// client.evaluate()'s TS SDK response is camelCase: decision.permitToken.
// verifyPermit()'s parameter names are also SDK-specific — permitId
// (not permitToken), and the optional cross-checks are action/agent
// (not actionType/actorId).
const result = await client.verifyPermit({
  permitId: decision.permitToken,
  action:   'production.deploy',
  agent:    'agent:copilot',
});

if (!result.verified) {
  throw new Error(`Permit invalid: ${result.outcome}`);
}

result = client.verify(
    decision.permit_token,
    action_type="production.deploy",
    actor_id="agent:copilot",
)

if not result.valid:
    raise Exception(f"Permit invalid: {result.outcome}")

await withPermit(
  {
    agent:  'agent:copilot',
    action: 'production.deploy',
    context: { target: 'svc-checkout', environment: 'production', commit: sha },
  },
  async (permit) => {
    // This runs only if evaluate() returned allow AND the resulting permit
    // verified. If either fails, withPermit throws AtlaSentDeniedError
    // before reaching this line.
    await deployToProduction();
    return permit.permitId;
  }
);

npx @atlasent/verify bundle.json --pubkey @atlasent-audit-key.pem