@decionis/agent-safe-pipeline 0.1.3 → 0.2.0

package/dist/execution/AuthorizationVerifier.js

@@ -1,30 +1,148 @@
+import { createHash } from "node:crypto";
 import { z } from "zod";
 import { AuthorityBaseUrl } from "../http/AuthorityBaseUrl.js";
+import { credentialReader } from "../http/Credential.js";
 import { BoundedResponseBody } from "../http/BoundedResponseBody.js";
 import { CanonicalIntentHasher } from "../intent/CanonicalIntentHasher.js";
-const ConsumeResponseSchema = z
-    .object({
+const boundedIdentifier = z
+    .string()
+    .min(1)
+    .max(200)
+    .refine(hasNoControlCharacters, { message: "IDENTIFIER_INVALID" });
+const sha256Digest = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const intentHash = sha256Digest;
+const CLAIM_TOKEN_PATTERN = /^[\w-]{43,128}$/;
+const COMPACT_JWS_PATTERN = /^[\w-]+\.[\w-]+\.[\w-]+$/;
+/** `boundedIdentifier` from the Decionis `EffectEvidence` contract, verbatim. */
+const effectIdentifier = z.string().trim().min(1).max(500);
+/**
+ * The Decionis Protocol 1.1 `EffectEvidence` contract, mirrored so an
+ * observation is bounded before it is serialised onto an authenticated
+ * request. Parsing also takes the snapshot the drop rule then checks, so the
+ * values that are verified are exactly the values that are sent. The
+ * `CONFIRMED` refinements are deliberately not mirrored: whether an
+ * observation qualifies as confirmed is the authority's judgement, not this
+ * package's, and a refusal is recoverable by the evidence-free retry.
+ */
+const EffectEvidenceSchema = z.strictObject({
+    version: z.literal("1.0"),
+    status: z.enum(["CONFIRMED", "UNCONFIRMED"]),
+    observation_method: z.enum([
+        "DOWNSTREAM_ACK",
+        "READ_AFTER_WRITE",
+        "EVENT_CONFIRMATION",
+        "STATE_RECONCILIATION",
+        "SIGNED_RECEIPT",
+        "EXTERNAL_ATTESTATION",
+        "HUMAN_VALIDATION",
+    ]),
+    observer: z
+        .strictObject({ id: effectIdentifier, version: effectIdentifier.nullable() })
+        .nullable(),
+    expected_effect_digest: sha256Digest,
+    observed_effect_digest: sha256Digest.nullable(),
+    observed_at: z.string().datetime().nullable(),
+    evidence_digest: sha256Digest.nullable(),
+    evidence_reference: effectIdentifier.nullable(),
+    execution_correlation_id: effectIdentifier,
+});
+/**
+ * Mirrors `ExecutionTokenResponse` and `ExecutionTokenClaims` in the Decionis
+ * OpenAPI contract. Claims are declared `additionalProperties: true`, and the
+ * live response carries revalidation fields beyond the documented envelope, so
+ * unknown fields are tolerated; authority is established only by the positive
+ * assertions checked below, never by an extra field.
+ */
+const ClaimResponseSchema = z.looseObject({
     valid: z.literal(true),
-    claims: z
-        .object({
-        jti: z.string().min(1).max(200),
-        decision_id: z.string().min(1).max(200),
-        dossier_id: z.string().min(1).max(200),
+    reason_codes: z.array(boundedIdentifier).max(50).optional(),
+    should_execute: z.boolean().optional(),
+    claims: z.looseObject({
+        iss: boundedIdentifier,
+        sub: boundedIdentifier.optional(),
+        aud: z.string().min(1).max(500).optional(),
+        org_id: z.string().uuid(),
+        dossier_id: boundedIdentifier,
+        decision_id: boundedIdentifier,
+        action: boundedIdentifier,
+        decision: z.literal("allow"),
+        scope: z.literal("execute"),
+        binding: z.looseObject({
+            intent_hash: intentHash,
+            // An authority that stores no commitment may omit the property, serialise
+            // its nullable column as `null`, or emit something this package does not
+            // recognise. All three mean "no commitment this executor can read", and
+            // all three must behave exactly as they did before this property existed,
+            // when the loose envelope passed the value through untouched. Reading an
+            // unrecognised value as absent keeps that promise and stays fail-closed:
+            // an intent that committed a digest still finds no match and is refused.
+            expected_effect_digest: sha256Digest.nullish().catch(undefined),
+            // The same rule for the payload digest and its profile: unreadable is
+            // absent, and absent means no comparison, which is what an authority
+            // that never bound one has always meant.
+            execution_payload_digest: sha256Digest.nullish().catch(undefined),
+            execution_payload_canonicalization_profile: z
+                .string()
+                .min(1)
+                .max(200)
+                .nullish()
+                .catch(undefined),
+        }),
+        jti: boundedIdentifier,
+        iat: z.number().int(),
+        nbf: z.number().int(),
         exp: z.number().int().positive(),
-        binding: z.object({ intent_hash: z.string().regex(/^sha256:[0-9a-f]{64}$/) }).strict(),
-    })
-        .strict(),
-})
-    .strict();
+    }),
+    claim_token: z.string().regex(CLAIM_TOKEN_PATTERN).nullable().optional(),
+    claim_lease_expires_at: z.string().datetime().nullable().optional(),
+    // A compact JWS or nothing. This package never verifies it: it is not the
+    // audience, the downstream is. An unreadable value is treated as absent
+    // rather than refused, because the grant it rides with is what authorizes.
+    claim_attestation: z.string().regex(COMPACT_JWS_PATTERN).max(8_192).nullish().catch(undefined),
+});
+/** The canonicalization this package can reproduce, named the way the authority names it. */
+const JCS_PROFILE = "RFC8785/JCS";
+/**
+ * The response envelope is deliberately loose, and the two effect fields are
+ * reporting-only: a value outside their contract must never turn a recorded
+ * finalization into `PENDING` for a consumer using none of this. Anything
+ * unrecognised reads as absent, which reports closed.
+ */
+const FinalizeResponseSchema = z.looseObject({
+    finalized: z.boolean(),
+    reason_codes: z.array(boundedIdentifier).max(50).optional(),
+    effect_evidence_recorded: z.boolean().optional().catch(undefined),
+    effect_confirmation: z.enum(["CONFIRMED", "UNCONFIRMED"]).optional().catch(undefined),
+});
 const MAX_RESPONSE_BYTES = 100 * 1024;
+/**
+ * Claims a Decionis execution grant through `/v1/execution/claim-token`
+ * immediately before dispatch and finalizes the attempt through
+ * `/v1/execution/finalize-token` afterwards, so commit evidence joins the
+ * Decision Dossier chain.
+ */
 export class DecionisGrantVerifier {
     baseUrl;
     apiKey;
     timeoutMs;
     fetchImpl;
+    /** Claim material is keyed by the frozen authorization it belongs to and never exposed. */
+    claims = new WeakMap();
+    /** The authority's own answer about an observation, keyed by the frozen authorization. */
+    reports = new WeakMap();
+    /**
+     * The digest the authority binds over the action parameters: SHA-256 of
+     * their RFC 8785 canonical form, the same canonicalization the intent hash
+     * uses. Exposed so a test, or an authority implementation, can produce the
+     * value this verifier will accept.
+     */
+    static parametersDigest(parameters) {
+        const canonical = CanonicalIntentHasher.stringify(parameters);
+        return `sha256:${createHash("sha256").update(canonical, "utf8").digest("hex")}`;
+    }
     constructor(options) {
         this.baseUrl = AuthorityBaseUrl.normalize(options.baseUrl, options.allowInsecureLoopback === true);
-        this.apiKey = options.apiKey;
+        this.apiKey = credentialReader(options.apiKey);
         this.timeoutMs = Math.min(Math.max(options.timeoutMs ?? 4_000, 1), 15_000);
         this.fetchImpl = options.fetch ?? fetch;
     }
@@ -36,20 +154,25 @@ export class DecionisGrantVerifier {
             decision.intentHash !== captured.intentHash) {
             return null;
         }
+        const commitCorrelationId = captured.intent.intentId;
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
-            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/consume-token`, {
+            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/claim-token`, {
                 method: "POST",
                 headers: {
-                    authorization: `Bearer ${this.apiKey}`,
+                    authorization: `Bearer ${this.apiKey()}`,
                     "content-type": "application/json",
                 },
                 body: JSON.stringify({
                     execution_token: decision.authorization.token,
                     intent_hash: captured.intentHash,
                     intent: CanonicalIntentHasher.bindingOf(captured.intent),
+                    // A Presence-bound decision is re-verified by the authority at claim
+                    // time, so the same evidence must accompany the claim.
+                    ...(decision.evidence === undefined ? {} : { evidence: decision.evidence }),
                     consumed_by: captured.intent.actor.id,
+                    commit_correlation_id: commitCorrelationId,
                 }),
                 signal: controller.signal,
             });
@@ -58,24 +181,61 @@ export class DecionisGrantVerifier {
             const text = await BoundedResponseBody.read(response, MAX_RESPONSE_BYTES);
             if (text === null)
                 return null;
-            const parsed = ConsumeResponseSchema.parse(JSON.parse(text));
-            const claimExpiryMs = parsed.claims.exp * 1_000;
+            const parsed = ClaimResponseSchema.parse(JSON.parse(text));
+            const claims = parsed.claims;
+            /** A `null` commitment is no commitment, exactly as an absent one is. */
+            const committedEffectDigest = claims.binding.expected_effect_digest ?? undefined;
+            const claimExpiryMs = claims.exp * 1_000;
             const decisionExpirySeconds = Math.floor(Date.parse(decision.authorization.expiresAt) / 1_000);
-            if (parsed.claims.binding.intent_hash !== captured.intentHash ||
-                parsed.claims.decision_id !== decision.decisionId ||
-                parsed.claims.dossier_id !== decision.dossierId ||
-                parsed.claims.exp !== decisionExpirySeconds ||
+            const audience = `${captured.intent.downstreamTarget.system}:${captured.intent.downstreamTarget.operation}`;
+            // When the authority says which digest it bound over the parameters,
+            // it must be the digest of the parameters this process captured, under
+            // a canonicalization this process can reproduce. A digest under a
+            // profile this package cannot compute is not "probably fine": it is a
+            // claim about the payload that cannot be checked, and is refused.
+            const payloadDigest = claims.binding.execution_payload_digest ?? undefined;
+            const payloadDigestDisagrees = payloadDigest !== undefined &&
+                (claims.binding.execution_payload_canonicalization_profile !== JCS_PROFILE ||
+                    payloadDigest !== DecionisGrantVerifier.parametersDigest(captured.intent.parameters));
+            if (parsed.should_execute === false ||
+                typeof parsed.claim_token !== "string" ||
+                claims.binding.intent_hash !== captured.intentHash ||
+                committedEffectDigest !== captured.intent.expectedEffectDigest ||
+                payloadDigestDisagrees ||
+                claims.decision_id !== decision.decisionId ||
+                claims.dossier_id !== decision.dossierId ||
+                claims.org_id !== captured.intent.tenantId ||
+                claims.sub !== captured.intent.actor.id ||
+                claims.action !== captured.intent.action ||
+                (claims.aud !== undefined && claims.aud !== audience) ||
+                claims.exp !== decisionExpirySeconds ||
                 claimExpiryMs <= Date.now() ||
                 claimExpiryMs > Date.parse(captured.intent.expiresAt)) {
                 return null;
             }
-            return Object.freeze({
-                decisionId: parsed.claims.decision_id,
-                dossierId: parsed.claims.dossier_id,
-                grantId: parsed.claims.jti,
-                intentHash: parsed.claims.binding.intent_hash,
-                expiresAt: new Date(parsed.claims.exp * 1_000).toISOString(),
+            // The lease the authority named for this claim, when it named one. It
+            // is reported rather than enforced here: what a caller does with a
+            // window is the caller's decision, and the grant's own expiry is
+            // already the outer bound this verifier checked above.
+            const lease = parsed.claim_lease_expires_at;
+            const attestation = parsed.claim_attestation ?? undefined;
+            const authorization = Object.freeze({
+                decisionId: claims.decision_id,
+                dossierId: claims.dossier_id,
+                grantId: claims.jti,
+                intentHash: claims.binding.intent_hash,
+                expiresAt: new Date(claims.exp * 1_000).toISOString(),
+                ...(typeof lease === "string" ? { leaseExpiresAt: lease } : {}),
+                ...(payloadDigest === undefined ? {} : { payloadDigest }),
+                ...(attestation === undefined ? {} : { claimAttestation: attestation }),
+            });
+            this.claims.set(authorization, {
+                executionToken: decision.authorization.token,
+                claimToken: parsed.claim_token,
+                commitCorrelationId,
+                expectedEffectDigest: committedEffectDigest,
             });
+            return authorization;
         }
         catch {
             return null;
@@ -84,5 +244,120 @@ export class DecionisGrantVerifier {
             clearTimeout(timeout);
         }
     }
+    async finalize(input) {
+        const claim = this.claims.get(input.authorization);
+        if (claim === undefined)
+            return "PENDING";
+        const evidence = DecionisGrantVerifier.bindableEffectEvidence(input, claim);
+        const first = await this.post(input, claim, evidence, false);
+        if (first === "RECORDED")
+            return "RECORDED";
+        if (first === "PENDING" || evidence === undefined)
+            return "PENDING";
+        // The authority answered with the one status an effect refusal uses, and
+        // every effect rejection precedes the commit transition, so the commit
+        // record is still recoverable by reporting the same outcome without the
+        // observation. This retries no side effect and sends nothing it has not
+        // already sent: the second body is byte-identical to the body this package
+        // sent before effect evidence existed.
+        const second = await this.post(input, claim, undefined, true);
+        return second === "RECORDED" ? "RECORDED" : "PENDING";
+    }
+    /**
+     * What the authority reported about effect evidence for an authorization this
+     * verifier finalized. `null` until a finalization was recorded. This is the
+     * authority's statement, never this package's inference.
+     */
+    effectReport(authorization) {
+        return this.reports.get(authorization) ?? null;
+    }
+    /**
+     * `REFUSED` only for the one status a finalization refusal uses (409); every
+     * other non-ok status, a throw, a timeout, or an oversize body is `PENDING`,
+     * exactly as it was before effect evidence existed. A rate-limited or
+     * unauthenticated authority must never be re-posted to.
+     */
+    async post(input, claim, evidence, evidenceRefused) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/finalize-token`, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${this.apiKey()}`,
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify({
+                    execution_token: claim.executionToken,
+                    claim_token: claim.claimToken,
+                    outcome: input.outcome,
+                    commit_correlation_id: claim.commitCorrelationId,
+                    ...(evidence === undefined ? {} : { effect_evidence: evidence }),
+                }),
+                signal: controller.signal,
+            });
+            if (!response.ok)
+                return response.status === 409 ? "REFUSED" : "PENDING";
+            const text = await BoundedResponseBody.read(response, MAX_RESPONSE_BYTES);
+            if (text === null)
+                return "PENDING";
+            const parsed = FinalizeResponseSchema.parse(JSON.parse(text));
+            if (!parsed.finalized)
+                return "PENDING";
+            // The authority's answer about an observation is only meaningful for a
+            // finalization that carried one. What was not sent cannot have been
+            // recorded, whatever the response says.
+            const sent = evidence !== undefined;
+            this.reports.set(input.authorization, {
+                effectEvidenceSent: sent,
+                effectEvidenceRefused: evidenceRefused,
+                effectEvidenceRecorded: sent && parsed.effect_evidence_recorded === true,
+                effectConfirmation: sent && parsed.effect_confirmation === "CONFIRMED" ? "CONFIRMED" : "UNCONFIRMED",
+            });
+            this.claims.delete(input.authorization);
+            return "RECORDED";
+        }
+        catch {
+            return "PENDING";
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    /**
+     * Effect evidence reaches the authority only when this executor can prove the
+     * authority will bind it: it must conform to the contract's bounded shape,
+     * the grant the authority returned must have committed to an expected-effect
+     * digest, the evidence must name that exact digest, and it must carry the
+     * correlation id this claim was made with. Unbindable evidence is dropped
+     * rather than sent, because the authority answers it with a 409 that aborts
+     * the whole finalization rather than discarding the observation.
+     *
+     * The checks run against the parsed copy, which is also the copy that is
+     * serialised, so a caller object with accessors cannot present one value to
+     * the drop rule and another to the wire.
+     */
+    static bindableEffectEvidence(input, claim) {
+        if (input.effectEvidence === undefined || claim.expectedEffectDigest === undefined) {
+            return undefined;
+        }
+        const parsed = EffectEvidenceSchema.safeParse(input.effectEvidence);
+        if (!parsed.success)
+            return undefined;
+        const evidence = parsed.data;
+        if (evidence.expected_effect_digest !== claim.expectedEffectDigest)
+            return undefined;
+        if (evidence.execution_correlation_id !== claim.commitCorrelationId)
+            return undefined;
+        return Object.freeze(evidence);
+    }
+}
+function hasNoControlCharacters(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit <= 0x1f || codeUnit === 0x7f)
+            return false;
+    }
+    return true;
 }
 //# sourceMappingURL=AuthorizationVerifier.js.map

package/dist/execution/AuthorizationVerifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAmB3E,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACtC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACvF,CAAC;SACD,MAAM,EAAE;CACZ,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAUtC,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,SAAS,CAAe;IAEzC,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,6BAA6B,EAAE;gBAClF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;iBACtC,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YAChD,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,IACE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBACzD,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBACjD,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBAC3C,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW;gBACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;gBACnC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;gBAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW;gBAC7C,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAiI3E,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC;QACzB,gBAAgB;QAChB,kBAAkB;QAClB,oBAAoB;QACpB,sBAAsB;QACtB,gBAAgB;QAChB,sBAAsB;QACtB,kBAAkB;KACnB,CAAC;IACF,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC5E,QAAQ,EAAE;IACb,sBAAsB,EAAE,YAAY;IACpC,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,eAAe,EAAE,YAAY,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAC/C,wBAAwB,EAAE,gBAAgB;CAC3C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC;QACpB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC;YACrB,WAAW,EAAE,UAAU;YACvB,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,sBAAsB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/D,sEAAsE;YACtE,qEAAqE;YACrE,yCAAyC;YACzC,wBAAwB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YACjE,0CAA0C,EAAE,CAAC;iBAC1C,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,GAAG,CAAC;iBACR,OAAO,EAAE;iBACT,KAAK,CAAC,SAAS,CAAC;SACpB,CAAC;QACF,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnE,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAC/F,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACjE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CACtF,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAmBtC;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAe;IACrB,SAAS,CAAS;IAClB,SAAS,CAAe;IACzC,2FAA2F;IAC1E,MAAM,GAAG,IAAI,OAAO,EAAsC,CAAC;IAC5E,0FAA0F;IACzE,OAAO,GAAG,IAAI,OAAO,EAAgD,CAAC;IAEvF;;;;;OAKG;IACI,MAAM,CAAC,gBAAgB,CAAC,UAAsB;QACnD,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAuB,CAAC,CAAC;QAC3E,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,2BAA2B,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,qEAAqE;oBACrE,uDAAuD;oBACvD,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBAC3E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACrC,qBAAqB,EAAE,mBAAmB;iBAC3C,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,yEAAyE;YACzE,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,SAAS,CAAC;YACjF,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YACzC,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC5G,qEAAqE;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,IAAI,SAAS,CAAC;YAC3E,MAAM,sBAAsB,GAC1B,aAAa,KAAK,SAAS;gBAC3B,CAAC,MAAM,CAAC,OAAO,CAAC,0CAA0C,KAAK,WAAW;oBACxE,aAAa,KAAK,qBAAqB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1F,IACE,MAAM,CAAC,cAAc,KAAK,KAAK;gBAC/B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAClD,qBAAqB,KAAK,QAAQ,CAAC,MAAM,CAAC,oBAAoB;gBAC9D,sBAAsB;gBACtB,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAC1C,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBACxC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAC1C,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACvC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;gBACxC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;gBACrD,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBACpC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,sEAAsE;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,uDAAuD;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,IAAI,SAAS,CAAC;YAC1D,MAAM,aAAa,GAA0B,MAAM,CAAC,MAAM,CAAC;gBACzD,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;gBACtC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;gBACrD,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC7B,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;gBAC5C,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,mBAAmB;gBACnB,oBAAoB,EAAE,qBAAqB;aAC5C,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAqC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9D,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,aAAoC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,IAAI,CAChB,KAAqC,EACrC,KAAkB,EAClB,QAA6C,EAC7C,eAAwB;QAExB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAAE;gBACnF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,WAAW,EAAE,KAAK,CAAC,UAAU;oBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;oBAChD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;iBACjE,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxC,uEAAuE;YACvE,oEAAoE;YACpE,wCAAwC;YACxC,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE;gBACpC,kBAAkB,EAAE,IAAI;gBACxB,qBAAqB,EAAE,eAAe;gBACtC,sBAAsB,EAAE,IAAI,IAAI,MAAM,CAAC,wBAAwB,KAAK,IAAI;gBACxE,kBAAkB,EAChB,IAAI,IAAI,MAAM,CAAC,mBAAmB,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa;aACnF,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,MAAM,CAAC,sBAAsB,CACnC,KAAqC,EACrC,KAAkB;QAElB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACnF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAA4B,MAAM,CAAC,IAAI,CAAC;QACtD,IAAI,QAAQ,CAAC,sBAAsB,KAAK,KAAK,CAAC,oBAAoB;YAAE,OAAO,SAAS,CAAC;QACrF,IAAI,QAAQ,CAAC,wBAAwB,KAAK,KAAK,CAAC,mBAAmB;YAAE,OAAO,SAAS,CAAC;QACtF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;CACF;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/execution/SafeExecutor.d.ts

@@ -1,25 +1,120 @@
 import type { GateDecision } from "../decision/DecisionAuthority.js";
+import type { AuditRecorder } from "../audit/AuditRecorder.js";
 import type { CapturedIntent } from "../intent/ExecutionIntent.js";
 import type { ActionRegistry } from "./ActionRegistry.js";
-import type { AuthorizationVerifier, VerifiedAuthorization } from "./AuthorizationVerifier.js";
-export type ExecutionBlockReason = "DECISION_NOT_ALLOW" | "INTENT_BINDING_MISMATCH" | "INTENT_CONFORMANCE_FAILED" | "AUTHORIZATION_MISSING" | "AUTHORIZATION_INVALID";
+import type { AuthorizationVerifier, ExecutionFinalization, VerifiedAuthorization } from "./AuthorizationVerifier.js";
+export type ExecutionBlockReason = "DECISION_NOT_AUTHORITATIVE" | "DECISION_NOT_ALLOW" | "INTENT_BINDING_MISMATCH" | "INTENT_CONFORMANCE_FAILED" | "AUTHORIZATION_MISSING" | "AUTHORIZATION_INVALID" | "RECOVERY_BINDING_MISMATCH" | "AUDIT_UNAVAILABLE";
+export type ExecutionPreDispatchFailureReason = "HANDLER_FAILED_BEFORE_DISPATCH" | "AUDIT_UNAVAILABLE";
+/**
+ * What a caller presents back to reconcile an attempt whose outcome was
+ * lost. The fields are listed rather than inherited, because this is a
+ * versioned wire object: a field that appears on `VerifiedAuthorization`
+ * later must be added here deliberately or not at all.
+ */
+export interface ExecutionRecoveryReference {
+    readonly version: "agent-safe.recovery/1";
+    readonly decisionId: string;
+    readonly dossierId: string;
+    readonly grantId: string;
+    readonly intentHash: string;
+    readonly expiresAt: string;
+    readonly idempotencyKey: string;
+}
+export interface ExecutionBlockedResult {
+    readonly outcome: "BLOCKED";
+    readonly executed: false;
+    readonly reason: ExecutionBlockReason;
+    readonly result: null;
+    readonly authorization: null;
+}
+/**
+ * The provider refused, definitively, after the dispatch boundary. The grant
+ * was consumed and the request was sent, and nothing was effected: the
+ * outcome is a fact, not an unknown, so there is nothing to reconcile and no
+ * recovery reference to present. A caller that wants the action after all
+ * needs a fresh decision and a fresh grant, because the refusal was about
+ * this attempt.
+ */
+export interface ProviderRefusedResult {
+    readonly outcome: "DEFINITELY_NOT_EXECUTED";
+    readonly executed: false;
+    readonly recovered: false;
+    /** The provider's own reason, as the handler reported it. */
+    readonly reason: string;
+    readonly result: null;
+    readonly authorization: VerifiedAuthorization;
+}
+export interface ProviderOutcomeUnknownResult {
+    readonly outcome: "UNKNOWN_AFTER_DISPATCH";
+    readonly executed: null;
+    readonly reason: "PROVIDER_OUTCOME_UNKNOWN";
+    readonly result: null;
+    readonly authorization: VerifiedAuthorization;
+    readonly recovery: ExecutionRecoveryReference;
+}
+/**
+ * Every outcome that consumed a grant reports whether the attempt's commit
+ * evidence reached the authority. Finalization is evidence, not authority;
+ * it never changes `outcome` or `executed`.
+ */
 export type SafeExecutionResult<TResult = unknown> = {
+    readonly outcome: "COMPLETED";
     readonly executed: true;
+    readonly recovered: false;
+    readonly result: TResult;
+    readonly authorization: VerifiedAuthorization;
+    readonly finalization: ExecutionFinalization;
+} | ExecutionBlockedResult | {
+    readonly outcome: "FAILED_BEFORE_DISPATCH";
+    readonly executed: false;
+    readonly reason: ExecutionPreDispatchFailureReason;
+    readonly result: null;
+    readonly authorization: VerifiedAuthorization;
+    readonly finalization: ExecutionFinalization;
+} | (ProviderRefusedResult & {
+    readonly finalization: ExecutionFinalization;
+}) | (ProviderOutcomeUnknownResult & {
+    readonly finalization: ExecutionFinalization;
+});
+export type ExecutionReconciliationResult<TResult = unknown> = {
+    readonly outcome: "COMPLETED";
+    readonly executed: true;
+    readonly recovered: true;
     readonly result: TResult;
     readonly authorization: VerifiedAuthorization;
 } | {
+    readonly outcome: "DEFINITELY_NOT_EXECUTED";
     readonly executed: false;
-    readonly reason: ExecutionBlockReason;
+    readonly recovered: true;
+    readonly reason: "PROVIDER_CONFIRMED_NOT_EXECUTED";
     readonly result: null;
-    readonly authorization: null;
-};
+    readonly authorization: VerifiedAuthorization;
+} | ExecutionBlockedResult | ProviderOutcomeUnknownResult;
 export declare class SafeExecutor {
     private readonly registry;
     private readonly verifier;
+    private readonly audit?;
     private readonly hasher;
-    constructor(registry: ActionRegistry, verifier: AuthorizationVerifier);
+    constructor(registry: ActionRegistry, verifier: AuthorizationVerifier, audit?: AuditRecorder | undefined);
     run<TResult = unknown>(captured: CapturedIntent, decision: GateDecision): Promise<SafeExecutionResult<TResult>>;
+    /**
+     * Reports the attempt outcome to the verifier's authority. A missing,
+     * failing, or malformed finalization can never alter the execution result.
+     */
+    private finalize;
+    private static finalizationCode;
+    reconcile<TResult = unknown>(captured: CapturedIntent, recovery: ExecutionRecoveryReference): Promise<ExecutionReconciliationResult<TResult>>;
+    /**
+     * Observational artifacts carry an explicit non-authoritative marker. They
+     * must never be interpreted as a `GateDecision`, even after an unsafe cast
+     * or a JSON round trip.
+     */
+    private static isAuthoritativeDecision;
     private intentConforms;
-    private static blocked;
+    private block;
+    private failedBeforeDispatch;
+    private record;
+    private static recoveryReference;
+    private static authorizationFrom;
 }
 //# sourceMappingURL=SafeExecutor.d.ts.map

package/dist/execution/SafeExecutor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SafeExecutor.d.ts","sourceRoot":"","sources":["../../src/execution/SafeExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAE/F,MAAM,MAAM,oBAAoB,GAC5B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAC7C;IACE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;CAC9B,CAAC;AAEN,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;gBAGnC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB;IAGrC,GAAG,CAAC,OAAO,GAAG,OAAO,EAChC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IA8CxC,OAAO,CAAC,cAAc;IAetB,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}
+{"version":3,"file":"SafeExecutor.d.ts","sourceRoot":"","sources":["../../src/execution/SafeExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EACV,qBAAqB,EAErB,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,oBAAoB,GAC5B,4BAA4B,GAC5B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,mBAAmB,CAAC;AAExB,MAAM,MAAM,iCAAiC,GAC3C,gCAAgC,GAAG,mBAAmB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAC7C;IACE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;CAC9C,GACD,sBAAsB,GACtB;IACE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;CAC9C,GACD,CAAC,qBAAqB,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAA;CAAE,CAAC,GAC1E,CAAC,4BAA4B,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC;AAEtF,MAAM,MAAM,6BAA6B,CAAC,OAAO,GAAG,OAAO,IACvD;IACE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD;IACE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD,sBAAsB,GACtB,4BAA4B,CAAC;AAEjC,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IALzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;gBAGnC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,CAAC,EAAE,aAAa,YAAA;IAG3B,GAAG,CAAC,OAAO,GAAG,OAAO,EAChC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAiLxC;;;OAGG;YACW,QAAQ;IAqBtB,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAIlB,SAAS,CAAC,OAAO,GAAG,OAAO,EACtC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAuElD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAQtC,OAAO,CAAC,cAAc;YAeR,KAAK;YAkBL,oBAAoB;YA6BpB,MAAM;IAOpB,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAoBhC,OAAO,CAAC,MAAM,CAAC,iBAAiB;CASjC"}