agentcert 0.2.7 → 0.4.0

package/dist/vendor/onegent-runtime/sandbox-hosted.d.ts

@@ -0,0 +1,77 @@
+import type { SandboxAdapterConformanceReport } from "./sandbox-adapter-kit.js";
+import type { SandboxCertificationReport } from "./sandbox-harness.js";
+import type { StripeSandboxReadOnlyReport } from "./stripe-test-readonly.js";
+export declare const SANDBOX_EVIDENCE_BUNDLE_SCHEMA_VERSION: "agentcert.evidence.v0.1";
+export type HostedSandboxReport = SandboxCertificationReport | SandboxAdapterConformanceReport | StripeSandboxReadOnlyReport;
+export interface SandboxHostedUploadOptions {
+    baseUrl: string;
+    projectId: string;
+    apiKey: string;
+    externalId?: string;
+    fetch?: typeof fetch;
+}
+export interface SandboxHostedUploadResult {
+    run: Record<string, unknown>;
+    evidence: Record<string, unknown>;
+    completion: Record<string, unknown>;
+}
+export interface SandboxCertificationEvidenceBundle {
+    schemaName: "agentcert.evidence_bundle";
+    schemaVersion: typeof SANDBOX_EVIDENCE_BUNDLE_SCHEMA_VERSION;
+    schemaSemver: "0.1.0";
+    kind: "agentcert.evidence_bundle";
+    runId: string;
+    generatedAt: string;
+    subject: {
+        name: string;
+        type: "application";
+    };
+    verdict: {
+        passed: boolean;
+        score: number;
+        level: string;
+    };
+    summary: {
+        products: ["onegent-runtime"];
+        criticalEvidence: number;
+        highEvidence: number;
+        totalEvidence: 1;
+    };
+    results: Array<{
+        schemaVersion: "1";
+        product: "onegent-runtime";
+        runId: string;
+        timestamp: string;
+        phase: "pre-release";
+        score: number;
+        passed: boolean;
+        summary: string;
+        artifacts: Record<string, string>;
+        evidence: Array<{
+            id: string;
+            kind: "sandbox_adapter_conformance" | "sandbox_certification" | "sandbox_vendor_egress";
+            severity: "info" | "high";
+            message: string;
+            source: "onegent-runtime";
+            metadata: {
+                report: HostedSandboxReport;
+                reportSchemaVersion: string;
+            };
+        }>;
+    }>;
+    evidence: SandboxCertificationEvidenceBundle["results"][number]["evidence"];
+    artifacts: Record<string, string>;
+    artifactManifest: {
+        schemaVersion: "agentcert.artifact_manifest.v0.1";
+        entries: [];
+    };
+    standards: Array<{
+        id: "agentcert-sandbox-contract";
+        name: "AgentCert Sandbox Adapter Contract";
+        status: "mapped";
+        note: string;
+    }>;
+}
+export declare function createSandboxCertificationEvidenceBundle(report: HostedSandboxReport): SandboxCertificationEvidenceBundle;
+export declare function uploadSandboxCertificationReport(report: HostedSandboxReport, options: SandboxHostedUploadOptions): Promise<SandboxHostedUploadResult>;
+//# sourceMappingURL=sandbox-hosted.d.ts.map

package/dist/vendor/onegent-runtime/sandbox-hosted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-hosted.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/sandbox-hosted.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAE7E,eAAO,MAAM,sCAAsC,EAAG,yBAAkC,CAAC;AAEzF,MAAM,MAAM,mBAAmB,GAAG,0BAA0B,GAAG,+BAA+B,GAAG,2BAA2B,CAAC;AAE7H,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,2BAA2B,CAAC;IACxC,aAAa,EAAE,OAAO,sCAAsC,CAAC;IAC7D,YAAY,EAAE,OAAO,CAAC;IACtB,IAAI,EAAE,2BAA2B,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,aAAa,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE;QACP,QAAQ,EAAE,CAAC,iBAAiB,CAAC,CAAC;QAC9B,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,CAAC,CAAC;KAClB,CAAC;IACF,OAAO,EAAE,KAAK,CAAC;QACb,aAAa,EAAE,GAAG,CAAC;QACnB,OAAO,EAAE,iBAAiB,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,aAAa,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,OAAO,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC;YACd,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,6BAA6B,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;YACxF,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;YAC1B,OAAO,EAAE,MAAM,CAAC;YAChB,MAAM,EAAE,iBAAiB,CAAC;YAC1B,QAAQ,EAAE;gBAAE,MAAM,EAAE,mBAAmB,CAAC;gBAAC,mBAAmB,EAAE,MAAM,CAAA;aAAE,CAAC;SACxE,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,QAAQ,EAAE,kCAAkC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gBAAgB,EAAE;QAChB,aAAa,EAAE,kCAAkC,CAAC;QAClD,OAAO,EAAE,EAAE,CAAC;KACb,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,4BAA4B,CAAC;QACjC,IAAI,EAAE,oCAAoC,CAAC;QAC3C,MAAM,EAAE,QAAQ,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC,CAAC;CACJ;AAED,wBAAgB,wCAAwC,CACtD,MAAM,EAAE,mBAAmB,GAC1B,kCAAkC,CAwDpC;AAED,wBAAsB,gCAAgC,CACpD,MAAM,EAAE,mBAAmB,EAC3B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CAyDpC"}

package/dist/vendor/onegent-runtime/sandbox-hosted.js

@@ -0,0 +1,133 @@
+import { createHash } from "node:crypto";
+export const SANDBOX_EVIDENCE_BUNDLE_SCHEMA_VERSION = "agentcert.evidence.v0.1";
+export function createSandboxCertificationEvidenceBundle(report) {
+    const reportDigest = createHash("sha256").update(JSON.stringify(report)).digest("hex");
+    const runId = `sandbox-${reportDigest}`;
+    const evidence = [{
+            id: `${report.kind}:${reportDigest.slice(0, 16)}`,
+            kind: report.kind === "agentcert.sandbox_adapter_conformance"
+                ? "sandbox_adapter_conformance"
+                : report.kind === "agentcert.sandbox_vendor_egress"
+                    ? "sandbox_vendor_egress"
+                    : "sandbox_certification",
+            severity: report.verdict.passed ? "info" : "high",
+            message: `${report.kind} ${report.verdict.passed ? "passed" : "failed"} (${report.verdict.score}/100).`,
+            source: "onegent-runtime",
+            metadata: { report: structuredClone(report), reportSchemaVersion: report.schemaVersion },
+        }];
+    return {
+        schemaName: "agentcert.evidence_bundle",
+        schemaVersion: SANDBOX_EVIDENCE_BUNDLE_SCHEMA_VERSION,
+        schemaSemver: "0.1.0",
+        kind: "agentcert.evidence_bundle",
+        runId,
+        generatedAt: report.generatedAt,
+        subject: { name: report.implementation, type: "application" },
+        verdict: {
+            passed: report.verdict.passed,
+            score: report.verdict.score,
+            level: report.verdict.passed ? "Sandbox conformant" : "Not conformant",
+        },
+        summary: {
+            products: ["onegent-runtime"],
+            criticalEvidence: 0,
+            highEvidence: report.verdict.passed ? 0 : 1,
+            totalEvidence: 1,
+        },
+        results: [{
+                schemaVersion: "1",
+                product: "onegent-runtime",
+                runId,
+                timestamp: report.generatedAt,
+                phase: "pre-release",
+                score: report.verdict.score,
+                passed: report.verdict.passed,
+                summary: `${report.kind} ${report.verdict.passed ? "passed" : "failed"}.`,
+                artifacts: {},
+                evidence,
+            }],
+        evidence,
+        artifacts: {},
+        artifactManifest: { schemaVersion: "agentcert.artifact_manifest.v0.1", entries: [] },
+        standards: [{
+                id: "agentcert-sandbox-contract",
+                name: "AgentCert Sandbox Adapter Contract",
+                status: "mapped",
+                note: "Synthetic or vendor test-mode evidence only. This does not authorize production access or certify production-side controls.",
+            }],
+    };
+}
+export async function uploadSandboxCertificationReport(report, options) {
+    const baseUrl = required(options.baseUrl, "baseUrl").replace(/\/$/, "");
+    const projectId = required(options.projectId, "projectId");
+    const apiKey = required(options.apiKey, "apiKey");
+    const requestFetch = options.fetch ?? fetch;
+    const projectUrl = `${baseUrl}/v1/projects/${encodeURIComponent(projectId)}`;
+    const bundle = createSandboxCertificationEvidenceBundle(report);
+    const bytes = Buffer.from(`${JSON.stringify(bundle, null, 2)}\n`, "utf8");
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    const operationId = `sandbox-upload-${digest.slice(0, 32)}`;
+    const externalId = options.externalId?.trim() || `${report.kind}:${report.implementation}:${report.generatedAt}`;
+    const run = await jsonRequest(requestFetch, `${projectUrl}/runs`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operationId}:run` },
+        body: JSON.stringify({
+            externalId,
+            kind: "custom",
+            schemaVersion: report.schemaVersion,
+            startedAt: report.generatedAt,
+            metadata: {
+                productLine: "onegent-runtime",
+                evidenceType: report.kind,
+                implementation: report.implementation,
+                sandboxOnly: true,
+            },
+        }),
+    });
+    if (typeof run.id !== "string" || !run.id)
+        throw new Error("AgentCert Control Plane returned a run without an id.");
+    const query = new URLSearchParams({
+        fileName: "sandbox-certification-evidence.json",
+        kind: "evidence_bundle",
+        schemaVersion: SANDBOX_EVIDENCE_BUNDLE_SCHEMA_VERSION,
+        runId: run.id,
+    });
+    const evidence = await jsonRequest(requestFetch, `${projectUrl}/evidence?${query}`, apiKey, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: new Uint8Array(bytes).buffer,
+    });
+    const completion = await jsonRequest(requestFetch, `${projectUrl}/runs/${encodeURIComponent(run.id)}/complete`, apiKey, {
+        method: "POST",
+        headers: { "idempotency-key": `${operationId}:complete` },
+        body: JSON.stringify({
+            status: report.verdict.passed ? "passed" : "failed",
+            score: report.verdict.score / 100,
+            summary: `${report.kind} ${report.verdict.passed ? "passed" : "failed"} (${report.verdict.score}/100).`,
+            metadata: {
+                evidenceId: evidence.id,
+                evidenceSha256: evidence.sha256,
+                sandboxReportSchemaVersion: report.schemaVersion,
+            },
+        }),
+    });
+    return { run, evidence, completion };
+}
+async function jsonRequest(requestFetch, url, apiKey, init) {
+    const headers = new Headers(init.headers);
+    headers.set("authorization", `Bearer ${apiKey}`);
+    if (typeof init.body === "string")
+        headers.set("content-type", "application/json");
+    const response = await requestFetch(url, { ...init, headers, redirect: "error" });
+    const value = await response.json().catch(() => ({}));
+    if (!response.ok) {
+        throw new Error(typeof value.error === "string" ? value.error : `AgentCert Control Plane request failed (${response.status}).`);
+    }
+    return value;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`Sandbox hosted upload ${name} is required.`);
+    return normalized;
+}

package/dist/vendor/onegent-runtime/sdk.d.ts

@@ -0,0 +1,29 @@
+import type { ActionAuditPacket, ActionExecutionSummary, ActionExecutionReceipt, ActionIntent, ActionReview, ApprovalAdapter, ApprovalRequest, AuditStore, AuthorizationPolicy, CreateActionIntentInput, LocalActionAdapter, ExecutionStore, PolicyEngine, PolicyEvaluation, PolicyRule, RiskAssessment, VerificationResult } from "./types.js";
+export interface OnegentRuntimeOptions {
+    policyRules?: PolicyRule[];
+    policyEngine?: PolicyEngine;
+    approvalAdapter?: ApprovalAdapter;
+    auditStore?: AuditStore;
+    authorizationPolicy?: AuthorizationPolicy;
+    executionStore?: ExecutionStore;
+}
+export interface OnegentRuntime {
+    captureAction(input: CreateActionIntentInput): ActionReview;
+    assessRisk(action: ActionIntent): RiskAssessment;
+    evaluatePolicy(action: ActionIntent, risk?: RiskAssessment): PolicyEvaluation;
+    requestApproval(action: ActionIntent | string, assignedTo?: string): Promise<ApprovalRequest>;
+    approveAction(action: ActionIntent | string, reviewerId?: string, reviewerComment?: string): ActionReview;
+    rejectAction(action: ActionIntent | string, reviewerId?: string, reviewerComment?: string): ActionReview;
+    executeAfterApproval(action: ActionIntent | string, adapter?: LocalActionAdapter): Promise<ActionExecutionSummary>;
+    rollbackAfterExecution(action: ActionIntent | string, adapter: LocalActionAdapter, reason: string): Promise<ActionExecutionReceipt>;
+    getExecutionReceipt(action: ActionIntent | string): Promise<ActionExecutionReceipt | undefined>;
+    verifyOutcome(action: ActionIntent | string, observedState?: ActionExecutionSummary | Record<string, unknown>): VerificationResult;
+    writeAuditPacket(action: ActionIntent | string): Promise<ActionAuditPacket>;
+    getActionReview(action: ActionIntent | string): ActionReview;
+    listActionReviews(): ActionReview[];
+}
+export declare function createOnegentRuntime(options?: OnegentRuntimeOptions): OnegentRuntime;
+export declare function createInMemoryExecutionStore(name?: string): ExecutionStore & {
+    receipts: Map<string, ActionExecutionReceipt>;
+};
+//# sourceMappingURL=sdk.d.ts.map

package/dist/vendor/onegent-runtime/sdk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/sdk.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,KAAK,EAAE,uBAAuB,GAAG,YAAY,CAAC;IAC5D,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,gBAAgB,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9F,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC1G,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACzG,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnH,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpI,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAChG,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,aAAa,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAAC;IACnI,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,YAAY,CAAC;IAC7D,iBAAiB,IAAI,YAAY,EAAE,CAAC;CACrC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA2GxF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,SAA8B,GAAG,cAAc,GAAG;IACjG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAC/C,CAQA"}

package/dist/vendor/onegent-runtime/sdk.js

@@ -0,0 +1,140 @@
+import { evaluatePolicy as evaluatePolicyRules } from "./policies.js";
+import { assessRisk as assessActionRisk } from "./risk.js";
+import { approveAction, captureActionIntent, executeAfterApproval as executeApprovedAction, executeAfterApprovalWithAdapter, generateAuditPacket, getActionReview, listActionReviews, rejectAction, recordRollback, requestApproval as requestActionApproval, verifyOutcome as verifyActionOutcome, } from "./service.js";
+export function createOnegentRuntime(options = {}) {
+    const executionStore = options.executionStore ?? createInMemoryExecutionStore();
+    const inFlight = new Map();
+    const executeOnce = async (actionInput, adapter) => {
+        const review = getActionReview(actionId(actionInput));
+        const key = review.action.idempotencyKey;
+        const existing = await executionStore.get(key);
+        if (existing) {
+            if (existing.actionIntentId !== review.action.id)
+                throw new Error(`Idempotency key ${key} is already bound to another action.`);
+            if (existing.status !== "COMPLETED") {
+                throw new Error(`Action ${review.action.id} execution is ${existing.status} and cannot be replayed as completed.`);
+            }
+            return existing.execution;
+        }
+        const pending = inFlight.get(key);
+        if (pending)
+            return pending;
+        const operation = (async () => {
+            const execution = adapter
+                ? await executeAfterApprovalWithAdapter(review.action.id, adapter, { idempotencyKey: key, attempt: 1 })
+                : executeApprovedAction(review.action.id);
+            await executionStore.put({
+                idempotencyKey: key,
+                actionIntentId: review.action.id,
+                adapterName: adapter?.name ?? "onegent-local-mock",
+                status: "COMPLETED",
+                execution,
+                rollbackToken: execution.rollbackToken,
+                executedAt: new Date().toISOString(),
+            });
+            return execution;
+        })();
+        inFlight.set(key, operation);
+        try {
+            return await operation;
+        }
+        finally {
+            inFlight.delete(key);
+        }
+    };
+    return {
+        captureAction: (input) => captureActionIntent(input, {
+            policyRules: options.policyRules,
+            policyEngine: options.policyEngine,
+            authorizationPolicy: options.authorizationPolicy,
+        }),
+        assessRisk: (action) => assessActionRisk(action),
+        evaluatePolicy: (action, risk) => {
+            const assessment = risk ?? assessActionRisk(action);
+            return options.policyEngine?.evaluate(action, assessment, options.policyRules ?? []) ?? evaluatePolicyRules(action, assessment, options.policyRules);
+        },
+        requestApproval: async (action, assignedTo) => {
+            const id = actionId(action);
+            const approval = requestActionApproval(id, assignedTo);
+            if (!options.approvalAdapter)
+                return approval;
+            const review = getActionReview(id);
+            const policy = options.policyEngine?.evaluate(review.action, review.riskAssessment, options.policyRules ?? []) ??
+                evaluatePolicyRules(review.action, review.riskAssessment, options.policyRules);
+            const decision = await options.approvalAdapter.requestApproval({
+                action: review.action,
+                risk: review.riskAssessment,
+                policy,
+                approvalRequest: approval,
+            });
+            if (decision?.approved !== undefined && !decision.reviewerId?.trim()) {
+                throw new Error(`Approval adapter ${options.approvalAdapter.name} must identify the reviewer.`);
+            }
+            if (decision?.expiresAt && Date.parse(decision.expiresAt) <= Date.now()) {
+                throw new Error(`Approval decision ${decision.decisionId ?? "from adapter"} has expired.`);
+            }
+            if (decision?.approved === true) {
+                approveAction(id, decision.reviewerId, decision.reviewerComment, { autoExecute: false });
+            }
+            else if (decision?.approved === false) {
+                rejectAction(id, decision.reviewerId, decision.reviewerComment);
+            }
+            return getActionReview(id).approvalRequest ?? approval;
+        },
+        approveAction: (action, reviewerId, reviewerComment) => approveAction(actionId(action), reviewerId, reviewerComment, { autoExecute: false }),
+        rejectAction: (action, reviewerId, reviewerComment) => rejectAction(actionId(action), reviewerId, reviewerComment),
+        executeAfterApproval: executeOnce,
+        rollbackAfterExecution: async (actionInput, adapter, reason) => {
+            const review = getActionReview(actionId(actionInput));
+            const key = review.action.idempotencyKey;
+            const receipt = await executionStore.get(key);
+            if (!receipt || receipt.actionIntentId !== review.action.id)
+                throw new Error(`Action ${review.action.id} has no completed execution to roll back.`);
+            if (receipt.status === "ROLLED_BACK")
+                return receipt;
+            if (!adapter.rollback)
+                throw new Error(`Adapter ${adapter.name} does not implement the rollback contract.`);
+            const result = await adapter.rollback(review.action, receipt.execution, { idempotencyKey: key, reason, rollbackToken: receipt.rollbackToken });
+            recordRollback(review.action.id, adapter.name, reason, result);
+            const next = {
+                ...receipt,
+                status: result.success ? "ROLLED_BACK" : "ROLLBACK_FAILED",
+                rollback: { ...result, attemptedAt: new Date().toISOString(), reason },
+            };
+            await executionStore.put(next);
+            return next;
+        },
+        getExecutionReceipt: async (actionInput) => executionStore.get(getActionReview(actionId(actionInput)).action.idempotencyKey),
+        verifyOutcome: (action, observedState) => verifyActionOutcome(actionId(action), observedStateForVerification(observedState)),
+        writeAuditPacket: async (action) => {
+            const packet = generateAuditPacket(actionId(action));
+            await options.auditStore?.writeAuditPacket(packet);
+            return packet;
+        },
+        getActionReview: (action) => getActionReview(actionId(action)),
+        listActionReviews: () => listActionReviews(),
+    };
+}
+export function createInMemoryExecutionStore(name = "in-memory-execution-store") {
+    const receipts = new Map();
+    return {
+        name,
+        receipts,
+        get: (idempotencyKey) => receipts.get(idempotencyKey),
+        put: (receipt) => { receipts.set(receipt.idempotencyKey, receipt); },
+    };
+}
+function actionId(action) {
+    return typeof action === "string" ? action : action.id;
+}
+function observedStateForVerification(input) {
+    if (!input)
+        return undefined;
+    if (isActionExecutionSummary(input)) {
+        return input.observedState;
+    }
+    return input;
+}
+function isActionExecutionSummary(input) {
+    return typeof input.method === "string" && typeof input.status === "string" && typeof input.targetSystem === "string";
+}

package/dist/vendor/onegent-runtime/service.d.ts

@@ -0,0 +1,27 @@
+import type { ActionAuditPacket, ActionExecutionSummary, ActionRollbackResult, ActionReview, AuthorizationPolicy, ApprovalRequest, CreateActionIntentInput, LocalActionAdapter, PolicyEngine, PolicyRule, VerificationResult } from "./types.js";
+export interface ActionGatewayOptions {
+    policyRules?: PolicyRule[];
+    policyEngine?: PolicyEngine;
+    authorizationPolicy?: AuthorizationPolicy;
+}
+export interface ApprovalOptions {
+    autoExecute?: boolean;
+}
+export declare function captureActionIntent(input: CreateActionIntentInput, options?: ActionGatewayOptions): ActionReview;
+export declare function approveAction(actionId: string, reviewerId?: string, reviewerComment?: string, options?: ApprovalOptions): ActionReview;
+export declare function requestApproval(actionId: string, assignedTo?: string, requestedBy?: string): ApprovalRequest;
+export declare function rejectAction(actionId: string, reviewerId?: string, reviewerComment?: string): ActionReview;
+export declare function executeAfterApproval(actionId: string): ActionExecutionSummary;
+export declare function executeAfterApprovalWithAdapter(actionId: string, adapter: LocalActionAdapter, context?: {
+    idempotencyKey: string;
+    attempt: number;
+}): Promise<ActionExecutionSummary>;
+export declare function recordRollback(actionId: string, adapterName: string, reason: string, result: ActionRollbackResult): ActionReview;
+export declare function executeMockAction(actionId: string): ActionExecutionSummary;
+export declare function verifyOutcome(actionId: string, observedState?: Record<string, unknown>): VerificationResult;
+export declare function verifyAction(actionId: string, observedState?: Record<string, unknown>): VerificationResult;
+export declare function getActionReview(actionId: string): ActionReview;
+export declare function listActionReviews(): ActionReview[];
+export declare function writeAuditPacket(actionId: string): ActionAuditPacket;
+export declare function generateAuditPacket(actionId: string): ActionAuditPacket;
+//# sourceMappingURL=service.d.ts.map

package/dist/vendor/onegent-runtime/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EAEpB,YAAY,EAEZ,mBAAmB,EACnB,eAAe,EAGf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,UAAU,EAEV,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,EAAE,OAAO,GAAE,oBAAyB,GAAG,YAAY,CAuGpH;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,eAAe,SAAuC,EACtD,OAAO,GAAE,eAAoB,GAC5B,YAAY,CAwBd;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,WAAW,SAAoB,GAC9B,eAAe,CA2BjB;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,eAAe,SAAgC,GAC9C,YAAY,CAmBd;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAQ7E;AAED,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,sBAAsB,CAAC,CA6BjC;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,GAC3B,YAAY,CAkBd;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAyC1E;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAE3G;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAoC1G;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAuB9D;AAED,wBAAgB,iBAAiB,IAAI,YAAY,EAAE,CAElD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAEpE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CA+BvE"}