witnora 0.8.1 → 0.9.0

package/dist/vendor/onegent-runtime/trusted-recorder.js

@@ -0,0 +1,347 @@
+import { mkdir, open, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { canonicalJson, publicKeyPemFor, publicKeySha256, sha256, signDigest, verifyDigest } from "./trust-crypto.js";
+export class TrustedActionRecorder {
+    runId;
+    journalPath;
+    ackPath;
+    collector;
+    sourcePublicKeyPem;
+    records;
+    signer;
+    now;
+    recoveredTailBytes;
+    ackSequence;
+    writeChain = Promise.resolve();
+    constructor(runId, storageDirectory, collector, signer, publicKeyPem, records, recoveredTailBytes, ackSequence, now) {
+        this.runId = runId;
+        const base = safeFileName(runId);
+        this.journalPath = join(resolve(storageDirectory), `${base}.journal.jsonl`);
+        this.ackPath = join(resolve(storageDirectory), `${base}.ack.json`);
+        this.collector = collector;
+        this.signer = signer;
+        this.sourcePublicKeyPem = publicKeyPem;
+        this.records = records;
+        this.recoveredTailBytes = recoveredTailBytes;
+        this.ackSequence = ackSequence;
+        this.now = now;
+    }
+    static async open(options) {
+        required(options.runId, "runId");
+        required(options.collector.id, "collector.id");
+        required(options.collector.version, "collector.version");
+        required(options.collector.environment, "collector.environment");
+        required(options.signer.keyId, "signer.keyId");
+        const storage = resolve(options.storageDirectory);
+        await mkdir(storage, { recursive: true });
+        const publicKeyPem = publicKeyPemFor(options.signer);
+        const collector = {
+            ...structuredClone(options.collector),
+            keyId: options.signer.keyId,
+            publicKeySha256: publicKeySha256(publicKeyPem),
+        };
+        const journalPath = join(storage, `${safeFileName(options.runId)}.journal.jsonl`);
+        const recovered = await recoverJournal(journalPath);
+        for (const record of recovered.records) {
+            if (record.runId !== options.runId)
+                throw new Error(`Recorder journal contains a record for run ${record.runId}.`);
+            if (canonicalJson(record.collector) !== canonicalJson(collector))
+                throw new Error("Recorder collector identity does not match the existing journal.");
+        }
+        const ackSequence = await readAck(join(storage, `${safeFileName(options.runId)}.ack.json`), recovered.records);
+        return new TrustedActionRecorder(options.runId, storage, collector, options.signer, publicKeyPem, recovered.records, recovered.recoveredTailBytes, ackSequence, options.now ?? (() => new Date()));
+    }
+    async start(payload = {}) {
+        if (this.records.length) {
+            const first = this.records[0];
+            if (first.type !== "RUN_STARTED")
+                throw new Error("Recorder journal does not begin with RUN_STARTED.");
+            if (this.recoveredTailBytes > 0 && this.records.at(-1)?.type !== "RUN_COMPLETED") {
+                const recoveredTailBytes = this.recoveredTailBytes;
+                await this.append("JOURNAL_RECOVERED", { recoveredTailBytes, droppedFragments: 1 });
+                this.recoveredTailBytes = 0;
+            }
+            return structuredClone(first);
+        }
+        const started = await this.appendAt("RUN_STARTED", payload, { absoluteSequence: 0 });
+        if (this.recoveredTailBytes > 0) {
+            const recoveredTailBytes = this.recoveredTailBytes;
+            await this.append("JOURNAL_RECOVERED", { recoveredTailBytes, droppedFragments: 1 });
+            this.recoveredTailBytes = 0;
+        }
+        return started;
+    }
+    async append(type, payload = {}) {
+        if (!this.records.length)
+            throw new Error("Recorder must start the run before appending events.");
+        if (this.records.at(-1)?.type === "RUN_COMPLETED")
+            throw new Error("Recorder run is already complete.");
+        return this.appendAt(type, payload);
+    }
+    async recordDropped(count, reason) {
+        if (!Number.isSafeInteger(count) || count <= 0)
+            throw new Error("Dropped event count must be a positive safe integer.");
+        required(reason, "dropped event reason");
+        return this.appendAt("EVENTS_DROPPED", { count, reason }, { skippedSequences: count });
+    }
+    async complete(payload = {}) {
+        if (!this.records.length)
+            throw new Error("Recorder must start the run before completion.");
+        const existing = this.records.at(-1);
+        if (existing?.type === "RUN_COMPLETED")
+            return structuredClone(existing);
+        return this.appendAt("RUN_COMPLETED", payload);
+    }
+    validation() {
+        return validateTrustedJournal(this.records, this.sourcePublicKeyPem, this.recoveredTailBytes);
+    }
+    listRecords() {
+        return structuredClone(this.records);
+    }
+    pendingRecords() {
+        return structuredClone(this.records.filter((record) => record.sequence > this.ackSequence));
+    }
+    async flush(sink) {
+        let delivered = 0;
+        for (const record of this.records.filter((item) => item.sequence > this.ackSequence)) {
+            await sink.write(structuredClone(record));
+            await this.persistAck({ sequence: record.sequence, eventHash: record.eventHash });
+            this.ackSequence = record.sequence;
+            delivered += 1;
+        }
+        return delivered;
+    }
+    createReceipt(input) {
+        const validation = this.validation();
+        if (!validation.complete)
+            throw new Error("Cannot create a trusted run receipt before RUN_COMPLETED.");
+        const first = this.records[0];
+        const last = this.records.at(-1);
+        const payload = {
+            schemaVersion: "agentcert.trusted_run_receipt.v0.1",
+            runId: this.runId,
+            collector: this.collector,
+            startedAt: first.occurredAt,
+            completedAt: last.occurredAt,
+            eventCount: this.records.length,
+            droppedEventCount: validation.droppedEventCount,
+            firstEventHash: first.eventHash,
+            lastEventHash: last.eventHash,
+            mandateDigests: [...new Set(input.mandateDigests)].sort(),
+            actionIds: [...new Set(input.actionIds)].sort(),
+            journal: validation,
+            evidenceStrength: input.evidenceStrength,
+            sourcePublicKeyPem: this.sourcePublicKeyPem,
+        };
+        const receiptSha256 = sha256(canonicalJson(payload));
+        return { ...payload, receiptSha256, sourceSignature: signDigest(receiptSha256, this.signer) };
+    }
+    async appendAt(type, payload, options = {}) {
+        let result;
+        const operation = this.writeChain.then(async () => {
+            const previous = this.records.at(-1);
+            const sequence = options.absoluteSequence ?? (previous?.sequence ?? -1) + 1 + (options.skippedSequences ?? 0);
+            if (previous && sequence <= previous.sequence)
+                throw new Error(`Sequence ${sequence} must be greater than ${previous.sequence}.`);
+            const occurredAt = this.now().toISOString();
+            const payloadCopy = structuredClone(payload);
+            const payloadSha256 = sha256(canonicalJson(payloadCopy));
+            const unsigned = {
+                schemaVersion: "agentcert.trusted_action_record.v0.1",
+                recordId: randomUUID(),
+                runId: this.runId,
+                sequence,
+                occurredAt,
+                type,
+                collector: this.collector,
+                previousEventHash: previous?.eventHash,
+                payload: payloadCopy,
+                payloadSha256,
+            };
+            const eventHash = sha256(canonicalJson(unsigned));
+            result = { ...unsigned, eventHash, sourceSignature: signDigest(eventHash, this.signer) };
+            await appendDurably(this.journalPath, `${JSON.stringify(result)}\n`);
+            this.records.push(result);
+        });
+        this.writeChain = operation.catch(() => undefined);
+        await operation;
+        return structuredClone(result);
+    }
+    async persistAck(ack) {
+        const temporary = `${this.ackPath}.${process.pid}.${randomUUID()}.tmp`;
+        await writeFile(temporary, JSON.stringify(ack), "utf8");
+        await rename(temporary, this.ackPath);
+    }
+}
+export function verifyTrustedRunReceipt(receipt) {
+    const errors = [];
+    const { receiptSha256, sourceSignature, ...payload } = receipt;
+    const actualDigest = sha256(canonicalJson(payload));
+    const digestMatches = actualDigest === receiptSha256;
+    if (!digestMatches)
+        errors.push("Trusted run receipt digest does not match its payload.");
+    const collectorKeyMatches = receipt.collector.keyId === sourceSignature.keyId
+        && receipt.collector.publicKeySha256 === publicKeySha256(receipt.sourcePublicKeyPem);
+    if (!collectorKeyMatches)
+        errors.push("Trusted run receipt collector identity does not match its source key.");
+    const signatureMatches = verifyDigest(receiptSha256, sourceSignature, receipt.sourcePublicKeyPem);
+    if (!signatureMatches)
+        errors.push("Trusted run receipt source signature is invalid.");
+    return { valid: digestMatches && collectorKeyMatches && signatureMatches, digestMatches, signatureMatches, collectorKeyMatches, errors };
+}
+export function validateTrustedJournal(records, publicKeyPem, recoveredTailBytes = 0) {
+    const gaps = [];
+    const duplicateSequences = [];
+    const duplicateRecordIds = [];
+    const hashMismatches = [];
+    const signatureFailures = [];
+    const errors = [];
+    const sequences = new Set();
+    const recordIds = new Set();
+    let droppedEventCount = recoveredTailBytes > 0 ? 1 : 0;
+    for (const [index, record] of records.entries()) {
+        if (sequences.has(record.sequence))
+            duplicateSequences.push(record.sequence);
+        sequences.add(record.sequence);
+        if (recordIds.has(record.recordId))
+            duplicateRecordIds.push(record.recordId);
+        recordIds.add(record.recordId);
+        const previous = records[index - 1];
+        if (previous) {
+            if (record.sequence > previous.sequence + 1) {
+                const missing = record.sequence - previous.sequence - 1;
+                const declared = record.type === "EVENTS_DROPPED" && record.payload.count === missing;
+                gaps.push({ afterSequence: previous.sequence, beforeSequence: record.sequence, missing, declared });
+                if (declared)
+                    droppedEventCount += missing;
+            }
+            else if (record.sequence <= previous.sequence) {
+                errors.push(`Sequence ${record.sequence} is not strictly greater than ${previous.sequence}.`);
+            }
+            if (record.previousEventHash !== previous.eventHash)
+                hashMismatches.push(record.sequence);
+        }
+        else {
+            if (record.sequence !== 0)
+                gaps.push({ afterSequence: -1, beforeSequence: record.sequence, missing: record.sequence, declared: false });
+            if (record.previousEventHash !== undefined)
+                hashMismatches.push(record.sequence);
+        }
+        if (record.type === "JOURNAL_RECOVERED")
+            droppedEventCount += numeric(record.payload.droppedFragments);
+        const expectedPayloadHash = sha256(canonicalJson(record.payload));
+        if (record.payloadSha256 !== expectedPayloadHash)
+            hashMismatches.push(record.sequence);
+        const expectedEventHash = sha256(canonicalJson(unsignedRecord(record)));
+        if (record.eventHash !== expectedEventHash)
+            hashMismatches.push(record.sequence);
+        if (!verifyDigest(record.eventHash, record.sourceSignature, publicKeyPem))
+            signatureFailures.push(record.sequence);
+    }
+    const undeclaredGaps = gaps.filter((gap) => !gap.declared);
+    if (undeclaredGaps.length)
+        errors.push("Journal contains undeclared sequence gaps.");
+    if (duplicateSequences.length)
+        errors.push("Journal contains duplicate sequences.");
+    if (duplicateRecordIds.length)
+        errors.push("Journal contains duplicate record identifiers.");
+    if (hashMismatches.length)
+        errors.push("Journal hash chain does not reconcile.");
+    if (signatureFailures.length)
+        errors.push("Journal contains invalid source signatures.");
+    const complete = records[0]?.type === "RUN_STARTED" && records.at(-1)?.type === "RUN_COMPLETED";
+    return {
+        valid: errors.length === 0,
+        complete,
+        sourceSigned: records.length > 0 && signatureFailures.length === 0,
+        gaps,
+        duplicateSequences: [...new Set(duplicateSequences)],
+        duplicateRecordIds: [...new Set(duplicateRecordIds)],
+        hashMismatches: [...new Set(hashMismatches)],
+        signatureFailures: [...new Set(signatureFailures)],
+        droppedEventCount,
+        recoveredTailBytes,
+        errors,
+    };
+}
+function unsignedRecord(record) {
+    const { eventHash: _eventHash, sourceSignature: _sourceSignature, ...unsigned } = record;
+    return unsigned;
+}
+async function recoverJournal(filePath) {
+    let raw = "";
+    try {
+        raw = await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (!raw)
+        return { records: [], recoveredTailBytes: 0 };
+    const lines = raw.split("\n");
+    const records = [];
+    let recoveredTailBytes = 0;
+    for (let index = 0; index < lines.length; index += 1) {
+        const line = lines[index];
+        if (!line.trim())
+            continue;
+        try {
+            records.push(JSON.parse(line));
+        }
+        catch {
+            const isTail = lines.slice(index + 1).every((candidate) => !candidate.trim());
+            if (!isTail)
+                throw new Error(`Trusted recorder journal contains invalid JSON at line ${index + 1}.`);
+            recoveredTailBytes = Buffer.byteLength(line);
+            await writeFile(filePath, records.length ? `${records.map((record) => JSON.stringify(record)).join("\n")}\n` : "", "utf8");
+            break;
+        }
+    }
+    return { records, recoveredTailBytes };
+}
+async function readAck(filePath, records) {
+    let raw = "";
+    try {
+        raw = await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return -1;
+        throw error;
+    }
+    let ack;
+    try {
+        ack = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("Recorder acknowledgement file is invalid JSON.");
+    }
+    const record = records.find((item) => item.sequence === ack.sequence);
+    if (!record || record.eventHash !== ack.eventHash)
+        throw new Error("Recorder acknowledgement does not match the journal.");
+    return ack.sequence;
+}
+async function appendDurably(filePath, value) {
+    await mkdir(dirname(filePath), { recursive: true });
+    const handle = await open(filePath, "a");
+    try {
+        await handle.write(value);
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+function safeFileName(value) {
+    return value.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 160);
+}
+function required(value, field) {
+    if (!value?.trim())
+        throw new Error(`Recorder ${field} is required.`);
+    return value;
+}
+function numeric(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : 0;
+}

package/dist/vendor/onegent-runtime/types.d.ts

@@ -0,0 +1,287 @@
+export type ActionType = "SUBMIT" | "PAY" | "SEND" | "UPDATE";
+export type ActionEnvironment = "demo" | "staging" | "production";
+export type ActionIntentStatus = "CAPTURED" | "NEEDS_REVIEW" | "APPROVED" | "REJECTED" | "EXECUTED" | "VERIFIED" | "FAILED_VERIFICATION" | "ROLLED_BACK" | "ROLLBACK_FAILED" | "CANCELLED";
+export type RiskLevel = "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
+export type PolicyEffect = "ALLOW" | "REQUIRE_APPROVAL" | "BLOCK";
+export type ApprovalStatus = "PENDING" | "APPROVED" | "REJECTED" | "EXPIRED";
+export type VerificationMethod = "MOCK" | "LOCAL_MOCK_ERP" | "LOCAL_ADAPTER" | "INDEPENDENT_PROBE";
+export interface ActionFieldChange {
+    field: string;
+    before?: unknown;
+    after?: unknown;
+}
+export interface AgentPrincipal {
+    id: string;
+    type: "agent" | "service";
+    version?: string;
+    owner?: string;
+}
+export interface ActionIntent {
+    id: string;
+    idempotencyKey: string;
+    workspaceId: string;
+    workflowId: string;
+    sourceAgentName: string;
+    sourceAgentRunId?: string;
+    principal: AgentPrincipal;
+    requestedPermissions: string[];
+    mandateId?: string;
+    actionType: ActionType;
+    targetSystem: string;
+    targetUrl?: string;
+    environment: ActionEnvironment;
+    title: string;
+    description: string;
+    businessObjectType: string;
+    businessObjectId: string;
+    amount?: number;
+    currency?: string;
+    recipient?: string;
+    vendorName?: string;
+    beforeState: Record<string, unknown>;
+    proposedAfterState: Record<string, unknown>;
+    fieldsChanged: ActionFieldChange[];
+    rawAgentReasoningSummary?: string;
+    createdAt: string;
+    status: ActionIntentStatus;
+}
+export interface CreateActionIntentInput {
+    idempotencyKey?: string;
+    workspaceId?: string;
+    workflowId?: string;
+    sourceAgentName: string;
+    sourceAgentRunId?: string;
+    principal?: AgentPrincipal;
+    requestedPermissions?: string[];
+    mandateId?: string;
+    actionType: ActionType;
+    targetSystem: string;
+    targetUrl?: string;
+    environment?: ActionEnvironment;
+    title: string;
+    description: string;
+    businessObjectType: string;
+    businessObjectId: string;
+    amount?: number;
+    currency?: string;
+    recipient?: string;
+    vendorName?: string;
+    beforeState?: Record<string, unknown>;
+    proposedAfterState?: Record<string, unknown>;
+    fieldsChanged?: ActionFieldChange[];
+    rawAgentReasoningSummary?: string;
+}
+export interface RiskAssessment {
+    id: string;
+    actionIntentId: string;
+    riskLevel: RiskLevel;
+    riskScore: number;
+    reasons: string[];
+    triggeredPolicies: string[];
+    requiresHumanApproval: boolean;
+    createdAt: string;
+}
+export interface PolicyRule {
+    id: string;
+    name: string;
+    description: string;
+    actionTypes: ActionType[];
+    effect: PolicyEffect;
+    enabled: boolean;
+    conditions?: PolicyCondition[];
+}
+export interface PolicyCondition {
+    field: string;
+    operator: "equals" | "notEquals" | "greaterThan" | "greaterThanOrEqual" | "lessThan" | "lessThanOrEqual" | "includes";
+    value: unknown;
+}
+export interface PolicyConfig {
+    schemaVersion: "1";
+    rules: PolicyRule[];
+}
+export interface PolicyEvaluation {
+    effect: PolicyEffect;
+    triggeredPolicies: string[];
+    reasons: string[];
+    requiresHumanApproval: boolean;
+    blocked: boolean;
+}
+export interface PolicyEngine {
+    evaluate(action: ActionIntent, risk: RiskAssessment, rules: PolicyRule[]): PolicyEvaluation;
+}
+export interface AuthorizationPolicyResult {
+    allowed: boolean;
+    grantedPermissions: string[];
+    policyVersion?: string;
+    reason: string;
+}
+export interface AuthorizationPolicy {
+    name: string;
+    authorize(action: ActionIntent): AuthorizationPolicyResult;
+}
+export interface AuthorizationDecision {
+    id: string;
+    actionIntentId: string;
+    principalId: string;
+    decision: "ALLOW" | "DENY";
+    requestedPermissions: string[];
+    grantedPermissions: string[];
+    policyName: string;
+    policyVersion?: string;
+    reason: string;
+    createdAt: string;
+}
+export interface ApprovalRequest {
+    id: string;
+    actionIntentId: string;
+    riskAssessmentId: string;
+    requestedBy: string;
+    assignedTo: string;
+    status: ApprovalStatus;
+    reviewerComment?: string;
+    createdAt: string;
+    reviewedAt?: string;
+}
+export interface ApprovalAdapterDecision {
+    approved?: boolean;
+    reviewerId?: string;
+    reviewerComment?: string;
+    decisionId?: string;
+    decidedAt?: string;
+    expiresAt?: string;
+}
+export interface ApprovalAdapterRequest {
+    action: ActionIntent;
+    risk: RiskAssessment;
+    policy: PolicyEvaluation;
+    approvalRequest: ApprovalRequest;
+}
+export interface ApprovalAdapter {
+    name: string;
+    requestApproval(input: ApprovalAdapterRequest): ApprovalAdapterDecision | void | Promise<ApprovalAdapterDecision | void>;
+}
+export interface VerificationResult {
+    id: string;
+    actionIntentId: string;
+    expectedState: Record<string, unknown>;
+    observedState: Record<string, unknown>;
+    success: boolean;
+    differences: string[];
+    verificationMethod: VerificationMethod;
+    createdAt: string;
+}
+export type AuditEventType = "ACTION_CAPTURED" | "AUTHORIZATION_CHECKED" | "RISK_ASSESSED" | "POLICY_EVALUATED" | "APPROVAL_REQUESTED" | "ACTION_APPROVED" | "ACTION_REJECTED" | "MOCK_EXECUTION_STARTED" | "MOCK_EXECUTION_COMPLETED" | "EXECUTION_REUSED" | "ROLLBACK_STARTED" | "ROLLBACK_COMPLETED" | "ROLLBACK_FAILED" | "VERIFICATION_PASSED" | "VERIFICATION_FAILED" | "AUDIT_PACKET_GENERATED";
+export interface AuditEvent {
+    id: string;
+    actionIntentId: string;
+    eventType: AuditEventType;
+    actorType: "AGENT" | "HUMAN" | "SYSTEM";
+    actorId: string;
+    message: string;
+    metadata?: Record<string, unknown>;
+    createdAt: string;
+}
+export interface MockPurchaseOrder {
+    id: string;
+    vendor: string;
+    amount: number;
+    currency: string;
+    status: "DRAFT" | "SUBMITTED";
+    vendorApproved: boolean;
+    lineItem: string;
+    lastUpdatedAt: string;
+    actionIntentId?: string;
+}
+export interface ActionReview {
+    action: ActionIntent;
+    riskAssessment: RiskAssessment;
+    authorizationDecision?: AuthorizationDecision;
+    approvalRequest?: ApprovalRequest;
+    verificationResult?: VerificationResult;
+    auditEvents: AuditEvent[];
+    policyRules: PolicyRule[];
+    blocked: boolean;
+}
+export interface ActionExecutionSummary {
+    method: VerificationMethod;
+    status: "NOT_EXECUTED" | "COMPLETED";
+    targetSystem: string;
+    previousState?: Record<string, unknown>;
+    observedState?: Record<string, unknown>;
+    rollbackToken?: string;
+}
+export interface LocalActionAdapterResult {
+    method?: VerificationMethod;
+    targetSystem?: string;
+    previousState?: Record<string, unknown>;
+    observedState: Record<string, unknown>;
+    rollbackToken?: string;
+}
+export interface LocalActionAdapterSafety {
+    mode: "sandbox";
+    allowedTargetSystems: string[];
+    networkAccess: false;
+}
+export interface ActionExecutionContext {
+    idempotencyKey: string;
+    attempt: number;
+}
+export interface ActionRollbackContext {
+    idempotencyKey: string;
+    reason: string;
+    rollbackToken?: string;
+}
+export interface ActionRollbackResult {
+    success: boolean;
+    observedState: Record<string, unknown>;
+    message?: string;
+}
+export interface LocalActionAdapter {
+    name: string;
+    safety?: LocalActionAdapterSafety;
+    execute(action: ActionIntent, context?: ActionExecutionContext): LocalActionAdapterResult | Promise<LocalActionAdapterResult>;
+    rollback?(action: ActionIntent, execution: ActionExecutionSummary, context: ActionRollbackContext): ActionRollbackResult | Promise<ActionRollbackResult>;
+}
+export interface ActionExecutionReceipt {
+    idempotencyKey: string;
+    actionIntentId: string;
+    adapterName: string;
+    status: "COMPLETED" | "ROLLED_BACK" | "ROLLBACK_FAILED";
+    execution: ActionExecutionSummary;
+    rollbackToken?: string;
+    executedAt: string;
+    rollback?: ActionRollbackResult & {
+        attemptedAt: string;
+        reason: string;
+    };
+}
+export interface ExecutionStore {
+    name: string;
+    get(idempotencyKey: string): ActionExecutionReceipt | undefined | Promise<ActionExecutionReceipt | undefined>;
+    put(receipt: ActionExecutionReceipt): void | Promise<void>;
+}
+export interface ActionAuditPacket {
+    demo: true;
+    product: "Witnora Runtime";
+    scenario: string;
+    actionIntent: ActionIntent;
+    riskAssessment: RiskAssessment;
+    authorizationDecision?: AuthorizationDecision;
+    triggeredPolicies: PolicyRule[];
+    approvalRequest?: ApprovalRequest;
+    execution: ActionExecutionSummary;
+    verificationResult?: VerificationResult;
+    auditEvents: AuditEvent[];
+    trustedActionEvidence?: import("./trust-types.js").TrustedActionEvidence;
+    disclaimer: string;
+}
+export interface AuditStore {
+    name: string;
+    writeAuditPacket(packet: ActionAuditPacket): void | Promise<void>;
+}
+export interface ProcurementWalkthroughState {
+    purchaseOrder: MockPurchaseOrder;
+    review: ActionReview;
+    auditPacket?: ActionAuditPacket;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/vendor/onegent-runtime/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../onegent-runtime/src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAC1B,UAAU,GACV,cAAc,GACd,UAAU,GACV,UAAU,GACV,UAAU,GACV,UAAU,GACV,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,WAAW,CAAC;AAEhB,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE/D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,kBAAkB,GAAG,OAAO,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,gBAAgB,GAAG,eAAe,GAAG,mBAAmB,CAAC;AAEnG,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,cAAc,CAAC;IAC1B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7C,aAAa,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACpC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,GAAG,WAAW,GAAG,aAAa,GAAG,oBAAoB,GAAG,UAAU,GAAG,iBAAiB,GAAG,UAAU,CAAC;IACtH,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,GAAG,CAAC;IACnB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC;CAC7F;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,yBAAyB,CAAC;CAC5D;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,KAAK,EAAE,sBAAsB,GAAG,uBAAuB,GAAG,IAAI,GAAG,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAAC;CAC1H;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GACtB,iBAAiB,GACjB,uBAAuB,GACvB,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,iBAAiB,GACjB,wBAAwB,GACxB,0BAA0B,GAC1B,kBAAkB,GAClB,kBAAkB,GAClB,oBAAoB,GACpB,iBAAiB,GACjB,qBAAqB,GACrB,qBAAqB,GACrB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,cAAc,CAAC;IAC1B,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,GAAG,WAAW,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,cAAc,GAAG,WAAW,CAAC;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,wBAAwB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9H,QAAQ,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,qBAAqB,GAAG,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC1J;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,iBAAiB,CAAC;IACxD,SAAS,EAAE,sBAAsB,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,oBAAoB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3E;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAAC;IAC9G,GAAG,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,cAAc,CAAC;IAC/B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C,iBAAiB,EAAE,UAAU,EAAE,CAAC;IAChC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,SAAS,EAAE,sBAAsB,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,qBAAqB,CAAC,EAAE,OAAO,kBAAkB,EAAE,qBAAqB,CAAC;IACzE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,iBAAiB,CAAC;IACjC,MAAM,EAAE,YAAY,CAAC;IACrB,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC"}

package/dist/vendor/onegent-runtime/types.js

@@ -0,0 +1 @@
+export {};