agentcert 0.5.3 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +23 -0
- package/dist/bundle.js +19 -0
- package/dist/cli.js +27 -0
- package/dist/command-help.js +3 -0
- package/dist/control-plane.js +1 -0
- package/dist/normalizers.js +47 -0
- package/dist/report.js +19 -2
- package/dist/schema-validator.js +200 -2
- package/dist/vendor/onegent-runtime/sdk.d.ts +1 -1
- package/dist/vendor/onegent-runtime/sdk.d.ts.map +1 -1
- package/dist/vendor/onegent-runtime/sdk.js +1 -1
- package/dist/vendor/onegent-runtime/service.d.ts +3 -3
- package/dist/vendor/onegent-runtime/service.d.ts.map +1 -1
- package/dist/vendor/onegent-runtime/service.js +6 -4
- package/dist/vendor/onegent-runtime/trust-types.d.ts +163 -0
- package/dist/vendor/onegent-runtime/trust-types.d.ts.map +1 -0
- package/dist/vendor/onegent-runtime/trust-types.js +7 -0
- package/dist/vendor/onegent-runtime/types.d.ts +4 -1
- package/dist/vendor/onegent-runtime/types.d.ts.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -57,6 +57,29 @@ npx agentcert connect --server https://agentcert.app --project your-project-id
|
|
|
57
57
|
npx agentcert push --evidence .agentcert/latest/agentcert-evidence.json
|
|
58
58
|
```
|
|
59
59
|
|
|
60
|
+
Bind a release, pull-request, or nightly run to an issued continuous assurance
|
|
61
|
+
case by declaring the exact reviewed scope:
|
|
62
|
+
|
|
63
|
+
```bash
|
|
64
|
+
npx agentcert run --config agentcert.config.json --push \
|
|
65
|
+
--assurance-case "$AGENTCERT_ASSURANCE_CASE_ID" \
|
|
66
|
+
--assurance-scope agentcert.assurance-scope.json \
|
|
67
|
+
--assurance-trigger auto
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
Validate the scope before CI uses it:
|
|
71
|
+
|
|
72
|
+
```bash
|
|
73
|
+
npx agentcert schema validate \
|
|
74
|
+
--schema assurance-scope \
|
|
75
|
+
--file agentcert.assurance-scope.json
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
`auto` treats pull requests as prospective, scheduled workflows as nightly,
|
|
79
|
+
and other GitHub runs as release checks. Authoritative failure or scope drift
|
|
80
|
+
sets the Hosted contract to `REVALIDATION_REQUIRED`; only an independently
|
|
81
|
+
issued successor case establishes a new `CURRENT` baseline.
|
|
82
|
+
|
|
60
83
|
Add `--push` to `agentcert run` to run locally and upload the resulting bundle
|
|
61
84
|
in one command. By default, both commands also upload local files referenced by
|
|
62
85
|
the bundle. Reads are confined to `--artifact-root` (the current directory by
|
package/dist/bundle.js
CHANGED
|
@@ -36,6 +36,7 @@ export function buildEvidenceBundle(results, subjectName, subjectType = "agent")
|
|
|
36
36
|
results,
|
|
37
37
|
evidence,
|
|
38
38
|
artifacts,
|
|
39
|
+
evidenceStrength: evidenceStrengthFor(results),
|
|
39
40
|
standards: [
|
|
40
41
|
{
|
|
41
42
|
id: "aiuc-1",
|
|
@@ -58,6 +59,24 @@ export function buildEvidenceBundle(results, subjectName, subjectType = "agent")
|
|
|
58
59
|
],
|
|
59
60
|
};
|
|
60
61
|
}
|
|
62
|
+
const STRENGTH_ORDER = ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
|
|
63
|
+
function evidenceStrengthFor(results) {
|
|
64
|
+
const values = results.map((result) => result.evidenceStrength ?? {
|
|
65
|
+
schemaVersion: "agentcert.evidence_strength.v0.1",
|
|
66
|
+
level: "reported",
|
|
67
|
+
claims: ["A producer supplied a result for this run."],
|
|
68
|
+
limitations: ["The result does not contain a source-signed action record."],
|
|
69
|
+
});
|
|
70
|
+
const weakest = values.length
|
|
71
|
+
? values.reduce((left, right) => STRENGTH_ORDER.indexOf(left.level) <= STRENGTH_ORDER.indexOf(right.level) ? left : right)
|
|
72
|
+
: { schemaVersion: "agentcert.evidence_strength.v0.1", level: "reported", claims: [], limitations: ["The bundle contains no results."] };
|
|
73
|
+
return {
|
|
74
|
+
schemaVersion: "agentcert.evidence_strength.v0.1",
|
|
75
|
+
level: weakest.level,
|
|
76
|
+
claims: [...new Set(values.flatMap((value) => value.claims))],
|
|
77
|
+
limitations: [...new Set(values.flatMap((value) => value.limitations))],
|
|
78
|
+
};
|
|
79
|
+
}
|
|
61
80
|
function levelForScore(score, passed) {
|
|
62
81
|
if (!passed) {
|
|
63
82
|
return "Not certified";
|
package/dist/cli.js
CHANGED
|
@@ -489,6 +489,7 @@ else if (command === "schema") {
|
|
|
489
489
|
agentcert schema validate --schema classifier-eval --file examples/agentcert/classifier-eval.example.json
|
|
490
490
|
agentcert schema validate --schema release-gate --file .agentcert/latest/agentcert-release-gate.json
|
|
491
491
|
agentcert schema validate --schema assurance-report --file assurance-report.json
|
|
492
|
+
agentcert schema validate --schema assurance-delivery --file assurance-delivery.json
|
|
492
493
|
agentcert schema validate --schema evidence-signature --file .agentcert/latest/agentcert-evidence.json.sig.json
|
|
493
494
|
`);
|
|
494
495
|
}
|
|
@@ -610,6 +611,7 @@ async function pushHostedEvidence(bundle, bytes, fileName) {
|
|
|
610
611
|
externalId: readFlag("--external-id"),
|
|
611
612
|
companionArtifacts: companions?.artifacts,
|
|
612
613
|
skippedCompanionArtifacts: companions?.skipped,
|
|
614
|
+
assurance: await readContinuousAssuranceBinding(),
|
|
613
615
|
});
|
|
614
616
|
process.stdout.write(`Hosted run: ${result.runId}\nHosted evidence: ${result.evidenceId}\n`);
|
|
615
617
|
if (companions) {
|
|
@@ -622,6 +624,31 @@ async function pushHostedEvidence(bundle, bytes, fileName) {
|
|
|
622
624
|
}
|
|
623
625
|
}
|
|
624
626
|
}
|
|
627
|
+
async function readContinuousAssuranceBinding() {
|
|
628
|
+
const caseId = readFlag("--assurance-case");
|
|
629
|
+
const scopePath = readFlag("--assurance-scope");
|
|
630
|
+
if (!caseId && !scopePath)
|
|
631
|
+
return undefined;
|
|
632
|
+
if (!caseId || !scopePath)
|
|
633
|
+
throw new Error("--assurance-case and --assurance-scope must be provided together.");
|
|
634
|
+
const scope = await readJson(scopePath);
|
|
635
|
+
const validation = validateAgentCertSchema("assurance-scope", scope);
|
|
636
|
+
if (!validation.valid)
|
|
637
|
+
throw new Error(`Assurance scope is invalid:\n${validation.errors.map((error) => `- ${error}`).join("\n")}`);
|
|
638
|
+
return { caseId, trigger: assuranceTriggerFromEnvironment(readFlag("--assurance-trigger") ?? "auto"), scope: scope };
|
|
639
|
+
}
|
|
640
|
+
function assuranceTriggerFromEnvironment(value) {
|
|
641
|
+
if (value === "pull_request" || value === "release" || value === "nightly")
|
|
642
|
+
return value;
|
|
643
|
+
if (value !== "auto")
|
|
644
|
+
throw new Error("--assurance-trigger must be auto, pull_request, release, or nightly.");
|
|
645
|
+
const event = process.env.GITHUB_EVENT_NAME;
|
|
646
|
+
if (event === "pull_request" || event === "pull_request_target")
|
|
647
|
+
return "pull_request";
|
|
648
|
+
if (event === "schedule")
|
|
649
|
+
return "nightly";
|
|
650
|
+
return "release";
|
|
651
|
+
}
|
|
625
652
|
async function promptValue(label) {
|
|
626
653
|
if (!process.stdin.isTTY || !process.stdout.isTTY) {
|
|
627
654
|
throw new Error(`Missing ${label.trim().replace(/:$/, "").toLowerCase()}. Pass it as a flag or environment variable.`);
|
package/dist/command-help.js
CHANGED
|
@@ -34,6 +34,9 @@ Options:
|
|
|
34
34
|
--project <id> Hosted project ID
|
|
35
35
|
--api-key <key> Project API key (prefer AGENTCERT_API_KEY in CI)
|
|
36
36
|
--external-id <id> Idempotent hosted run ID
|
|
37
|
+
--assurance-case <id> Issued assurance case to reconcile
|
|
38
|
+
--assurance-scope <p> Declared agent/model/prompt/tools/policy/suite scope JSON
|
|
39
|
+
--assurance-trigger <t> auto, pull_request, release, or nightly (default: auto)
|
|
37
40
|
--artifact-root <dir> Allowed root for companion artifacts (default: current directory)
|
|
38
41
|
--no-artifacts Upload only the evidence bundle
|
|
39
42
|
--help, -h Show this help
|
package/dist/control-plane.js
CHANGED
|
@@ -70,6 +70,7 @@ export async function pushEvidenceToControlPlane(options) {
|
|
|
70
70
|
subject: bundle.subject,
|
|
71
71
|
products: bundle.summary.products,
|
|
72
72
|
},
|
|
73
|
+
assurance: options.assurance,
|
|
73
74
|
}),
|
|
74
75
|
});
|
|
75
76
|
await requestJson(request, `${projectUrl}/runs/${encodeURIComponent(run.id)}/events`, {
|
package/dist/normalizers.js
CHANGED
|
@@ -42,6 +42,7 @@ export function normalizeMcpBenchResult(input, artifactPath) {
|
|
|
42
42
|
passed,
|
|
43
43
|
certLevel: stringValue(value.cert_level),
|
|
44
44
|
summary: passed ? "MCPBench completed without blocking violations." : "MCPBench found blocking evidence.",
|
|
45
|
+
evidenceStrength: reportedStrength("MCPBench result was imported without a source-signed action journal."),
|
|
45
46
|
artifacts: recordOfStrings(value.artifact_paths, { results: artifactPath }),
|
|
46
47
|
evidence,
|
|
47
48
|
};
|
|
@@ -85,6 +86,7 @@ export function normalizeTripwireResult(input, artifactPath) {
|
|
|
85
86
|
score: overallScore,
|
|
86
87
|
passed,
|
|
87
88
|
summary: passed ? "Tripwire CI gate passed." : "Tripwire CI gate failed.",
|
|
89
|
+
evidenceStrength: reportedStrength("Tripwire result was imported without a source-signed action journal."),
|
|
88
90
|
artifacts: { result: artifactPath, outDir: stringValue(value.outDir) ?? "" },
|
|
89
91
|
evidence,
|
|
90
92
|
};
|
|
@@ -98,6 +100,10 @@ export function normalizeOnegentAuditPacket(input, artifactPath) {
|
|
|
98
100
|
const authorization = asRecord(value.authorizationDecision);
|
|
99
101
|
const verification = asRecord(value.verificationResult);
|
|
100
102
|
const auditEvents = Array.isArray(value.auditEvents) ? value.auditEvents : [];
|
|
103
|
+
const trusted = asRecord(value.trustedActionEvidence);
|
|
104
|
+
const trustedStrength = evidenceStrengthValue(trusted.evidenceStrength);
|
|
105
|
+
const mandate = asRecord(trusted.mandate);
|
|
106
|
+
const receipt = asRecord(trusted.runReceipt);
|
|
101
107
|
const verificationSuccess = verification.success === true;
|
|
102
108
|
const approved = approval.status === "APPROVED" || approval.status === undefined;
|
|
103
109
|
const passed = verificationSuccess && approved;
|
|
@@ -158,6 +164,25 @@ export function normalizeOnegentAuditPacket(input, artifactPath) {
|
|
|
158
164
|
artifactPath,
|
|
159
165
|
metadata: verification,
|
|
160
166
|
});
|
|
167
|
+
if (trustedStrength) {
|
|
168
|
+
evidence.push({
|
|
169
|
+
id: "onegent_action_mandate",
|
|
170
|
+
kind: "action_mandate",
|
|
171
|
+
severity: "info",
|
|
172
|
+
message: `High-risk action was bound to mandate ${stringValue(mandate.mandateId) ?? "UNKNOWN"}.`,
|
|
173
|
+
source: "onegent-runtime",
|
|
174
|
+
artifactPath,
|
|
175
|
+
metadata: { mandateId: mandate.mandateId, mandateDigestSha256: mandate.digestSha256 },
|
|
176
|
+
}, {
|
|
177
|
+
id: "onegent_trusted_journal",
|
|
178
|
+
kind: "trusted_action_journal",
|
|
179
|
+
severity: asRecord(receipt.journal).valid === true ? "info" : "critical",
|
|
180
|
+
message: `Source-signed action journal strength: ${trustedStrength.level}.`,
|
|
181
|
+
source: "onegent-runtime",
|
|
182
|
+
artifactPath,
|
|
183
|
+
metadata: { receiptSha256: receipt.receiptSha256, collector: receipt.collector, journal: receipt.journal },
|
|
184
|
+
});
|
|
185
|
+
}
|
|
161
186
|
for (const event of auditEvents) {
|
|
162
187
|
const record = asRecord(event);
|
|
163
188
|
evidence.push({
|
|
@@ -181,10 +206,32 @@ export function normalizeOnegentAuditPacket(input, artifactPath) {
|
|
|
181
206
|
summary: passed
|
|
182
207
|
? "Runtime action was approved, mock-executed, verified, and audited."
|
|
183
208
|
: "Runtime action did not complete the approval and verification gate.",
|
|
209
|
+
evidenceStrength: trustedStrength ?? reportedStrength("Onegent audit packet does not include a trusted action receipt."),
|
|
184
210
|
artifacts: { auditPacket: artifactPath },
|
|
185
211
|
evidence,
|
|
186
212
|
};
|
|
187
213
|
}
|
|
214
|
+
function reportedStrength(limitation) {
|
|
215
|
+
return {
|
|
216
|
+
schemaVersion: "agentcert.evidence_strength.v0.1",
|
|
217
|
+
level: "reported",
|
|
218
|
+
claims: ["A producer supplied a result for this run."],
|
|
219
|
+
limitations: [limitation],
|
|
220
|
+
};
|
|
221
|
+
}
|
|
222
|
+
function evidenceStrengthValue(input) {
|
|
223
|
+
const value = asRecord(input);
|
|
224
|
+
const level = value.level;
|
|
225
|
+
if (value.schemaVersion !== "agentcert.evidence_strength.v0.1"
|
|
226
|
+
|| !["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"].includes(String(level)))
|
|
227
|
+
return undefined;
|
|
228
|
+
return {
|
|
229
|
+
schemaVersion: "agentcert.evidence_strength.v0.1",
|
|
230
|
+
level: level,
|
|
231
|
+
claims: Array.isArray(value.claims) ? value.claims.filter((item) => typeof item === "string") : [],
|
|
232
|
+
limitations: Array.isArray(value.limitations) ? value.limitations.filter((item) => typeof item === "string") : [],
|
|
233
|
+
};
|
|
234
|
+
}
|
|
188
235
|
function normalizeScore(value) {
|
|
189
236
|
return value <= 1 ? Math.round(value * 100) : Math.round(value);
|
|
190
237
|
}
|
package/dist/report.js
CHANGED
|
@@ -6,7 +6,12 @@ export function renderMarkdownReport(bundle) {
|
|
|
6
6
|
`Generated: ${bundle.generatedAt}`,
|
|
7
7
|
`Verdict: ${bundle.verdict.passed ? "PASS" : "FAIL"}`,
|
|
8
8
|
`Score: ${bundle.verdict.score}`,
|
|
9
|
-
`
|
|
9
|
+
`Evidence strength: ${bundle.evidenceStrength?.level ?? "reported"}`,
|
|
10
|
+
"",
|
|
11
|
+
"## Evidence Strength",
|
|
12
|
+
"",
|
|
13
|
+
...(bundle.evidenceStrength?.claims ?? ["A producer supplied a result for this run."]).map((claim) => `- Claim: ${claim}`),
|
|
14
|
+
...(bundle.evidenceStrength?.limitations ?? ["This legacy bundle does not declare stronger source controls."]).map((limitation) => `- Limitation: ${limitation}`),
|
|
10
15
|
"",
|
|
11
16
|
"## Results",
|
|
12
17
|
"",
|
|
@@ -34,6 +39,11 @@ export function renderMarkdownReport(bundle) {
|
|
|
34
39
|
return `${lines.join("\n")}\n`;
|
|
35
40
|
}
|
|
36
41
|
export function renderHtmlReport(bundle) {
|
|
42
|
+
const strength = bundle.evidenceStrength ?? {
|
|
43
|
+
level: "reported",
|
|
44
|
+
claims: ["A producer supplied a result for this run."],
|
|
45
|
+
limitations: ["This legacy bundle does not declare stronger source controls."],
|
|
46
|
+
};
|
|
37
47
|
const resultCards = bundle.results
|
|
38
48
|
.map((result) => `<article class="card ${result.passed ? "pass" : "fail"}">
|
|
39
49
|
<span>${escapeHtml(result.phase)}</span>
|
|
@@ -108,10 +118,17 @@ export function renderHtmlReport(bundle) {
|
|
|
108
118
|
<div class="summary">
|
|
109
119
|
<div class="metric"><span>Verdict</span><strong class="${bundle.verdict.passed ? "verdict-pass" : "verdict-fail"}">${bundle.verdict.passed ? "PASS" : "FAIL"}</strong></div>
|
|
110
120
|
<div class="metric"><span>Score</span><strong>${bundle.verdict.score}/100</strong></div>
|
|
111
|
-
<div class="metric"><span>
|
|
121
|
+
<div class="metric"><span>Evidence strength</span><strong>${escapeHtml(bundle.evidenceStrength?.level ?? "reported")}</strong></div>
|
|
112
122
|
<div class="metric"><span>Evidence</span><strong>${bundle.summary.totalEvidence}</strong></div>
|
|
113
123
|
</div>
|
|
114
124
|
<div class="cards">${resultCards}</div>
|
|
125
|
+
<section>
|
|
126
|
+
<h2>Evidence strength: ${escapeHtml(strength.level)}</h2>
|
|
127
|
+
<h3>Supported claims</h3>
|
|
128
|
+
<ul>${strength.claims.map((claim) => `<li>${escapeHtml(claim)}</li>`).join("")}</ul>
|
|
129
|
+
<h3>Limitations</h3>
|
|
130
|
+
<ul>${strength.limitations.map((limitation) => `<li>${escapeHtml(limitation)}</li>`).join("")}</ul>
|
|
131
|
+
</section>
|
|
115
132
|
<section>
|
|
116
133
|
<h2>Evidence</h2>
|
|
117
134
|
<table>
|
package/dist/schema-validator.js
CHANGED
|
@@ -12,10 +12,16 @@ export function parseSchemaId(input) {
|
|
|
12
12
|
value === "robustness-lab" ||
|
|
13
13
|
value === "release-gate" ||
|
|
14
14
|
value === "assurance-report" ||
|
|
15
|
-
value === "
|
|
15
|
+
value === "assurance-delivery" ||
|
|
16
|
+
value === "assurance-scope" ||
|
|
17
|
+
value === "evidence-signature" ||
|
|
18
|
+
value === "evidence-strength" ||
|
|
19
|
+
value === "action-mandate" ||
|
|
20
|
+
value === "trusted-action-record" ||
|
|
21
|
+
value === "trusted-run-receipt") {
|
|
16
22
|
return value;
|
|
17
23
|
}
|
|
18
|
-
throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report,
|
|
24
|
+
throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, assurance-scope, evidence-signature, evidence-strength, action-mandate, trusted-action-record, or trusted-run-receipt.`);
|
|
19
25
|
}
|
|
20
26
|
export function validateAgentCertSchema(schema, input) {
|
|
21
27
|
const errors = [];
|
|
@@ -45,6 +51,18 @@ export function validateAgentCertSchema(schema, input) {
|
|
|
45
51
|
validateRobustnessLab(value, errors);
|
|
46
52
|
if (schema === "assurance-report")
|
|
47
53
|
validateAssuranceReport(value, errors);
|
|
54
|
+
if (schema === "assurance-delivery")
|
|
55
|
+
validateAssuranceDelivery(value, errors);
|
|
56
|
+
if (schema === "assurance-scope")
|
|
57
|
+
validateAssuranceScope(value, errors);
|
|
58
|
+
if (schema === "evidence-strength")
|
|
59
|
+
validateEvidenceStrength(value, errors);
|
|
60
|
+
if (schema === "action-mandate")
|
|
61
|
+
validateActionMandate(value, errors);
|
|
62
|
+
if (schema === "trusted-action-record")
|
|
63
|
+
validateTrustedActionRecord(value, errors);
|
|
64
|
+
if (schema === "trusted-run-receipt")
|
|
65
|
+
validateTrustedRunReceipt(value, errors);
|
|
48
66
|
}
|
|
49
67
|
return { schema, valid: errors.length === 0, errors };
|
|
50
68
|
}
|
|
@@ -62,6 +80,13 @@ function validateEvidenceBundle(value, errors) {
|
|
|
62
80
|
requiredArray(value, "evidence", errors);
|
|
63
81
|
requiredObject(value, "artifacts", errors);
|
|
64
82
|
requiredArray(value, "standards", errors);
|
|
83
|
+
if (value.evidenceStrength !== undefined) {
|
|
84
|
+
const strength = recordValue(value.evidenceStrength);
|
|
85
|
+
if (!strength)
|
|
86
|
+
errors.push("evidenceStrength must be an object.");
|
|
87
|
+
else
|
|
88
|
+
validateEvidenceStrength(strength, errors, "evidenceStrength.");
|
|
89
|
+
}
|
|
65
90
|
const subject = recordValue(value.subject);
|
|
66
91
|
if (subject) {
|
|
67
92
|
requiredStringAt(subject, "name", "subject.name", errors);
|
|
@@ -86,6 +111,88 @@ function validateEvidenceBundle(value, errors) {
|
|
|
86
111
|
validateEvidenceArray(value.evidence, "evidence", errors);
|
|
87
112
|
validateStandards(value.standards, errors);
|
|
88
113
|
}
|
|
114
|
+
const EVIDENCE_LEVELS = ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
|
|
115
|
+
const ACTION_TYPES = ["SUBMIT", "PAY", "SEND", "UPDATE"];
|
|
116
|
+
function validateEvidenceStrength(value, errors, prefix = "") {
|
|
117
|
+
requiredConst(value, "schemaVersion", "agentcert.evidence_strength.v0.1", errors);
|
|
118
|
+
requiredEnumAt(value, "level", EVIDENCE_LEVELS, `${prefix}level`, errors);
|
|
119
|
+
requiredArray(value, "claims", errors);
|
|
120
|
+
requiredArray(value, "limitations", errors);
|
|
121
|
+
stringArray(value.claims, `${prefix}claims`, errors);
|
|
122
|
+
stringArray(value.limitations, `${prefix}limitations`, errors);
|
|
123
|
+
}
|
|
124
|
+
function validateActionMandate(value, errors) {
|
|
125
|
+
requiredConst(value, "schemaVersion", "agentcert.action_mandate.v0.1", errors);
|
|
126
|
+
for (const field of ["mandateId", "policySha256", "validFrom", "expiresAt", "issuedAt", "digestSha256"])
|
|
127
|
+
requiredString(value, field, errors);
|
|
128
|
+
requiredObject(value, "issuer", errors);
|
|
129
|
+
requiredObject(value, "subject", errors);
|
|
130
|
+
requiredObject(value, "scope", errors);
|
|
131
|
+
requiredObject(value, "sourceSignature", errors);
|
|
132
|
+
sha256Field(value, "policySha256", errors);
|
|
133
|
+
sha256Field(value, "digestSha256", errors);
|
|
134
|
+
for (const field of ["validFrom", "expiresAt", "issuedAt"])
|
|
135
|
+
validateTimestamp(value[field], field, errors);
|
|
136
|
+
const scope = recordValue(value.scope);
|
|
137
|
+
if (scope) {
|
|
138
|
+
requiredArray(scope, "actionTypes", errors);
|
|
139
|
+
requiredArray(scope, "targetSystems", errors);
|
|
140
|
+
requiredArray(scope, "permissions", errors);
|
|
141
|
+
if (Array.isArray(scope.actionTypes))
|
|
142
|
+
scope.actionTypes.forEach((item, index) => {
|
|
143
|
+
if (!ACTION_TYPES.includes(String(item)))
|
|
144
|
+
errors.push(`scope.actionTypes[${index}] is not supported.`);
|
|
145
|
+
});
|
|
146
|
+
}
|
|
147
|
+
validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
|
|
148
|
+
}
|
|
149
|
+
function validateTrustedActionRecord(value, errors) {
|
|
150
|
+
requiredConst(value, "schemaVersion", "agentcert.trusted_action_record.v0.1", errors);
|
|
151
|
+
for (const field of ["recordId", "runId", "occurredAt", "type", "payloadSha256", "eventHash"])
|
|
152
|
+
requiredString(value, field, errors);
|
|
153
|
+
requiredNonNegativeInteger(value, "sequence", "sequence", errors);
|
|
154
|
+
requiredObject(value, "collector", errors);
|
|
155
|
+
requiredObject(value, "payload", errors);
|
|
156
|
+
requiredObject(value, "sourceSignature", errors);
|
|
157
|
+
sha256Field(value, "payloadSha256", errors);
|
|
158
|
+
sha256Field(value, "eventHash", errors);
|
|
159
|
+
if (value.previousEventHash !== undefined)
|
|
160
|
+
sha256Field(value, "previousEventHash", errors);
|
|
161
|
+
validateTimestamp(value.occurredAt, "occurredAt", errors);
|
|
162
|
+
validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
|
|
163
|
+
}
|
|
164
|
+
function validateTrustedRunReceipt(value, errors) {
|
|
165
|
+
requiredConst(value, "schemaVersion", "agentcert.trusted_run_receipt.v0.1", errors);
|
|
166
|
+
for (const field of ["runId", "startedAt", "completedAt", "firstEventHash", "lastEventHash", "sourcePublicKeyPem", "receiptSha256"])
|
|
167
|
+
requiredString(value, field, errors);
|
|
168
|
+
for (const field of ["eventCount", "droppedEventCount"])
|
|
169
|
+
requiredNonNegativeInteger(value, field, field, errors);
|
|
170
|
+
requiredObject(value, "collector", errors);
|
|
171
|
+
requiredArray(value, "mandateDigests", errors);
|
|
172
|
+
requiredArray(value, "actionIds", errors);
|
|
173
|
+
requiredObject(value, "journal", errors);
|
|
174
|
+
requiredObject(value, "evidenceStrength", errors);
|
|
175
|
+
requiredObject(value, "sourceSignature", errors);
|
|
176
|
+
for (const field of ["firstEventHash", "lastEventHash", "receiptSha256"])
|
|
177
|
+
sha256Field(value, field, errors);
|
|
178
|
+
const strength = recordValue(value.evidenceStrength);
|
|
179
|
+
if (strength)
|
|
180
|
+
validateEvidenceStrength(strength, errors, "evidenceStrength.");
|
|
181
|
+
validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
|
|
182
|
+
}
|
|
183
|
+
function sha256Field(value, field, errors) {
|
|
184
|
+
if (typeof value[field] === "string" && !/^[0-9a-f]{64}$/.test(value[field]))
|
|
185
|
+
errors.push(`${field} must be a lowercase SHA-256 digest.`);
|
|
186
|
+
}
|
|
187
|
+
function validateSourceSignature(value, path, errors) {
|
|
188
|
+
const signature = recordValue(value);
|
|
189
|
+
if (!signature)
|
|
190
|
+
return;
|
|
191
|
+
if (signature.algorithm !== "Ed25519")
|
|
192
|
+
errors.push(`${path}.algorithm must equal Ed25519.`);
|
|
193
|
+
requiredStringAt(signature, "keyId", `${path}.keyId`, errors);
|
|
194
|
+
requiredStringAt(signature, "signature", `${path}.signature`, errors);
|
|
195
|
+
}
|
|
89
196
|
function validateResult(value, errors) {
|
|
90
197
|
requiredConst(value, "schemaVersion", "1", errors);
|
|
91
198
|
requiredString(value, "product", errors);
|
|
@@ -189,6 +296,97 @@ function validateAssuranceReport(value, errors) {
|
|
|
189
296
|
errors.push("evaluationPlanSha256 must be a lowercase SHA-256 digest.");
|
|
190
297
|
validateTimestamp(value.issuedAt, "issuedAt", errors);
|
|
191
298
|
validateTimestamp(value.expiresAt, "expiresAt", errors);
|
|
299
|
+
validateAssuranceContinuity(value.continuousAssurance, errors);
|
|
300
|
+
}
|
|
301
|
+
function validateAssuranceDelivery(value, errors) {
|
|
302
|
+
requiredConst(value, "schemaVersion", "agentcert.assurance_delivery.v0.1", errors);
|
|
303
|
+
for (const key of ["engagementId", "projectId", "assuranceCaseId", "dueAt", "deliveredAt", "evaluationPlanSha256", "statement"])
|
|
304
|
+
requiredString(value, key, errors);
|
|
305
|
+
for (const key of ["customer", "subject", "sandbox", "workflow", "terms", "decision", "integration", "evidenceStrength", "attestation"])
|
|
306
|
+
requiredObject(value, key, errors);
|
|
307
|
+
for (const key of ["baselineEvidence", "remediationItems", "retestEvidence"])
|
|
308
|
+
requiredArray(value, key, errors);
|
|
309
|
+
if (!/^[0-9a-f]{64}$/.test(String(value.evaluationPlanSha256 ?? "")))
|
|
310
|
+
errors.push("evaluationPlanSha256 must be a lowercase SHA-256 digest.");
|
|
311
|
+
validateTimestamp(value.dueAt, "dueAt", errors);
|
|
312
|
+
validateTimestamp(value.deliveredAt, "deliveredAt", errors);
|
|
313
|
+
const terms = recordValue(value.terms);
|
|
314
|
+
if (terms) {
|
|
315
|
+
if (terms.priceUsd !== 5000)
|
|
316
|
+
errors.push("terms.priceUsd must equal 5000.");
|
|
317
|
+
if (terms.workflowCount !== 1)
|
|
318
|
+
errors.push("terms.workflowCount must equal 1.");
|
|
319
|
+
if (terms.includedRetests !== 1)
|
|
320
|
+
errors.push("terms.includedRetests must equal 1.");
|
|
321
|
+
if (terms.privacy !== "private_by_default")
|
|
322
|
+
errors.push("terms.privacy must equal private_by_default.");
|
|
323
|
+
}
|
|
324
|
+
const decision = recordValue(value.decision);
|
|
325
|
+
if (decision)
|
|
326
|
+
requiredEnum(decision, "verdict", ["RELEASE", "RELEASE_WITH_CONTROLS", "BLOCK"], errors);
|
|
327
|
+
validateAssuranceContinuity(value.continuousAssurance, errors);
|
|
328
|
+
}
|
|
329
|
+
function validateAssuranceContinuity(input, errors) {
|
|
330
|
+
if (input === undefined)
|
|
331
|
+
return;
|
|
332
|
+
const value = recordValue(input);
|
|
333
|
+
if (!value) {
|
|
334
|
+
errors.push("continuousAssurance must be an object.");
|
|
335
|
+
return;
|
|
336
|
+
}
|
|
337
|
+
requiredConst(value, "schemaVersion", "agentcert.assurance_continuity.v0.1", errors);
|
|
338
|
+
requiredObject(value, "scope", errors);
|
|
339
|
+
requiredSha256At(value, "scopeFingerprintSha256", "continuousAssurance.scopeFingerprintSha256", errors);
|
|
340
|
+
requiredConst(value, "freshnessAtIssuance", "CURRENT", errors);
|
|
341
|
+
requiredArray(value, "revalidationRequiredWhen", errors);
|
|
342
|
+
stringArray(value.revalidationRequiredWhen, "continuousAssurance.revalidationRequiredWhen", errors);
|
|
343
|
+
const scope = recordValue(value.scope);
|
|
344
|
+
if (scope) {
|
|
345
|
+
const nested = [];
|
|
346
|
+
validateAssuranceScope(scope, nested);
|
|
347
|
+
errors.push(...nested.map((error) => `continuousAssurance.scope.${error}`));
|
|
348
|
+
}
|
|
349
|
+
}
|
|
350
|
+
function validateAssuranceScope(value, errors) {
|
|
351
|
+
requiredConst(value, "schemaVersion", "agentcert.assurance_scope.v0.1", errors);
|
|
352
|
+
for (const key of ["agent", "model", "prompt", "tools", "policy", "scenarioSuite"])
|
|
353
|
+
requiredObject(value, key, errors);
|
|
354
|
+
const agent = recordValue(value.agent);
|
|
355
|
+
const model = recordValue(value.model);
|
|
356
|
+
const prompt = recordValue(value.prompt);
|
|
357
|
+
const tools = recordValue(value.tools);
|
|
358
|
+
const policy = recordValue(value.policy);
|
|
359
|
+
const suite = recordValue(value.scenarioSuite);
|
|
360
|
+
if (agent) {
|
|
361
|
+
requiredStringAt(agent, "id", "agent.id", errors);
|
|
362
|
+
requiredStringAt(agent, "version", "agent.version", errors);
|
|
363
|
+
optionalSha256At(agent, "artifactSha256", "agent.artifactSha256", errors);
|
|
364
|
+
}
|
|
365
|
+
if (model)
|
|
366
|
+
for (const key of ["provider", "name", "version"])
|
|
367
|
+
requiredStringAt(model, key, `model.${key}`, errors);
|
|
368
|
+
if (prompt)
|
|
369
|
+
requiredSha256At(prompt, "sha256", "prompt.sha256", errors);
|
|
370
|
+
if (tools)
|
|
371
|
+
requiredSha256At(tools, "manifestSha256", "tools.manifestSha256", errors);
|
|
372
|
+
if (policy) {
|
|
373
|
+
requiredStringAt(policy, "id", "policy.id", errors);
|
|
374
|
+
requiredStringAt(policy, "version", "policy.version", errors);
|
|
375
|
+
optionalSha256At(policy, "sha256", "policy.sha256", errors);
|
|
376
|
+
}
|
|
377
|
+
if (suite) {
|
|
378
|
+
requiredStringAt(suite, "id", "scenarioSuite.id", errors);
|
|
379
|
+
requiredStringAt(suite, "version", "scenarioSuite.version", errors);
|
|
380
|
+
requiredSha256At(suite, "sha256", "scenarioSuite.sha256", errors);
|
|
381
|
+
}
|
|
382
|
+
}
|
|
383
|
+
function requiredSha256At(value, key, path, errors) {
|
|
384
|
+
if (typeof value[key] !== "string" || !/^[0-9a-f]{64}$/.test(value[key]))
|
|
385
|
+
errors.push(`${path} must be a lowercase SHA-256 digest.`);
|
|
386
|
+
}
|
|
387
|
+
function optionalSha256At(value, key, path, errors) {
|
|
388
|
+
if (value[key] !== undefined && (typeof value[key] !== "string" || !/^[0-9a-f]{64}$/.test(value[key])))
|
|
389
|
+
errors.push(`${path} must be a lowercase SHA-256 digest.`);
|
|
192
390
|
}
|
|
193
391
|
function validateFailureReview(value, errors) {
|
|
194
392
|
requiredConst(value, "schemaVersion", "1", errors);
|
|
@@ -17,7 +17,7 @@ export interface OnegentRuntime {
|
|
|
17
17
|
executeAfterApproval(action: ActionIntent | string, adapter?: LocalActionAdapter): Promise<ActionExecutionSummary>;
|
|
18
18
|
rollbackAfterExecution(action: ActionIntent | string, adapter: LocalActionAdapter, reason: string): Promise<ActionExecutionReceipt>;
|
|
19
19
|
getExecutionReceipt(action: ActionIntent | string): Promise<ActionExecutionReceipt | undefined>;
|
|
20
|
-
verifyOutcome(action: ActionIntent | string, observedState?: ActionExecutionSummary | Record<string, unknown
|
|
20
|
+
verifyOutcome(action: ActionIntent | string, observedState?: ActionExecutionSummary | Record<string, unknown>, method?: import("./types.js").VerificationMethod): VerificationResult;
|
|
21
21
|
writeAuditPacket(action: ActionIntent | string): Promise<ActionAuditPacket>;
|
|
22
22
|
getActionReview(action: ActionIntent | string): ActionReview;
|
|
23
23
|
listActionReviews(): ActionReview[];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/sdk.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,KAAK,EAAE,uBAAuB,GAAG,YAAY,CAAC;IAC5D,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,gBAAgB,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9F,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC1G,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACzG,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnH,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpI,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAChG,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,aAAa,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"sdk.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/sdk.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,KAAK,EAAE,uBAAuB,GAAG,YAAY,CAAC;IAC5D,UAAU,CAAC,MAAM,EAAE,YAAY,GAAG,cAAc,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,gBAAgB,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9F,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IAC1G,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;IACzG,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnH,sBAAsB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpI,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAChG,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,aAAa,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,OAAO,YAAY,EAAE,kBAAkB,GAAG,kBAAkB,CAAC;IACrL,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC5E,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,GAAG,YAAY,CAAC;IAC7D,iBAAiB,IAAI,YAAY,EAAE,CAAC;CACrC;AAED,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,GAAG,cAAc,CA2GxF;AAED,wBAAgB,4BAA4B,CAAC,IAAI,SAA8B,GAAG,cAAc,GAAG;IACjG,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CAC/C,CAQA"}
|
|
@@ -105,7 +105,7 @@ export function createOnegentRuntime(options = {}) {
|
|
|
105
105
|
return next;
|
|
106
106
|
},
|
|
107
107
|
getExecutionReceipt: async (actionInput) => executionStore.get(getActionReview(actionId(actionInput)).action.idempotencyKey),
|
|
108
|
-
verifyOutcome: (action, observedState) => verifyActionOutcome(actionId(action), observedStateForVerification(observedState)),
|
|
108
|
+
verifyOutcome: (action, observedState, method) => verifyActionOutcome(actionId(action), observedStateForVerification(observedState), method),
|
|
109
109
|
writeAuditPacket: async (action) => {
|
|
110
110
|
const packet = generateAuditPacket(actionId(action));
|
|
111
111
|
await options.auditStore?.writeAuditPacket(packet);
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { ActionAuditPacket, ActionExecutionSummary, ActionRollbackResult, ActionReview, AuthorizationPolicy, ApprovalRequest, CreateActionIntentInput, LocalActionAdapter, PolicyEngine, PolicyRule, VerificationResult } from "./types.js";
|
|
1
|
+
import type { ActionAuditPacket, ActionExecutionSummary, ActionRollbackResult, ActionReview, AuthorizationPolicy, ApprovalRequest, CreateActionIntentInput, LocalActionAdapter, PolicyEngine, PolicyRule, VerificationMethod, VerificationResult } from "./types.js";
|
|
2
2
|
export interface ActionGatewayOptions {
|
|
3
3
|
policyRules?: PolicyRule[];
|
|
4
4
|
policyEngine?: PolicyEngine;
|
|
@@ -18,8 +18,8 @@ export declare function executeAfterApprovalWithAdapter(actionId: string, adapte
|
|
|
18
18
|
}): Promise<ActionExecutionSummary>;
|
|
19
19
|
export declare function recordRollback(actionId: string, adapterName: string, reason: string, result: ActionRollbackResult): ActionReview;
|
|
20
20
|
export declare function executeMockAction(actionId: string): ActionExecutionSummary;
|
|
21
|
-
export declare function verifyOutcome(actionId: string, observedState?: Record<string, unknown
|
|
22
|
-
export declare function verifyAction(actionId: string, observedState?: Record<string, unknown
|
|
21
|
+
export declare function verifyOutcome(actionId: string, observedState?: Record<string, unknown>, method?: VerificationMethod): VerificationResult;
|
|
22
|
+
export declare function verifyAction(actionId: string, observedState?: Record<string, unknown>, methodOverride?: VerificationMethod): VerificationResult;
|
|
23
23
|
export declare function getActionReview(actionId: string): ActionReview;
|
|
24
24
|
export declare function listActionReviews(): ActionReview[];
|
|
25
25
|
export declare function writeAuditPacket(actionId: string): ActionAuditPacket;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EAEpB,YAAY,EAEZ,mBAAmB,EACnB,eAAe,EAGf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,UAAU,
|
|
1
|
+
{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/service.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EAEpB,YAAY,EAEZ,mBAAmB,EACnB,eAAe,EAGf,uBAAuB,EACvB,kBAAkB,EAClB,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,oBAAoB;IACnC,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,EAAE,OAAO,GAAE,oBAAyB,GAAG,YAAY,CAwGpH;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,eAAe,SAAuC,EACtD,OAAO,GAAE,eAAoB,GAC5B,YAAY,CAwBd;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,WAAW,SAAoB,GAC9B,eAAe,CA2BjB;AAED,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,MAAM,EAChB,UAAU,SAAiC,EAC3C,eAAe,SAAgC,GAC9C,YAAY,CAmBd;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAQ7E;AAED,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,CAAC,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,sBAAsB,CAAC,CA6BjC;AAED,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,oBAAoB,GAC3B,YAAY,CAkBd;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAyC1E;AAED,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAExI;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,CAoC/I;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAuB9D;AAED,wBAAgB,iBAAiB,IAAI,YAAY,EAAE,CAElD;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CAEpE;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CA+BvE"}
|
|
@@ -15,6 +15,7 @@ export function captureActionIntent(input, options = {}) {
|
|
|
15
15
|
sourceAgentRunId: input.sourceAgentRunId,
|
|
16
16
|
principal: input.principal ?? { id: input.sourceAgentName, type: "agent" },
|
|
17
17
|
requestedPermissions: input.requestedPermissions ?? [`${input.targetSystem}:${input.actionType}`],
|
|
18
|
+
mandateId: input.mandateId,
|
|
18
19
|
actionType: input.actionType,
|
|
19
20
|
targetSystem: input.targetSystem,
|
|
20
21
|
targetUrl: input.targetUrl,
|
|
@@ -246,10 +247,10 @@ export function executeMockAction(actionId) {
|
|
|
246
247
|
observedState,
|
|
247
248
|
};
|
|
248
249
|
}
|
|
249
|
-
export function verifyOutcome(actionId, observedState) {
|
|
250
|
-
return verifyAction(actionId, observedState);
|
|
250
|
+
export function verifyOutcome(actionId, observedState, method) {
|
|
251
|
+
return verifyAction(actionId, observedState, method);
|
|
251
252
|
}
|
|
252
|
-
export function verifyAction(actionId, observedState) {
|
|
253
|
+
export function verifyAction(actionId, observedState, methodOverride) {
|
|
253
254
|
const action = requireAction(actionId);
|
|
254
255
|
if (action.status !== "EXECUTED" && action.status !== "VERIFIED" && action.status !== "FAILED_VERIFICATION") {
|
|
255
256
|
throw new Error(`Action ${actionId} must be mock-executed before verification.`);
|
|
@@ -257,7 +258,8 @@ export function verifyAction(actionId, observedState) {
|
|
|
257
258
|
const effectiveObservedState = observedState ?? observeActionState(action);
|
|
258
259
|
const differences = diffState(action.proposedAfterState, effectiveObservedState);
|
|
259
260
|
const success = differences.length === 0;
|
|
260
|
-
const method =
|
|
261
|
+
const method = methodOverride ??
|
|
262
|
+
(action.businessObjectType === "purchase_order" && action.targetSystem === "MockERP" ? "LOCAL_MOCK_ERP" : "MOCK");
|
|
261
263
|
const result = {
|
|
262
264
|
id: nextId("verify"),
|
|
263
265
|
actionIntentId: action.id,
|
|
@@ -0,0 +1,163 @@
|
|
|
1
|
+
import type { ActionExecutionSummary, ActionIntent, ActionType, CreateActionIntentInput, LocalActionAdapter, VerificationResult } from "./types.js";
|
|
2
|
+
export declare const EVIDENCE_STRENGTH_LEVELS: readonly ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
|
|
3
|
+
export type EvidenceStrengthLevel = (typeof EVIDENCE_STRENGTH_LEVELS)[number];
|
|
4
|
+
export interface EvidenceStrengthAssessment {
|
|
5
|
+
schemaVersion: "agentcert.evidence_strength.v0.1";
|
|
6
|
+
level: EvidenceStrengthLevel;
|
|
7
|
+
claims: string[];
|
|
8
|
+
limitations: string[];
|
|
9
|
+
}
|
|
10
|
+
export interface CollectorIdentity {
|
|
11
|
+
id: string;
|
|
12
|
+
version: string;
|
|
13
|
+
keyId: string;
|
|
14
|
+
publicKeySha256: string;
|
|
15
|
+
environment: string;
|
|
16
|
+
}
|
|
17
|
+
export interface SourceSigner {
|
|
18
|
+
keyId: string;
|
|
19
|
+
privateKeyPem: string;
|
|
20
|
+
publicKeyPem?: string;
|
|
21
|
+
}
|
|
22
|
+
export interface SourceSignature {
|
|
23
|
+
algorithm: "Ed25519";
|
|
24
|
+
keyId: string;
|
|
25
|
+
signature: string;
|
|
26
|
+
}
|
|
27
|
+
export interface ActionMandateScope {
|
|
28
|
+
actionTypes: ActionType[];
|
|
29
|
+
targetSystems: string[];
|
|
30
|
+
permissions: string[];
|
|
31
|
+
businessObjectIds?: string[];
|
|
32
|
+
recipients?: string[];
|
|
33
|
+
currencies?: string[];
|
|
34
|
+
maxAmount?: number;
|
|
35
|
+
}
|
|
36
|
+
export interface ActionMandatePayload {
|
|
37
|
+
schemaVersion: "agentcert.action_mandate.v0.1";
|
|
38
|
+
mandateId: string;
|
|
39
|
+
issuer: {
|
|
40
|
+
id: string;
|
|
41
|
+
type: "human" | "organization" | "service";
|
|
42
|
+
};
|
|
43
|
+
subject: {
|
|
44
|
+
principalId: string;
|
|
45
|
+
agentVersion?: string;
|
|
46
|
+
};
|
|
47
|
+
scope: ActionMandateScope;
|
|
48
|
+
expectedOutcome?: Record<string, unknown>;
|
|
49
|
+
policySha256: string;
|
|
50
|
+
validFrom: string;
|
|
51
|
+
expiresAt: string;
|
|
52
|
+
issuedAt: string;
|
|
53
|
+
}
|
|
54
|
+
export interface ActionMandate extends ActionMandatePayload {
|
|
55
|
+
digestSha256: string;
|
|
56
|
+
sourceSignature: SourceSignature;
|
|
57
|
+
}
|
|
58
|
+
export interface CreateActionMandateInput extends Omit<ActionMandatePayload, "schemaVersion" | "issuedAt"> {
|
|
59
|
+
issuedAt?: string;
|
|
60
|
+
}
|
|
61
|
+
export interface MandateVerification {
|
|
62
|
+
valid: boolean;
|
|
63
|
+
digestMatches: boolean;
|
|
64
|
+
signatureMatches: boolean;
|
|
65
|
+
active: boolean;
|
|
66
|
+
errors: string[];
|
|
67
|
+
}
|
|
68
|
+
export interface MandateStore {
|
|
69
|
+
readonly name: string;
|
|
70
|
+
get(mandateId: string): Promise<ActionMandate | undefined>;
|
|
71
|
+
put(mandate: ActionMandate): Promise<ActionMandate>;
|
|
72
|
+
list(): Promise<ActionMandate[]>;
|
|
73
|
+
}
|
|
74
|
+
export type TrustedRecordType = "RUN_STARTED" | "JOURNAL_RECOVERED" | "EVENTS_DROPPED" | "MANDATE_BOUND" | "ACTION_CAPTURED" | "APPROVAL_REQUESTED" | "ACTION_APPROVED" | "ACTION_REJECTED" | "EXECUTION_STARTED" | "EXECUTION_COMPLETED" | "OUTCOME_OBSERVED" | "VERIFICATION_PASSED" | "VERIFICATION_FAILED" | "RUN_COMPLETED";
|
|
75
|
+
export interface TrustedActionRecord {
|
|
76
|
+
schemaVersion: "agentcert.trusted_action_record.v0.1";
|
|
77
|
+
recordId: string;
|
|
78
|
+
runId: string;
|
|
79
|
+
sequence: number;
|
|
80
|
+
occurredAt: string;
|
|
81
|
+
type: TrustedRecordType;
|
|
82
|
+
collector: CollectorIdentity;
|
|
83
|
+
previousEventHash?: string;
|
|
84
|
+
payload: Record<string, unknown>;
|
|
85
|
+
payloadSha256: string;
|
|
86
|
+
eventHash: string;
|
|
87
|
+
sourceSignature: SourceSignature;
|
|
88
|
+
}
|
|
89
|
+
export interface JournalGap {
|
|
90
|
+
afterSequence: number;
|
|
91
|
+
beforeSequence: number;
|
|
92
|
+
missing: number;
|
|
93
|
+
declared: boolean;
|
|
94
|
+
}
|
|
95
|
+
export interface JournalValidation {
|
|
96
|
+
valid: boolean;
|
|
97
|
+
complete: boolean;
|
|
98
|
+
sourceSigned: boolean;
|
|
99
|
+
gaps: JournalGap[];
|
|
100
|
+
duplicateSequences: number[];
|
|
101
|
+
duplicateRecordIds: string[];
|
|
102
|
+
hashMismatches: number[];
|
|
103
|
+
signatureFailures: number[];
|
|
104
|
+
droppedEventCount: number;
|
|
105
|
+
recoveredTailBytes: number;
|
|
106
|
+
errors: string[];
|
|
107
|
+
}
|
|
108
|
+
export interface TrustedRunReceipt {
|
|
109
|
+
schemaVersion: "agentcert.trusted_run_receipt.v0.1";
|
|
110
|
+
runId: string;
|
|
111
|
+
collector: CollectorIdentity;
|
|
112
|
+
startedAt: string;
|
|
113
|
+
completedAt: string;
|
|
114
|
+
eventCount: number;
|
|
115
|
+
droppedEventCount: number;
|
|
116
|
+
firstEventHash: string;
|
|
117
|
+
lastEventHash: string;
|
|
118
|
+
mandateDigests: string[];
|
|
119
|
+
actionIds: string[];
|
|
120
|
+
journal: JournalValidation;
|
|
121
|
+
evidenceStrength: EvidenceStrengthAssessment;
|
|
122
|
+
sourcePublicKeyPem: string;
|
|
123
|
+
receiptSha256: string;
|
|
124
|
+
sourceSignature: SourceSignature;
|
|
125
|
+
}
|
|
126
|
+
export interface TrustedRecorderSink {
|
|
127
|
+
name: string;
|
|
128
|
+
write(record: TrustedActionRecord): Promise<void>;
|
|
129
|
+
}
|
|
130
|
+
export interface ControlledAdapterBoundary {
|
|
131
|
+
mode: "agentcert_gateway";
|
|
132
|
+
credentials: "gateway_managed";
|
|
133
|
+
bypassPrevention: "credentials_unavailable_to_agent";
|
|
134
|
+
allowedActionTypes: ActionType[];
|
|
135
|
+
allowedTargetSystems: string[];
|
|
136
|
+
}
|
|
137
|
+
export interface ControlledActionAdapter extends LocalActionAdapter {
|
|
138
|
+
control: ControlledAdapterBoundary;
|
|
139
|
+
}
|
|
140
|
+
export interface OutcomeObservation {
|
|
141
|
+
observationId: string;
|
|
142
|
+
observedAt: string;
|
|
143
|
+
observedState: Record<string, unknown>;
|
|
144
|
+
source: string;
|
|
145
|
+
}
|
|
146
|
+
export interface IndependentOutcomeProbe {
|
|
147
|
+
name: string;
|
|
148
|
+
independent: true;
|
|
149
|
+
observe(action: ActionIntent, execution: ActionExecutionSummary): Promise<OutcomeObservation>;
|
|
150
|
+
}
|
|
151
|
+
export interface TrustedActionEvidence {
|
|
152
|
+
schemaVersion: "agentcert.trusted_action_evidence.v0.1";
|
|
153
|
+
mandate: ActionMandate;
|
|
154
|
+
runReceipt: TrustedRunReceipt;
|
|
155
|
+
outcomeObservation?: OutcomeObservation;
|
|
156
|
+
verification?: VerificationResult;
|
|
157
|
+
evidenceStrength: EvidenceStrengthAssessment;
|
|
158
|
+
}
|
|
159
|
+
export interface TrustedCaptureInput {
|
|
160
|
+
action: CreateActionIntentInput;
|
|
161
|
+
mandateId: string;
|
|
162
|
+
}
|
|
163
|
+
//# sourceMappingURL=trust-types.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"trust-types.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/trust-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,UAAU,EACV,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,wBAAwB,6FAM3B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,kCAAkC,CAAC;IAClD,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,+BAA+B,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAAA;KAAE,CAAC;IACnE,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,oBAAoB;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,UAAU,CAAC;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC3D,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,qBAAqB,GACrB,kBAAkB,GAClB,qBAAqB,GACrB,qBAAqB,GACrB,eAAe,CAAC;AAEpB,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oCAAoC,CAAC;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,iBAAiB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,gBAAgB,EAAE,kCAAkC,CAAC;IACrD,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC/F;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,wCAAwC,CAAC;IACxD,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,gBAAgB,EAAE,0BAA0B,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,uBAAuB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB"}
|
|
@@ -4,7 +4,7 @@ export type ActionIntentStatus = "CAPTURED" | "NEEDS_REVIEW" | "APPROVED" | "REJ
|
|
|
4
4
|
export type RiskLevel = "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
|
|
5
5
|
export type PolicyEffect = "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
|
|
6
6
|
export type ApprovalStatus = "PENDING" | "APPROVED" | "REJECTED" | "EXPIRED";
|
|
7
|
-
export type VerificationMethod = "MOCK" | "LOCAL_MOCK_ERP" | "LOCAL_ADAPTER";
|
|
7
|
+
export type VerificationMethod = "MOCK" | "LOCAL_MOCK_ERP" | "LOCAL_ADAPTER" | "INDEPENDENT_PROBE";
|
|
8
8
|
export interface ActionFieldChange {
|
|
9
9
|
field: string;
|
|
10
10
|
before?: unknown;
|
|
@@ -25,6 +25,7 @@ export interface ActionIntent {
|
|
|
25
25
|
sourceAgentRunId?: string;
|
|
26
26
|
principal: AgentPrincipal;
|
|
27
27
|
requestedPermissions: string[];
|
|
28
|
+
mandateId?: string;
|
|
28
29
|
actionType: ActionType;
|
|
29
30
|
targetSystem: string;
|
|
30
31
|
targetUrl?: string;
|
|
@@ -52,6 +53,7 @@ export interface CreateActionIntentInput {
|
|
|
52
53
|
sourceAgentRunId?: string;
|
|
53
54
|
principal?: AgentPrincipal;
|
|
54
55
|
requestedPermissions?: string[];
|
|
56
|
+
mandateId?: string;
|
|
55
57
|
actionType: ActionType;
|
|
56
58
|
targetSystem: string;
|
|
57
59
|
targetUrl?: string;
|
|
@@ -270,6 +272,7 @@ export interface ActionAuditPacket {
|
|
|
270
272
|
execution: ActionExecutionSummary;
|
|
271
273
|
verificationResult?: VerificationResult;
|
|
272
274
|
auditEvents: AuditEvent[];
|
|
275
|
+
trustedActionEvidence?: import("./trust-types.js").TrustedActionEvidence;
|
|
273
276
|
disclaimer: string;
|
|
274
277
|
}
|
|
275
278
|
export interface AuditStore {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,cAAc,GACd,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,WAAW,CAAC;AAEhB,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,gBAAgB,GAAG,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,cAAc,GACd,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,WAAW,CAAC;AAEhB,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,gBAAgB,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAEnG,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,cAAc,CAAC;IAC1B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,oBAAoB,GAAG,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAAC;IACtH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,GAAG,CAAC;IACnB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC;CAC7F;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,yBAAyB,CAAC;CAC5D;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CAC1H;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,wBAAwB,GACxB,0BAA0B,GAC1B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,cAAc,CAAC;IAC1B,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,WAAW,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,cAAc,GAAG,WAAW,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9H,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC1J;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACxD,SAAS,EAAE,sBAAsB,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,oBAAoB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAC9G,GAAG,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,2BAA2B,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,iBAAiB,EAAE,UAAU,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,SAAS,EAAE,sBAAsB,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,kBAAkB,EAAE,qBAAqB,CAAC;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,iBAAiB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC"}
|