feat: prepare exact private action tickets

.github/workflows/ci.yml

@@ -18,7 +18,9 @@ jobs:
         with:
           node-version-file: sdk/typescript/.node-version
           cache: npm
-          cache-dependency-path: sdk/typescript/package-lock.json
+          cache-dependency-path: |
+            sdk/typescript/package-lock.json
+            action_plane/typescript/package-lock.json
       - uses: astral-sh/setup-uv@v6
         with:
           version: "0.8.22"

.gitignore

@@ -31,6 +31,10 @@ sdk/typescript/node_modules/
 sdk/typescript/dist/
 sdk/typescript/*.tgz
 sdk/typescript/*.tsbuildinfo
+action_plane/typescript/node_modules/
+action_plane/typescript/dist/
+action_plane/typescript/*.tgz
+action_plane/typescript/*.tsbuildinfo
 
 # --- OS / editor ---
 .DS_Store

CONTEXT.md

@@ -320,11 +320,12 @@ A signed, short-lived, one-shot capability for exactly one external effect.
   handling belong to the owning design and ADRs.
 - **Invariant:** ContextAccessTicket and ActionTicket have different audiences
   and are never interchangeable; rejected use has business effect zero.
-- **Activation note:** Issue #18 proves only a distinct signed
-  Organization/channel-bound synthetic no-op and zero-effect rejection. It does
-  not activate the canonical durable one-shot lifecycle, ActionPlane
-  prepare/perform, Sender/IM delivery, payload/destination/approval/idempotency,
-  DeliveryAttempt, replay, stored receipt, or reconciliation semantics.
+- **Activation note:** Issue #18 proves a distinct signed
+  Organization/channel-bound synthetic no-op. Issue #67 additionally activates
+  private `ActionPlane.prepare`: exact payload/destination/audience/approval/
+  idempotency binding and durable digest-only issuance. Ticket consumption,
+  `perform`, Sender/IM delivery, stored receipts, replay after application, and
+  reconciliation remain `NOT_ACTIVE`.
 - **Do not confuse with:** read ticket, EgressGrant, WorkerLease, credential, or
   proof that an effect succeeded.
 

Makefile

@@ -1,8 +1,9 @@
-.PHONY: install build lint typecheck test catalog security-gate smoke db-up db-down db-reset integration openapi-generate openapi-check openapi-breaking-check sdk-generate sdk-check sdk-build sdk-test sdk-pack check
+.PHONY: install build lint typecheck test catalog security-gate smoke db-up db-down db-reset integration openapi-generate openapi-check openapi-breaking-check sdk-generate sdk-check sdk-build sdk-test sdk-pack action-typecheck action-build action-test check
 
 install:
 	uv sync --frozen
 	npm --prefix sdk/typescript ci --ignore-scripts
+	npm --prefix action_plane/typescript ci --ignore-scripts
 
 build:
 	uv build
@@ -12,6 +13,7 @@ lint:
 
 typecheck:
 	uv run mypy
+	npm --prefix action_plane/typescript run typecheck
 
 test:
 	uv run pytest -q tests/unit
@@ -62,4 +64,13 @@ sdk-test:
 sdk-pack:
 	npm --prefix sdk/typescript run pack:artifact
 
-check: build lint typecheck openapi-check sdk-check sdk-build sdk-test sdk-pack test catalog smoke integration security-gate
+action-typecheck:
+	npm --prefix action_plane/typescript run typecheck
+
+action-build:
+	npm --prefix action_plane/typescript run build
+
+action-test:
+	npm --prefix action_plane/typescript run test:runtime
+
+check: build lint typecheck openapi-check sdk-check sdk-build sdk-test sdk-pack action-build action-test test catalog smoke integration security-gate

action_plane/typescript/.node-version

@@ -0,0 +1 @@
+22.12.0

action_plane/typescript/README.md

@@ -0,0 +1,14 @@
+# ContextEngine ActionPlane
+
+This private TypeScript module owns the trusted `ActionPlane.prepare` boundary
+for one private delivery effect. It accepts only module-created
+`TrustedEffectIntent` values, revalidates exact authority through the dedicated
+PostgreSQL action login, and returns a closed zero-effect outcome or one
+operation-specific `ActionTicket`.
+
+`perform`, Sender/provider access, group delivery, and external effects are not
+part of this package revision and remain inactive.
+
+Run `npm test` for the contract, type, and runtime checks. Real PostgreSQL
+prepare/RLS/idempotency evidence is exercised by the repository integration
+suite.

action_plane/typescript/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,11 @@
+# Third-party notices
+
+Production dependencies are pinned by `package-lock.json`.
+
+- `canonicalize` 3.0.0 — Apache License 2.0. Used only to encode the RFC 8785
+  JSON payload binding before hashing.
+- `pg` 8.22.0 — MIT License. Copyright (c) 2010–2021 Brian Carlson. Used only
+  for the dedicated PostgreSQL prepare authority.
+
+The complete license texts are included with the installed packages and their
+published distributions.

action_plane/typescript/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@context-engine/action-plane",
+  "version": "0.0.0-m2-prepare",
+  "description": "Trusted private ActionPlane prepare module",
+  "type": "module",
+  "private": true,
+  "license": "UNLICENSED",
+  "engines": {
+    "node": "22.12.0",
+    "npm": "10.9.0"
+  },
+  "packageManager": "npm@10.9.0",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "scripts": {
+    "clean": "node scripts/clean.mjs",
+    "typecheck": "tsc --project tsconfig.json --noEmit",
+    "build": "npm run clean && tsc --project tsconfig.build.json",
+    "test:runtime": "node --test test/action-plane.test.mjs",
+    "test": "npm run typecheck && npm run build && npm run test:runtime"
+  },
+  "dependencies": {
+    "canonicalize": "3.0.0",
+    "pg": "8.22.0"
+  },
+  "devDependencies": {
+    "@types/node": "22.10.2",
+    "@types/pg": "8.20.0",
+    "typescript": "5.9.3"
+  }
+}

action_plane/typescript/scripts/clean.mjs

@@ -0,0 +1,4 @@
+import { rmSync } from "node:fs";
+import { resolve } from "node:path";
+
+rmSync(resolve(import.meta.dirname, "../dist"), { force: true, recursive: true });

action_plane/typescript/src/index.ts

@@ -0,0 +1,20 @@
+export {
+  ActionPlane,
+  ActionTicketKeyring,
+  CreatePlaceholderActionTicket,
+  FinalizeReplyActionTicket,
+  PrivateActionPrepareProfile,
+  SendPrivateFollowupActionTicket,
+} from "./internal.js";
+
+export type {
+  ActionOperation,
+  ActionPreparationOutcome,
+  ActionPrepareDatabase,
+  ActionTicket,
+  AudienceChanged,
+  GenericDenied,
+  PreparedAction,
+  RetryableUnavailable,
+  TrustedEffectIntent,
+} from "./internal.js";