@decionis/agent-safe-pipeline 0.1.4 → 0.3.0

package/dist/execution/AuthorizationVerifier.d.ts

@@ -1,4 +1,6 @@
+import { type Credential } from "../http/Credential.js";
 import type { CapturedIntent } from "../intent/ExecutionIntent.js";
+import type { JsonObject } from "../intent/JsonValue.js";
 import type { GateDecision } from "../decision/DecisionAuthority.js";
 export interface VerifiedAuthorization {
     readonly decisionId: string;
@@ -6,6 +8,34 @@ export interface VerifiedAuthorization {
     readonly grantId: string;
     readonly intentHash: string;
     readonly expiresAt: string;
+    /**
+     * When the authority stops accepting a commit for this claim, if it said.
+     * A lease is shorter than the grant's own expiry and is the real window a
+     * side effect has to finish inside: a commit the authority will no longer
+     * record leaves an outcome nobody can reconcile from the record, however
+     * successful the dispatch was.
+     *
+     * Absent when the authority did not return one, which is how a deployment
+     * whose issuer predates the field behaves. A consumer that ignores this
+     * field is exactly as correct as it was before the field existed.
+     */
+    readonly leaseExpiresAt?: string;
+    /**
+     * The digest the authority bound over the canonical action parameters, when
+     * it exposed one. It has already been checked against this package's own
+     * digest of the same parameters before this object exists: a claim whose
+     * digest disagreed was refused, not returned. It is carried so a handler
+     * can show a downstream what the authority bound, not so anyone re-checks it.
+     */
+    readonly payloadDigest?: string;
+    /**
+     * Proof of this claim a system of record can verify without trusting this
+     * process: a compact JWS the authority signed over the grant, the decision,
+     * the binding and the lease. A handler forwards it downstream, and a
+     * downstream that requires it can refuse an instruction the authority never
+     * claimed. Absent when the authority predates it.
+     */
+    readonly claimAttestation?: string;
 }
 /** Outcome of the downstream attempt reported to the authority after a claimed grant. */
 export type ExecutionCommitOutcome = "COMMITTED" | "FAILED" | "INDETERMINATE";
@@ -15,11 +45,83 @@ export type ExecutionCommitOutcome = "COMMITTED" | "FAILED" | "INDETERMINATE";
  * the verifier has no finalization contract.
  */
 export type ExecutionFinalization = "RECORDED" | "PENDING" | "UNSUPPORTED";
+/**
+ * Exact wire shape of the Decionis Protocol 1.1 `EffectEvidence` contract: an
+ * observation of what happened downstream, supplied by the trusted runtime that
+ * observed it. This package never constructs, interprets, upgrades, or
+ * downgrades an observation; it forwards a bounded, validated copy of the one
+ * it was handed, and drops anything outside the contract's own shape rather
+ * than serialising a caller-controlled object onto an authenticated request.
+ */
+export interface AuthorityEffectEvidence {
+    readonly version: "1.0";
+    readonly status: "CONFIRMED" | "UNCONFIRMED";
+    readonly observation_method: "DOWNSTREAM_ACK" | "READ_AFTER_WRITE" | "EVENT_CONFIRMATION" | "STATE_RECONCILIATION" | "SIGNED_RECEIPT" | "EXTERNAL_ATTESTATION" | "HUMAN_VALIDATION";
+    readonly observer: {
+        readonly id: string;
+        readonly version: string | null;
+    } | null;
+    readonly expected_effect_digest: string;
+    readonly observed_effect_digest: string | null;
+    readonly observed_at: string | null;
+    readonly evidence_digest: string | null;
+    readonly evidence_reference: string | null;
+    readonly execution_correlation_id: string;
+}
+/**
+ * What the authority itself said about an observation it was sent, narrowed by
+ * what this executor knows it sent. `effectEvidenceRecorded` and
+ * `effectConfirmation` are the authority's statement, but they are only ever
+ * reported for a finalization that actually carried the observation: an
+ * authority claiming to have recorded evidence it was not sent is not evidence.
+ */
+export interface AuthorityEffectReport {
+    /** The finalization that was recorded carried the observation. */
+    readonly effectEvidenceSent: boolean;
+    /**
+     * An earlier finalization attempt carried the observation and the authority
+     * refused it, so this commit record was recovered without it. Distinguishes a
+     * refused observation from one that was dropped or never supplied.
+     */
+    readonly effectEvidenceRefused: boolean;
+    readonly effectEvidenceRecorded: boolean;
+    readonly effectConfirmation: "CONFIRMED" | "UNCONFIRMED";
+    /** The finalization that was recorded carried the provider's effect receipt. */
+    readonly effectReceiptSent: boolean;
+    /**
+     * The authority verified the receipt it was sent: the provider's signature
+     * under a key the organisation registered, describing this grant and this
+     * claim. Only ever true for a finalization that carried one.
+     */
+    readonly effectReceiptVerified: boolean;
+    /** The authority's code for what it found in the receipt, when it was sent one. */
+    readonly effectReceiptVerification: string | null;
+}
 export interface AuthorizationFinalizationInput {
     readonly captured: CapturedIntent;
     readonly decision: GateDecision;
     readonly authorization: VerifiedAuthorization;
     readonly outcome: ExecutionCommitOutcome;
+    /**
+     * Optional observation of the downstream effect, forwarded verbatim. It is
+     * sent only when the signed grant committed to an expected-effect digest, the
+     * evidence names that same digest, and its `execution_correlation_id` equals
+     * the commit correlation id this grant was claimed with. Otherwise it is
+     * dropped, because the authority refuses the entire finalization for evidence
+     * it cannot bind and the commit outcome would be lost with it. It is also
+     * dropped when it does not conform to the contract's own bounded shape.
+     */
+    readonly effectEvidence?: AuthorityEffectEvidence;
+    /**
+     * The provider's signed effect receipt, as it returned it with its answer:
+     * a compact JWS the authority verifies against the keys the organisation
+     * registered and records with the commit evidence. Forwarded verbatim when
+     * it has the shape of a compact JWS and is no longer than the contract
+     * allows; otherwise dropped, because the authority refuses a malformed
+     * body and the commit outcome would be lost with it. It is never a reason
+     * for the authority to refuse a finalization it would otherwise record.
+     */
+    readonly effectReceipt?: string;
 }
 export interface AuthorizationVerifier {
     verifyAndConsume(captured: CapturedIntent, decision: GateDecision): Promise<VerifiedAuthorization | null>;
@@ -32,7 +134,8 @@ export interface AuthorizationVerifier {
 }
 export interface DecionisGrantVerifierOptions {
     readonly baseUrl: string;
-    readonly apiKey: string;
+    /** The Decionis credential, as a value or as a function read at each request. */
+    readonly apiKey: Credential;
     readonly timeoutMs?: number;
     readonly fetch?: typeof fetch;
     readonly allowInsecureLoopback?: boolean;
@@ -50,8 +153,51 @@ export declare class DecionisGrantVerifier implements AuthorizationVerifier {
     private readonly fetchImpl;
     /** Claim material is keyed by the frozen authorization it belongs to and never exposed. */
     private readonly claims;
+    /** The authority's own answer about an observation, keyed by the frozen authorization. */
+    private readonly reports;
+    /**
+     * The digest the authority binds over the action parameters: SHA-256 of
+     * their RFC 8785 canonical form, the same canonicalization the intent hash
+     * uses. Exposed so a test, or an authority implementation, can produce the
+     * value this verifier will accept.
+     */
+    static parametersDigest(parameters: JsonObject): `sha256:${string}`;
     constructor(options: DecionisGrantVerifierOptions);
     verifyAndConsume(captured: CapturedIntent, decision: GateDecision): Promise<VerifiedAuthorization | null>;
     finalize(input: AuthorizationFinalizationInput): Promise<"RECORDED" | "PENDING">;
+    /**
+     * What the authority reported about effect evidence for an authorization this
+     * verifier finalized. `null` until a finalization was recorded. This is the
+     * authority's statement, never this package's inference.
+     */
+    effectReport(authorization: VerifiedAuthorization): AuthorityEffectReport | null;
+    /**
+     * `REFUSED` only for the one status a finalization refusal uses (409); every
+     * other non-ok status, a throw, a timeout, or an oversize body is `PENDING`,
+     * exactly as it was before effect evidence existed. A rate-limited or
+     * unauthenticated authority must never be re-posted to.
+     */
+    private post;
+    /**
+     * Effect evidence reaches the authority only when this executor can prove the
+     * authority will bind it: it must conform to the contract's bounded shape,
+     * the grant the authority returned must have committed to an expected-effect
+     * digest, the evidence must name that exact digest, and it must carry the
+     * correlation id this claim was made with. Unbindable evidence is dropped
+     * rather than sent, because the authority answers it with a 409 that aborts
+     * the whole finalization rather than discarding the observation.
+     *
+     * The checks run against the parsed copy, which is also the copy that is
+     * serialised, so a caller object with accessors cannot present one value to
+     * the drop rule and another to the wire.
+     */
+    private static bindableEffectEvidence;
+    /**
+     * A receipt is forwarded as the provider returned it, and only when it has
+     * the shape the contract accepts: anything else would be refused as a
+     * malformed body, and the commit outcome with it. Its signature and claims
+     * are the authority's to verify; this package reads nothing in it.
+     */
+    private static bindableEffectReceipt;
 }
 //# sourceMappingURL=AuthorizationVerifier.d.ts.map

package/dist/execution/AuthorizationVerifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationVerifier.d.ts","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAE3E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;CAC1C;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CACd,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACnF;AAsDD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqD;gBAEzD,OAAO,EAAE,4BAA4B;IAU3C,gBAAgB,CAC3B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA8E3B,QAAQ,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;CAiC9F"}
+{"version":3,"file":"AuthorizationVerifier.d.ts","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,EACvB,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACnF,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,GAAG,aAAa,CAAC;IACzD,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAC;IAClD;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CACd,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACnF;AAyID,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqD;IAC5E,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+D;IAEvF;;;;;OAKG;WACW,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,MAAM,EAAE;gBAKvD,OAAO,EAAE,4BAA4B;IAU3C,gBAAgB,CAC3B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAsG3B,QAAQ,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAkB7F;;;;OAIG;IACI,YAAY,CAAC,aAAa,EAAE,qBAAqB,GAAG,qBAAqB,GAAG,IAAI;IAIvF;;;;;OAKG;YACW,IAAI;IAyDlB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAerC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;CAKrC"}

package/dist/execution/AuthorizationVerifier.js

@@ -1,5 +1,7 @@
+import { createHash } from "node:crypto";
 import { z } from "zod";
 import { AuthorityBaseUrl } from "../http/AuthorityBaseUrl.js";
+import { credentialReader } from "../http/Credential.js";
 import { BoundedResponseBody } from "../http/BoundedResponseBody.js";
 import { CanonicalIntentHasher } from "../intent/CanonicalIntentHasher.js";
 const boundedIdentifier = z
@@ -7,8 +9,43 @@ const boundedIdentifier = z
     .min(1)
     .max(200)
     .refine(hasNoControlCharacters, { message: "IDENTIFIER_INVALID" });
-const intentHash = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const sha256Digest = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const intentHash = sha256Digest;
 const CLAIM_TOKEN_PATTERN = /^[\w-]{43,128}$/;
+const COMPACT_JWS_PATTERN = /^[\w-]+\.[\w-]+\.[\w-]+$/;
+/** `boundedIdentifier` from the Decionis `EffectEvidence` contract, verbatim. */
+const effectIdentifier = z.string().trim().min(1).max(500);
+/**
+ * The Decionis Protocol 1.1 `EffectEvidence` contract, mirrored so an
+ * observation is bounded before it is serialised onto an authenticated
+ * request. Parsing also takes the snapshot the drop rule then checks, so the
+ * values that are verified are exactly the values that are sent. The
+ * `CONFIRMED` refinements are deliberately not mirrored: whether an
+ * observation qualifies as confirmed is the authority's judgement, not this
+ * package's, and a refusal is recoverable by the evidence-free retry.
+ */
+const EffectEvidenceSchema = z.strictObject({
+    version: z.literal("1.0"),
+    status: z.enum(["CONFIRMED", "UNCONFIRMED"]),
+    observation_method: z.enum([
+        "DOWNSTREAM_ACK",
+        "READ_AFTER_WRITE",
+        "EVENT_CONFIRMATION",
+        "STATE_RECONCILIATION",
+        "SIGNED_RECEIPT",
+        "EXTERNAL_ATTESTATION",
+        "HUMAN_VALIDATION",
+    ]),
+    observer: z
+        .strictObject({ id: effectIdentifier, version: effectIdentifier.nullable() })
+        .nullable(),
+    expected_effect_digest: sha256Digest,
+    observed_effect_digest: sha256Digest.nullable(),
+    observed_at: z.string().datetime().nullable(),
+    evidence_digest: sha256Digest.nullable(),
+    evidence_reference: effectIdentifier.nullable(),
+    execution_correlation_id: effectIdentifier,
+});
 /**
  * Mirrors `ExecutionTokenResponse` and `ExecutionTokenClaims` in the Decionis
  * OpenAPI contract. Claims are declared `additionalProperties: true`, and the
@@ -30,7 +67,27 @@ const ClaimResponseSchema = z.looseObject({
         action: boundedIdentifier,
         decision: z.literal("allow"),
         scope: z.literal("execute"),
-        binding: z.looseObject({ intent_hash: intentHash }),
+        binding: z.looseObject({
+            intent_hash: intentHash,
+            // An authority that stores no commitment may omit the property, serialise
+            // its nullable column as `null`, or emit something this package does not
+            // recognise. All three mean "no commitment this executor can read", and
+            // all three must behave exactly as they did before this property existed,
+            // when the loose envelope passed the value through untouched. Reading an
+            // unrecognised value as absent keeps that promise and stays fail-closed:
+            // an intent that committed a digest still finds no match and is refused.
+            expected_effect_digest: sha256Digest.nullish().catch(undefined),
+            // The same rule for the payload digest and its profile: unreadable is
+            // absent, and absent means no comparison, which is what an authority
+            // that never bound one has always meant.
+            execution_payload_digest: sha256Digest.nullish().catch(undefined),
+            execution_payload_canonicalization_profile: z
+                .string()
+                .min(1)
+                .max(200)
+                .nullish()
+                .catch(undefined),
+        }),
         jti: boundedIdentifier,
         iat: z.number().int(),
         nbf: z.number().int(),
@@ -38,11 +95,34 @@ const ClaimResponseSchema = z.looseObject({
     }),
     claim_token: z.string().regex(CLAIM_TOKEN_PATTERN).nullable().optional(),
     claim_lease_expires_at: z.string().datetime().nullable().optional(),
+    // A compact JWS or nothing. This package never verifies it: it is not the
+    // audience, the downstream is. An unreadable value is treated as absent
+    // rather than refused, because the grant it rides with is what authorizes.
+    claim_attestation: z.string().regex(COMPACT_JWS_PATTERN).max(8_192).nullish().catch(undefined),
 });
+/** The canonicalization this package can reproduce, named the way the authority names it. */
+const JCS_PROFILE = "RFC8785/JCS";
+/**
+ * The response envelope is deliberately loose, and the two effect fields are
+ * reporting-only: a value outside their contract must never turn a recorded
+ * finalization into `PENDING` for a consumer using none of this. Anything
+ * unrecognised reads as absent, which reports closed.
+ */
 const FinalizeResponseSchema = z.looseObject({
     finalized: z.boolean(),
     reason_codes: z.array(boundedIdentifier).max(50).optional(),
+    effect_evidence_recorded: z.boolean().optional().catch(undefined),
+    effect_confirmation: z.enum(["CONFIRMED", "UNCONFIRMED"]).optional().catch(undefined),
+    effect_receipt: z
+        .looseObject({
+        verified: z.boolean(),
+        verification_code: boundedIdentifier.nullable().optional().catch(undefined),
+    })
+        .optional()
+        .catch(undefined),
 });
+/** The contract's bound on a forwarded receipt: three base64url segments, at most this long. */
+const MAX_RECEIPT_LENGTH = 20_000;
 const MAX_RESPONSE_BYTES = 100 * 1024;
 /**
  * Claims a Decionis execution grant through `/v1/execution/claim-token`
@@ -57,9 +137,21 @@ export class DecionisGrantVerifier {
     fetchImpl;
     /** Claim material is keyed by the frozen authorization it belongs to and never exposed. */
     claims = new WeakMap();
+    /** The authority's own answer about an observation, keyed by the frozen authorization. */
+    reports = new WeakMap();
+    /**
+     * The digest the authority binds over the action parameters: SHA-256 of
+     * their RFC 8785 canonical form, the same canonicalization the intent hash
+     * uses. Exposed so a test, or an authority implementation, can produce the
+     * value this verifier will accept.
+     */
+    static parametersDigest(parameters) {
+        const canonical = CanonicalIntentHasher.stringify(parameters);
+        return `sha256:${createHash("sha256").update(canonical, "utf8").digest("hex")}`;
+    }
     constructor(options) {
         this.baseUrl = AuthorityBaseUrl.normalize(options.baseUrl, options.allowInsecureLoopback === true);
-        this.apiKey = options.apiKey;
+        this.apiKey = credentialReader(options.apiKey);
         this.timeoutMs = Math.min(Math.max(options.timeoutMs ?? 4_000, 1), 15_000);
         this.fetchImpl = options.fetch ?? fetch;
     }
@@ -78,7 +170,7 @@ export class DecionisGrantVerifier {
             const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/claim-token`, {
                 method: "POST",
                 headers: {
-                    authorization: `Bearer ${this.apiKey}`,
+                    authorization: `Bearer ${this.apiKey()}`,
                     "content-type": "application/json",
                 },
                 body: JSON.stringify({
@@ -100,12 +192,25 @@ export class DecionisGrantVerifier {
                 return null;
             const parsed = ClaimResponseSchema.parse(JSON.parse(text));
             const claims = parsed.claims;
+            /** A `null` commitment is no commitment, exactly as an absent one is. */
+            const committedEffectDigest = claims.binding.expected_effect_digest ?? undefined;
             const claimExpiryMs = claims.exp * 1_000;
             const decisionExpirySeconds = Math.floor(Date.parse(decision.authorization.expiresAt) / 1_000);
             const audience = `${captured.intent.downstreamTarget.system}:${captured.intent.downstreamTarget.operation}`;
+            // When the authority says which digest it bound over the parameters,
+            // it must be the digest of the parameters this process captured, under
+            // a canonicalization this process can reproduce. A digest under a
+            // profile this package cannot compute is not "probably fine": it is a
+            // claim about the payload that cannot be checked, and is refused.
+            const payloadDigest = claims.binding.execution_payload_digest ?? undefined;
+            const payloadDigestDisagrees = payloadDigest !== undefined &&
+                (claims.binding.execution_payload_canonicalization_profile !== JCS_PROFILE ||
+                    payloadDigest !== DecionisGrantVerifier.parametersDigest(captured.intent.parameters));
             if (parsed.should_execute === false ||
                 typeof parsed.claim_token !== "string" ||
                 claims.binding.intent_hash !== captured.intentHash ||
+                committedEffectDigest !== captured.intent.expectedEffectDigest ||
+                payloadDigestDisagrees ||
                 claims.decision_id !== decision.decisionId ||
                 claims.dossier_id !== decision.dossierId ||
                 claims.org_id !== captured.intent.tenantId ||
@@ -117,17 +222,27 @@ export class DecionisGrantVerifier {
                 claimExpiryMs > Date.parse(captured.intent.expiresAt)) {
                 return null;
             }
+            // The lease the authority named for this claim, when it named one. It
+            // is reported rather than enforced here: what a caller does with a
+            // window is the caller's decision, and the grant's own expiry is
+            // already the outer bound this verifier checked above.
+            const lease = parsed.claim_lease_expires_at;
+            const attestation = parsed.claim_attestation ?? undefined;
             const authorization = Object.freeze({
                 decisionId: claims.decision_id,
                 dossierId: claims.dossier_id,
                 grantId: claims.jti,
                 intentHash: claims.binding.intent_hash,
                 expiresAt: new Date(claims.exp * 1_000).toISOString(),
+                ...(typeof lease === "string" ? { leaseExpiresAt: lease } : {}),
+                ...(payloadDigest === undefined ? {} : { payloadDigest }),
+                ...(attestation === undefined ? {} : { claimAttestation: attestation }),
             });
             this.claims.set(authorization, {
                 executionToken: decision.authorization.token,
                 claimToken: parsed.claim_token,
                 commitCorrelationId,
+                expectedEffectDigest: committedEffectDigest,
             });
             return authorization;
         }
@@ -142,13 +257,44 @@ export class DecionisGrantVerifier {
         const claim = this.claims.get(input.authorization);
         if (claim === undefined)
             return "PENDING";
+        const evidence = DecionisGrantVerifier.bindableEffectEvidence(input, claim);
+        const receipt = DecionisGrantVerifier.bindableEffectReceipt(input);
+        const first = await this.post(input, claim, evidence, receipt, false);
+        if (first === "RECORDED")
+            return "RECORDED";
+        if (first === "PENDING" || evidence === undefined)
+            return "PENDING";
+        // The authority answered with the one status an effect refusal uses, and
+        // every effect rejection precedes the commit transition, so the commit
+        // record is still recoverable by reporting the same outcome without the
+        // observation. This retries no side effect and sends nothing it has not
+        // already sent: the second body is the first without the observation.
+        // The receipt stays, because the authority never refuses for a receipt.
+        const second = await this.post(input, claim, undefined, receipt, true);
+        return second === "RECORDED" ? "RECORDED" : "PENDING";
+    }
+    /**
+     * What the authority reported about effect evidence for an authorization this
+     * verifier finalized. `null` until a finalization was recorded. This is the
+     * authority's statement, never this package's inference.
+     */
+    effectReport(authorization) {
+        return this.reports.get(authorization) ?? null;
+    }
+    /**
+     * `REFUSED` only for the one status a finalization refusal uses (409); every
+     * other non-ok status, a throw, a timeout, or an oversize body is `PENDING`,
+     * exactly as it was before effect evidence existed. A rate-limited or
+     * unauthenticated authority must never be re-posted to.
+     */
+    async post(input, claim, evidence, receipt, evidenceRefused) {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
         try {
             const response = await this.fetchImpl(`${this.baseUrl}/v1/execution/finalize-token`, {
                 method: "POST",
                 headers: {
-                    authorization: `Bearer ${this.apiKey}`,
+                    authorization: `Bearer ${this.apiKey()}`,
                     "content-type": "application/json",
                 },
                 body: JSON.stringify({
@@ -156,17 +302,35 @@ export class DecionisGrantVerifier {
                     claim_token: claim.claimToken,
                     outcome: input.outcome,
                     commit_correlation_id: claim.commitCorrelationId,
+                    ...(evidence === undefined ? {} : { effect_evidence: evidence }),
+                    ...(receipt === undefined ? {} : { effect_receipt: receipt }),
                 }),
                 signal: controller.signal,
             });
             if (!response.ok)
-                return "PENDING";
+                return response.status === 409 ? "REFUSED" : "PENDING";
             const text = await BoundedResponseBody.read(response, MAX_RESPONSE_BYTES);
             if (text === null)
                 return "PENDING";
             const parsed = FinalizeResponseSchema.parse(JSON.parse(text));
             if (!parsed.finalized)
                 return "PENDING";
+            // The authority's answer about an observation is only meaningful for a
+            // finalization that carried one. What was not sent cannot have been
+            // recorded, whatever the response says.
+            const sent = evidence !== undefined;
+            const receiptSent = receipt !== undefined;
+            this.reports.set(input.authorization, {
+                effectEvidenceSent: sent,
+                effectEvidenceRefused: evidenceRefused,
+                effectEvidenceRecorded: sent && parsed.effect_evidence_recorded === true,
+                effectConfirmation: sent && parsed.effect_confirmation === "CONFIRMED" ? "CONFIRMED" : "UNCONFIRMED",
+                effectReceiptSent: receiptSent,
+                effectReceiptVerified: receiptSent && parsed.effect_receipt?.verified === true,
+                effectReceiptVerification: receiptSent
+                    ? (parsed.effect_receipt?.verification_code ?? null)
+                    : null,
+            });
             this.claims.delete(input.authorization);
             return "RECORDED";
         }
@@ -177,6 +341,45 @@ export class DecionisGrantVerifier {
             clearTimeout(timeout);
         }
     }
+    /**
+     * Effect evidence reaches the authority only when this executor can prove the
+     * authority will bind it: it must conform to the contract's bounded shape,
+     * the grant the authority returned must have committed to an expected-effect
+     * digest, the evidence must name that exact digest, and it must carry the
+     * correlation id this claim was made with. Unbindable evidence is dropped
+     * rather than sent, because the authority answers it with a 409 that aborts
+     * the whole finalization rather than discarding the observation.
+     *
+     * The checks run against the parsed copy, which is also the copy that is
+     * serialised, so a caller object with accessors cannot present one value to
+     * the drop rule and another to the wire.
+     */
+    static bindableEffectEvidence(input, claim) {
+        if (input.effectEvidence === undefined || claim.expectedEffectDigest === undefined) {
+            return undefined;
+        }
+        const parsed = EffectEvidenceSchema.safeParse(input.effectEvidence);
+        if (!parsed.success)
+            return undefined;
+        const evidence = parsed.data;
+        if (evidence.expected_effect_digest !== claim.expectedEffectDigest)
+            return undefined;
+        if (evidence.execution_correlation_id !== claim.commitCorrelationId)
+            return undefined;
+        return Object.freeze(evidence);
+    }
+    /**
+     * A receipt is forwarded as the provider returned it, and only when it has
+     * the shape the contract accepts: anything else would be refused as a
+     * malformed body, and the commit outcome with it. Its signature and claims
+     * are the authority's to verify; this package reads nothing in it.
+     */
+    static bindableEffectReceipt(input) {
+        const receipt = input.effectReceipt;
+        if (typeof receipt !== "string" || receipt.length > MAX_RECEIPT_LENGTH)
+            return undefined;
+        return COMPACT_JWS_PATTERN.test(receipt) ? receipt : undefined;
+    }
 }
 function hasNoControlCharacters(value) {
     for (let index = 0; index < value.length; index += 1) {

package/dist/execution/AuthorizationVerifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AA0C3E,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC7D,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC;QACpB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;QACnD,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAgBtC;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAS;IACf,SAAS,CAAS;IAClB,SAAS,CAAe;IACzC,2FAA2F;IAC1E,MAAM,GAAG,IAAI,OAAO,EAAsC,CAAC;IAE5E,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,2BAA2B,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,qEAAqE;oBACrE,uDAAuD;oBACvD,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBAC3E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACrC,qBAAqB,EAAE,mBAAmB;iBAC3C,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YACzC,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC5G,IACE,MAAM,CAAC,cAAc,KAAK,KAAK;gBAC/B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAClD,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAC1C,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBACxC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAC1C,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACvC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;gBACxC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;gBACrD,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBACpC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,aAAa,GAA0B,MAAM,CAAC,MAAM,CAAC;gBACzD,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;gBACtC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;aACtD,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC7B,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;gBAC5C,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,mBAAmB;aACpB,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAqC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAAE;gBACnF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,WAAW,EAAE,KAAK,CAAC,UAAU;oBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;iBACjD,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"AuthorizationVerifier.js","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAqJ3E,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,YAAY,CAAC;AAChC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE3D;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5C,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC;QACzB,gBAAgB;QAChB,kBAAkB;QAClB,oBAAoB;QACpB,sBAAsB;QACtB,gBAAgB;QAChB,sBAAsB;QACtB,kBAAkB;KACnB,CAAC;IACF,QAAQ,EAAE,CAAC;SACR,YAAY,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC5E,QAAQ,EAAE;IACb,sBAAsB,EAAE,YAAY;IACpC,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,eAAe,EAAE,YAAY,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAC/C,wBAAwB,EAAE,gBAAgB;CAC3C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC;QACpB,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;QACzB,UAAU,EAAE,iBAAiB;QAC7B,WAAW,EAAE,iBAAiB;QAC9B,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC;YACrB,WAAW,EAAE,UAAU;YACvB,0EAA0E;YAC1E,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,yEAAyE;YACzE,sBAAsB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/D,sEAAsE;YACtE,qEAAqE;YACrE,yCAAyC;YACzC,wBAAwB,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YACjE,0CAA0C,EAAE,CAAC;iBAC1C,MAAM,EAAE;iBACR,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,GAAG,CAAC;iBACR,OAAO,EAAE;iBACT,KAAK,CAAC,SAAS,CAAC;SACpB,CAAC;QACF,GAAG,EAAE,iBAAiB;QACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACrB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KACjC,CAAC;IACF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnE,0EAA0E;IAC1E,wEAAwE;IACxE,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAC/F,CAAC,CAAC;AAEH,6FAA6F;AAC7F,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACjE,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACrF,cAAc,EAAE,CAAC;SACd,WAAW,CAAC;QACX,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,iBAAiB,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;KAC5E,CAAC;SACD,QAAQ,EAAE;SACV,KAAK,CAAC,SAAS,CAAC;CACpB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC;AAmBtC;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACf,OAAO,CAAS;IAChB,MAAM,CAAe;IACrB,SAAS,CAAS;IAClB,SAAS,CAAe;IACzC,2FAA2F;IAC1E,MAAM,GAAG,IAAI,OAAO,EAAsC,CAAC;IAC5E,0FAA0F;IACzE,OAAO,GAAG,IAAI,OAAO,EAAgD,CAAC;IAEvF;;;;;OAKG;IACI,MAAM,CAAC,gBAAgB,CAAC,UAAsB;QACnD,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAuB,CAAC,CAAC;QAC3E,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,YAAmB,OAAqC;QACtD,IAAI,CAAC,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACvC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC1C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAC3B,QAAwB,EACxB,QAAsB;QAEtB,IACE,QAAQ,CAAC,OAAO,KAAK,OAAO;YAC5B,QAAQ,CAAC,UAAU;YACnB,QAAQ,CAAC,aAAa,KAAK,IAAI;YAC/B,QAAQ,CAAC,SAAS,KAAK,IAAI;YAC3B,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAC3C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,2BAA2B,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;oBAC7C,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACxD,qEAAqE;oBACrE,uDAAuD;oBACvD,GAAG,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBAC3E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACrC,qBAAqB,EAAE,mBAAmB;iBAC3C,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC7B,yEAAyE;YACzE,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,SAAS,CAAC;YACjF,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC;YACzC,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,KAAK,CACrD,CAAC;YACF,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC;YAC5G,qEAAqE;YACrE,uEAAuE;YACvE,kEAAkE;YAClE,sEAAsE;YACtE,kEAAkE;YAClE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,IAAI,SAAS,CAAC;YAC3E,MAAM,sBAAsB,GAC1B,aAAa,KAAK,SAAS;gBAC3B,CAAC,MAAM,CAAC,OAAO,CAAC,0CAA0C,KAAK,WAAW;oBACxE,aAAa,KAAK,qBAAqB,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1F,IACE,MAAM,CAAC,cAAc,KAAK,KAAK;gBAC/B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;gBACtC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAClD,qBAAqB,KAAK,QAAQ,CAAC,MAAM,CAAC,oBAAoB;gBAC9D,sBAAsB;gBACtB,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,UAAU;gBAC1C,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,SAAS;gBACxC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAC1C,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACvC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM;gBACxC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC;gBACrD,MAAM,CAAC,GAAG,KAAK,qBAAqB;gBACpC,aAAa,IAAI,IAAI,CAAC,GAAG,EAAE;gBAC3B,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,sEAAsE;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,uDAAuD;YACvD,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,CAAC;YAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,iBAAiB,IAAI,SAAS,CAAC;YAC1D,MAAM,aAAa,GAA0B,MAAM,CAAC,MAAM,CAAC;gBACzD,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;gBACtC,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;gBACrD,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;gBACzD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC;aACxE,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE;gBAC7B,cAAc,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK;gBAC5C,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,mBAAmB;gBACnB,oBAAoB,EAAE,qBAAqB;aAC5C,CAAC,CAAC;YACH,OAAO,aAAa,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,QAAQ,CAAC,KAAqC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,qBAAqB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACpE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACvE,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACI,YAAY,CAAC,aAAoC;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,IAAI,CAChB,KAAqC,EACrC,KAAkB,EAClB,QAA6C,EAC7C,OAA2B,EAC3B,eAAwB;QAExB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,8BAA8B,EAAE;gBACnF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,eAAe,EAAE,KAAK,CAAC,cAAc;oBACrC,WAAW,EAAE,KAAK,CAAC,UAAU;oBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;oBAChD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;oBAChE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;iBAC9D,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;YAC1E,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACpC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxC,uEAAuE;YACvE,oEAAoE;YACpE,wCAAwC;YACxC,MAAM,IAAI,GAAG,QAAQ,KAAK,SAAS,CAAC;YACpC,MAAM,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE;gBACpC,kBAAkB,EAAE,IAAI;gBACxB,qBAAqB,EAAE,eAAe;gBACtC,sBAAsB,EAAE,IAAI,IAAI,MAAM,CAAC,wBAAwB,KAAK,IAAI;gBACxE,kBAAkB,EAChB,IAAI,IAAI,MAAM,CAAC,mBAAmB,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa;gBAClF,iBAAiB,EAAE,WAAW;gBAC9B,qBAAqB,EAAE,WAAW,IAAI,MAAM,CAAC,cAAc,EAAE,QAAQ,KAAK,IAAI;gBAC9E,yBAAyB,EAAE,WAAW;oBACpC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,IAAI,IAAI,CAAC;oBACpD,CAAC,CAAC,IAAI;aACT,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,MAAM,CAAC,sBAAsB,CACnC,KAAqC,EACrC,KAAkB;QAElB,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YACnF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,QAAQ,GAA4B,MAAM,CAAC,IAAI,CAAC;QACtD,IAAI,QAAQ,CAAC,sBAAsB,KAAK,KAAK,CAAC,oBAAoB;YAAE,OAAO,SAAS,CAAC;QACrF,IAAI,QAAQ,CAAC,wBAAwB,KAAK,KAAK,CAAC,mBAAmB;YAAE,OAAO,SAAS,CAAC;QACtF,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,qBAAqB,CAAC,KAAqC;QACxE,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,kBAAkB;YAAE,OAAO,SAAS,CAAC;QACzF,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;CACF;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/execution/SafeExecutor.d.ts

@@ -5,8 +5,19 @@ import type { ActionRegistry } from "./ActionRegistry.js";
 import type { AuthorizationVerifier, ExecutionFinalization, VerifiedAuthorization } from "./AuthorizationVerifier.js";
 export type ExecutionBlockReason = "DECISION_NOT_AUTHORITATIVE" | "DECISION_NOT_ALLOW" | "INTENT_BINDING_MISMATCH" | "INTENT_CONFORMANCE_FAILED" | "AUTHORIZATION_MISSING" | "AUTHORIZATION_INVALID" | "RECOVERY_BINDING_MISMATCH" | "AUDIT_UNAVAILABLE";
 export type ExecutionPreDispatchFailureReason = "HANDLER_FAILED_BEFORE_DISPATCH" | "AUDIT_UNAVAILABLE";
-export interface ExecutionRecoveryReference extends VerifiedAuthorization {
+/**
+ * What a caller presents back to reconcile an attempt whose outcome was
+ * lost. The fields are listed rather than inherited, because this is a
+ * versioned wire object: a field that appears on `VerifiedAuthorization`
+ * later must be added here deliberately or not at all.
+ */
+export interface ExecutionRecoveryReference {
     readonly version: "agent-safe.recovery/1";
+    readonly decisionId: string;
+    readonly dossierId: string;
+    readonly grantId: string;
+    readonly intentHash: string;
+    readonly expiresAt: string;
     readonly idempotencyKey: string;
 }
 export interface ExecutionBlockedResult {
@@ -16,6 +27,23 @@ export interface ExecutionBlockedResult {
     readonly result: null;
     readonly authorization: null;
 }
+/**
+ * The provider refused, definitively, after the dispatch boundary. The grant
+ * was consumed and the request was sent, and nothing was effected: the
+ * outcome is a fact, not an unknown, so there is nothing to reconcile and no
+ * recovery reference to present. A caller that wants the action after all
+ * needs a fresh decision and a fresh grant, because the refusal was about
+ * this attempt.
+ */
+export interface ProviderRefusedResult {
+    readonly outcome: "DEFINITELY_NOT_EXECUTED";
+    readonly executed: false;
+    readonly recovered: false;
+    /** The provider's own reason, as the handler reported it. */
+    readonly reason: string;
+    readonly result: null;
+    readonly authorization: VerifiedAuthorization;
+}
 export interface ProviderOutcomeUnknownResult {
     readonly outcome: "UNKNOWN_AFTER_DISPATCH";
     readonly executed: null;
@@ -43,7 +71,9 @@ export type SafeExecutionResult<TResult = unknown> = {
     readonly result: null;
     readonly authorization: VerifiedAuthorization;
     readonly finalization: ExecutionFinalization;
-} | (ProviderOutcomeUnknownResult & {
+} | (ProviderRefusedResult & {
+    readonly finalization: ExecutionFinalization;
+}) | (ProviderOutcomeUnknownResult & {
     readonly finalization: ExecutionFinalization;
 });
 export type ExecutionReconciliationResult<TResult = unknown> = {
@@ -68,7 +98,8 @@ export declare class SafeExecutor {
     constructor(registry: ActionRegistry, verifier: AuthorizationVerifier, audit?: AuditRecorder | undefined);
     run<TResult = unknown>(captured: CapturedIntent, decision: GateDecision): Promise<SafeExecutionResult<TResult>>;
     /**
-     * Reports the attempt outcome to the verifier's authority. A missing,
+     * Reports the attempt outcome to the verifier's authority, with the
+     * provider's effect receipt when the attempt brought one back. A missing,
      * failing, or malformed finalization can never alter the execution result.
      */
     private finalize;