@decionis/agent-safe-pipeline 0.2.0 → 0.3.1

package/dist/intent/IntentBindingSchema.js

@@ -0,0 +1,73 @@
+import { z } from "zod";
+import { JsonObjectSchema, JsonValueSchema } from "./JsonValue.js";
+/** Where the published schema of the binding lives; the `$id` it carries. */
+export const INTENT_SCHEMA_ID = "https://github.com/decionis/agent-safe-pipeline/blob/master/spec/intent/v1/schema.json";
+const identifier = z.string().min(1).max(200);
+const actionType = z
+    .string()
+    .min(1)
+    .max(120)
+    .regex(/^[a-z][a-z0-9._:-]*$/);
+const sha256Digest = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+/**
+ * The `agent-safe.intent/1` binding as it is hashed and sent, as a strict
+ * schema: what `CanonicalIntentHasher.bindingOf` produces, and what an
+ * implementation in another language must produce byte for byte before
+ * canonicalization. Nothing here trims or coerces, because a validator that
+ * altered a binding would be validating different bytes than it hashes.
+ * `context` is any JSON object that carries the trusted runtime's
+ * `idempotency_key`; every other object refuses a key it does not name.
+ */
+export const AuthorityIntentBindingSchema = z
+    .object({
+    protocol_version: z.literal("agent-safe.intent/1"),
+    tenant_id: z.string().uuid(),
+    intent_id: z.string().uuid(),
+    captured_at: z.string().datetime(),
+    expires_at: z.string().datetime(),
+    actor: z
+        .object({
+        id: identifier,
+        type: identifier,
+        runtime: identifier.optional(),
+        trust_level: z.string().min(1).max(80).optional(),
+    })
+        .strict(),
+    action: z
+        .object({
+        type: actionType,
+        resource: z.string().min(1).max(500),
+        parameters: JsonObjectSchema,
+    })
+        .strict(),
+    context: z.object({ idempotency_key: z.string().min(1).max(180) }).catchall(JsonValueSchema),
+    downstream_target: z
+        .object({
+        system: identifier,
+        operation: identifier,
+        environment: identifier.optional(),
+        endpoint: z.string().min(1).max(500).optional(),
+    })
+        .strict(),
+    expected_effect_digest: sha256Digest.optional(),
+})
+    .strict()
+    .meta({
+    title: "agent-safe.intent/1 binding",
+    description: "The execution intent as the authority receives it and as it is hashed: keys sorted by UTF-16 code unit, encoded as JSON without whitespace, and digested with SHA-256. Every property is inside the hash.",
+});
+/**
+ * The binding's JSON Schema (draft 2020-12), the document published at
+ * `spec/intent/v1/schema.json`. It is derived from the schema above, so the
+ * published file and the validator cannot disagree; a test holds the file to
+ * this output.
+ */
+export function intentBindingJsonSchema() {
+    const generated = z.toJSONSchema(AuthorityIntentBindingSchema, {
+        target: "draft-2020-12",
+        io: "input",
+    });
+    const { $schema, ...rest } = generated;
+    return { $schema, $id: INTENT_SCHEMA_ID, ...rest };
+}
+//# sourceMappingURL=IntentBindingSchema.js.map

package/dist/intent/IntentBindingSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IntentBindingSchema.js","sourceRoot":"","sources":["../../src/intent/IntentBindingSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEnE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAC3B,wFAAwF,CAAC;AAE3F,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,sBAAsB,CAAC,CAAC;AACjC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAClD,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,UAAU,EAAE,gBAAgB;KAC7B,CAAC;SACD,MAAM,EAAE;IACX,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;IAC5F,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC;QACN,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,UAAU;QACrB,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,MAAM,EAAE;IACX,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE;KACR,IAAI,CAAC;IACJ,KAAK,EAAE,6BAA6B;IACpC,WAAW,EACT,2MAA2M;CAC9M,CAAC,CAAC;AAKL;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,4BAA4B,EAAE;QAC7D,MAAM,EAAE,eAAe;QACvB,EAAE,EAAE,OAAO;KACZ,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;AACrD,CAAC"}

package/dist/intent/JsonValue.d.ts

@@ -6,6 +6,11 @@ export type JsonValue = JsonPrimitive | JsonValue[] | {
 export type JsonObject = {
     [key: string]: JsonValue;
 };
+/**
+ * Named in the schema registry so that the published JSON Schema of the
+ * intent binding (`intentBindingJsonSchema`) refers to it as `JsonValue`
+ * rather than by a generated name; parsing is unaffected.
+ */
 export declare const JsonValueSchema: z.ZodType<JsonValue>;
 export declare const JsonObjectSchema: z.ZodType<JsonObject>;
 //# sourceMappingURL=JsonValue.d.ts.map

package/dist/intent/JsonValue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JsonValue.d.ts","sourceRoot":"","sources":["../../src/intent/JsonValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AACnF,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtD,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAShD,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC"}
+{"version":3,"file":"JsonValue.d.ts","sourceRoot":"","sources":["../../src/intent/JsonValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AACnF,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAW+B,CAAC;AAEjF,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC"}

package/dist/intent/JsonValue.js

@@ -1,11 +1,18 @@
 import { z } from "zod";
-export const JsonValueSchema = z.lazy(() => z.union([
+/**
+ * Named in the schema registry so that the published JSON Schema of the
+ * intent binding (`intentBindingJsonSchema`) refers to it as `JsonValue`
+ * rather than by a generated name; parsing is unaffected.
+ */
+export const JsonValueSchema = z
+    .lazy(() => z.union([
     z.boolean(),
     z.number().finite(),
     z.string(),
     z.null(),
     z.array(JsonValueSchema),
     z.record(z.string(), JsonValueSchema),
-]));
+]))
+    .meta({ id: "JsonValue", description: "Any JSON value; numbers are finite." });
 export const JsonObjectSchema = z.record(z.string(), JsonValueSchema);
 //# sourceMappingURL=JsonValue.js.map

package/dist/intent/JsonValue.js.map

@@ -1 +1 @@
-{"version":3,"file":"JsonValue.js","sourceRoot":"","sources":["../../src/intent/JsonValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,MAAM,CAAC,MAAM,eAAe,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAC/D,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACnB,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;CACtC,CAAC,CACH,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC"}
+{"version":3,"file":"JsonValue.js","sourceRoot":"","sources":["../../src/intent/JsonValue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAyB,CAAC;KACnD,IAAI,CAAC,GAAG,EAAE,CACT,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACnB,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;CACtC,CAAC,CACH;KACA,IAAI,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,gBAAgB,GAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC"}

package/dist/testing/Index.d.ts

@@ -8,5 +8,5 @@
 export { FixtureAuthorizationVerifier, FixtureDecisionAuthority, createFixtureAuthorityPair, type FixtureAuthorityPair, type FixtureCommitRecord, type FixtureVerdictResolver, type UnsafeFixtureAuthorityOptions, } from "../decision/FixtureDecisionAuthority.js";
 export { InMemoryReplayStore } from "../execution/ReplayStore.js";
 export { LocalPresence, LOCAL_PRESENCE_API_KEY, readBody, type LocalAuthenticator, type LocalCeremonyResponse, type LocalPresenceOptions, type LocalPresenceRequestRecord, type LocalReceipt, type LocalReceiptBinding, type LocalReceiptVerification, type LocalVerificationRecord, type LocalVerificationStatus, } from "./LocalPresence.js";
-export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, type LocalAuthorityOptions, type LocalClaimAttestationClaims, type LocalAuthorityPolicy, type LocalAuthorityRequestRecord, type LocalGrantRecord, type LocalManagedEscalationRecord, type LocalRouteOverride, } from "./LocalAuthority.js";
+export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, EFFECT_RECEIPT_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, type LocalAuthorityOptions, type LocalClaimAttestationClaims, type LocalEffectReceiptCode, type LocalEffectReceiptRecord, type LocalProviderKey, type LocalAuthorityPolicy, type LocalAuthorityRequestRecord, type LocalGrantRecord, type LocalManagedEscalationRecord, type LocalRouteOverride, } from "./LocalAuthority.js";
 //# sourceMappingURL=Index.d.ts.map

package/dist/testing/Index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC"}

package/dist/testing/Index.js

@@ -8,5 +8,5 @@
 export { FixtureAuthorizationVerifier, FixtureDecisionAuthority, createFixtureAuthorityPair, } from "../decision/FixtureDecisionAuthority.js";
 export { InMemoryReplayStore } from "../execution/ReplayStore.js";
 export { LocalPresence, LOCAL_PRESENCE_API_KEY, readBody, } from "./LocalPresence.js";
-export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, } from "./LocalAuthority.js";
+export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, EFFECT_RECEIPT_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, } from "./LocalAuthority.js";
 //# sourceMappingURL=Index.js.map

package/dist/testing/Index.js.map

@@ -1 +1 @@
-{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,GAK3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,GAUT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,GAQhB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,GAK3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,GAUT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,GAWhB,MAAM,qBAAqB,CAAC"}

package/dist/testing/LocalAuthority.d.ts

@@ -1,3 +1,21 @@
+/**
+ * Loopback stand-in for the Decionis execution-authority routes that
+ * `@decionis/agent-safe-pipeline` consumes: enforce-and-bind (including
+ * shadow mode and managed escalation), escalation status and cancellation,
+ * claim-token with its consume-token alias, and finalize-token.
+ *
+ * It validates every request against the published OpenAPI contract with its
+ * own canonicalizer, so a hash it recomputes is independent evidence that the
+ * package binds intents the way Decionis does. Direct Presence evidence is
+ * verified against a `LocalPresence`, and a managed escalation is orchestrated
+ * through that same `LocalPresence` the way Decionis orchestrates Presence:
+ * create a request bound to the exact intent hash, wait for the ceremony,
+ * verify the receipt, re-evaluate policy, then expose a normal grant.
+ *
+ * Grants, claims, escalations, and commit outcomes are synthetic in-memory
+ * state. Nothing here is a real policy, tenant, or credential.
+ */
+import { type KeyObject } from "node:crypto";
 import { z } from "zod";
 import { type LocalPresence } from "./LocalPresence.js";
 export declare const LOCAL_AUTHORITY_API_KEY = "test-key";
@@ -8,6 +26,8 @@ export declare const LOCAL_AUTHORITY_ISSUER = "synthetic-authority";
 /** Where the fixture publishes its attestation key, at the path Decionis documents. */
 export declare const LOCAL_AUTHORITY_JWKS_PATH = "/.well-known/decionis-execution-grant-jwks.json";
 export declare const CLAIM_ATTESTATION_TYPE = "decionis-claim-attestation+jwt";
+/** The protected header `typ` of a verifying provider's effect receipt (VP-3). */
+export declare const EFFECT_RECEIPT_TYPE = "decionis-effect-receipt+jwt";
 /** `ExecutionAuthorityRequest`: the binding plus hash, mode, evidence, and managed constraints. */
 declare const AuthorityRequestSchema: z.ZodObject<{
     intent_hash: z.ZodString;
@@ -119,6 +139,28 @@ export interface LocalGrantRecord {
     correlationId: string | null;
     consumedBy: string | null;
     finalized: "COMMITTED" | "FAILED" | "INDETERMINATE" | null;
+    /** The provider's effect receipt as this authority read it at finalization, when one came. */
+    receipt: LocalEffectReceiptRecord | null;
+}
+/** The verdict codes the hosted authority records for a receipt, and this double with it. */
+export type LocalEffectReceiptCode = "EFFECT_RECEIPT_VERIFIED" | "EFFECT_RECEIPT_MALFORMED" | "EFFECT_RECEIPT_KEY_UNKNOWN" | "EFFECT_RECEIPT_SIGNATURE_INVALID" | "EFFECT_RECEIPT_BINDING_MISMATCH";
+export interface LocalEffectReceiptRecord {
+    readonly token: string;
+    readonly verified: boolean;
+    readonly verification_code: LocalEffectReceiptCode;
+    readonly provider_key_id: string | null;
+    readonly issuer: string | null;
+    readonly effect_status: "EFFECTED" | "REFUSED" | "INDETERMINATE" | null;
+    readonly effect_digest: string | null;
+    readonly effect_reference: string | null;
+    readonly effected_at: string | null;
+}
+/** A verifying provider's registered receipt key: the public half, its `kid`, the `iss` it signs as. */
+export interface LocalProviderKey {
+    readonly kid: string;
+    readonly issuer: string;
+    readonly publicKey: KeyObject;
+    readonly label: string | null;
 }
 export interface LocalManagedEscalationRecord {
     readonly escalationId: string;
@@ -200,6 +242,8 @@ export declare class LocalAuthority {
     readonly grants: Map<string, LocalGrantRecord>;
     /** Managed escalations keyed by their opaque identifier. */
     readonly escalations: Map<string, LocalManagedEscalationRecord>;
+    /** The verifying providers' receipt keys, by `kid`, as `/v1/execution/provider-keys` registers them. */
+    readonly providerKeys: Map<string, LocalProviderKey>;
     private readonly apiKey;
     private readonly presence;
     private readonly legacyVerifyReceipt;
@@ -237,6 +281,27 @@ export declare class LocalAuthority {
      * `node:crypto` alone so the fixture stays an independent implementation.
      */
     private attest;
+    /**
+     * Registers the public half of a provider's receipt key, as the hosted
+     * `POST /v1/execution/provider-keys` does; a test or a demo provider calls
+     * it directly rather than over HTTP.
+     */
+    registerProviderKey(input: {
+        readonly kid: string;
+        readonly issuer: string;
+        readonly publicJwk: JsonWebKey;
+        readonly label?: string;
+    }): void;
+    /**
+     * Reads a receipt the way the hosted authority does: the protected header
+     * names an Ed25519 key the organisation registered; the signature verifies
+     * under it; the issuer is the one registered with the key and the audience
+     * is this authority; and the claims describe this grant and this claim,
+     * through `sub`, the decision and dossier ids and the digest of the claim
+     * token being finalized. Anything else is recorded with its code, and the
+     * finalization proceeds regardless.
+     */
+    private readEffectReceipt;
     get baseUrl(): string;
     start(): Promise<void>;
     stop(): Promise<void>;
@@ -249,6 +314,8 @@ export declare class LocalAuthority {
     /** Statuses returned, in order, for the next managed escalation instead of orchestration. */
     scriptNextManagedLifecycle(statuses: readonly LifecycleEntry[]): void;
     private handle;
+    /** `POST /v1/execution/provider-keys`: the public half only, or a 400 naming why. */
+    private registerProviderKeyRoute;
     private enforceAndBind;
     /** Keeps a minted decision for its dossier route, with the envelope when links are on. */
     private remember;

package/dist/testing/LocalAuthority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LocalAuthority.d.ts","sourceRoot":"","sources":["../../src/testing/LocalAuthority.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAClD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAQzC,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAC3F,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AA2HvE,mGAAmG;AACnG,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AA2BH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,KAAK,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAC9C,KAAK,aAAa,GACd,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,QAAQ,CAAC;AACb,KAAK,cAAc,GAAG,aAAa,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACxF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOxC,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gGAAgG;IAChG,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAC3E,UAAU,EAAE,MAAM,KACf,OAAO,CAAC;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,qEAAqE;AACrE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAEzF,+FAA+F;AAC/F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,0CAA0C,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAyBD,qBAAa,cAAc;IACzB,oFAAoF;IACpF,SAAgB,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IAC7D,8CAA8C;IAC9C,SAAgB,MAAM,gCAAuC;IAC7D,4DAA4D;IAC5D,SAAgB,WAAW,4CAAmD;IAC9E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyC;IAC7E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAoB;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG7B;IACF,4FAA4F;IAC5F,SAAgB,gBAAgB,4BAA4B;IAC5D;;;;;OAKG;IACI,wBAAwB,UAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAKxB;IACF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;IACnF,OAAO,CAAC,oBAAoB,CAAiC;IAC7D,OAAO,CAAC,SAAS,CAAK;IACtB,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGrB;IACJ,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;IAC5C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;gBAEE,OAAO,GAAE,qBAA0B;IAiBtD,8FAA8F;IAC9F,IAAW,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAMvE;IAED;;;;OAIG;IACH,OAAO,CAAC,MAAM;IA+Cd,IAAW,OAAO,IAAI,MAAM,CAE3B;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQlC;;;;OAIG;IACI,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAIjF,6FAA6F;IACtF,0BAA0B,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;YAI9D,MAAM;IAuFpB,OAAO,CAAC,cAAc;IA2BtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ;IAkBhB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA0CrB,wFAAwF;IACxF,OAAO,CAAC,QAAQ;IA6BhB,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,aAAa;IA+CrB,qGAAqG;IACrG,OAAO,CAAC,WAAW;IAgDnB,iGAAiG;IACjG,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,aAAa;IA8CrB,OAAO,CAAC,QAAQ;IA8BhB,qFAAqF;IACrF,OAAO,CAAC,OAAO;IAqDf,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,KAAK;IA+Fb,OAAO,CAAC,QAAQ;IAiEhB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAIzB,+EAA+E;IAC/E,OAAO,CAAC,aAAa;YAiBP,OAAO;IAmCrB,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,MAAM,CAAC,UAAU;CAU1B"}
+{"version":3,"file":"LocalAuthority.d.ts","sourceRoot":"","sources":["../../src/testing/LocalAuthority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAClD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAQzC,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAC3F,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AACvE,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AA4HjE,mGAAmG;AACnG,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AA+CH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,KAAK,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAC9C,KAAK,aAAa,GACd,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,QAAQ,CAAC;AACb,KAAK,cAAc,GAAG,aAAa,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACxF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOxC,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,GAAG,IAAI,CAAC;IAC3D,8FAA8F;IAC9F,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;CAC1C;AAED,6FAA6F;AAC7F,MAAM,MAAM,sBAAsB,GAC9B,yBAAyB,GACzB,0BAA0B,GAC1B,4BAA4B,GAC5B,kCAAkC,GAClC,iCAAiC,CAAC;AAEtC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAMD,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gGAAgG;IAChG,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAC3E,UAAU,EAAE,MAAM,KACf,OAAO,CAAC;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED,qEAAqE;AACrE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAEzF,+FAA+F;AAC/F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,0CAA0C,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAyBD,qBAAa,cAAc;IACzB,oFAAoF;IACpF,SAAgB,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IAC7D,8CAA8C;IAC9C,SAAgB,MAAM,gCAAuC;IAC7D,4DAA4D;IAC5D,SAAgB,WAAW,4CAAmD;IAC9E,wGAAwG;IACxG,SAAgB,YAAY,gCAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyC;IAC7E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAoB;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG7B;IACF,4FAA4F;IAC5F,SAAgB,gBAAgB,4BAA4B;IAC5D;;;;;OAKG;IACI,wBAAwB,UAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAKxB;IACF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;IACnF,OAAO,CAAC,oBAAoB,CAAiC;IAC7D,OAAO,CAAC,SAAS,CAAK;IACtB,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGrB;IACJ,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;IAC5C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;gBAEE,OAAO,GAAE,qBAA0B;IAiBtD,8FAA8F;IAC9F,IAAW,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAMvE;IAED;;;;OAIG;IACH,OAAO,CAAC,MAAM;IA+Cd;;;;OAIG;IACI,mBAAmB,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI;IASR;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2FzB,IAAW,OAAO,IAAI,MAAM,CAE3B;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQlC;;;;OAIG;IACI,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAIjF,6FAA6F;IACtF,0BAA0B,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;YAI9D,MAAM;IA4FpB,qFAAqF;IACrF,OAAO,CAAC,wBAAwB;IAwBhC,OAAO,CAAC,cAAc;IA2BtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ;IAkBhB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA0CrB,wFAAwF;IACxF,OAAO,CAAC,QAAQ;IA6BhB,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,YAAY;IA+BpB,OAAO,CAAC,aAAa;IAgDrB,qGAAqG;IACrG,OAAO,CAAC,WAAW;IAgDnB,iGAAiG;IACjG,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,aAAa;IA8CrB,OAAO,CAAC,QAAQ;IA8BhB,qFAAqF;IACrF,OAAO,CAAC,OAAO;IAqDf,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,KAAK;IA+Fb,OAAO,CAAC,QAAQ;IAkHhB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAIzB,+EAA+E;IAC/E,OAAO,CAAC,aAAa;YAiBP,OAAO;IAmCrB,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,MAAM,CAAC,UAAU;CAU1B"}

package/dist/testing/LocalAuthority.js

@@ -15,7 +15,7 @@
  * Grants, claims, escalations, and commit outcomes are synthetic in-memory
  * state. Nothing here is a real policy, tenant, or credential.
  */
-import { createHash, generateKeyPairSync, randomBytes, randomUUID, sign, } from "node:crypto";
+import { createHash, createPublicKey, generateKeyPairSync, randomBytes, randomUUID, sign, verify, } from "node:crypto";
 import { createServer } from "node:http";
 import { z } from "zod";
 import { readBody } from "./LocalPresence.js";
@@ -33,6 +33,9 @@ export const LOCAL_AUTHORITY_ISSUER = "synthetic-authority";
 /** Where the fixture publishes its attestation key, at the path Decionis documents. */
 export const LOCAL_AUTHORITY_JWKS_PATH = "/.well-known/decionis-execution-grant-jwks.json";
 export const CLAIM_ATTESTATION_TYPE = "decionis-claim-attestation+jwt";
+/** The protected header `typ` of a verifying provider's effect receipt (VP-3). */
+export const EFFECT_RECEIPT_TYPE = "decionis-effect-receipt+jwt";
+const COMPACT_JWS = /^[\w-]+\.[\w-]+\.[\w-]+$/;
 /** The profile the fixture digests parameters under; the only one the pipeline reproduces. */
 const JCS_PROFILE = "RFC8785/JCS";
 const boundedId = z.string().trim().min(1).max(200);
@@ -179,8 +182,30 @@ const FinalizeRequestSchema = z.strictObject({
     // evidence with a 409 and a reason code, not with a 400 request rejection,
     // so the shape is checked where that answer is produced.
     effect_evidence: z.unknown().optional(),
+    // The provider's receipt: only its shape is a request error. What it says
+    // is verified and recorded, never a reason to refuse the finalization.
+    effect_receipt: z.string().min(1).max(20_000).regex(COMPACT_JWS).optional(),
+});
+/** `ExecutionProviderKeyRegistrationRequest`: the public half of an Ed25519 key. */
+const ProviderKeyRegistrationSchema = z.strictObject({
+    org_id: z.uuid().optional(),
+    kid: boundedId,
+    issuer: z.string().trim().min(1).max(500),
+    algorithm: z.literal("EdDSA"),
+    public_jwk: z.strictObject({
+        kty: z.literal("OKP"),
+        crv: z.literal("Ed25519"),
+        x: z.string().regex(/^[\w-]{43}$/),
+        kid: z.string().optional(),
+        alg: z.literal("EdDSA").optional(),
+        use: z.literal("sig").optional(),
+    }),
+    label: z.string().max(200).optional(),
 });
 const BINDING_KEYS = Object.keys(IntentBindingSchema.shape);
+function effectStatus(value) {
+    return value === "EFFECTED" || value === "REFUSED" || value === "INDETERMINATE" ? value : null;
+}
 /** The organization a provisioned synthetic workspace belongs to. */
 export const LOCAL_AUTHORITY_PROVISIONAL_ORG_ID = "00000000-0000-4000-8000-000000000008";
 /**
@@ -232,6 +257,8 @@ export class LocalAuthority {
     grants = new Map();
     /** Managed escalations keyed by their opaque identifier. */
     escalations = new Map();
+    /** The verifying providers' receipt keys, by `kid`, as `/v1/execution/provider-keys` registers them. */
+    providerKeys = new Map();
     apiKey;
     presence;
     legacyVerifyReceipt;
@@ -330,6 +357,103 @@ export class LocalAuthority {
         const signature = sign(null, Buffer.from(`${header}.${payload}`, "ascii"), this.attestationKey.privateKey);
         return `${header}.${payload}.${signature.toString("base64url")}`;
     }
+    /**
+     * Registers the public half of a provider's receipt key, as the hosted
+     * `POST /v1/execution/provider-keys` does; a test or a demo provider calls
+     * it directly rather than over HTTP.
+     */
+    registerProviderKey(input) {
+        this.providerKeys.set(input.kid, {
+            kid: input.kid,
+            issuer: input.issuer,
+            publicKey: createPublicKey({ key: input.publicJwk, format: "jwk" }),
+            label: input.label ?? null,
+        });
+    }
+    /**
+     * Reads a receipt the way the hosted authority does: the protected header
+     * names an Ed25519 key the organisation registered; the signature verifies
+     * under it; the issuer is the one registered with the key and the audience
+     * is this authority; and the claims describe this grant and this claim,
+     * through `sub`, the decision and dossier ids and the digest of the claim
+     * token being finalized. Anything else is recorded with its code, and the
+     * finalization proceeds regardless.
+     */
+    readEffectReceipt(token, grant, claimToken) {
+        const record = (code, partial = {}) => ({
+            token,
+            verified: code === "EFFECT_RECEIPT_VERIFIED",
+            verification_code: code,
+            provider_key_id: null,
+            issuer: null,
+            effect_status: null,
+            effect_digest: null,
+            effect_reference: null,
+            effected_at: null,
+            ...partial,
+        });
+        const [encodedHeader = "", encodedPayload = "", encodedSignature = ""] = token.split(".");
+        let header;
+        let payload;
+        try {
+            header = JSON.parse(Buffer.from(encodedHeader, "base64url").toString("utf8"));
+            payload = JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8"));
+        }
+        catch {
+            return record("EFFECT_RECEIPT_MALFORMED");
+        }
+        if (header.alg !== "EdDSA" ||
+            header.typ !== EFFECT_RECEIPT_TYPE ||
+            typeof header.kid !== "string" ||
+            header.kid.length === 0) {
+            return record("EFFECT_RECEIPT_MALFORMED");
+        }
+        const key = this.providerKeys.get(header.kid);
+        if (key === undefined) {
+            return record("EFFECT_RECEIPT_KEY_UNKNOWN", { provider_key_id: header.kid });
+        }
+        const known = { provider_key_id: key.kid, issuer: key.issuer };
+        const signed = Buffer.from(`${encodedHeader}.${encodedPayload}`, "ascii");
+        if (!verify(null, signed, key.publicKey, Buffer.from(encodedSignature, "base64url")) ||
+            payload.iss !== key.issuer ||
+            payload.aud !== LOCAL_AUTHORITY_ISSUER) {
+            return record("EFFECT_RECEIPT_SIGNATURE_INVALID", known);
+        }
+        const effect = typeof payload.effect === "object" && payload.effect !== null
+            ? payload.effect
+            : null;
+        const status = effectStatus(effect?.status);
+        const digest = effect?.digest;
+        const effectedAt = effect?.effected_at;
+        if (typeof payload.sub !== "string" ||
+            typeof payload.decision_id !== "string" ||
+            typeof payload.dossier_id !== "string" ||
+            typeof payload.claim_token_digest !== "string" ||
+            typeof payload.jti !== "string" ||
+            typeof payload.iat !== "number" ||
+            status === null ||
+            (digest !== undefined && !sha256Digest.safeParse(digest).success) ||
+            typeof effectedAt !== "string" ||
+            Number.isNaN(Date.parse(effectedAt))) {
+            return record("EFFECT_RECEIPT_MALFORMED", known);
+        }
+        const described = {
+            ...known,
+            effect_status: status,
+            effect_digest: typeof digest === "string" ? digest : null,
+            effect_reference: typeof effect?.reference === "string" ? effect.reference : null,
+            effected_at: new Date(effectedAt).toISOString(),
+        };
+        const claimTokenDigest = `sha256:${createHash("sha256").update(claimToken, "utf8").digest("hex")}`;
+        if (payload.sub !== grant.jti ||
+            payload.decision_id !== grant.decisionId ||
+            payload.dossier_id !== grant.dossierId ||
+            payload.claim_token_digest !== claimTokenDigest ||
+            (typeof payload.intent_hash === "string" && payload.intent_hash !== grant.intentHash)) {
+            return record("EFFECT_RECEIPT_BINDING_MISMATCH", described);
+        }
+        return record("EFFECT_RECEIPT_VERIFIED", described);
+    }
     get baseUrl() {
         return `${LOOPBACK_ORIGIN}:${this.port}`;
     }
@@ -372,6 +496,9 @@ export class LocalAuthority {
                 authorization: headerString(req.headers.authorization),
                 "content-type": headerString(req.headers["content-type"]),
                 "idempotency-key": headerString(req.headers["idempotency-key"]),
+                // What the client says about itself, so a test can see the version
+                // and the surface a call carried; the double never acts on it.
+                "user-agent": headerString(req.headers["user-agent"]),
             },
             body: null,
             recomputedHash: null,
@@ -434,6 +561,8 @@ export class LocalAuthority {
             return this.send(res, record, 415, { error: "UNSUPPORTED_MEDIA_TYPE" });
         }
         switch (url.pathname) {
+            case "/v1/execution/provider-keys":
+                return this.send(res, record, ...this.registerProviderKeyRoute(record));
             case "/v1/authority/enforce-and-bind":
                 return this.respond(res, record, "enforce", this.enforceAndBind(record));
             case "/v1/execution/claim-token":
@@ -445,6 +574,31 @@ export class LocalAuthority {
                 return this.send(res, record, 404, { error: "NOT_FOUND" });
         }
     }
+    /** `POST /v1/execution/provider-keys`: the public half only, or a 400 naming why. */
+    registerProviderKeyRoute(record) {
+        const parsed = ProviderKeyRegistrationSchema.safeParse(record.body);
+        if (!parsed.success)
+            return [400, { error: "INVALID_BODY" }];
+        const body = parsed.data;
+        this.registerProviderKey({
+            kid: body.kid,
+            issuer: body.issuer,
+            publicJwk: { kty: body.public_jwk.kty, crv: body.public_jwk.crv, x: body.public_jwk.x },
+            ...(body.label === undefined ? {} : { label: body.label }),
+        });
+        return [
+            201,
+            {
+                service: "decionis",
+                kid: body.kid,
+                issuer: body.issuer,
+                algorithm: "EdDSA",
+                label: body.label ?? null,
+                created_at: new Date(this.clock()).toISOString(),
+                revoked_at: null,
+            },
+        ];
+    }
     enforceAndBind(record) {
         const parsed = AuthorityRequestSchema.safeParse(record.body);
         if (!parsed.success)
@@ -620,6 +774,7 @@ export class LocalAuthority {
             receiptDossierId: approval?.receiptDossierId ?? null,
             claimed: false,
             claimToken: null,
+            receipt: null,
             correlationId: null,
             consumedBy: null,
             finalized: null,
@@ -973,9 +1128,37 @@ export class LocalAuthority {
         }
         if (grant.finalized !== null)
             return rejected("NONCE_REPLAY_DETECTED");
+        // The receipt is read first and recorded whatever it says; when the grant
+        // named the effect it expected and the executor supplied no observation of
+        // its own, a verified receipt with a digest stands in as SIGNED_RECEIPT
+        // evidence by the provider's key, exactly as the hosted route reads it.
+        const receipt = parsed.data.effect_receipt === undefined
+            ? null
+            : this.readEffectReceipt(parsed.data.effect_receipt, grant, parsed.data.claim_token);
+        let supplied = parsed.data.effect_evidence;
+        if (supplied === undefined &&
+            receipt?.verified === true &&
+            grant.expectedEffectDigest !== null &&
+            receipt.effect_digest !== null) {
+            supplied = {
+                version: "1.0",
+                status: receipt.effect_status === "EFFECTED" &&
+                    receipt.effect_digest === grant.expectedEffectDigest &&
+                    parsed.data.outcome === "COMMITTED"
+                    ? "CONFIRMED"
+                    : "UNCONFIRMED",
+                observation_method: "SIGNED_RECEIPT",
+                observer: { id: receipt.provider_key_id, version: EFFECT_RECEIPT_TYPE },
+                expected_effect_digest: grant.expectedEffectDigest,
+                observed_effect_digest: receipt.effect_digest,
+                observed_at: receipt.effected_at,
+                evidence_digest: `sha256:${createHash("sha256").update(receipt.token, "utf8").digest("hex")}`,
+                evidence_reference: receipt.effect_reference,
+                execution_correlation_id: parsed.data.commit_correlation_id,
+            };
+        }
         // The hosted authority refuses the whole finalization for evidence it
         // cannot bind, in exactly this order, before the commit transition.
-        const supplied = parsed.data.effect_evidence;
         let evidence;
         if (supplied !== undefined) {
             const parsedEvidence = EffectEvidenceSchema.safeParse(supplied);
@@ -995,7 +1178,13 @@ export class LocalAuthority {
                 return rejected("EFFECT_EVIDENCE_OUTCOME_MISMATCH");
             }
             if (evidence.status === "CONFIRMED") {
-                const trusted = this.effectObserverIds();
+                // A verified receipt's key is an observer for this finalization only.
+                const trusted = [
+                    ...this.effectObserverIds(),
+                    ...(receipt?.verified === true && receipt.provider_key_id !== null
+                        ? [receipt.provider_key_id]
+                        : []),
+                ];
                 if (trusted.length === 0) {
                     return rejected("EFFECT_OBSERVER_PROVENANCE_UNAVAILABLE");
                 }
@@ -1005,6 +1194,7 @@ export class LocalAuthority {
             }
         }
         grant.finalized = parsed.data.outcome;
+        grant.receipt = receipt;
         // Byte-for-byte the hosted success body: the commit's own decision-chain
         // evidence is queued, not yet recorded, so a successful finalization still
         // carries `COMMIT_EVIDENCE_PENDING`.
@@ -1018,6 +1208,16 @@ export class LocalAuthority {
                 evidence_recorded: false,
                 effect_evidence_recorded: evidence !== undefined,
                 effect_confirmation: evidence?.status === "CONFIRMED" ? "CONFIRMED" : "UNCONFIRMED",
+                ...(receipt === null
+                    ? {}
+                    : {
+                        effect_receipt: {
+                            verified: receipt.verified,
+                            verification_code: receipt.verification_code,
+                            provider_key_id: receipt.provider_key_id,
+                            recorded: true,
+                        },
+                    }),
                 reason_codes: ["COMMIT_EVIDENCE_PENDING"],
             },
         };