usertrust-acs-adapter 1.4.0

package/README.md

@@ -0,0 +1,66 @@
+# usertrust-acs-adapter
+
+ACS/AGT composite-evaluator adapter for the usertrust governance kernel. It occupies the
+SpendGuard composite slot documented by Microsoft's Agent Governance Toolkit: a stateless
+policy layer decides, and the usertrust ledger provides the stateful two-phase reservation
+(PENDING hold → settle or void) behind it.
+
+## The composite contract
+
+1. The external policy decides FIRST (`allow` / `warn` / `deny` / `escalate` / `transform`).
+2. On `allow`/`warn`, the usertrust ledger atomically reserves (a PENDING hold).
+3. A denied action never consumes a reservation.
+
+If the ledger cannot reserve, the `allow` is converted to `deny` with an ACS-vocabulary
+reason (`budget_cost_usd_exceeded`, or `usertrust:policy_denied:<reason>`). A policy that
+returns malformed output fails closed: `deny` with `runtime_error:policy_output_invalid`.
+Each `CompositeResult` is one-shot — a second `settle()` returns `null` and a second (or
+post-settle) `abort()` is a no-op.
+
+## Usage
+
+```ts
+import { CompositeEvaluator, createMockGovernor } from "usertrust-acs-adapter";
+
+const { governor } = createMockGovernor({ budget: 1000 }); // or createGovernor() from usertrust/headless
+const evaluator = new CompositeEvaluator({
+	policy: (action, { inputIdentity, budgets }) =>
+		action.kind === "exfiltrate" ? { decision: "deny", reason: "blocked" } : { decision: "allow" },
+	governor,
+});
+
+const result = await evaluator.evaluate({
+	kind: "tool_call",
+	model: "claude-sonnet-4-6",
+	estimatedInputTokens: 200,
+	maxOutputTokens: 500,
+});
+if (result.verdict.decision === "allow") {
+	// ... run the action ...
+	await evaluator.settle(result, { inputTokens: 210, outputTokens: 480 });
+} // denied? nothing to clean up — no reservation was made
+```
+
+`runDemo()` produces an infrastructure-free transcript of all three contract lines.
+
+## evaluate_only mode
+
+With `mode: "evaluate_only"` the adapter is a pure shadow evaluator: the policy verdict is
+**preserved exactly as decided** (a `deny` stays a `deny` in `result.verdict`), but nothing
+is enforced — `result.enforced` is `false`, the ledger is never touched, no reservation is
+made, and `settle()`/`abort()` are no-ops returning `null`. Use it to observe what a policy
+would do before turning enforcement on. (Note: the usertrust-server layer defines its own,
+different `evaluate_only` semantics — see that package's README.)
+
+## ACS compatibility
+
+The verdict set, the reserved `runtime_error:*` reason namespace, and the
+`envelope.budgets` counters (`tool_call_count`, `token_count`, `elapsed_seconds`,
+`cost_usd`) follow the Agent Control Specification so the adapter can sit behind an
+ACS-style policy layer unchanged. usertrust meters in usertokens; `cost_usd` carries the
+usertoken cost unless the deployment configures a conversion. Action identity
+(`canonicalJson`/`actionIdentity`) is the adapter's own namespace — unrelated to core's
+audit-chain canonicalization.
+
+Patterns and schemas adapted from the Microsoft Agent Governance Toolkit (MIT License) —
+see the repository `NOTICE` file. No Microsoft source code is included.

package/dist/composite.d.ts

@@ -0,0 +1,55 @@
+import type { TrustReceipt } from "usertrust";
+import type { Authorization, Governor } from "usertrust/headless";
+import type { AcsBudgetsEnvelope, AcsVerdict } from "./vocabulary.js";
+export interface AcsAction {
+    kind: string;
+    model: string;
+    input?: unknown;
+    estimatedInputTokens?: number | undefined;
+    maxOutputTokens?: number | undefined;
+    actor?: string | undefined;
+}
+export type PolicyDecider = (action: AcsAction, context: {
+    inputIdentity: string;
+    budgets: AcsBudgetsEnvelope;
+}) => AcsVerdict | Promise<AcsVerdict>;
+export interface CompositeResult {
+    verdict: AcsVerdict;
+    enforced: boolean;
+    authorization: Authorization | null;
+    inputIdentity: string;
+    budgets: AcsBudgetsEnvelope;
+}
+/**
+ * The SpendGuard-slot composite contract: a stateless policy decides
+ * allow/deny FIRST; on allow the usertrust ledger atomically reserves
+ * (two-phase PENDING); denied actions never consume a reservation.
+ * Composition shape adapted from the Microsoft Agent Governance Toolkit's
+ * documented composite-evaluator integration point (MIT — see NOTICE).
+ */
+export declare class CompositeEvaluator {
+    private readonly policy;
+    private readonly governor;
+    private readonly mode;
+    private readonly clock;
+    private readonly startedAt;
+    /** Results already settled or aborted — a result is one-shot. */
+    private readonly finished;
+    private toolCallCount;
+    private tokenCount;
+    private costTotal;
+    constructor(opts: {
+        policy: PolicyDecider;
+        governor: Governor;
+        mode?: "enforce" | "evaluate_only";
+        clock?: () => number;
+    });
+    budgetsEnvelope(): AcsBudgetsEnvelope;
+    evaluate(action: AcsAction): Promise<CompositeResult>;
+    settle(result: CompositeResult, usage?: {
+        inputTokens?: number | undefined;
+        outputTokens?: number | undefined;
+    }): Promise<TrustReceipt | null>;
+    abort(result: CompositeResult, error?: unknown): Promise<void>;
+}
+//# sourceMappingURL=composite.d.ts.map

package/dist/composite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"composite.d.ts","sourceRoot":"","sources":["../src/composite.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAElE,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGtE,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,MAAM,aAAa,GAAG,CAC3B,MAAM,EAAE,SAAS,EACjB,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,KAC3D,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,WAAW,eAAe;IAC/B,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,kBAAkB,CAAC;CAC5B;AAWD;;;;;;GAMG;AACH,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAW;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;IAC3D,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,SAAS,CAAK;gBAEV,IAAI,EAAE;QACjB,MAAM,EAAE,aAAa,CAAC;QACtB,QAAQ,EAAE,QAAQ,CAAC;QACnB,IAAI,CAAC,EAAE,SAAS,GAAG,eAAe,CAAC;QACnC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;KACrB;IAQD,eAAe,IAAI,kBAAkB;IAS/B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC;IAiErD,MAAM,CACX,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAC7E,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAezB,KAAK,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAWpE"}

package/dist/composite.js

@@ -0,0 +1,143 @@
+import { InsufficientBalanceError, PolicyDeniedError } from "usertrust";
+import { actionIdentity } from "./identity.js";
+import { ACS_BUDGET_REASONS, isAcsDecision, runtimeError } from "./vocabulary.js";
+/**
+ * Runtime validation of the policy's output: a policy that returns anything
+ * other than an object with a known ACS decision fails CLOSED (deny).
+ */
+function asValidVerdict(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return null;
+    return isAcsDecision(raw.decision) ? raw : null;
+}
+/**
+ * The SpendGuard-slot composite contract: a stateless policy decides
+ * allow/deny FIRST; on allow the usertrust ledger atomically reserves
+ * (two-phase PENDING); denied actions never consume a reservation.
+ * Composition shape adapted from the Microsoft Agent Governance Toolkit's
+ * documented composite-evaluator integration point (MIT — see NOTICE).
+ */
+export class CompositeEvaluator {
+    policy;
+    governor;
+    mode;
+    clock;
+    startedAt;
+    /** Results already settled or aborted — a result is one-shot. */
+    finished = new WeakSet();
+    toolCallCount = 0;
+    tokenCount = 0;
+    costTotal = 0;
+    constructor(opts) {
+        this.policy = opts.policy;
+        this.governor = opts.governor;
+        this.mode = opts.mode ?? "enforce";
+        this.clock = opts.clock ?? Date.now;
+        this.startedAt = this.clock();
+    }
+    budgetsEnvelope() {
+        return {
+            tool_call_count: this.toolCallCount,
+            token_count: this.tokenCount,
+            elapsed_seconds: Math.floor((this.clock() - this.startedAt) / 1000),
+            cost_usd: this.costTotal,
+        };
+    }
+    async evaluate(action) {
+        const inputIdentity = actionIdentity({
+            kind: action.kind,
+            model: action.model,
+            input: action.input ?? null,
+        });
+        const budgets = this.budgetsEnvelope();
+        const raw = await this.policy(action, { inputIdentity, budgets });
+        this.toolCallCount += 1;
+        const verdict = asValidVerdict(raw) ?? {
+            decision: "deny",
+            reason: runtimeError("policy_output_invalid"),
+        };
+        if (verdict.decision !== "allow" && verdict.decision !== "warn") {
+            return {
+                verdict,
+                enforced: this.mode === "enforce",
+                authorization: null,
+                inputIdentity,
+                budgets: this.budgetsEnvelope(),
+            };
+        }
+        if (this.mode === "evaluate_only") {
+            return {
+                verdict,
+                enforced: false,
+                authorization: null,
+                inputIdentity,
+                budgets: this.budgetsEnvelope(),
+            };
+        }
+        try {
+            const authorization = await this.governor.authorize({
+                model: action.model,
+                estimatedInputTokens: action.estimatedInputTokens,
+                maxOutputTokens: action.maxOutputTokens,
+                params: { acs_kind: action.kind, acs_input_identity: inputIdentity },
+                actor: action.actor ?? "acs-adapter",
+            });
+            return {
+                verdict,
+                enforced: true,
+                authorization,
+                inputIdentity,
+                budgets: this.budgetsEnvelope(),
+            };
+        }
+        catch (err) {
+            let reason;
+            if (err instanceof InsufficientBalanceError) {
+                reason = ACS_BUDGET_REASONS.cost;
+            }
+            else if (err instanceof PolicyDeniedError) {
+                reason = `usertrust:policy_denied:${err.reason}`;
+            }
+            else {
+                throw err;
+            }
+            return {
+                verdict: { decision: "deny", reason },
+                enforced: true,
+                authorization: null,
+                inputIdentity,
+                budgets: this.budgetsEnvelope(),
+            };
+        }
+    }
+    async settle(result, usage) {
+        if (!result.authorization || this.finished.has(result))
+            return null;
+        this.finished.add(result);
+        try {
+            const receipt = await this.governor.settle(result.authorization, usage);
+            this.tokenCount += (usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0);
+            this.costTotal += receipt.cost;
+            return receipt;
+        }
+        catch (err) {
+            // A failed settle stays retryable.
+            this.finished.delete(result);
+            throw err;
+        }
+    }
+    async abort(result, error) {
+        if (!result.authorization || this.finished.has(result))
+            return;
+        this.finished.add(result);
+        try {
+            await this.governor.abort(result.authorization, error);
+        }
+        catch (err) {
+            // A failed abort stays retryable.
+            this.finished.delete(result);
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=composite.js.map

package/dist/composite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"composite.js","sourceRoot":"","sources":["../src/composite.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAwBlF;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAY;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,aAAa,CAAE,GAA8B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,GAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,kBAAkB;IACb,MAAM,CAAgB;IACtB,QAAQ,CAAW;IACnB,IAAI,CAA8B;IAClC,KAAK,CAAe;IACpB,SAAS,CAAS;IACnC,iEAAiE;IAChD,QAAQ,GAAG,IAAI,OAAO,EAAmB,CAAC;IACnD,aAAa,GAAG,CAAC,CAAC;IAClB,UAAU,GAAG,CAAC,CAAC;IACf,SAAS,GAAG,CAAC,CAAC;IAEtB,YAAY,IAKX;QACA,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,eAAe;QACd,OAAO;YACN,eAAe,EAAE,IAAI,CAAC,aAAa;YACnC,WAAW,EAAE,IAAI,CAAC,UAAU;YAC5B,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;YACnE,QAAQ,EAAE,IAAI,CAAC,SAAS;SACxB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAiB;QAC/B,MAAM,aAAa,GAAG,cAAc,CAAC;YACpC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;SAC3B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,MAAM,GAAG,GAAY,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;QACxB,MAAM,OAAO,GAAe,cAAc,CAAC,GAAG,CAAC,IAAI;YAClD,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,YAAY,CAAC,uBAAuB,CAAC;SAC7C,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACjE,OAAO;gBACN,OAAO;gBACP,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS;gBACjC,aAAa,EAAE,IAAI;gBACnB,aAAa;gBACb,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE;aAC/B,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACnC,OAAO;gBACN,OAAO;gBACP,QAAQ,EAAE,KAAK;gBACf,aAAa,EAAE,IAAI;gBACnB,aAAa;gBACb,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE;aAC/B,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACnD,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE;gBACpE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,aAAa;aACpC,CAAC,CAAC;YACH,OAAO;gBACN,OAAO;gBACP,QAAQ,EAAE,IAAI;gBACd,aAAa;gBACb,aAAa;gBACb,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE;aAC/B,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,MAAc,CAAC;YACnB,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;gBAC7C,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC;YAClC,CAAC;iBAAM,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBAC7C,MAAM,GAAG,2BAA2B,GAAG,CAAC,MAAM,EAAE,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,CAAC;YACX,CAAC;YACD,OAAO;gBACN,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;gBACrC,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,IAAI;gBACnB,aAAa;gBACb,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE;aAC/B,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,MAAM,CACX,MAAuB,EACvB,KAA+E;QAE/E,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACxE,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;YAC/B,OAAO,OAAO,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,mCAAmC;YACnC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAuB,EAAE,KAAe;QACnD,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,kCAAkC;YAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,GAAG,CAAC;QACX,CAAC;IACF,CAAC;CACD"}

package/dist/identity.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Bisected action identity, adapted from the ACS input_identity /
+ * enforced_identity pattern (Microsoft Agent Governance Toolkit, MIT — see
+ * NOTICE): hash the action at decision time, bind approvals to that hash, and
+ * re-derive immediately before execution so an action mutated after approval
+ * fails closed.
+ *
+ * Canonicalization scope: this module defines the ACTION-IDENTITY namespace
+ * only. It is unrelated to core's audit-chain canonicalization and has no
+ * parity coupling with usertrust-verify. Per JSON.stringify semantics, `-0`
+ * normalizes to `0` before hashing.
+ */
+export declare function canonicalJson(value: unknown, seen?: WeakSet<object>): string;
+export declare function actionIdentity(value: unknown): string;
+export interface AcsApproval {
+    identity: string;
+    approvedAt: string;
+}
+export declare function bindApproval(identity: string): AcsApproval;
+export declare class IdentityMismatchError extends Error {
+    readonly expected: string;
+    readonly actual: string;
+    constructor(expected: string, actual: string);
+}
+/** Re-derive the action identity and fail closed if it no longer matches the approval. */
+export declare function assertApprovalMatches(approval: AcsApproval, value: unknown): void;
+//# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AAEH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,OAAO,CAAC,MAAM,CAAiB,GAAG,MAAM,CAgC3F;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAErD;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAE1D;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,SAAgB,QAAQ,EAAE,MAAM,CAAC;IACjC,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEnB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAQ5C;AAED,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAKjF"}

package/dist/identity.js

@@ -0,0 +1,75 @@
+import { createHash } from "node:crypto";
+import { runtimeError } from "./vocabulary.js";
+/**
+ * Bisected action identity, adapted from the ACS input_identity /
+ * enforced_identity pattern (Microsoft Agent Governance Toolkit, MIT — see
+ * NOTICE): hash the action at decision time, bind approvals to that hash, and
+ * re-derive immediately before execution so an action mutated after approval
+ * fails closed.
+ *
+ * Canonicalization scope: this module defines the ACTION-IDENTITY namespace
+ * only. It is unrelated to core's audit-chain canonicalization and has no
+ * parity coupling with usertrust-verify. Per JSON.stringify semantics, `-0`
+ * normalizes to `0` before hashing.
+ */
+export function canonicalJson(value, seen = new WeakSet()) {
+    if (value === null)
+        return "null";
+    switch (typeof value) {
+        case "string":
+            return JSON.stringify(value);
+        case "boolean":
+            return value ? "true" : "false";
+        case "number":
+            if (!Number.isFinite(value))
+                throw new TypeError("non-finite number in canonical JSON");
+            return JSON.stringify(value);
+        case "object":
+            break;
+        default:
+            throw new TypeError(`non-JSON value in canonical JSON: ${typeof value}`);
+    }
+    const obj = value;
+    if (seen.has(obj))
+        throw new TypeError("circular reference in canonical JSON");
+    seen.add(obj);
+    try {
+        if (Array.isArray(obj)) {
+            return `[${obj.map((item) => canonicalJson(item, seen)).join(",")}]`;
+        }
+        const keys = Object.keys(obj).sort();
+        const parts = [];
+        for (const key of keys) {
+            const entry = obj[key];
+            parts.push(`${JSON.stringify(key)}:${canonicalJson(entry, seen)}`);
+        }
+        return `{${parts.join(",")}}`;
+    }
+    finally {
+        seen.delete(obj);
+    }
+}
+export function actionIdentity(value) {
+    return createHash("sha256").update(canonicalJson(value), "utf-8").digest("hex");
+}
+export function bindApproval(identity) {
+    return { identity, approvedAt: new Date().toISOString() };
+}
+export class IdentityMismatchError extends Error {
+    expected;
+    actual;
+    constructor(expected, actual) {
+        super(`${runtimeError("approval_action_mismatch")}: approval bound to ${expected.slice(0, 12)}… but action re-derives to ${actual.slice(0, 12)}…`);
+        this.name = "IdentityMismatchError";
+        this.expected = expected;
+        this.actual = actual;
+    }
+}
+/** Re-derive the action identity and fail closed if it no longer matches the approval. */
+export function assertApprovalMatches(approval, value) {
+    const actual = actionIdentity(value);
+    if (actual !== approval.identity) {
+        throw new IdentityMismatchError(approval.identity, actual);
+    }
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C;;;;;;;;;;;GAWG;AAEH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,OAAwB,IAAI,OAAO,EAAE;IAClF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACtB,KAAK,QAAQ;YACZ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,KAAK,SAAS;YACb,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACjC,KAAK,QAAQ;YACZ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;YACxF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,KAAK,QAAQ;YACZ,MAAM;QACP;YACC,MAAM,IAAI,SAAS,CAAC,qCAAqC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,GAAG,GAAG,KAAe,CAAC;IAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC/E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;YACpD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/B,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjF,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC/B,QAAQ,CAAS;IACjB,MAAM,CAAS;IAE/B,YAAY,QAAgB,EAAE,MAAc;QAC3C,KAAK,CACJ,GAAG,YAAY,CAAC,0BAA0B,CAAC,uBAAuB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAC3I,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,CAAC;CACD;AAED,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB,CAAC,QAAqB,EAAE,KAAc;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;AACF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export { ACS_BUDGET_REASONS, ACS_DECISIONS, isAcsDecision, runtimeError, } from "./vocabulary.js";
+export type { AcsBudgetsEnvelope, AcsDecision, AcsVerdict } from "./vocabulary.js";
+export { actionIdentity, assertApprovalMatches, bindApproval, canonicalJson, IdentityMismatchError, } from "./identity.js";
+export type { AcsApproval } from "./identity.js";
+export { CompositeEvaluator } from "./composite.js";
+export type { AcsAction, CompositeResult, PolicyDecider } from "./composite.js";
+export { createMockGovernor, mockPolicyDecider, runDemo } from "./mock.js";
+export type { DemoStep } from "./mock.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,YAAY,GACZ,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EACN,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,qBAAqB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAChF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3E,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { ACS_BUDGET_REASONS, ACS_DECISIONS, isAcsDecision, runtimeError, } from "./vocabulary.js";
+export { actionIdentity, assertApprovalMatches, bindApproval, canonicalJson, IdentityMismatchError, } from "./identity.js";
+export { CompositeEvaluator } from "./composite.js";
+export { createMockGovernor, mockPolicyDecider, runDemo } from "./mock.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,YAAY,GACZ,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACN,cAAc,EACd,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,qBAAqB,GACrB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}

package/dist/mock.d.ts

@@ -0,0 +1,26 @@
+import type { Governor } from "usertrust/headless";
+import type { PolicyDecider } from "./composite.js";
+/**
+ * In-memory Governor for demos and tests: real two-phase semantics
+ * (hold/settle/void against a budget) with no TigerBeetle and no disk.
+ * Cost model: 1 token = 1 usertoken.
+ */
+export declare function createMockGovernor(opts?: {
+    budget?: number;
+}): {
+    governor: Governor;
+};
+/** Deny actions whose kind is listed; allow everything else. */
+export declare function mockPolicyDecider(denyKinds: string[]): PolicyDecider;
+export interface DemoStep {
+    label: string;
+    decision: string;
+    reason?: string | undefined;
+    budgetRemaining: number;
+}
+/**
+ * Infrastructure-free demo of the composite contract: allow+settle, a policy
+ * deny that provably consumes no reservation, then budget exhaustion.
+ */
+export declare function runDemo(): Promise<DemoStep[]>;
+//# sourceMappingURL=mock.d.ts.map

package/dist/mock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.d.ts","sourceRoot":"","sources":["../src/mock.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAkC,QAAQ,EAAgB,MAAM,oBAAoB,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAgEzF;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa,CAKpE;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAsB,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAgDnD"}

package/dist/mock.js

@@ -0,0 +1,128 @@
+import { createHash } from "node:crypto";
+import { InsufficientBalanceError } from "usertrust";
+import { CompositeEvaluator } from "./composite.js";
+/**
+ * In-memory Governor for demos and tests: real two-phase semantics
+ * (hold/settle/void against a budget) with no TigerBeetle and no disk.
+ * Cost model: 1 token = 1 usertoken.
+ */
+export function createMockGovernor(opts = {}) {
+    let budget = opts.budget ?? 10_000;
+    let seq = 0;
+    const holds = new Map();
+    const governor = {
+        async authorize(params) {
+            const estimatedCost = (params.estimatedInputTokens ?? 100) + (params.maxOutputTokens ?? 4096);
+            if (estimatedCost > budget) {
+                throw new InsufficientBalanceError("mock", estimatedCost, budget);
+            }
+            seq += 1;
+            const auth = {
+                transferId: `tx_mock_${seq}`,
+                estimatedCost,
+                model: params.model,
+                createdAt: Date.now(),
+            };
+            budget -= estimatedCost;
+            holds.set(auth.transferId, auth);
+            return auth;
+        },
+        async settle(auth, params) {
+            holds.delete(auth.transferId);
+            const actual = (params?.inputTokens ?? 0) + (params?.outputTokens ?? 0);
+            const cost = actual > 0 ? actual : auth.estimatedCost;
+            budget += auth.estimatedCost - cost;
+            return {
+                transferId: auth.transferId,
+                cost,
+                budgetRemaining: budget,
+                auditHash: createHash("sha256").update(auth.transferId).digest("hex"),
+                chainPath: "mock://chain",
+                receiptUrl: null,
+                settled: true,
+                model: auth.model,
+                provider: "mock",
+                timestamp: new Date().toISOString(),
+            };
+        },
+        async abort(auth) {
+            if (holds.delete(auth.transferId)) {
+                budget += auth.estimatedCost;
+            }
+        },
+        async destroy() {
+            for (const auth of holds.values()) {
+                budget += auth.estimatedCost;
+            }
+            holds.clear();
+        },
+        estimateCost(_model, inputTokens, outputTokens) {
+            return inputTokens + outputTokens;
+        },
+        estimateInputTokens(messages) {
+            return Math.ceil(JSON.stringify(messages).length / 4);
+        },
+        budgetRemaining() {
+            return budget;
+        },
+        // biome-ignore lint/suspicious/noExplicitAny: mock config, never read by the adapter
+        config: {},
+    };
+    return { governor };
+}
+/** Deny actions whose kind is listed; allow everything else. */
+export function mockPolicyDecider(denyKinds) {
+    return (action) => denyKinds.includes(action.kind)
+        ? { decision: "deny", reason: `demo_policy:kind_${action.kind}_denied` }
+        : { decision: "allow" };
+}
+/**
+ * Infrastructure-free demo of the composite contract: allow+settle, a policy
+ * deny that provably consumes no reservation, then budget exhaustion.
+ */
+export async function runDemo() {
+    const { governor } = createMockGovernor({ budget: 60 });
+    const evaluator = new CompositeEvaluator({
+        policy: mockPolicyDecider(["exfiltrate"]),
+        governor,
+    });
+    const transcript = [];
+    const allowed = await evaluator.evaluate({
+        kind: "tool_call",
+        model: "mock-1",
+        estimatedInputTokens: 20,
+        maxOutputTokens: 20,
+    });
+    await evaluator.settle(allowed, { inputTokens: 20, outputTokens: 10 });
+    transcript.push({
+        label: "governed tool call settles at actual usage",
+        decision: allowed.verdict.decision,
+        budgetRemaining: governor.budgetRemaining(),
+    });
+    const denied = await evaluator.evaluate({
+        kind: "exfiltrate",
+        model: "mock-1",
+        estimatedInputTokens: 5,
+        maxOutputTokens: 5,
+    });
+    transcript.push({
+        label: "policy deny consumes no reservation",
+        decision: denied.verdict.decision,
+        reason: denied.verdict.reason,
+        budgetRemaining: governor.budgetRemaining(),
+    });
+    const broke = await evaluator.evaluate({
+        kind: "tool_call",
+        model: "mock-1",
+        estimatedInputTokens: 500,
+        maxOutputTokens: 500,
+    });
+    transcript.push({
+        label: "reservation failure denies with ACS budget reason",
+        decision: broke.verdict.decision,
+        reason: broke.verdict.reason,
+        budgetRemaining: governor.budgetRemaining(),
+    });
+    return transcript;
+}
+//# sourceMappingURL=mock.js.map

package/dist/mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.js","sourceRoot":"","sources":["../src/mock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAGrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA4B,EAAE;IAChE,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IACnC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE/C,MAAM,QAAQ,GAAa;QAC1B,KAAK,CAAC,SAAS,CAAC,MAAuB;YACtC,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,oBAAoB,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;YAC9F,IAAI,aAAa,GAAG,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,wBAAwB,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;YACnE,CAAC;YACD,GAAG,IAAI,CAAC,CAAC;YACT,MAAM,IAAI,GAAkB;gBAC3B,UAAU,EAAE,WAAW,GAAG,EAAE;gBAC5B,aAAa;gBACb,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACrB,CAAC;YACF,MAAM,IAAI,aAAa,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAmB,EAAE,MAAqB;YACtD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,IAAI,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;YACtD,MAAM,IAAI,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YACpC,OAAO;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,IAAI;gBACJ,eAAe,EAAE,MAAM;gBACvB,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACrE,SAAS,EAAE,cAAc;gBACzB,UAAU,EAAE,IAAI;gBAChB,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACnC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,IAAmB;YAC9B,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC;YAC9B,CAAC;QACF,CAAC;QACD,KAAK,CAAC,OAAO;YACZ,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;QACD,YAAY,CAAC,MAAc,EAAE,WAAmB,EAAE,YAAoB;YACrE,OAAO,WAAW,GAAG,YAAY,CAAC;QACnC,CAAC;QACD,mBAAmB,CAAC,QAAmB;YACtC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,eAAe;YACd,OAAO,MAAM,CAAC;QACf,CAAC;QACD,qFAAqF;QACrF,MAAM,EAAE,EAAS;KACjB,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC;AACrB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,SAAmB;IACpD,OAAO,CAAC,MAAM,EAAE,EAAE,CACjB,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,MAAM,CAAC,IAAI,SAAS,EAAE;QACxE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO;IAC5B,MAAM,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC;QACxC,MAAM,EAAE,iBAAiB,CAAC,CAAC,YAAY,CAAC,CAAC;QACzC,QAAQ;KACR,CAAC,CAAC;IACH,MAAM,UAAU,GAAe,EAAE,CAAC;IAElC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC;QACxC,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,QAAQ;QACf,oBAAoB,EAAE,EAAE;QACxB,eAAe,EAAE,EAAE;KACnB,CAAC,CAAC;IACH,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,IAAI,CAAC;QACf,KAAK,EAAE,4CAA4C;QACnD,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;QAClC,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;KAC3C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC;QACvC,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,QAAQ;QACf,oBAAoB,EAAE,CAAC;QACvB,eAAe,EAAE,CAAC;KAClB,CAAC,CAAC;IACH,UAAU,CAAC,IAAI,CAAC;QACf,KAAK,EAAE,qCAAqC;QAC5C,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ;QACjC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;QAC7B,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;KAC3C,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC;QACtC,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,QAAQ;QACf,oBAAoB,EAAE,GAAG;QACzB,eAAe,EAAE,GAAG;KACpB,CAAC,CAAC;IACH,UAAU,CAAC,IAAI,CAAC;QACf,KAAK,EAAE,mDAAmD;QAC1D,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ;QAChC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;QAC5B,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;KAC3C,CAAC,CAAC;IAEH,OAAO,UAAU,CAAC;AACnB,CAAC"}

package/dist/vocabulary.d.ts

@@ -0,0 +1,37 @@
+/**
+ * ACS-compatible verdict vocabulary.
+ *
+ * The decision set, the reserved `runtime_error:*` reason namespace, and the
+ * `envelope.budgets` counter names are adapted from the Microsoft Agent
+ * Governance Toolkit's Agent Control Specification (MIT License) so that
+ * usertrust can act as the stateful backend behind an ACS-style stateless
+ * policy layer. See the repository NOTICE file for attribution.
+ */
+export declare const ACS_DECISIONS: readonly ["allow", "warn", "deny", "escalate", "transform"];
+export type AcsDecision = (typeof ACS_DECISIONS)[number];
+export interface AcsVerdict {
+    decision: AcsDecision;
+    reason?: string | undefined;
+}
+export declare function isAcsDecision(value: unknown): value is AcsDecision;
+/** Build a reason string in the reserved `runtime_error:*` namespace. */
+export declare function runtimeError(code: string): string;
+/** Deny-reason names matching the ACS envelope.budgets counter vocabulary. */
+export declare const ACS_BUDGET_REASONS: {
+    readonly toolCalls: "budget_tool_call_count_exceeded";
+    readonly tokens: "budget_token_count_exceeded";
+    readonly elapsed: "budget_elapsed_seconds_exceeded";
+    readonly cost: "budget_cost_usd_exceeded";
+};
+/**
+ * ACS envelope.budgets counters. Counter names follow the ACS schema.
+ * Note: usertrust meters in usertokens; `cost_usd` carries the usertoken cost
+ * unless the deployment configures a conversion.
+ */
+export interface AcsBudgetsEnvelope {
+    tool_call_count: number;
+    token_count: number;
+    elapsed_seconds: number;
+    cost_usd: number;
+}
+//# sourceMappingURL=vocabulary.d.ts.map

package/dist/vocabulary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.d.ts","sourceRoot":"","sources":["../src/vocabulary.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,aAAa,6DAA8D,CAAC;AACzF,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,MAAM,WAAW,UAAU;IAC1B,QAAQ,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAID,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB;;;;;CAKrB,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CACjB"}

package/dist/vocabulary.js

@@ -0,0 +1,29 @@
+/**
+ * ACS-compatible verdict vocabulary.
+ *
+ * The decision set, the reserved `runtime_error:*` reason namespace, and the
+ * `envelope.budgets` counter names are adapted from the Microsoft Agent
+ * Governance Toolkit's Agent Control Specification (MIT License) so that
+ * usertrust can act as the stateful backend behind an ACS-style stateless
+ * policy layer. See the repository NOTICE file for attribution.
+ */
+export const ACS_DECISIONS = ["allow", "warn", "deny", "escalate", "transform"];
+export function isAcsDecision(value) {
+    return typeof value === "string" && ACS_DECISIONS.includes(value);
+}
+const RUNTIME_ERROR_CODE = /^[a-z][a-z0-9_]*$/;
+/** Build a reason string in the reserved `runtime_error:*` namespace. */
+export function runtimeError(code) {
+    if (!RUNTIME_ERROR_CODE.test(code)) {
+        throw new TypeError(`invalid runtime_error code: ${JSON.stringify(code)}`);
+    }
+    return `runtime_error:${code}`;
+}
+/** Deny-reason names matching the ACS envelope.budgets counter vocabulary. */
+export const ACS_BUDGET_REASONS = {
+    toolCalls: "budget_tool_call_count_exceeded",
+    tokens: "budget_token_count_exceeded",
+    elapsed: "budget_elapsed_seconds_exceeded",
+    cost: "budget_cost_usd_exceeded",
+};
+//# sourceMappingURL=vocabulary.js.map

package/dist/vocabulary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.js","sourceRoot":"","sources":["../src/vocabulary.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAU,CAAC;AAQzF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAE/C,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,iBAAiB,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,SAAS,EAAE,iCAAiC;IAC5C,MAAM,EAAE,6BAA6B;IACrC,OAAO,EAAE,iCAAiC;IAC1C,IAAI,EAAE,0BAA0B;CACvB,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+	"name": "usertrust-acs-adapter",
+	"version": "1.4.0",
+	"description": "ACS/AGT composite-evaluator adapter: external policy decides, the usertrust ledger reserves",
+	"license": "Apache-2.0",
+	"author": "Usertools, Inc. <hello@usertools.ai> (https://usertrust.ai)",
+	"homepage": "https://usertrust.ai",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/usertools-ai/usertrust.git",
+		"directory": "packages/acs-adapter"
+	},
+	"bugs": "https://github.com/usertools-ai/usertrust/issues",
+	"keywords": ["ai", "governance", "agent", "acs", "agt", "policy", "adapter"],
+	"type": "module",
+	"main": "dist/index.js",
+	"types": "dist/index.d.ts",
+	"exports": {
+		".": {
+			"import": "./dist/index.js",
+			"types": "./dist/index.d.ts"
+		}
+	},
+	"scripts": {
+		"build": "tsc -b",
+		"prepublishOnly": "tsc -b"
+	},
+	"files": ["dist"],
+	"dependencies": {
+		"usertrust": "*"
+	}
+}