@decionis/agent-safe-pipeline 0.1.4 → 0.3.0

package/dist/report/DecisionReport.js

@@ -0,0 +1,37 @@
+/**
+ * Prints what Decionis said about a decision, when it was asked. A decision
+ * with no `hosted` evaluation prints nothing, so a caller that never set a
+ * key sees exactly the output it saw before.
+ *
+ * The verify lines name the record by identifier only. The page, when the
+ * authority attached one, verifies it for anyone who opens it; the command
+ * needs the signed record, fetched with the caller's key, and the public
+ * JWKS, fetched by anyone; the signature check itself runs offline and needs
+ * no account.
+ */
+export function printDecision(decision, options = {}) {
+    const hosted = decision.hosted;
+    if (hosted === undefined)
+        return;
+    const out = options.out ?? process.stdout;
+    const verifyCommand = options.verifyCommand ?? ((dossierId) => `pnpm decionis:verify ${dossierId}`);
+    out.write(`verdict: ${decision.verdict}\n`);
+    out.write(`decionis: ${hosted.verdict} (${hosted.mode}, ${standing(hosted)})\n`);
+    for (const code of hosted.reasonCodes)
+        out.write(`  - ${code}\n`);
+    if (hosted.dossierId === null) {
+        out.write("dossier: none\n");
+        return;
+    }
+    out.write(`dossier: ${hosted.dossierId}\n`);
+    if (hosted.verificationUrl !== null) {
+        out.write(`verify it in a browser, no account needed: ${hosted.verificationUrl}\n`);
+    }
+    out.write(`verify it yourself, no account needed: ${verifyCommand(hosted.dossierId)}\n`);
+}
+function standing(hosted) {
+    if (hosted.failClosed)
+        return "failed closed";
+    return hosted.governs ? "governs" : "recorded beside the local verdict";
+}
+//# sourceMappingURL=DecisionReport.js.map

package/dist/report/DecisionReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DecisionReport.js","sourceRoot":"","sources":["../../src/report/DecisionReport.ts"],"names":[],"mappings":"AASA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,QAAsB,EAAE,UAAiC,EAAE;IACvF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,aAAa,GACjB,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;IAEhG,GAAG,CAAC,KAAK,CAAC,YAAY,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACpC,GAAG,CAAC,KAAK,CAAC,8CAA8C,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;IACtF,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,0CAA0C,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,QAAQ,CAAC,MAAwB;IACxC,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,eAAe,CAAC;IAC9C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC;AAC1E,CAAC"}

package/dist/report/DossierReport.d.ts

@@ -0,0 +1,43 @@
+import { type ClientSource } from "../http/ClientIdentification.js";
+export interface DossierFetchOptions {
+    readonly baseUrl: string;
+    readonly apiKey: string;
+    readonly tenantId: string;
+    readonly dossierId: string;
+    readonly allowInsecureLoopback?: boolean;
+    readonly fetch?: typeof fetch;
+    readonly timeoutMs?: number;
+    readonly source?: ClientSource;
+}
+/** What the proof bundle says about the record, for a person to read. */
+export interface SignedDossierSummary {
+    readonly dossierId: string;
+    readonly outcome: string | null;
+    readonly generatedAt: string | null;
+    readonly algorithm: string | null;
+    readonly keyId: string | null;
+    readonly issuedAt: string | null;
+    readonly artifacts: number;
+    /** The issuer tier the record carries, `provisional_anonymous` for a workspace without an account. */
+    readonly issuerTier: string | null;
+    readonly bytes: number;
+}
+export declare class DossierFetchError extends Error {
+    readonly code: "DOSSIER_UNAVAILABLE" | "DOSSIER_REFUSED" | "DOSSIER_NOT_FOUND" | "DOSSIER_RESPONSE_INVALID" | "DOSSIER_TIMED_OUT";
+    readonly status: number | null;
+    constructor(code: "DOSSIER_UNAVAILABLE" | "DOSSIER_REFUSED" | "DOSSIER_NOT_FOUND" | "DOSSIER_RESPONSE_INVALID" | "DOSSIER_TIMED_OUT", status: number | null);
+}
+/** The summary of one `GET /v1/protocol/dossiers/{id}` body; null when it holds no signed payload. */
+export declare function summarizeDossier(body: unknown, bytes: number): SignedDossierSummary | null;
+/** Fetches the signed record with the caller's key and summarizes its proof. */
+export declare function fetchSignedDossier(options: DossierFetchOptions): Promise<{
+    readonly summary: SignedDossierSummary;
+    readonly body: unknown;
+}>;
+/** The signed record, in three lines a person can read. */
+export declare function printSignedDossier(summary: SignedDossierSummary, options?: {
+    readonly out?: {
+        write(chunk: string): unknown;
+    };
+}): void;
+//# sourceMappingURL=DossierReport.d.ts.map

package/dist/report/DossierReport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DossierReport.d.ts","sourceRoot":"","sources":["../../src/report/DossierReport.ts"],"names":[],"mappings":"AAYA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAE/E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sGAAsG;IACtG,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,iBAAkB,SAAQ,KAAK;aAExB,IAAI,EAChB,qBAAqB,GACrB,iBAAiB,GACjB,mBAAmB,GACnB,0BAA0B,GAC1B,mBAAmB;aACP,MAAM,EAAE,MAAM,GAAG,IAAI;gBANrB,IAAI,EAChB,qBAAqB,GACrB,iBAAiB,GACjB,mBAAmB,GACnB,0BAA0B,GAC1B,mBAAmB,EACP,MAAM,EAAE,MAAM,GAAG,IAAI;CAKxC;AAmBD,sGAAsG;AACtG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,IAAI,CAqB1F;AAED,gFAAgF;AAChF,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC,CAwD7E;AAED,2DAA2D;AAC3D,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAA;CAAO,GACjE,IAAI,CAaN"}

package/dist/report/DossierReport.js

@@ -0,0 +1,130 @@
+/**
+ * The signed record itself, at the end of a run. `enforce-and-bind` names
+ * the Decision Dossier it left; this fetches that record with the caller's
+ * key from `GET /v1/protocol/dossiers/{id}`, reads the proof bundle it
+ * carries, and prints what a person needs to know it is signed: the
+ * algorithm, the key, when it was issued, how many artifacts it covers and
+ * under which issuer tier. The signature check itself is `@decionis/verify`'s
+ * (the `decionis:verify` script, or the public page); this shows the proof,
+ * it does not re-implement it.
+ */
+import { AuthorityBaseUrl } from "../http/AuthorityBaseUrl.js";
+import { BoundedResponseBody } from "../http/BoundedResponseBody.js";
+import { userAgent } from "../http/ClientIdentification.js";
+export class DossierFetchError extends Error {
+    code;
+    status;
+    constructor(code, status) {
+        super(code);
+        this.code = code;
+        this.status = status;
+        this.name = "DossierFetchError";
+    }
+}
+/** A signed record with its inputs snapshot can be large; the reader's own bound. */
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DOSSIER_ID_PATTERN = /^[\w-]{1,200}$/;
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : null;
+}
+function text(value) {
+    return typeof value === "string" && value.length > 0 && value.length <= 500 ? value : null;
+}
+/** The summary of one `GET /v1/protocol/dossiers/{id}` body; null when it holds no signed payload. */
+export function summarizeDossier(body, bytes) {
+    const payload = record(record(record(body)?.["dossier"])?.["dossier_payload"]);
+    if (payload === null)
+        return null;
+    const dossierId = text(payload["dossier_id"]);
+    if (dossierId === null)
+        return null;
+    const routing = record(payload["routing_decision"]);
+    const bundle = record(record(payload["integrity"])?.["proof_bundle"]);
+    const artifacts = bundle?.["artifacts"];
+    const portable = record(payload["portable_artifact"]);
+    const issuer = record(portable?.["issuer_context"]) ?? record(payload["issuer_context"]) ?? null;
+    return {
+        dossierId,
+        outcome: text(routing?.["outcome"]),
+        generatedAt: text(payload["generated_at"]),
+        algorithm: text(bundle?.["algorithm"]),
+        keyId: text(bundle?.["key_id"]),
+        issuedAt: text(bundle?.["issued_at"]),
+        artifacts: Array.isArray(artifacts) ? artifacts.length : 0,
+        issuerTier: text(issuer?.["tier"]),
+        bytes,
+    };
+}
+/** Fetches the signed record with the caller's key and summarizes its proof. */
+export async function fetchSignedDossier(options) {
+    if (!DOSSIER_ID_PATTERN.test(options.dossierId)) {
+        throw new DossierFetchError("DOSSIER_RESPONSE_INVALID", null);
+    }
+    const baseUrl = AuthorityBaseUrl.normalize(options.baseUrl, options.allowInsecureLoopback ?? false);
+    const url = `${baseUrl}/v1/protocol/dossiers/${encodeURIComponent(options.dossierId)}?org_id=${encodeURIComponent(options.tenantId)}`;
+    const doFetch = options.fetch ?? fetch;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    let response;
+    try {
+        response = await doFetch(url, {
+            method: "GET",
+            headers: {
+                accept: "application/json",
+                authorization: `Bearer ${options.apiKey}`,
+                "user-agent": userAgent(options.source),
+            },
+            redirect: "error",
+            signal: controller.signal,
+        });
+    }
+    catch {
+        clearTimeout(timer);
+        throw new DossierFetchError(controller.signal.aborted ? "DOSSIER_TIMED_OUT" : "DOSSIER_UNAVAILABLE", null);
+    }
+    let raw;
+    try {
+        raw = await BoundedResponseBody.read(response, MAX_RESPONSE_BYTES);
+    }
+    catch {
+        raw = null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (response.status === 404)
+        throw new DossierFetchError("DOSSIER_NOT_FOUND", 404);
+    if (response.status === 401 || response.status === 403) {
+        throw new DossierFetchError("DOSSIER_REFUSED", response.status);
+    }
+    if (response.status >= 500)
+        throw new DossierFetchError("DOSSIER_UNAVAILABLE", response.status);
+    if (response.status !== 200 || raw === null) {
+        throw new DossierFetchError("DOSSIER_RESPONSE_INVALID", response.status);
+    }
+    let body;
+    try {
+        body = JSON.parse(raw);
+    }
+    catch {
+        throw new DossierFetchError("DOSSIER_RESPONSE_INVALID", response.status);
+    }
+    const summary = summarizeDossier(body, Buffer.byteLength(raw, "utf8"));
+    if (summary === null)
+        throw new DossierFetchError("DOSSIER_RESPONSE_INVALID", response.status);
+    return { summary, body };
+}
+/** The signed record, in three lines a person can read. */
+export function printSignedDossier(summary, options = {}) {
+    const out = options.out ?? process.stdout;
+    const signed = summary.keyId === null
+        ? "unsigned record"
+        : `${summary.algorithm ?? "signed"} by key ${summary.keyId}${summary.issuedAt === null ? "" : ` at ${summary.issuedAt}`}`;
+    out.write(`signed dossier: ${summary.dossierId} (${String(summary.bytes)} bytes${summary.outcome === null ? "" : `, ${summary.outcome}`})\n`);
+    out.write(`  ${signed}, ${String(summary.artifacts)} signed artifact(s)\n`);
+    out.write(`  issuer: ${summary.issuerTier ?? "not stated"}${summary.issuerTier === "provisional_anonymous" ? " (a workspace without an account; claim it to keep it)" : ""}\n`);
+}
+//# sourceMappingURL=DossierReport.js.map

package/dist/report/DossierReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DossierReport.js","sourceRoot":"","sources":["../../src/report/DossierReport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAqB,MAAM,iCAAiC,CAAC;AA2B/E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAExB;IAMA;IAPlB,YACkB,IAKO,EACP,MAAqB;QAErC,KAAK,CAAC,IAAI,CAAC,CAAC;QARI,SAAI,GAAJ,IAAI,CAKG;QACP,WAAM,GAAN,MAAM,CAAe;QAGrC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,qFAAqF;AACrF,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAI5C,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAc;QACjB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7F,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,gBAAgB,CAAC,IAAa,EAAE,KAAa;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,gBAAgB,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,IAAI,CAAC;IACjG,OAAO;QACL,SAAS;QACT,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACnC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;QACtC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC/B,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;QACrC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK;KACN,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA4B;IAE5B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CACxC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,IAAI,KAAK,CACvC,CAAC;IACF,MAAM,GAAG,GAAG,GAAG,OAAO,yBAAyB,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,kBAAkB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtI,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAC5F,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE;gBACzC,YAAY,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;aACxC;YACD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,iBAAiB,CACzB,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,EACvE,IAAI,CACL,CAAC;IACJ,CAAC;IACD,IAAI,GAAkB,CAAC;IACvB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,IAAI;QAAE,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,kBAAkB,CAChC,OAA6B,EAC7B,UAAgE,EAAE;IAElE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,MAAM,MAAM,GACV,OAAO,CAAC,KAAK,KAAK,IAAI;QACpB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,WAAW,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC9H,GAAG,CAAC,KAAK,CACP,mBAAmB,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,KAAK,CACnI,CAAC;IACF,GAAG,CAAC,KAAK,CAAC,KAAK,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC5E,GAAG,CAAC,KAAK,CACP,aAAa,OAAO,CAAC,UAAU,IAAI,YAAY,GAAG,OAAO,CAAC,UAAU,KAAK,uBAAuB,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,EAAE,IAAI,CACrK,CAAC;AACJ,CAAC"}

package/dist/report/HostedOutcome.d.ts

@@ -0,0 +1,18 @@
+/**
+ * How an example ends. A local run ends with its verdict and one line that
+ * says what the hosted path adds. A hosted run ends with what Decionis
+ * decided, the Decision Dossier it left, the page that verifies it (when
+ * the authority attached one), the command that verifies it offline, and
+ * the signed record itself, fetched with the run's own key and shown by its
+ * proof: the thing the local path cannot produce.
+ */
+import type { HostedGate } from "../decision/CreateGate.js";
+import type { GateDecision } from "../decision/DecisionAuthority.js";
+import { type DecisionReportOptions } from "./DecisionReport.js";
+export interface HostedOutcomeOptions extends DecisionReportOptions {
+    /** Whether a local run prints the line about the hosted path; on by default. */
+    readonly hint?: boolean;
+}
+export declare const HOSTED_HINT = "hint: DECIONIS_HOSTED=1 has Decionis evaluate the same intent and sign a Decision Dossier; no account, no card, one variable";
+export declare function printHostedOutcome(gate: HostedGate, decision: GateDecision, options?: HostedOutcomeOptions): Promise<void>;
+//# sourceMappingURL=HostedOutcome.d.ts.map

package/dist/report/HostedOutcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HostedOutcome.d.ts","sourceRoot":"","sources":["../../src/report/HostedOutcome.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGhF,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,gFAAgF;IAChF,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,eAAO,MAAM,WAAW,iIACwG,CAAC;AAEjI,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,YAAY,EACtB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/report/HostedOutcome.js

@@ -0,0 +1,24 @@
+import { printDecision } from "./DecisionReport.js";
+import { DossierFetchError, printSignedDossier } from "./DossierReport.js";
+export const HOSTED_HINT = "hint: DECIONIS_HOSTED=1 has Decionis evaluate the same intent and sign a Decision Dossier; no account, no card, one variable";
+export async function printHostedOutcome(gate, decision, options = {}) {
+    const out = options.out ?? process.stdout;
+    if (gate.credentials === null || gate.fetchDossier === null) {
+        if (options.hint !== false)
+            out.write(`${HOSTED_HINT}\n`);
+        return;
+    }
+    printDecision(decision, options);
+    const dossierId = decision.hosted?.dossierId ?? null;
+    if (dossierId === null)
+        return;
+    try {
+        const { summary } = await gate.fetchDossier(dossierId);
+        printSignedDossier(summary, { out });
+    }
+    catch (error) {
+        const code = error instanceof DossierFetchError ? error.code : "DOSSIER_UNAVAILABLE";
+        out.write(`signed dossier: not fetched (${code}); the record is still there under your key\n`);
+    }
+}
+//# sourceMappingURL=HostedOutcome.js.map

package/dist/report/HostedOutcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HostedOutcome.js","sourceRoot":"","sources":["../../src/report/HostedOutcome.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAA8B,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAO3E,MAAM,CAAC,MAAM,WAAW,GACtB,8HAA8H,CAAC;AAEjI,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAgB,EAChB,QAAsB,EACtB,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;IAC1C,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,IAAI,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,IAAI,IAAI,CAAC;IACrD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACvD,kBAAkB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC;QACrF,GAAG,CAAC,KAAK,CAAC,gCAAgC,IAAI,+CAA+C,CAAC,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/testing/Index.d.ts

@@ -8,5 +8,5 @@
 export { FixtureAuthorizationVerifier, FixtureDecisionAuthority, createFixtureAuthorityPair, type FixtureAuthorityPair, type FixtureCommitRecord, type FixtureVerdictResolver, type UnsafeFixtureAuthorityOptions, } from "../decision/FixtureDecisionAuthority.js";
 export { InMemoryReplayStore } from "../execution/ReplayStore.js";
 export { LocalPresence, LOCAL_PRESENCE_API_KEY, readBody, type LocalAuthenticator, type LocalCeremonyResponse, type LocalPresenceOptions, type LocalPresenceRequestRecord, type LocalReceipt, type LocalReceiptBinding, type LocalReceiptVerification, type LocalVerificationRecord, type LocalVerificationStatus, } from "./LocalPresence.js";
-export { AUTONOMOUS_LIMIT_MINOR, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, hashBinding, stableStringify, type LocalAuthorityOptions, type LocalAuthorityPolicy, type LocalAuthorityRequestRecord, type LocalGrantRecord, type LocalManagedEscalationRecord, type LocalRouteOverride, } from "./LocalAuthority.js";
+export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, EFFECT_RECEIPT_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, type LocalAuthorityOptions, type LocalClaimAttestationClaims, type LocalEffectReceiptCode, type LocalEffectReceiptRecord, type LocalProviderKey, type LocalAuthorityPolicy, type LocalAuthorityRequestRecord, type LocalGrantRecord, type LocalManagedEscalationRecord, type LocalRouteOverride, } from "./LocalAuthority.js";
 //# sourceMappingURL=Index.d.ts.map

package/dist/testing/Index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC"}

package/dist/testing/Index.js

@@ -8,5 +8,5 @@
 export { FixtureAuthorizationVerifier, FixtureDecisionAuthority, createFixtureAuthorityPair, } from "../decision/FixtureDecisionAuthority.js";
 export { InMemoryReplayStore } from "../execution/ReplayStore.js";
 export { LocalPresence, LOCAL_PRESENCE_API_KEY, readBody, } from "./LocalPresence.js";
-export { AUTONOMOUS_LIMIT_MINOR, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, hashBinding, stableStringify, } from "./LocalAuthority.js";
+export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, EFFECT_RECEIPT_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, } from "./LocalAuthority.js";
 //# sourceMappingURL=Index.js.map

package/dist/testing/Index.js.map

@@ -1 +1 @@
-{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,GAK3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,GAUT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,WAAW,EACX,eAAe,GAOhB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,GAK3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,GAUT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,GAWhB,MAAM,qBAAqB,CAAC"}

package/dist/testing/LocalAuthority.d.ts

@@ -1,8 +1,33 @@
+/**
+ * Loopback stand-in for the Decionis execution-authority routes that
+ * `@decionis/agent-safe-pipeline` consumes: enforce-and-bind (including
+ * shadow mode and managed escalation), escalation status and cancellation,
+ * claim-token with its consume-token alias, and finalize-token.
+ *
+ * It validates every request against the published OpenAPI contract with its
+ * own canonicalizer, so a hash it recomputes is independent evidence that the
+ * package binds intents the way Decionis does. Direct Presence evidence is
+ * verified against a `LocalPresence`, and a managed escalation is orchestrated
+ * through that same `LocalPresence` the way Decionis orchestrates Presence:
+ * create a request bound to the exact intent hash, wait for the ceremony,
+ * verify the receipt, re-evaluate policy, then expose a normal grant.
+ *
+ * Grants, claims, escalations, and commit outcomes are synthetic in-memory
+ * state. Nothing here is a real policy, tenant, or credential.
+ */
+import { type KeyObject } from "node:crypto";
 import { z } from "zod";
 import { type LocalPresence } from "./LocalPresence.js";
 export declare const LOCAL_AUTHORITY_API_KEY = "test-key";
 export declare const AUTONOMOUS_LIMIT_MINOR = 10000;
 export declare const HUMAN_LIMIT_MINOR = 100000;
+/** The issuer the fixture's grants and attestations name; a provider double checks it. */
+export declare const LOCAL_AUTHORITY_ISSUER = "synthetic-authority";
+/** Where the fixture publishes its attestation key, at the path Decionis documents. */
+export declare const LOCAL_AUTHORITY_JWKS_PATH = "/.well-known/decionis-execution-grant-jwks.json";
+export declare const CLAIM_ATTESTATION_TYPE = "decionis-claim-attestation+jwt";
+/** The protected header `typ` of a verifying provider's effect receipt (VP-3). */
+export declare const EFFECT_RECEIPT_TYPE = "decionis-effect-receipt+jwt";
 /** `ExecutionAuthorityRequest`: the binding plus hash, mode, evidence, and managed constraints. */
 declare const AuthorityRequestSchema: z.ZodObject<{
     intent_hash: z.ZodString;
@@ -57,6 +82,7 @@ declare const AuthorityRequestSchema: z.ZodObject<{
         operation: z.ZodString;
         endpoint: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
+    expected_effect_digest: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type LocalAuthorityRequest = z.infer<typeof AuthorityRequestSchema>;
 type Verdict = "ALLOW" | "ESCALATE" | "BLOCK";
@@ -102,6 +128,10 @@ export interface LocalGrantRecord {
     readonly expiresAt: number;
     readonly nonce: string;
     readonly bindingDigest: string;
+    /** The digest the authority bound over the canonical action parameters. */
+    readonly payloadDigest: string;
+    /** The expected-effect digest committed at enforce-and-bind; null when none was bound. */
+    readonly expectedEffectDigest: string | null;
     /** Present for direct grants issued on client-supplied evidence; null for managed grants. */
     readonly receiptDossierId: string | null;
     claimed: boolean;
@@ -109,6 +139,28 @@ export interface LocalGrantRecord {
     correlationId: string | null;
     consumedBy: string | null;
     finalized: "COMMITTED" | "FAILED" | "INDETERMINATE" | null;
+    /** The provider's effect receipt as this authority read it at finalization, when one came. */
+    receipt: LocalEffectReceiptRecord | null;
+}
+/** The verdict codes the hosted authority records for a receipt, and this double with it. */
+export type LocalEffectReceiptCode = "EFFECT_RECEIPT_VERIFIED" | "EFFECT_RECEIPT_MALFORMED" | "EFFECT_RECEIPT_KEY_UNKNOWN" | "EFFECT_RECEIPT_SIGNATURE_INVALID" | "EFFECT_RECEIPT_BINDING_MISMATCH";
+export interface LocalEffectReceiptRecord {
+    readonly token: string;
+    readonly verified: boolean;
+    readonly verification_code: LocalEffectReceiptCode;
+    readonly provider_key_id: string | null;
+    readonly issuer: string | null;
+    readonly effect_status: "EFFECTED" | "REFUSED" | "INDETERMINATE" | null;
+    readonly effect_digest: string | null;
+    readonly effect_reference: string | null;
+    readonly effected_at: string | null;
+}
+/** A verifying provider's registered receipt key: the public half, its `kid`, the `iss` it signs as. */
+export interface LocalProviderKey {
+    readonly kid: string;
+    readonly issuer: string;
+    readonly publicKey: KeyObject;
+    readonly label: string | null;
 }
 export interface LocalManagedEscalationRecord {
     readonly escalationId: string;
@@ -135,7 +187,46 @@ export interface LocalAuthorityOptions {
     readonly policy?: LocalAuthorityPolicy;
     /** Subject routed to for a managed escalation without an approver principal. */
     readonly managedApproverId?: string;
+    /**
+     * API-key identities this deployment accepts as effect observers, mirroring
+     * `DECIONIS_TRUSTED_EFFECT_OBSERVER_API_KEY_IDS`. Empty by default, exactly as
+     * the hosted authority is by default, so `CONFIRMED` evidence is refused
+     * unless a test opts in. As in the hosted route, the allowlist is intersected
+     * with the caller's own authenticated identity — this double's `apiKey` — so
+     * naming any other id confirms nothing.
+     */
+    readonly trustedEffectObserverIds?: readonly string[];
     readonly clock?: () => number;
+    /**
+     * Attach a verification envelope to every decision, as the hosted
+     * `evaluate-decision` does and `enforce-and-bind` may: a page URL under
+     * this double's own origin, so a test can see the link travel end to end.
+     */
+    readonly verificationLinks?: boolean;
+}
+/** The organization a provisioned synthetic workspace belongs to. */
+export declare const LOCAL_AUTHORITY_PROVISIONAL_ORG_ID = "00000000-0000-4000-8000-000000000008";
+/** What one claim attestation says, as the fixture signs it and a provider double reads it. */
+export interface LocalClaimAttestationClaims {
+    readonly iss: string;
+    readonly sub: string;
+    readonly org_id: string;
+    readonly dossier_id: string;
+    readonly decision_id: string;
+    readonly binding: {
+        readonly intent_hash: string;
+        readonly execution_payload_digest: string;
+        readonly execution_payload_canonicalization_profile: string;
+        readonly expected_effect_digest?: string;
+        readonly execution_nonce: string;
+        readonly execution_correlation_id: string;
+    };
+    readonly claim_token_digest: string;
+    readonly claim_validated_at: string;
+    readonly jti: string;
+    readonly iat: number;
+    readonly nbf: number;
+    readonly exp: number;
 }
 /**
  * Independent canonicalization: keys sorted by UTF-16 code unit, values encoded
@@ -151,19 +242,66 @@ export declare class LocalAuthority {
     readonly grants: Map<string, LocalGrantRecord>;
     /** Managed escalations keyed by their opaque identifier. */
     readonly escalations: Map<string, LocalManagedEscalationRecord>;
+    /** The verifying providers' receipt keys, by `kid`, as `/v1/execution/provider-keys` registers them. */
+    readonly providerKeys: Map<string, LocalProviderKey>;
     private readonly apiKey;
     private readonly presence;
     private readonly legacyVerifyReceipt;
     private readonly policy;
     private readonly managedApproverId;
+    private readonly trustedEffectObserverIds;
     private readonly clock;
+    private readonly attestationKey;
+    /** The `kid` the fixture's attestations name; a provider double looks it up in the JWKS. */
+    readonly attestationKeyId = "synthetic-exec-grant-1";
+    /**
+     * A drill knob: when set, the next claim binds a digest over parameters
+     * other than the ones captured, which is what a tampered or mismatched
+     * authority looks like from the executor's side, and what BEAP-L3-BND-01
+     * says the executor must refuse.
+     */
+    misbindNextPayloadDigest: boolean;
     private readonly overrides;
     private readonly managedByIntent;
     private nextManagedLifecycle;
     private decisions;
+    /** Every decision minted, by dossier id, for `GET /v1/protocol/dossiers/{id}`. */
+    private readonly dossiers;
+    private readonly verificationLinks;
     private server;
     private port;
     constructor(options?: LocalAuthorityOptions);
+    /** The fixture's JWKS, as `GET /.well-known/decionis-execution-grant-jwks.json` serves it. */
+    get jwks(): {
+        readonly keys: readonly Record<string, unknown>[];
+    };
+    /**
+     * A compact JWS over the claim, signed the way Decionis signs one: EdDSA,
+     * the grant key, the attestation type in the protected header. Built with
+     * `node:crypto` alone so the fixture stays an independent implementation.
+     */
+    private attest;
+    /**
+     * Registers the public half of a provider's receipt key, as the hosted
+     * `POST /v1/execution/provider-keys` does; a test or a demo provider calls
+     * it directly rather than over HTTP.
+     */
+    registerProviderKey(input: {
+        readonly kid: string;
+        readonly issuer: string;
+        readonly publicJwk: JsonWebKey;
+        readonly label?: string;
+    }): void;
+    /**
+     * Reads a receipt the way the hosted authority does: the protected header
+     * names an Ed25519 key the organisation registered; the signature verifies
+     * under it; the issuer is the one registered with the key and the audience
+     * is this authority; and the claims describe this grant and this claim,
+     * through `sub`, the decision and dossier ids and the digest of the claim
+     * token being finalized. Anything else is recorded with its code, and the
+     * finalization proceeds regardless.
+     */
+    private readEffectReceipt;
     get baseUrl(): string;
     start(): Promise<void>;
     stop(): Promise<void>;
@@ -176,7 +314,18 @@ export declare class LocalAuthority {
     /** Statuses returned, in order, for the next managed escalation instead of orchestration. */
     scriptNextManagedLifecycle(statuses: readonly LifecycleEntry[]): void;
     private handle;
+    /** `POST /v1/execution/provider-keys`: the public half only, or a 400 naming why. */
+    private registerProviderKeyRoute;
     private enforceAndBind;
+    /** Keeps a minted decision for its dossier route, with the envelope when links are on. */
+    private remember;
+    /**
+     * The persisted record, shaped as `GET /v1/protocol/dossiers/{id}` returns
+     * it: a payload with the routing decision, the inputs and a proof bundle
+     * naming this double's key. The artifacts are not signed; the record says
+     * so in its issuer tier, and nothing here claims otherwise.
+     */
+    private dossierRecord;
     /** Policy plus evidence handling: a valid receipt turns an escalation into an allow. */
     private evaluate;
     private verifyEvidence;
@@ -193,6 +342,13 @@ export declare class LocalAuthority {
     private cancelManaged;
     private claim;
     private finalize;
+    /**
+     * The hosted route never trusts the allowlist alone: it returns at most the
+     * caller's own authenticated API-key identity, so a confirmed observation
+     * must name the identity that presented the credential. This double has one
+     * credential, so that credential is its identity.
+     */
+    private effectObserverIds;
     /** Recomputes the hash independently and applies the contract's time rules. */
     private assertBinding;
     private respond;

package/dist/testing/LocalAuthority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LocalAuthority.d.ts","sourceRoot":"","sources":["../../src/testing/LocalAuthority.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAClD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAyEzC,mGAAmG;AACnG,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AAuBH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,KAAK,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAC9C,KAAK,aAAa,GACd,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,QAAQ,CAAC;AACb,KAAK,cAAc,GAAG,aAAa,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACxF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOxC,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gGAAgG;IAChG,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAC3E,UAAU,EAAE,MAAM,KACf,OAAO,CAAC;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAyBD,qBAAa,cAAc;IACzB,oFAAoF;IACpF,SAAgB,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IAC7D,8CAA8C;IAC9C,SAAgB,MAAM,gCAAuC;IAC7D,4DAA4D;IAC5D,SAAgB,WAAW,4CAAmD;IAC9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyC;IAC7E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAKxB;IACF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;IACnF,OAAO,CAAC,oBAAoB,CAAiC;IAC7D,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;gBAEE,OAAO,GAAE,qBAA0B;IAUtD,IAAW,OAAO,IAAI,MAAM,CAE3B;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQlC;;;;OAIG;IACI,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAIjF,6FAA6F;IACtF,0BAA0B,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;YAI9D,MAAM;IA0DpB,OAAO,CAAC,cAAc;IAwBtB,wFAAwF;IACxF,OAAO,CAAC,QAAQ;IA6BhB,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,aAAa;IA6CrB,qGAAqG;IACrG,OAAO,CAAC,WAAW;IAgDnB,iGAAiG;IACjG,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,aAAa;IA8CrB,OAAO,CAAC,QAAQ;IA8BhB,qFAAqF;IACrF,OAAO,CAAC,OAAO;IAqDf,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,KAAK;IAoEb,OAAO,CAAC,QAAQ;IA6BhB,+EAA+E;IAC/E,OAAO,CAAC,aAAa;YAiBP,OAAO;IAmCrB,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,MAAM,CAAC,UAAU;CAU1B"}
+{"version":3,"file":"LocalAuthority.d.ts","sourceRoot":"","sources":["../../src/testing/LocalAuthority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAClD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAQzC,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAC3F,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AACvE,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AA4HjE,mGAAmG;AACnG,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AA+CH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,KAAK,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAC9C,KAAK,aAAa,GACd,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,QAAQ,CAAC;AACb,KAAK,cAAc,GAAG,aAAa,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACxF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOxC,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,GAAG,IAAI,CAAC;IAC3D,8FAA8F;IAC9F,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;CAC1C;AAED,6FAA6F;AAC7F,MAAM,MAAM,sBAAsB,GAC9B,yBAAyB,GACzB,0BAA0B,GAC1B,4BAA4B,GAC5B,kCAAkC,GAClC,iCAAiC,CAAC;AAEtC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAMD,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gGAAgG;IAChG,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAC3E,UAAU,EAAE,MAAM,KACf,OAAO,CAAC;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,qEAAqE;AACrE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAEzF,+FAA+F;AAC/F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,0CAA0C,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAyBD,qBAAa,cAAc;IACzB,oFAAoF;IACpF,SAAgB,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IAC7D,8CAA8C;IAC9C,SAAgB,MAAM,gCAAuC;IAC7D,4DAA4D;IAC5D,SAAgB,WAAW,4CAAmD;IAC9E,wGAAwG;IACxG,SAAgB,YAAY,gCAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyC;IAC7E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAoB;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG7B;IACF,4FAA4F;IAC5F,SAAgB,gBAAgB,4BAA4B;IAC5D;;;;;OAKG;IACI,wBAAwB,UAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAKxB;IACF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;IACnF,OAAO,CAAC,oBAAoB,CAAiC;IAC7D,OAAO,CAAC,SAAS,CAAK;IACtB,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGrB;IACJ,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;IAC5C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;gBAEE,OAAO,GAAE,qBAA0B;IAiBtD,8FAA8F;IAC9F,IAAW,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAMvE;IAED;;;;OAIG;IACH,OAAO,CAAC,MAAM;IA+Cd;;;;OAIG;IACI,mBAAmB,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI;IASR;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2FzB,IAAW,OAAO,IAAI,MAAM,CAE3B;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQlC;;;;OAIG;IACI,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAIjF,6FAA6F;IACtF,0BAA0B,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;YAI9D,MAAM;IAyFpB,qFAAqF;IACrF,OAAO,CAAC,wBAAwB;IAwBhC,OAAO,CAAC,cAAc;IA2BtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ;IAkBhB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA0CrB,wFAAwF;IACxF,OAAO,CAAC,QAAQ;IA6BhB,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,aAAa;IAgDrB,qGAAqG;IACrG,OAAO,CAAC,WAAW;IAgDnB,iGAAiG;IACjG,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,aAAa;IA8CrB,OAAO,CAAC,QAAQ;IA8BhB,qFAAqF;IACrF,OAAO,CAAC,OAAO;IAqDf,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,KAAK;IA+Fb,OAAO,CAAC,QAAQ;IAkHhB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAIzB,+EAA+E;IAC/E,OAAO,CAAC,aAAa;YAiBP,OAAO;IAmCrB,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,MAAM,CAAC,UAAU;CAU1B"}