@decionis/agent-safe-pipeline 0.1.2

package/dist/decision/FixtureDecisionAuthority.d.ts

@@ -0,0 +1,32 @@
+import { type KeyObject } from "node:crypto";
+import type { CapturedIntent } from "../intent/ExecutionIntent.js";
+import type { AuthorizationVerifier, VerifiedAuthorization } from "../execution/AuthorizationVerifier.js";
+import type { ReplayStore } from "../execution/ReplayStore.js";
+import type { DecisionAuthority, DecisionEvidence, DecisionVerdict, GateDecision } from "./DecisionAuthority.js";
+export type FixtureVerdictResolver = (intent: CapturedIntent, evidence?: DecisionEvidence) => DecisionVerdict;
+export interface FixtureAuthorityPair {
+    readonly authority: FixtureDecisionAuthority;
+    readonly verifier: FixtureAuthorizationVerifier;
+}
+export interface UnsafeFixtureAuthorityOptions {
+    readonly unsafeAllowDevelopmentFixture: true;
+    readonly privateKey?: KeyObject;
+    readonly keyId?: string;
+    readonly replayStore?: ReplayStore;
+}
+export declare class FixtureDecisionAuthority implements DecisionAuthority {
+    private readonly resolveVerdict;
+    private readonly privateKey;
+    private readonly keyId;
+    constructor(resolveVerdict: FixtureVerdictResolver, options: UnsafeFixtureAuthorityOptions);
+    publicKey(): KeyObject;
+    evaluate(intent: CapturedIntent, evidence?: DecisionEvidence): Promise<GateDecision>;
+}
+export declare class FixtureAuthorizationVerifier implements AuthorizationVerifier {
+    private readonly publicKey;
+    private readonly replayStore;
+    constructor(publicKey: KeyObject, replayStore: ReplayStore, unsafeAllowDevelopmentFixture: true);
+    verifyAndConsume(captured: CapturedIntent, decision: GateDecision): Promise<VerifiedAuthorization | null>;
+}
+export declare function createFixtureAuthorityPair(resolver: FixtureVerdictResolver, options: UnsafeFixtureAuthorityOptions): FixtureAuthorityPair;
+//# sourceMappingURL=FixtureDecisionAuthority.d.ts.map

package/dist/decision/FixtureDecisionAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FixtureDecisionAuthority.d.ts","sourceRoot":"","sources":["../../src/decision/FixtureDecisionAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EACV,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACb,MAAM,wBAAwB,CAAC;AAGhC,MAAM,MAAM,sBAAsB,GAAG,CACnC,MAAM,EAAE,cAAc,EACtB,QAAQ,CAAC,EAAE,gBAAgB,KACxB,eAAe,CAAC;AAErB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;CACjD;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,6BAA6B,EAAE,IAAI,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED,qBAAa,wBAAyB,YAAW,iBAAiB;IAK9D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAJjC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;gBAGZ,cAAc,EAAE,sBAAsB,EACvD,OAAO,EAAE,6BAA6B;IAOjC,SAAS,IAAI,SAAS;IAIhB,QAAQ,CACnB,MAAM,EAAE,cAAc,EACtB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,YAAY,CAAC;CA+CzB;AAED,qBAAa,4BAA6B,YAAW,qBAAqB;IAEtE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW,EACzC,6BAA6B,EAAE,IAAI;IAKxB,gBAAgB,CAC3B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;CAkCzC;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,6BAA6B,GACrC,oBAAoB,CAUtB"}

package/dist/decision/FixtureDecisionAuthority.js

@@ -0,0 +1,117 @@
+import { createPublicKey, generateKeyPairSync, randomUUID } from "node:crypto";
+import { SignJWT, jwtVerify } from "jose";
+import { InMemoryReplayStore } from "../execution/ReplayStore.js";
+import { immutableGateDecision } from "./ImmutableGateDecision.js";
+export class FixtureDecisionAuthority {
+    resolveVerdict;
+    privateKey;
+    keyId;
+    constructor(resolveVerdict, options) {
+        this.resolveVerdict = resolveVerdict;
+        assertDevelopmentFixtureAllowed(options.unsafeAllowDevelopmentFixture);
+        this.privateKey = options.privateKey ?? generateKeyPairSync("ed25519").privateKey;
+        this.keyId = options.keyId ?? "agent-safe-fixture";
+    }
+    publicKey() {
+        return createPublicKey(this.privateKey);
+    }
+    async evaluate(intent, evidence) {
+        const verdict = this.resolveVerdict(intent, evidence);
+        const decisionId = `fixture_${randomUUID()}`;
+        const dossierId = `fixture_dossier_${randomUUID()}`;
+        if (verdict !== "ALLOW") {
+            return immutableGateDecision({
+                verdict,
+                decisionId,
+                dossierId,
+                intentHash: intent.intentHash,
+                reasonCodes: [`FIXTURE_${verdict}`],
+                authorization: null,
+                failClosed: false,
+            });
+        }
+        const issuedAt = Math.floor(Date.now() / 1_000);
+        const expiresAt = Math.min(issuedAt + 60, Math.floor(new Date(intent.intent.expiresAt).valueOf() / 1_000));
+        const token = await new SignJWT({
+            decision_id: decisionId,
+            dossier_id: dossierId,
+            decision: "allow",
+            scope: "execute",
+            binding: { intent_hash: intent.intentHash },
+        })
+            .setProtectedHeader({ alg: "EdDSA", kid: this.keyId, typ: "JWT" })
+            .setIssuer("agent-safe-fixture")
+            .setAudience(`${intent.intent.downstreamTarget.system}:${intent.intent.downstreamTarget.operation}`)
+            .setJti(randomUUID())
+            .setIssuedAt(issuedAt)
+            .setNotBefore(issuedAt)
+            .setExpirationTime(expiresAt)
+            .sign(this.privateKey);
+        return immutableGateDecision({
+            verdict,
+            decisionId,
+            dossierId,
+            intentHash: intent.intentHash,
+            reasonCodes: ["FIXTURE_ALLOW"],
+            authorization: { token, expiresAt: new Date(expiresAt * 1_000).toISOString() },
+            failClosed: false,
+        });
+    }
+}
+export class FixtureAuthorizationVerifier {
+    publicKey;
+    replayStore;
+    constructor(publicKey, replayStore, unsafeAllowDevelopmentFixture) {
+        this.publicKey = publicKey;
+        this.replayStore = replayStore;
+        assertDevelopmentFixtureAllowed(unsafeAllowDevelopmentFixture);
+    }
+    async verifyAndConsume(captured, decision) {
+        if (decision.authorization === null || decision.dossierId === null)
+            return null;
+        try {
+            const audience = `${captured.intent.downstreamTarget.system}:${captured.intent.downstreamTarget.operation}`;
+            const { payload } = await jwtVerify(decision.authorization.token, this.publicKey, {
+                algorithms: ["EdDSA"],
+                issuer: "agent-safe-fixture",
+                audience,
+            });
+            const binding = payload.binding;
+            if (payload.decision !== "allow" ||
+                payload.scope !== "execute" ||
+                payload.decision_id !== decision.decisionId ||
+                payload.dossier_id !== decision.dossierId ||
+                binding?.intent_hash !== captured.intentHash ||
+                typeof payload.jti !== "string" ||
+                typeof payload.exp !== "number") {
+                return null;
+            }
+            const expiresAt = new Date(payload.exp * 1_000);
+            if (!(await this.replayStore.claim(payload.jti, expiresAt)))
+                return null;
+            return Object.freeze({
+                decisionId: decision.decisionId,
+                dossierId: decision.dossierId,
+                grantId: payload.jti,
+                intentHash: captured.intentHash,
+                expiresAt: expiresAt.toISOString(),
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+}
+export function createFixtureAuthorityPair(resolver, options) {
+    const authority = new FixtureDecisionAuthority(resolver, options);
+    return {
+        authority,
+        verifier: new FixtureAuthorizationVerifier(authority.publicKey(), options.replayStore ?? new InMemoryReplayStore(), true),
+    };
+}
+function assertDevelopmentFixtureAllowed(explicitlyAllowed) {
+    if (!explicitlyAllowed || process.env.NODE_ENV === "production") {
+        throw new Error("FIXTURE_AUTHORITY_FORBIDDEN");
+    }
+}
+//# sourceMappingURL=FixtureDecisionAuthority.js.map

package/dist/decision/FixtureDecisionAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FixtureDecisionAuthority.js","sourceRoot":"","sources":["../../src/decision/FixtureDecisionAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAO1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAOlE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAmBnE,MAAM,OAAO,wBAAwB;IAKhB;IAJF,UAAU,CAAY;IACtB,KAAK,CAAS;IAE/B,YACmB,cAAsC,EACvD,OAAsC;QADrB,mBAAc,GAAd,cAAc,CAAwB;QAGvD,+BAA+B,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;QAClF,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,oBAAoB,CAAC;IACrD,CAAC;IAEM,SAAS;QACd,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,QAAQ,CACnB,MAAsB,EACtB,QAA2B;QAE3B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,WAAW,UAAU,EAAE,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,mBAAmB,UAAU,EAAE,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACxB,OAAO,qBAAqB,CAAC;gBAC3B,OAAO;gBACP,UAAU;gBACV,SAAS;gBACT,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,WAAW,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;gBACnC,aAAa,EAAE,IAAI;gBACnB,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,QAAQ,GAAG,EAAE,EACb,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAChE,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC;YAC9B,WAAW,EAAE,UAAU;YACvB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE;SAC5C,CAAC;aACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;aACjE,SAAS,CAAC,oBAAoB,CAAC;aAC/B,WAAW,CACV,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CACvF;aACA,MAAM,CAAC,UAAU,EAAE,CAAC;aACpB,WAAW,CAAC,QAAQ,CAAC;aACrB,YAAY,CAAC,QAAQ,CAAC;aACtB,iBAAiB,CAAC,SAAS,CAAC;aAC5B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO,qBAAqB,CAAC;YAC3B,OAAO;YACP,UAAU;YACV,SAAS;YACT,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,CAAC,eAAe,CAAC;YAC9B,aAAa,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE;YAC9E,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAEpB;IACA;IAFnB,YACmB,SAAoB,EACpB,WAAwB,EACzC,6BAAmC;QAFlB,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;QAGzC,+BAA+B,CAAC,6BAA6B,CAAC,CAAC;IACjE,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC5G,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE;gBAChF,UAAU,EAAE,CAAC,OAAO,CAAC;gBACrB,MAAM,EAAE,oBAAoB;gBAC5B,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAgD,CAAC;YACzE,IACE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,OAAO,CAAC,KAAK,KAAK,SAAS;gBAC3B,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAC3C,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBACzC,OAAO,EAAE,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAC5C,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAC/B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAgC,EAChC,OAAsC;IAEtC,MAAM,SAAS,GAAG,IAAI,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClE,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,IAAI,4BAA4B,CACxC,SAAS,CAAC,SAAS,EAAE,EACrB,OAAO,CAAC,WAAW,IAAI,IAAI,mBAAmB,EAAE,EAChD,IAAI,CACL;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,iBAA0B;IACjE,IAAI,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;AACH,CAAC"}

package/dist/decision/ImmutableGateDecision.d.ts

@@ -0,0 +1,3 @@
+import type { GateDecision } from "./DecisionAuthority.js";
+export declare function immutableGateDecision(decision: GateDecision): GateDecision;
+//# sourceMappingURL=ImmutableGateDecision.d.ts.map

package/dist/decision/ImmutableGateDecision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImmutableGateDecision.d.ts","sourceRoot":"","sources":["../../src/decision/ImmutableGateDecision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3D,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,YAAY,GAAG,YAAY,CAO1E"}

package/dist/decision/ImmutableGateDecision.js

@@ -0,0 +1,8 @@
+export function immutableGateDecision(decision) {
+    return Object.freeze({
+        ...decision,
+        reasonCodes: Object.freeze([...decision.reasonCodes]),
+        authorization: decision.authorization === null ? null : Object.freeze({ ...decision.authorization }),
+    });
+}
+//# sourceMappingURL=ImmutableGateDecision.js.map

package/dist/decision/ImmutableGateDecision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImmutableGateDecision.js","sourceRoot":"","sources":["../../src/decision/ImmutableGateDecision.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,qBAAqB,CAAC,QAAsB;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,QAAQ;QACX,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrD,aAAa,EACX,QAAQ,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,aAAa,EAAE,CAAC;KACxF,CAAC,CAAC;AACL,CAAC"}

package/dist/execution/ActionRegistry.d.ts

@@ -0,0 +1,22 @@
+import type { z } from "zod";
+import type { CapturedIntent } from "../intent/ExecutionIntent.js";
+import type { VerifiedAuthorization } from "./AuthorizationVerifier.js";
+export interface ActionExecutionContext<TParameters> {
+    readonly intent: CapturedIntent;
+    readonly parameters: TParameters;
+    readonly authorization: VerifiedAuthorization;
+}
+export interface ActionHandler<TParameters, TResult> {
+    readonly parametersSchema: z.ZodType<TParameters>;
+    execute(context: ActionExecutionContext<TParameters>): Promise<TResult> | TResult;
+}
+export declare class ActionRegistry {
+    private readonly actions;
+    private sealed;
+    register<TParameters, TResult>(action: string, handler: ActionHandler<TParameters, TResult>): this;
+    seal(): this;
+    has(action: string): boolean;
+    validate(captured: CapturedIntent): void;
+    execute(captured: CapturedIntent, authorization: VerifiedAuthorization): Promise<unknown>;
+}
+//# sourceMappingURL=ActionRegistry.d.ts.map

package/dist/execution/ActionRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ActionRegistry.d.ts","sourceRoot":"","sources":["../../src/execution/ActionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,MAAM,WAAW,sBAAsB,CAAC,WAAW;IACjD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C;AAED,MAAM,WAAW,aAAa,CAAC,WAAW,EAAE,OAAO;IACjD,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACnF;AAOD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,MAAM,CAAS;IAEhB,QAAQ,CAAC,WAAW,EAAE,OAAO,EAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,GAC3C,IAAI;IAOA,IAAI,IAAI,IAAI;IAKZ,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI;IASlC,OAAO,CAClB,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,qBAAqB,GACnC,OAAO,CAAC,OAAO,CAAC;CAQpB"}

package/dist/execution/ActionRegistry.js

@@ -0,0 +1,41 @@
+export class ActionRegistry {
+    actions = new Map();
+    sealed = false;
+    register(action, handler) {
+        if (this.sealed)
+            throw new Error("ACTION_REGISTRY_SEALED");
+        if (this.actions.has(action))
+            throw new Error("ACTION_ALREADY_REGISTERED");
+        this.actions.set(action, handler);
+        return this;
+    }
+    seal() {
+        this.sealed = true;
+        return this;
+    }
+    has(action) {
+        return this.actions.has(action);
+    }
+    validate(captured) {
+        if (!this.sealed)
+            throw new Error("ACTION_REGISTRY_NOT_SEALED");
+        const handler = this.actions.get(captured.intent.action);
+        if (!handler)
+            throw new Error("ACTION_NOT_REGISTERED");
+        if (!handler.parametersSchema.safeParse(captured.intent.parameters).success) {
+            throw new Error("ACTION_PARAMETERS_INVALID");
+        }
+    }
+    async execute(captured, authorization) {
+        if (!this.sealed)
+            throw new Error("ACTION_REGISTRY_NOT_SEALED");
+        const handler = this.actions.get(captured.intent.action);
+        if (!handler)
+            throw new Error("ACTION_NOT_REGISTERED");
+        const result = handler.parametersSchema.safeParse(captured.intent.parameters);
+        if (!result.success)
+            throw new Error("ACTION_PARAMETERS_INVALID");
+        return handler.execute({ intent: captured, parameters: result.data, authorization });
+    }
+}
+//# sourceMappingURL=ActionRegistry.js.map

package/dist/execution/ActionRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ActionRegistry.js","sourceRoot":"","sources":["../../src/execution/ActionRegistry.ts"],"names":[],"mappings":"AAoBA,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACvD,MAAM,GAAG,KAAK,CAAC;IAEhB,QAAQ,CACb,MAAc,EACd,OAA4C;QAE5C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAA2B,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,IAAI;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAEM,QAAQ,CAAC,QAAwB;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,QAAwB,EACxB,aAAoC;QAEpC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;IACvF,CAAC;CACF"}

package/dist/execution/AuthorizationVerifier.d.ts

@@ -0,0 +1,28 @@
+import type { CapturedIntent } from "../intent/ExecutionIntent.js";
+import type { GateDecision } from "../decision/DecisionAuthority.js";
+export interface VerifiedAuthorization {
+    readonly decisionId: string;
+    readonly dossierId: string;
+    readonly grantId: string;
+    readonly intentHash: string;
+    readonly expiresAt: string;
+}
+export interface AuthorizationVerifier {
+    verifyAndConsume(captured: CapturedIntent, decision: GateDecision): Promise<VerifiedAuthorization | null>;
+}
+export interface DecionisGrantVerifierOptions {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+    readonly timeoutMs?: number;
+    readonly fetch?: typeof fetch;
+    readonly allowInsecureLoopback?: boolean;
+}
+export declare class DecionisGrantVerifier implements AuthorizationVerifier {
+    private readonly baseUrl;
+    private readonly apiKey;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    constructor(options: DecionisGrantVerifierOptions);
+    verifyAndConsume(captured: CapturedIntent, decision: GateDecision): Promise<VerifiedAuthorization | null>;
+}
+//# sourceMappingURL=AuthorizationVerifier.d.ts.map

package/dist/execution/AuthorizationVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationVerifier.d.ts","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CACd,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC1C;AAmBD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAEtB,OAAO,EAAE,4BAA4B;IAU3C,gBAAgB,CAC3B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;CA0DzC"}

package/dist/execution/AuthorizationVerifier.js

@@ -0,0 +1,88 @@
+import { z } from "zod";
+import { AuthorityBaseUrl } from "../http/AuthorityBaseUrl.js";
+import { BoundedResponseBody } from "../http/BoundedResponseBody.js";
+import { CanonicalIntentHasher } from "../intent/CanonicalIntentHasher.js";
+const ConsumeResponseSchema = z
+    .object({
+    valid: z.literal(true),
+    claims: z
+        .object({
+        jti: z.string().min(1).max(200),
+        decision_id: z.string().min(1).max(200),
+        dossier_id: z.string().min(1).max(200),
+        exp: z.number().int().positive(),
+        binding: z.object({ intent_hash: z.string().regex(/^sha256:[0-9a-f]{64}$/) }).strict(),
+    })
+        .strict(),
+})
+    .strict();
+const MAX_RESPONSE_BYTES = 100 * 1024;
+export class DecionisGrantVerifier {
+    baseUrl;
+    apiKey;
+    timeoutMs;
+    fetchImpl;
+    constructor(options) {
+        this.baseUrl = AuthorityBaseUrl.normalize(options.baseUrl, options.allowInsecureLoopback === true);
+        this.apiKey = options.apiKey;
+        this.timeoutMs = Math.min(Math.max(options.timeoutMs ?? 4_000, 1), 15_000);
+        this.fetchImpl = options.fetch ?? fetch;
+    }
+    async verifyAndConsume(captured, decision) {
+        if (decision.verdict !== "ALLOW" ||
+            decision.failClosed ||
+            decision.authorization === null ||
+            decision.dossierId === null ||
+            decision.intentHash !== captured.intentHash) {
+            return null;
+        }
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/consume-token`, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${this.apiKey}`,
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    execution_token: decision.authorization.token,
+                    intent_hash: captured.intentHash,
+                    intent: CanonicalIntentHasher.bindingOf(captured.intent),
+                    consumed_by: captured.intent.actor.id,
+                }),
+                signal: controller.signal,
+            });
+            if (!response.ok)
+                return null;
+            const text = await BoundedResponseBody.read(response, MAX_RESPONSE_BYTES);
+            if (text === null)
+                return null;
+            const parsed = ConsumeResponseSchema.parse(JSON.parse(text));
+            const claimExpiryMs = parsed.claims.exp * 1_000;
+            const decisionExpirySeconds = Math.floor(Date.parse(decision.authorization.expiresAt) / 1_000);
+            if (parsed.claims.binding.intent_hash !== captured.intentHash ||
+                parsed.claims.decision_id !== decision.decisionId ||
+                parsed.claims.dossier_id !== decision.dossierId ||
+                parsed.claims.exp !== decisionExpirySeconds ||
+                claimExpiryMs <= Date.now() ||
+                claimExpiryMs > Date.parse(captured.intent.expiresAt)) {
+                return null;
+            }
+            return Object.freeze({
+                decisionId: parsed.claims.decision_id,
+                dossierId: parsed.claims.dossier_id,
+                grantId: parsed.claims.jti,
+                intentHash: parsed.claims.binding.intent_hash,
+                expiresAt: new Date(parsed.claims.exp * 1_000).toISOString(),
+            });
+        }
+        catch {
+            return null;
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+//# sourceMappingURL=AuthorizationVerifier.js.map

package/dist/execution/AuthorizationVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAmB3E,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACvF,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAUtC,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,6BAA6B,EAAE;gBAClF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACtC,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YAChD,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,IACE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBACzD,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBACjD,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBAC3C,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;gBACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;gBACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;gBAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW;gBAC7C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}

package/dist/execution/ReplayStore.d.ts

@@ -0,0 +1,10 @@
+export interface ReplayStore {
+    claim(grantId: string, expiresAt: Date): Promise<boolean>;
+}
+export declare class InMemoryReplayStore implements ReplayStore {
+    private readonly maxEntries;
+    private readonly claims;
+    constructor(maxEntries?: number);
+    claim(grantId: string, expiresAt: Date): Promise<boolean>;
+}
+//# sourceMappingURL=ReplayStore.d.ts.map

package/dist/execution/ReplayStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReplayStore.d.ts","sourceRoot":"","sources":["../../src/execution/ReplayStore.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D;AAED,qBAAa,mBAAoB,YAAW,WAAW;IAGlC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAF9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAEhB,UAAU,SAAS;IAM1C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;CAcvE"}

package/dist/execution/ReplayStore.js

@@ -0,0 +1,28 @@
+export class InMemoryReplayStore {
+    maxEntries;
+    claims = new Map();
+    constructor(maxEntries = 10_000) {
+        this.maxEntries = maxEntries;
+        if (!Number.isSafeInteger(maxEntries) || maxEntries < 1) {
+            throw new Error("REPLAY_STORE_CAPACITY_INVALID");
+        }
+    }
+    async claim(grantId, expiresAt) {
+        const now = Date.now();
+        const expiry = expiresAt.valueOf();
+        if (grantId.length === 0 || grantId.length > 200 || !Number.isFinite(expiry) || expiry <= now) {
+            return false;
+        }
+        for (const [key, expiry] of this.claims) {
+            if (expiry <= now)
+                this.claims.delete(key);
+        }
+        if (this.claims.has(grantId))
+            return false;
+        if (this.claims.size >= this.maxEntries)
+            throw new Error("REPLAY_STORE_CAPACITY_EXCEEDED");
+        this.claims.set(grantId, expiry);
+        return true;
+    }
+}
+//# sourceMappingURL=ReplayStore.js.map

package/dist/execution/ReplayStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ReplayStore.js","sourceRoot":"","sources":["../../src/execution/ReplayStore.ts"],"names":[],"mappings":"AAIA,MAAM,OAAO,mBAAmB;IAGM;IAFnB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAAoC,aAAa,MAAM;QAAnB,eAAU,GAAV,UAAU,CAAS;QACrD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,SAAe;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAC9F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxC,IAAI,MAAM,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/execution/SafeExecutor.d.ts

@@ -0,0 +1,25 @@
+import type { GateDecision } from "../decision/DecisionAuthority.js";
+import type { CapturedIntent } from "../intent/ExecutionIntent.js";
+import type { ActionRegistry } from "./ActionRegistry.js";
+import type { AuthorizationVerifier, VerifiedAuthorization } from "./AuthorizationVerifier.js";
+export type ExecutionBlockReason = "DECISION_NOT_ALLOW" | "INTENT_BINDING_MISMATCH" | "INTENT_CONFORMANCE_FAILED" | "AUTHORIZATION_MISSING" | "AUTHORIZATION_INVALID";
+export type SafeExecutionResult<TResult = unknown> = {
+    readonly executed: true;
+    readonly result: TResult;
+    readonly authorization: VerifiedAuthorization;
+} | {
+    readonly executed: false;
+    readonly reason: ExecutionBlockReason;
+    readonly result: null;
+    readonly authorization: null;
+};
+export declare class SafeExecutor {
+    private readonly registry;
+    private readonly verifier;
+    private readonly hasher;
+    constructor(registry: ActionRegistry, verifier: AuthorizationVerifier);
+    run<TResult = unknown>(captured: CapturedIntent, decision: GateDecision): Promise<SafeExecutionResult<TResult>>;
+    private intentConforms;
+    private static blocked;
+}
+//# sourceMappingURL=SafeExecutor.d.ts.map

package/dist/execution/SafeExecutor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SafeExecutor.d.ts","sourceRoot":"","sources":["../../src/execution/SafeExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE/F,MAAM,MAAM,oBAAoB,GAC5B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAC7C;IACE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;CAC9B,CAAC;AAEN,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;gBAGnC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGrC,GAAG,CAAC,OAAO,GAAG,OAAO,EAChC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IA8CxC,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}

package/dist/execution/SafeExecutor.js

@@ -0,0 +1,73 @@
+import { CanonicalIntentHasher } from "../intent/CanonicalIntentHasher.js";
+export class SafeExecutor {
+    registry;
+    verifier;
+    hasher = new CanonicalIntentHasher();
+    constructor(registry, verifier) {
+        this.registry = registry;
+        this.verifier = verifier;
+    }
+    async run(captured, decision) {
+        if (decision.verdict !== "ALLOW" || decision.failClosed) {
+            return SafeExecutor.blocked("DECISION_NOT_ALLOW");
+        }
+        if (decision.intentHash !== captured.intentHash) {
+            return SafeExecutor.blocked("INTENT_BINDING_MISMATCH");
+        }
+        if (decision.authorization === null) {
+            return SafeExecutor.blocked("AUTHORIZATION_MISSING");
+        }
+        if (!this.intentConforms(captured)) {
+            return SafeExecutor.blocked("INTENT_CONFORMANCE_FAILED");
+        }
+        this.registry.validate(captured);
+        let authorization;
+        try {
+            authorization = await this.verifier.verifyAndConsume(captured, decision);
+        }
+        catch {
+            return SafeExecutor.blocked("AUTHORIZATION_INVALID");
+        }
+        if (authorization === null)
+            return SafeExecutor.blocked("AUTHORIZATION_INVALID");
+        const authorizationExpiry = Date.parse(authorization.expiresAt);
+        if (authorization.decisionId !== decision.decisionId ||
+            authorization.dossierId !== decision.dossierId ||
+            authorization.grantId.length === 0 ||
+            authorization.intentHash !== captured.intentHash ||
+            Math.floor(authorizationExpiry / 1_000) !==
+                Math.floor(Date.parse(decision.authorization.expiresAt) / 1_000) ||
+            authorizationExpiry <= Date.now() ||
+            authorizationExpiry > Date.parse(captured.intent.expiresAt)) {
+            return SafeExecutor.blocked("AUTHORIZATION_INVALID");
+        }
+        if (!this.intentConforms(captured)) {
+            return SafeExecutor.blocked("INTENT_CONFORMANCE_FAILED");
+        }
+        let result;
+        try {
+            result = (await this.registry.execute(captured, authorization));
+        }
+        catch {
+            throw new Error("ACTION_EXECUTION_FAILED");
+        }
+        return { executed: true, result, authorization };
+    }
+    intentConforms(captured) {
+        let recomputed = null;
+        try {
+            recomputed = this.hasher.capture(captured.intent);
+        }
+        catch {
+            // Malformed runtime objects are non-conformant.
+        }
+        return (recomputed !== null &&
+            recomputed.intentHash === captured.intentHash &&
+            recomputed.canonicalIntent === captured.canonicalIntent &&
+            recomputed.byteLength === captured.byteLength);
+    }
+    static blocked(reason) {
+        return { executed: false, reason, result: null, authorization: null };
+    }
+}
+//# sourceMappingURL=SafeExecutor.js.map

package/dist/execution/SafeExecutor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SafeExecutor.js","sourceRoot":"","sources":["../../src/execution/SafeExecutor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAyB3E,MAAM,OAAO,YAAY;IAIJ;IACA;IAJF,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAEtD,YACmB,QAAwB,EACxB,QAA+B;QAD/B,aAAQ,GAAR,QAAQ,CAAgB;QACxB,aAAQ,GAAR,QAAQ,CAAuB;IAC/C,CAAC;IAEG,KAAK,CAAC,GAAG,CACd,QAAwB,EACxB,QAAsB;QAEtB,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxD,OAAO,YAAY,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YAChD,OAAO,YAAY,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,YAAY,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,YAAY,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,aAA2C,CAAC;QAChD,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,aAAa,KAAK,IAAI;YAAE,OAAO,YAAY,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACjF,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAChE,IACE,aAAa,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAChD,aAAa,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;YAC9C,aAAa,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAClC,aAAa,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAChD,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,KAAK,CAAC;gBACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;YAClE,mBAAmB,IAAI,IAAI,CAAC,GAAG,EAAE;YACjC,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAC3D,CAAC;YACD,OAAO,YAAY,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,OAAO,YAAY,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAY,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACnD,CAAC;IAEO,cAAc,CAAC,QAAwB;QAC7C,IAAI,UAAU,GAA0B,IAAI,CAAC;QAC7C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;QACD,OAAO,CACL,UAAU,KAAK,IAAI;YACnB,UAAU,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAC7C,UAAU,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YACvD,UAAU,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAC9C,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,MAA4B;QACjD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACxE,CAAC;CACF"}

package/dist/http/AuthorityBaseUrl.d.ts

@@ -0,0 +1,4 @@
+export declare class AuthorityBaseUrl {
+    static normalize(value: string, allowInsecureLoopback?: boolean): string;
+}
+//# sourceMappingURL=AuthorityBaseUrl.d.ts.map

package/dist/http/AuthorityBaseUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityBaseUrl.d.ts","sourceRoot":"","sources":["../../src/http/AuthorityBaseUrl.ts"],"names":[],"mappings":"AAAA,qBAAa,gBAAgB;WACb,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,qBAAqB,UAAQ,GAAG,MAAM;CAsB9E"}

package/dist/http/AuthorityBaseUrl.js

@@ -0,0 +1,22 @@
+export class AuthorityBaseUrl {
+    static normalize(value, allowInsecureLoopback = false) {
+        const normalizedValue = value.trim();
+        const url = new URL(normalizedValue);
+        const loopback = url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]";
+        if (url.username || url.password) {
+            throw new Error("DECIONIS_URL_MUST_NOT_CONTAIN_CREDENTIALS");
+        }
+        if (url.search || url.hash) {
+            throw new Error("DECIONIS_URL_MUST_NOT_CONTAIN_QUERY_OR_FRAGMENT");
+        }
+        if (url.protocol !== "https:" && !(allowInsecureLoopback && loopback)) {
+            throw new Error("DECIONIS_URL_MUST_USE_HTTPS");
+        }
+        let end = normalizedValue.length;
+        while (end > 0 && normalizedValue.charCodeAt(end - 1) === 47) {
+            end -= 1;
+        }
+        return normalizedValue.slice(0, end);
+    }
+}
+//# sourceMappingURL=AuthorityBaseUrl.js.map

package/dist/http/AuthorityBaseUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityBaseUrl.js","sourceRoot":"","sources":["../../src/http/AuthorityBaseUrl.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,gBAAgB;IACpB,MAAM,CAAC,SAAS,CAAC,KAAa,EAAE,qBAAqB,GAAG,KAAK;QAClE,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;QACrC,MAAM,QAAQ,GACZ,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;QAE3F,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,qBAAqB,IAAI,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC;QACjC,OAAO,GAAG,GAAG,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC7D,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;QACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/http/BoundedResponseBody.d.ts

@@ -0,0 +1,4 @@
+export declare class BoundedResponseBody {
+    static read(response: Response, maxBytes: number): Promise<string | null>;
+}
+//# sourceMappingURL=BoundedResponseBody.d.ts.map

package/dist/http/BoundedResponseBody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BoundedResponseBody.d.ts","sourceRoot":"","sources":["../../src/http/BoundedResponseBody.ts"],"names":[],"mappings":"AAAA,qBAAa,mBAAmB;WACV,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CA6BvF"}

package/dist/http/BoundedResponseBody.js

@@ -0,0 +1,33 @@
+export class BoundedResponseBody {
+    static async read(response, maxBytes) {
+        if (response.body === null)
+            return "";
+        const reader = response.body.getReader();
+        const chunks = [];
+        let byteLength = 0;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                byteLength += value.byteLength;
+                if (byteLength > maxBytes) {
+                    await reader.cancel().catch(() => undefined);
+                    return null;
+                }
+                chunks.push(value);
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        const body = new Uint8Array(byteLength);
+        let offset = 0;
+        for (const chunk of chunks) {
+            body.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return new TextDecoder("utf-8", { fatal: true }).decode(body);
+    }
+}
+//# sourceMappingURL=BoundedResponseBody.js.map