witnora 0.8.1 → 0.9.0

package/dist/vendor/onegent-runtime/stripe-test-readonly.js

@@ -0,0 +1,163 @@
+import { createBoundedVendorSandboxEgress, VendorSandboxEgressError, } from "./vendor-sandbox-egress.js";
+export const STRIPE_TEST_API_ORIGIN = "https://api.stripe.com";
+export const STRIPE_SANDBOX_TIMEOUT_MS = 5_000;
+export const STRIPE_SANDBOX_MAX_REQUESTS_PER_MINUTE = 10;
+export const STRIPE_PAYMENT_INTENT_RETRIEVE = "stripe.payment_intent.retrieve";
+export const STRIPE_PAYMENT_INTENT_LIST = "stripe.payment_intent.list";
+const STRIPE_RESOURCES = Object.freeze([
+    Object.freeze({
+        id: STRIPE_PAYMENT_INTENT_RETRIEVE,
+        method: "GET",
+        pathPattern: /^\/v1\/payment_intents\/pi_[A-Za-z0-9]{8,128}$/,
+    }),
+    Object.freeze({
+        id: STRIPE_PAYMENT_INTENT_LIST,
+        method: "GET",
+        pathPattern: /^\/v1\/payment_intents\?limit=(?:[1-9]|10)$/,
+    }),
+]);
+export function createStripeTestModeReadOnlyAdapter(options) {
+    const apiKey = options.restrictedApiKey.trim();
+    if (!/^rk_test_[A-Za-z0-9_]{8,}$/.test(apiKey)) {
+        throw new Error("Stripe read-only reference adapter requires an rk_test_ restricted test-mode key.");
+    }
+    const timeoutMs = options.timeoutMs ?? STRIPE_SANDBOX_TIMEOUT_MS;
+    const maxRequestsPerMinute = options.maxRequestsPerMinute ?? STRIPE_SANDBOX_MAX_REQUESTS_PER_MINUTE;
+    const egress = createBoundedVendorSandboxEgress({
+        policy: {
+            vendor: "stripe",
+            allowedOrigin: STRIPE_TEST_API_ORIGIN,
+            resources: STRIPE_RESOURCES,
+            timeoutMs,
+            maxRequestsPerMinute,
+        },
+        fetch: options.fetch,
+        now: options.now,
+    });
+    const get = (resource, path) => egress.requestJson({
+        resource,
+        method: "GET",
+        path,
+        headers: {
+            authorization: `Bearer ${apiKey}`,
+            accept: "application/json",
+            "user-agent": "agentcert-onegent-runtime/stripe-sandbox-readonly-v0.4",
+        },
+    });
+    return Object.freeze({
+        name: "stripe-test-mode-readonly",
+        safety: Object.freeze({
+            mode: "sandbox",
+            access: "read-only",
+            vendor: "stripe",
+            allowedOrigins: Object.freeze([STRIPE_TEST_API_ORIGIN]),
+            allowedMethods: Object.freeze(["GET"]),
+            allowedResources: Object.freeze([STRIPE_PAYMENT_INTENT_RETRIEVE, STRIPE_PAYMENT_INTENT_LIST]),
+            timeoutMs,
+            maxRequestsPerMinute,
+        }),
+        retrievePaymentIntent: async (id) => {
+            if (!/^pi_[A-Za-z0-9]{8,128}$/.test(id))
+                throw new Error("Stripe PaymentIntent ID is invalid.");
+            return paymentIntentSnapshot(await get(STRIPE_PAYMENT_INTENT_RETRIEVE, `/v1/payment_intents/${encodeURIComponent(id)}`));
+        },
+        listPaymentIntents: async (limit = 10) => {
+            if (!Number.isSafeInteger(limit) || limit < 1 || limit > 10)
+                throw new Error("Stripe read-only list limit must be an integer from 1 to 10.");
+            const payload = await get(STRIPE_PAYMENT_INTENT_LIST, `/v1/payment_intents?limit=${limit}`);
+            if (!isRecord(payload) || payload.object !== "list" || !Array.isArray(payload.data)) {
+                throw new Error("Stripe returned an invalid PaymentIntent list response.");
+            }
+            return payload.data.map(paymentIntentSnapshot);
+        },
+        getRequestAudit: () => egress.getAuditLog(),
+    });
+}
+export async function runStripeSandboxReadOnlyCertification(options) {
+    const generatedAt = new Date((options.now ?? Date.now)()).toISOString();
+    const timeoutMs = options.timeoutMs ?? STRIPE_SANDBOX_TIMEOUT_MS;
+    const maxRequestsPerMinute = options.maxRequestsPerMinute ?? STRIPE_SANDBOX_MAX_REQUESTS_PER_MINUTE;
+    const checks = [];
+    let adapter;
+    let observation;
+    try {
+        adapter = createStripeTestModeReadOnlyAdapter(options);
+        checks.push(passed("restricted-test-key", "Credential format is restricted to Stripe rk_test_ keys and is not retained."), passed("fixed-egress-policy", "Egress is fixed to Stripe HTTPS, GET, and allowlisted PaymentIntent resources."));
+        observation = await adapter.retrievePaymentIntent(options.paymentIntentId);
+        checks.push(passed("bounded-read", "The allowlisted PaymentIntent read completed within the configured bounds."), passed("test-mode-response", "Stripe explicitly returned livemode=false."), passed("evidence-redaction", "The evidence snapshot excludes credentials, client_secret, metadata, and raw response bytes."));
+    }
+    catch (error) {
+        if (!adapter) {
+            checks.push(failed("restricted-test-key", "A valid Stripe rk_test_ restricted test-mode key was not available."), failed("fixed-egress-policy", "The request was not attempted because credential validation failed."));
+        }
+        else {
+            checks.push(failed("bounded-read", safeStripeFailure(error)));
+        }
+        checks.push(failed("test-mode-response", "No validated Stripe test-mode observation was produced."), failed("evidence-redaction", "No successful redacted observation was produced."));
+    }
+    const passedCount = checks.filter((check) => check.status === "passed").length;
+    const report = {
+        schemaVersion: "agentcert.sandbox_vendor_egress.v0.4",
+        kind: "agentcert.sandbox_vendor_egress",
+        implementation: "stripe-payment-intent-readonly",
+        vendor: "stripe",
+        environment: "sandbox",
+        generatedAt,
+        verdict: { passed: passedCount === checks.length, score: Math.round((passedCount / checks.length) * 100) },
+        summary: { passed: passedCount, failed: checks.length - passedCount, total: checks.length },
+        checks,
+        policy: {
+            allowedOrigins: [STRIPE_TEST_API_ORIGIN],
+            allowedMethods: ["GET"],
+            allowedResources: [STRIPE_PAYMENT_INTENT_RETRIEVE, STRIPE_PAYMENT_INTENT_LIST],
+            timeoutMs,
+            maxRequestsPerMinute,
+        },
+        audit: adapter?.getRequestAudit() ?? [],
+        ...(observation ? { observation } : {}),
+        disclaimer: "Stripe sandbox read-only evidence proves this bounded test-mode observation only. It does not authorize writes, attest Stripe controls, or certify production behavior.",
+    };
+    return structuredClone(report);
+}
+function paymentIntentSnapshot(value) {
+    if (!isRecord(value) || value.object !== "payment_intent" || typeof value.id !== "string") {
+        throw new Error("Stripe returned an invalid PaymentIntent response.");
+    }
+    if (value.livemode !== false)
+        throw new Error("Stripe read-only adapter refuses responses that are not explicitly test mode.");
+    return {
+        id: value.id,
+        object: "payment_intent",
+        livemode: false,
+        ...numberField(value, "amount", "amount"),
+        ...numberField(value, "amount_capturable", "amountCapturable"),
+        ...numberField(value, "amount_received", "amountReceived"),
+        ...stringField(value, "currency", "currency"),
+        ...stringField(value, "status", "status"),
+        ...numberField(value, "created", "created"),
+    };
+}
+function safeStripeFailure(error) {
+    if (error instanceof VendorSandboxEgressError)
+        return `Stripe sandbox read failed (${error.code}).`;
+    if (error instanceof Error && error.message.includes("not explicitly test mode"))
+        return "Stripe response was not explicitly test mode.";
+    if (error instanceof Error && error.message.includes("invalid PaymentIntent"))
+        return "Stripe returned an invalid PaymentIntent response.";
+    return "Stripe sandbox read failed before a validated observation was produced.";
+}
+function passed(id, message) {
+    return { id, status: "passed", message };
+}
+function failed(id, message) {
+    return { id, status: "failed", message };
+}
+function numberField(value, source, target) {
+    return typeof value[source] === "number" && Number.isFinite(value[source]) ? { [target]: value[source] } : {};
+}
+function stringField(value, source, target) {
+    return typeof value[source] === "string" ? { [target]: value[source] } : {};
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}

package/dist/vendor/onegent-runtime/trust-crypto.d.ts

@@ -0,0 +1,11 @@
+import type { SourceSignature, SourceSigner } from "./trust-types.js";
+export declare function canonicalJson(value: unknown): string;
+export declare function sha256(value: string | Buffer): string;
+export declare function publicKeyPemFor(signer: SourceSigner): string;
+export declare function publicKeySha256(publicKeyPem: string): string;
+export declare function signDigest(digest: string, signer: SourceSigner): SourceSignature;
+export declare function verifyDigest(digest: string, signature: SourceSignature, publicKeyPem: string): boolean;
+export declare function generateSourceSigner(keyId: string): SourceSigner & {
+    publicKeyPem: string;
+};
+//# sourceMappingURL=trust-crypto.d.ts.map

package/dist/vendor/onegent-runtime/trust-crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-crypto.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/trust-crypto.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEtE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAG5D;AAED,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,eAAe,CAOhF;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAOtG;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAO3F"}

package/dist/vendor/onegent-runtime/trust-crypto.js

@@ -0,0 +1,70 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, } from "node:crypto";
+export function canonicalJson(value) {
+    return JSON.stringify(canonicalValue(value));
+}
+export function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+export function publicKeyPemFor(signer) {
+    if (signer.publicKeyPem)
+        return normalizePem(signer.publicKeyPem);
+    return createPublicKey(createPrivateKey(signer.privateKeyPem)).export({ type: "spki", format: "pem" }).toString();
+}
+export function publicKeySha256(publicKeyPem) {
+    const der = createPublicKey(publicKeyPem).export({ type: "spki", format: "der" });
+    return sha256(der);
+}
+export function signDigest(digest, signer) {
+    assertDigest(digest);
+    return {
+        algorithm: "Ed25519",
+        keyId: signer.keyId,
+        signature: sign(null, Buffer.from(digest, "hex"), createPrivateKey(signer.privateKeyPem)).toString("base64url"),
+    };
+}
+export function verifyDigest(digest, signature, publicKeyPem) {
+    if (!/^[a-f0-9]{64}$/.test(digest) || signature.algorithm !== "Ed25519")
+        return false;
+    try {
+        return verify(null, Buffer.from(digest, "hex"), createPublicKey(publicKeyPem), Buffer.from(signature.signature, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+export function generateSourceSigner(keyId) {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    return {
+        keyId,
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    };
+}
+function canonicalValue(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return value;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("Canonical JSON does not support non-finite numbers.");
+        return Object.is(value, -0) ? 0 : value;
+    }
+    if (Array.isArray(value))
+        return value.map(canonicalValue);
+    if (value && typeof value === "object") {
+        const output = {};
+        for (const key of Object.keys(value).sort()) {
+            const child = value[key];
+            if (child !== undefined)
+                output[key] = canonicalValue(child);
+        }
+        return output;
+    }
+    throw new Error(`Canonical JSON does not support ${typeof value}.`);
+}
+function normalizePem(value) {
+    return createPublicKey(value).export({ type: "spki", format: "pem" }).toString();
+}
+function assertDigest(value) {
+    if (!/^[a-f0-9]{64}$/.test(value))
+        throw new Error("A SHA-256 hex digest is required for source signing.");
+}

package/dist/vendor/onegent-runtime/trust-types.d.ts

@@ -0,0 +1,163 @@
+import type { ActionExecutionSummary, ActionIntent, ActionType, CreateActionIntentInput, LocalActionAdapter, VerificationResult } from "./types.js";
+export declare const EVIDENCE_STRENGTH_LEVELS: readonly ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
+export type EvidenceStrengthLevel = (typeof EVIDENCE_STRENGTH_LEVELS)[number];
+export interface EvidenceStrengthAssessment {
+    schemaVersion: "agentcert.evidence_strength.v0.1";
+    level: EvidenceStrengthLevel;
+    claims: string[];
+    limitations: string[];
+}
+export interface CollectorIdentity {
+    id: string;
+    version: string;
+    keyId: string;
+    publicKeySha256: string;
+    environment: string;
+}
+export interface SourceSigner {
+    keyId: string;
+    privateKeyPem: string;
+    publicKeyPem?: string;
+}
+export interface SourceSignature {
+    algorithm: "Ed25519";
+    keyId: string;
+    signature: string;
+}
+export interface ActionMandateScope {
+    actionTypes: ActionType[];
+    targetSystems: string[];
+    permissions: string[];
+    businessObjectIds?: string[];
+    recipients?: string[];
+    currencies?: string[];
+    maxAmount?: number;
+}
+export interface ActionMandatePayload {
+    schemaVersion: "agentcert.action_mandate.v0.1";
+    mandateId: string;
+    issuer: {
+        id: string;
+        type: "human" | "organization" | "service";
+    };
+    subject: {
+        principalId: string;
+        agentVersion?: string;
+    };
+    scope: ActionMandateScope;
+    expectedOutcome?: Record<string, unknown>;
+    policySha256: string;
+    validFrom: string;
+    expiresAt: string;
+    issuedAt: string;
+}
+export interface ActionMandate extends ActionMandatePayload {
+    digestSha256: string;
+    sourceSignature: SourceSignature;
+}
+export interface CreateActionMandateInput extends Omit<ActionMandatePayload, "schemaVersion" | "issuedAt"> {
+    issuedAt?: string;
+}
+export interface MandateVerification {
+    valid: boolean;
+    digestMatches: boolean;
+    signatureMatches: boolean;
+    active: boolean;
+    errors: string[];
+}
+export interface MandateStore {
+    readonly name: string;
+    get(mandateId: string): Promise<ActionMandate | undefined>;
+    put(mandate: ActionMandate): Promise<ActionMandate>;
+    list(): Promise<ActionMandate[]>;
+}
+export type TrustedRecordType = "RUN_STARTED" | "JOURNAL_RECOVERED" | "EVENTS_DROPPED" | "MANDATE_BOUND" | "ACTION_CAPTURED" | "APPROVAL_REQUESTED" | "ACTION_APPROVED" | "ACTION_REJECTED" | "EXECUTION_STARTED" | "EXECUTION_COMPLETED" | "EXECUTION_GRANT_VERIFIED" | "EXECUTION_GRANT_CLAIMED" | "EXECUTION_SESSION_STARTED" | "CREDENTIAL_LEASE_ACTIVATED" | "BROWSER_CONTEXT_CREATED" | "TARGET_NAVIGATION" | "AUTHORIZED_ACTION_PREPARED" | "FINAL_PARAMETERS_VERIFIED" | "HIGH_RISK_SUBMISSION_STARTED" | "HIGH_RISK_SUBMISSION_COMPLETED" | "TARGET_RESPONSE_OBSERVED" | "OUTCOME_PROBE_STARTED" | "CREDENTIAL_LEASE_REVOKED" | "EXECUTION_SESSION_COMPLETED" | "EXECUTION_SESSION_FAILED" | "OUTCOME_OBSERVED" | "VERIFICATION_PASSED" | "VERIFICATION_FAILED" | "RUN_COMPLETED";
+export interface TrustedActionRecord {
+    schemaVersion: "agentcert.trusted_action_record.v0.1";
+    recordId: string;
+    runId: string;
+    sequence: number;
+    occurredAt: string;
+    type: TrustedRecordType;
+    collector: CollectorIdentity;
+    previousEventHash?: string;
+    payload: Record<string, unknown>;
+    payloadSha256: string;
+    eventHash: string;
+    sourceSignature: SourceSignature;
+}
+export interface JournalGap {
+    afterSequence: number;
+    beforeSequence: number;
+    missing: number;
+    declared: boolean;
+}
+export interface JournalValidation {
+    valid: boolean;
+    complete: boolean;
+    sourceSigned: boolean;
+    gaps: JournalGap[];
+    duplicateSequences: number[];
+    duplicateRecordIds: string[];
+    hashMismatches: number[];
+    signatureFailures: number[];
+    droppedEventCount: number;
+    recoveredTailBytes: number;
+    errors: string[];
+}
+export interface TrustedRunReceipt {
+    schemaVersion: "agentcert.trusted_run_receipt.v0.1";
+    runId: string;
+    collector: CollectorIdentity;
+    startedAt: string;
+    completedAt: string;
+    eventCount: number;
+    droppedEventCount: number;
+    firstEventHash: string;
+    lastEventHash: string;
+    mandateDigests: string[];
+    actionIds: string[];
+    journal: JournalValidation;
+    evidenceStrength: EvidenceStrengthAssessment;
+    sourcePublicKeyPem: string;
+    receiptSha256: string;
+    sourceSignature: SourceSignature;
+}
+export interface TrustedRecorderSink {
+    name: string;
+    write(record: TrustedActionRecord): Promise<void>;
+}
+export interface ControlledAdapterBoundary {
+    mode: "agentcert_gateway";
+    credentials: "gateway_managed";
+    bypassPrevention: "credentials_unavailable_to_agent";
+    allowedActionTypes: ActionType[];
+    allowedTargetSystems: string[];
+}
+export interface ControlledActionAdapter extends LocalActionAdapter {
+    control: ControlledAdapterBoundary;
+}
+export interface OutcomeObservation {
+    observationId: string;
+    observedAt: string;
+    observedState: Record<string, unknown>;
+    source: string;
+}
+export interface IndependentOutcomeProbe {
+    name: string;
+    independent: true;
+    observe(action: ActionIntent, execution: ActionExecutionSummary): Promise<OutcomeObservation>;
+}
+export interface TrustedActionEvidence {
+    schemaVersion: "agentcert.trusted_action_evidence.v0.1";
+    mandate: ActionMandate;
+    runReceipt: TrustedRunReceipt;
+    outcomeObservation?: OutcomeObservation;
+    verification?: VerificationResult;
+    evidenceStrength: EvidenceStrengthAssessment;
+}
+export interface TrustedCaptureInput {
+    action: CreateActionIntentInput;
+    mandateId: string;
+}
+//# sourceMappingURL=trust-types.d.ts.map

package/dist/vendor/onegent-runtime/trust-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-types.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/trust-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,UAAU,EACV,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,wBAAwB,6FAM3B,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,kCAAkC,CAAC;IAClD,KAAK,EAAE,qBAAqB,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,+BAA+B,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAAA;KAAE,CAAC;IACnE,OAAO,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAc,SAAQ,oBAAoB;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,oBAAoB,EAAE,eAAe,GAAG,UAAU,CAAC;IACxG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC3D,GAAG,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpD,IAAI,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAClC;AAED,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,GACjB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,mBAAmB,GACnB,qBAAqB,GACrB,0BAA0B,GAC1B,yBAAyB,GACzB,2BAA2B,GAC3B,4BAA4B,GAC5B,yBAAyB,GACzB,mBAAmB,GACnB,4BAA4B,GAC5B,2BAA2B,GAC3B,8BAA8B,GAC9B,gCAAgC,GAChC,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,6BAA6B,GAC7B,0BAA0B,GAC1B,kBAAkB,GAClB,qBAAqB,GACrB,qBAAqB,GACrB,eAAe,CAAC;AAEpB,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,sCAAsC,CAAC;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,oCAAoC,CAAC;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,iBAAiB,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,gBAAgB,EAAE,0BAA0B,CAAC;IAC7C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,gBAAgB,EAAE,kCAAkC,CAAC;IACrD,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,uBAAwB,SAAQ,kBAAkB;IACjE,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,IAAI,CAAC;IAClB,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC/F;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,wCAAwC,CAAC;IACxD,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,iBAAiB,CAAC;IAC9B,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,gBAAgB,EAAE,0BAA0B,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,uBAAuB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/vendor/onegent-runtime/trust-types.js

@@ -0,0 +1,7 @@
+export const EVIDENCE_STRENGTH_LEVELS = [
+    "reported",
+    "recorded",
+    "enforced",
+    "outcome_verified",
+    "independently_reviewed",
+];

package/dist/vendor/onegent-runtime/trusted-recorder.d.ts

@@ -0,0 +1,49 @@
+import type { CollectorIdentity, EvidenceStrengthAssessment, JournalValidation, SourceSigner, TrustedActionRecord, TrustedRecorderSink, TrustedRecordType, TrustedRunReceipt } from "./trust-types.js";
+export interface TrustedActionRecorderOptions {
+    runId: string;
+    storageDirectory: string;
+    collector: Omit<CollectorIdentity, "keyId" | "publicKeySha256">;
+    signer: SourceSigner;
+    now?: () => Date;
+}
+export interface ReceiptInput {
+    mandateDigests: string[];
+    actionIds: string[];
+    evidenceStrength: EvidenceStrengthAssessment;
+}
+export interface TrustedRunReceiptVerification {
+    valid: boolean;
+    digestMatches: boolean;
+    signatureMatches: boolean;
+    collectorKeyMatches: boolean;
+    errors: string[];
+}
+export declare class TrustedActionRecorder {
+    readonly runId: string;
+    readonly journalPath: string;
+    readonly ackPath: string;
+    readonly collector: CollectorIdentity;
+    readonly sourcePublicKeyPem: string;
+    private readonly records;
+    private readonly signer;
+    private readonly now;
+    private recoveredTailBytes;
+    private ackSequence;
+    private writeChain;
+    private constructor();
+    static open(options: TrustedActionRecorderOptions): Promise<TrustedActionRecorder>;
+    start(payload?: Record<string, unknown>): Promise<TrustedActionRecord>;
+    append(type: Exclude<TrustedRecordType, "RUN_STARTED" | "RUN_COMPLETED">, payload?: Record<string, unknown>): Promise<TrustedActionRecord>;
+    recordDropped(count: number, reason: string): Promise<TrustedActionRecord>;
+    complete(payload?: Record<string, unknown>): Promise<TrustedActionRecord>;
+    validation(): JournalValidation;
+    listRecords(): TrustedActionRecord[];
+    pendingRecords(): TrustedActionRecord[];
+    flush(sink: TrustedRecorderSink): Promise<number>;
+    createReceipt(input: ReceiptInput): TrustedRunReceipt;
+    private appendAt;
+    private persistAck;
+}
+export declare function verifyTrustedRunReceipt(receipt: TrustedRunReceipt): TrustedRunReceiptVerification;
+export declare function validateTrustedJournal(records: TrustedActionRecord[], publicKeyPem: string, recoveredTailBytes?: number): JournalValidation;
+//# sourceMappingURL=trusted-recorder.d.ts.map

package/dist/vendor/onegent-runtime/trusted-recorder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-recorder.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/trusted-recorder.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,iBAAiB,EACjB,0BAA0B,EAE1B,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAQ1B,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,iBAAiB,CAAC,CAAC;IAChE,MAAM,EAAE,YAAY,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,0BAA0B,CAAC;CAC9C;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,qBAAqB;IAa9B,QAAQ,CAAC,KAAK,EAAE,MAAM;IAZxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwB;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,UAAU,CAAoC;IAEtD,OAAO;WAuBM,IAAI,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAkClF,KAAK,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAoB1E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,EAAE,aAAa,GAAG,eAAe,CAAC,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAM9I,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAM1E,QAAQ,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAOnF,UAAU,IAAI,iBAAiB;IAI/B,WAAW,IAAI,mBAAmB,EAAE;IAIpC,cAAc,IAAI,mBAAmB,EAAE;IAIjC,KAAK,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;IAWvD,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,iBAAiB;YAyBvC,QAAQ;YAmCR,UAAU;CAKzB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,GAAG,6BAA6B,CAYjG;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,mBAAmB,EAAE,EAC9B,YAAY,EAAE,MAAM,EACpB,kBAAkB,SAAI,GACrB,iBAAiB,CA2DnB"}