            triggeredPolicies: blockRules.map((rule) => rule.id),
+            reasons: blockRules.map((rule) => rule.description),
+            requiresHumanApproval: false,
+            blocked: true,
+        };
+    }
+    const approvalRules = triggeredRules.filter((rule) => rule.effect === "REQUIRE_APPROVAL");
+    if (approvalRules.length > 0) {
+        return {
+            effect: "REQUIRE_APPROVAL",
+            triggeredPolicies: approvalRules.map((rule) => rule.id),
+            reasons: approvalRules.map((rule) => rule.description),
+            requiresHumanApproval: true,
+            blocked: false,
+        };
+    }
+    return {
+        effect: "ALLOW",
+        triggeredPolicies: triggeredRules.map((rule) => rule.id),
+        reasons: risk.reasons,
+        requiresHumanApproval: false,
+        blocked: false,
+    };
+}
+export function getPolicyRules(ids, policyRules = DEFAULT_POLICY_RULES) {
+    const idSet = new Set(ids);
+    return policyRules.filter((rule) => idSet.has(rule.id));
+}
+export function matchesRule(action, rule) {
+    if (!rule.enabled || !rule.actionTypes.includes(action.actionType)) {
+        return false;
+    }
+    if (!rule.conditions || rule.conditions.length === 0) {
+        return true;
+    }
+    return rule.conditions.every((condition) => matchesCondition(action, condition));
+}
+function matchesCondition(action, condition) {
+    const actual = action[condition.field];
+    switch (condition.operator) {
+        case "equals":
+            return actual === condition.value;
+        case "notEquals":
+            return actual !== condition.value;
+        case "greaterThan":
+            return typeof actual === "number" && typeof condition.value === "number" && actual > condition.value;
+        case "greaterThanOrEqual":
+            return typeof actual === "number" && typeof condition.value === "number" && actual >= condition.value;
+        case "lessThan":
+            return typeof actual === "number" && typeof condition.value === "number" && actual < condition.value;
+        case "lessThanOrEqual":
+            return typeof actual === "number" && typeof condition.value === "number" && actual <= condition.value;
+        case "includes":
+            return typeof actual === "string" && typeof condition.value === "string" && actual.includes(condition.value);
+    }
+}

package/dist/vendor/onegent-runtime/risk.d.ts

@@ -0,0 +1,3 @@
+import type { ActionIntent, RiskAssessment } from "./types.js";
+export declare function assessRisk(action: ActionIntent): RiskAssessment;
+//# sourceMappingURL=risk.d.ts.map

package/dist/vendor/onegent-runtime/risk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/risk.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAa,MAAM,YAAY,CAAC;AAK1E,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAsD/D"}

package/dist/vendor/onegent-runtime/risk.js

@@ -0,0 +1,54 @@
+import { nextId, nowIso } from "./store.js";
+const PURCHASE_ORDER_APPROVAL_THRESHOLD = 1_000;
+export function assessRisk(action) {
+    const reasons = [];
+    const triggeredPolicies = [];
+    let riskLevel = "LOW";
+    let riskScore = 20;
+    if (action.actionType === "PAY") {
+        riskLevel = "HIGH";
+        riskScore = 85;
+        reasons.push("Payment actions can move money and require human approval in the demo runtime.");
+        triggeredPolicies.push("payment-actions-require-approval");
+    }
+    if (action.actionType === "SEND" && action.recipient && !action.recipient.endsWith("@example.local")) {
+        riskLevel = maxRisk(riskLevel, "HIGH");
+        riskScore = Math.max(riskScore, 75);
+        reasons.push("External send actions can disclose business data and require human approval.");
+        triggeredPolicies.push("external-send-requires-approval");
+    }
+    if (action.actionType === "SUBMIT" && (action.amount ?? 0) > PURCHASE_ORDER_APPROVAL_THRESHOLD) {
+        riskLevel = maxRisk(riskLevel, "HIGH");
+        riskScore = Math.max(riskScore, 80);
+        reasons.push("Purchase orders over $1,000 require human approval.");
+        triggeredPolicies.push("po-over-1000-requires-approval");
+    }
+    if (action.actionType === "UPDATE" && action.fieldsChanged.length > 0) {
+        riskLevel = maxRisk(riskLevel, "MEDIUM");
+        riskScore = Math.max(riskScore, 45);
+        reasons.push("Update actions modify business records and require verification.");
+    }
+    if (action.environment === "production") {
+        riskLevel = maxRisk(riskLevel, "CRITICAL");
+        riskScore = Math.max(riskScore, 95);
+        reasons.push("Production actions are blocked in this local demo runtime.");
+        triggeredPolicies.push("production-actions-blocked-in-demo");
+    }
+    if (reasons.length === 0) {
+        reasons.push("No high-risk demo policy matched this action.");
+    }
+    return {
+        id: nextId("risk"),
+        actionIntentId: action.id,
+        riskLevel,
+        riskScore,
+        reasons,
+        triggeredPolicies,
+        requiresHumanApproval: riskLevel === "HIGH" || riskLevel === "CRITICAL",
+        createdAt: nowIso(),
+    };
+}
+function maxRisk(left, right) {
+    const order = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+    return order[Math.max(order.indexOf(left), order.indexOf(right))];
+}