@decionis/agent-safe-pipeline 0.3.4 → 0.3.6

package/dist/decision/edge/EdgeDecisionAuthority.js

@@ -0,0 +1,197 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { DecionisGate } from "../DecionisGate.js";
+import { FailClosedDecision, } from "../DecisionAuthority.js";
+import { immutableGateDecision } from "../ImmutableGateDecision.js";
+const sha256 = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const identifier = z.string().min(1).max(200);
+/** The `decide` result (module ABI 3). Fields beyond these are not read. */
+const DecideResultSchema = z.object({
+    verdict: z.enum(["ALLOW", "ESCALATE", "BLOCK"]),
+    reason_codes: z.array(identifier).max(50),
+    policy_version: identifier,
+    bundle: z.object({
+        bundle_id: identifier,
+        policy_version: identifier,
+        kid: identifier,
+        jti: identifier,
+    }),
+    authority_requirement: z.record(z.string(), z.unknown()).nullable(),
+    evaluation_digest: sha256,
+});
+/**
+ * A `DecisionAuthority` that decides inside the deployment, with the Decionis
+ * edge evaluator: the same verdict hosted `enforce-and-bind` gives for the
+ * same binding and bundle, with no network call on the way.
+ *
+ * - `ALLOW` in enforcement becomes a local authorization, held in
+ *   `LocalGrants` and consumed once by `LocalAuthorizationVerifier`; there is
+ *   no Decionis grant on this path and nothing to claim.
+ * - `BLOCK` is a refusal, as it is hosted.
+ * - `ESCALATE` in enforcement hands the same intent, with the same escalation
+ *   options, to the hosted authority: the human-approval paths are hosted.
+ * - Approval evidence is only ever evaluated hosted.
+ * - No usable bundle, a module fault, or a result this host cannot read
+ *   follows `onUnavailable`: the hosted authority, or a fail-closed `BLOCK`.
+ *
+ * This class is the open host. The evaluator is a separately licensed
+ * module this package does not contain; without it the executor runs on the
+ * hosted authority alone, exactly as it does without this class.
+ */
+export class EdgeDecisionAuthority {
+    options;
+    evaluationMode;
+    onUnavailable;
+    clock;
+    constructor(options) {
+        this.options = options;
+        const mode = options.mode ?? "ENFORCEMENT";
+        if (mode !== "ENFORCEMENT" && mode !== "SHADOW")
+            throw new Error("EDGE_MODE_INVALID");
+        const hostedMode = options.hosted.evaluationMode;
+        if (hostedMode !== undefined && hostedMode !== mode)
+            throw new Error("EDGE_MODE_MISMATCH");
+        const onUnavailable = options.onUnavailable ?? "hosted";
+        if (onUnavailable !== "hosted" && onUnavailable !== "block") {
+            throw new Error("EDGE_ON_UNAVAILABLE_INVALID");
+        }
+        this.evaluationMode = mode;
+        this.onUnavailable = onUnavailable;
+        this.clock = options.clock ?? Date.now;
+    }
+    async evaluate(captured, evidence, options = {}) {
+        if (evidence !== undefined)
+            return await this.options.hosted.evaluate(captured, evidence, options);
+        const replayed = await this.replayed(captured);
+        if (replayed !== null)
+            return FailClosedDecision.create(captured.intentHash, replayed);
+        const now = this.clock();
+        const bundle = this.options.bundles.current(now);
+        if (bundle === null) {
+            return await this.unavailable(captured, "EDGE_BUNDLE_UNAVAILABLE", null, options);
+        }
+        let envelope;
+        try {
+            envelope = this.options.module.decide(bundle.handle, {
+                binding: DecionisGate.binding(captured),
+                mode: this.evaluationMode,
+                now: new Date(now).toISOString(),
+            });
+        }
+        catch {
+            return await this.unavailable(captured, "EDGE_MODULE_FAULTED", null, options);
+        }
+        if (!envelope.ok) {
+            return await this.unavailable(captured, "EDGE_MODULE_REFUSED", envelope.code, options);
+        }
+        const parsed = DecideResultSchema.safeParse(envelope.result);
+        if (!parsed.success || !EdgeDecisionAuthority.sameBundle(parsed.data, bundle)) {
+            return await this.unavailable(captured, "EDGE_RESULT_INVALID", null, options);
+        }
+        const result = parsed.data;
+        const delegated = result.verdict === "ESCALATE" && this.evaluationMode === "ENFORCEMENT";
+        const decisionId = EdgeDecisionAuthority.decisionId(captured, result);
+        try {
+            this.options.record?.({
+                event: "EDGE_DECISION",
+                mode: this.evaluationMode,
+                intent_id: captured.intent.intentId,
+                intent_hash: captured.intentHash,
+                decision_id: decisionId,
+                verdict: result.verdict,
+                reason_codes: [...result.reason_codes],
+                policy_version: result.policy_version,
+                bundle_id: result.bundle.bundle_id,
+                kid: result.bundle.kid,
+                jti: result.bundle.jti,
+                evaluation_digest: result.evaluation_digest,
+                delegated,
+            });
+        }
+        catch {
+            return FailClosedDecision.create(captured.intentHash, "EDGE_RECORD_UNAVAILABLE");
+        }
+        if (delegated)
+            return await this.options.hosted.evaluate(captured, undefined, options);
+        return this.local(captured, result, decisionId, bundle, now);
+    }
+    local(captured, result, decisionId, bundle, now) {
+        const dossierId = `edge:${result.evaluation_digest}`;
+        let authorization = null;
+        if (result.verdict === "ALLOW" && this.evaluationMode === "ENFORCEMENT") {
+            // The authorization lives no longer than the intent or the bundle.
+            const expiresAtMs = Math.min(Date.parse(captured.intent.expiresAt), bundle.expiresAtMs);
+            if (!(expiresAtMs > now)) {
+                return FailClosedDecision.create(captured.intentHash, "INTENT_EXPIRED");
+            }
+            const expiresAt = new Date(expiresAtMs).toISOString();
+            const token = this.options.grants.issue({
+                intentId: captured.intent.intentId,
+                intentHash: captured.intentHash,
+                decisionId,
+                dossierId,
+                expiresAt,
+            });
+            authorization = { token, expiresAt };
+        }
+        return immutableGateDecision({
+            verdict: result.verdict,
+            decisionId,
+            dossierId,
+            intentHash: captured.intentHash,
+            reasonCodes: result.reason_codes,
+            authorization,
+            failClosed: false,
+        });
+    }
+    async unavailable(captured, reason, moduleCode, options) {
+        const fallback = this.onUnavailable === "hosted" ? "HOSTED" : "BLOCK";
+        try {
+            this.options.record?.({
+                event: "EDGE_UNAVAILABLE",
+                mode: this.evaluationMode,
+                intent_id: captured.intent.intentId,
+                intent_hash: captured.intentHash,
+                reason,
+                module_code: moduleCode !== null && /^[a-z][a-z0-9_]{0,62}$/.test(moduleCode) ? moduleCode : null,
+                fallback,
+            });
+        }
+        catch {
+            return FailClosedDecision.create(captured.intentHash, "EDGE_RECORD_UNAVAILABLE");
+        }
+        if (fallback === "HOSTED")
+            return await this.options.hosted.evaluate(captured, undefined, options);
+        return FailClosedDecision.create(captured.intentHash, reason);
+    }
+    /**
+     * Why an enforcement decision must not be made: the intent has already
+     * been claimed, or the store that would say so cannot be asked. Neither is
+     * a decision, so neither is recorded or counted.
+     */
+    async replayed(captured) {
+        const store = this.options.replay;
+        if (this.evaluationMode !== "ENFORCEMENT" || store?.consumed === undefined)
+            return null;
+        try {
+            return (await store.consumed(captured.intent.intentId)) ? "INTENT_ALREADY_CONSUMED" : null;
+        }
+        catch {
+            return "EDGE_REPLAY_STORE_UNAVAILABLE";
+        }
+    }
+    /** The module must have decided on the bundle this host gave it. */
+    static sameBundle(result, bundle) {
+        return (result.bundle.bundle_id === bundle.bundleId &&
+            result.bundle.policy_version === bundle.policyVersion &&
+            result.bundle.kid === bundle.kid);
+    }
+    /** Unique per intent and evaluation, and derivable from the record that names it. */
+    static decisionId(captured, result) {
+        const digest = createHash("sha256")
+            .update(`${captured.intentHash}\n${result.evaluation_digest}\n${result.bundle.jti}`, "utf8")
+            .digest("hex");
+        return `edge:${digest.slice(0, 40)}`;
+    }
+}
+//# sourceMappingURL=EdgeDecisionAuthority.js.map

package/dist/decision/edge/EdgeDecisionAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeDecisionAuthority.js","sourceRoot":"","sources":["../../../src/decision/edge/EdgeDecisionAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,kBAAkB,GAOnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAmEpE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACzD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE9C,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACzC,cAAc,EAAE,UAAU;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,SAAS,EAAE,UAAU;QACrB,cAAc,EAAE,UAAU;QAC1B,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,UAAU;KAChB,CAAC;IACF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnE,iBAAiB,EAAE,MAAM;CAC1B,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,qBAAqB;IAKI;IAJpB,cAAc,CAAyB;IACtC,aAAa,CAAwB;IACrC,KAAK,CAAe;IAErC,YAAoC,OAAqC;QAArC,YAAO,GAAP,OAAO,CAA8B;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,aAAa,CAAC;QAC3C,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtF,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;QACjD,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC3F,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC;QACxD,IAAI,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,QAAQ,CACnB,QAAwB,EACxB,QAA2B,EAC3B,UAAqC,EAAE;QAEvC,IAAI,QAAQ,KAAK,SAAS;YACxB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,yBAAyB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;gBACnD,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvC,IAAI,EAAE,IAAI,CAAC,cAAc;gBACzB,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,qBAAqB,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9E,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,KAAK,UAAU,IAAI,IAAI,CAAC,cAAc,KAAK,aAAa,CAAC;QACzF,MAAM,UAAU,GAAG,qBAAqB,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,IAAI,CAAC,cAAc;gBACzB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBACnC,WAAW,EAAE,QAAQ,CAAC,UAAU;gBAChC,WAAW,EAAE,UAAU;gBACvB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;gBACtC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;gBAClC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;gBACtB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;gBACtB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,SAAS;aACV,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,SAAS;YAAE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CACX,QAAwB,EACxB,MAAoB,EACpB,UAAkB,EAClB,MAAoB,EACpB,GAAW;QAEX,MAAM,SAAS,GAAG,QAAQ,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACrD,IAAI,aAAa,GAAkC,IAAI,CAAC;QACxD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,cAAc,KAAK,aAAa,EAAE,CAAC;YACxE,mEAAmE;YACnE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YACxF,IAAI,CAAC,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBAClC,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,UAAU;gBACV,SAAS;gBACT,SAAS;aACV,CAAC,CAAC;YACH,aAAa,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,qBAAqB,CAAC;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,UAAU;YACV,SAAS;YACT,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,WAAW,EAAE,MAAM,CAAC,YAAY;YAChC,aAAa;YACb,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,QAAwB,EACxB,MAAc,EACd,UAAyB,EACzB,OAAkC;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,EAAE,kBAAkB;gBACzB,IAAI,EAAE,IAAI,CAAC,cAAc;gBACzB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBACnC,WAAW,EAAE,QAAQ,CAAC,UAAU;gBAChC,MAAM;gBACN,WAAW,EACT,UAAU,KAAK,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;gBACtF,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ;YACvB,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1E,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,QAAQ,CAAC,QAAwB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,IAAI,IAAI,CAAC,cAAc,KAAK,aAAa,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACxF,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,+BAA+B,CAAC;QACzC,CAAC;IACH,CAAC;IAED,oEAAoE;IAC5D,MAAM,CAAC,UAAU,CAAC,MAAoB,EAAE,MAAoB;QAClE,OAAO,CACL,MAAM,CAAC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,QAAQ;YAC3C,MAAM,CAAC,MAAM,CAAC,cAAc,KAAK,MAAM,CAAC,aAAa;YACrD,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CACjC,CAAC;IACJ,CAAC;IAED,qFAAqF;IAC7E,MAAM,CAAC,UAAU,CAAC,QAAwB,EAAE,MAAoB;QACtE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;aAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,iBAAiB,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;aAC3F,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;CACF"}

package/dist/decision/edge/EdgeModule.d.ts

@@ -0,0 +1,63 @@
+/** The module ABI this host speaks: ABI 2's bundle exports plus `decide`. */
+export declare const EDGE_MODULE_ABI_VERSION = 3;
+/** Why a module was refused, or why a call into it failed. Never a message from the module. */
+export type EdgeModuleErrorCode = "EDGE_MODULE_UNREADABLE" | "EDGE_MODULE_INVALID" | "EDGE_MODULE_ABI_UNSUPPORTED" | "EDGE_MODULE_FAULTED";
+export declare class EdgeModuleError extends Error {
+    readonly code: EdgeModuleErrorCode;
+    constructor(code: EdgeModuleErrorCode);
+}
+/**
+ * One answer from the module: its result, or the refusal code it gave. The
+ * module's own message is dropped here; it may quote the input, and nothing
+ * of the input belongs in a log line.
+ */
+export type EdgeEnvelope = {
+    readonly ok: true;
+    readonly result: unknown;
+} | {
+    readonly ok: false;
+    readonly code: string;
+};
+/**
+ * The host side of the Decionis edge evaluator: the proprietary WebAssembly
+ * module, licensed separately and not part of this package, instantiated with
+ * no imports. This class knows the module's calling convention and nothing of
+ * its policy semantics.
+ *
+ * A module that does not export ABI 3 is refused at construction, so a
+ * process configured for the edge never starts on an older or a foreign
+ * module. A call that traps marks the instance faulted: its memory can no
+ * longer be trusted, so every later call refuses rather than answering from
+ * it.
+ */
+export declare class EdgeModule {
+    private readonly exports;
+    private faulted;
+    private readonly encoder;
+    private readonly decoder;
+    private constructor();
+    /** Reads, compiles and instantiates the module at `path`. */
+    static fromFile(path: string): EdgeModule;
+    /**
+     * Compiles and instantiates `bytes` synchronously, so a refusal is a
+     * refusal to start rather than a promise someone forgets to await.
+     */
+    static fromBytes(bytes: Uint8Array<ArrayBuffer>): EdgeModule;
+    /** Checks an instance's exports against ABI 3. */
+    static fromExports(exports: WebAssembly.Exports): EdgeModule;
+    /** True once a call trapped; the instance answers nothing after that. */
+    get isFaulted(): boolean;
+    /** `load_bundle({signed_bundle, org_id, now})`. */
+    loadBundle(input: {
+        readonly signed_bundle: string;
+        readonly org_id: string;
+        readonly now: string;
+    }): EdgeEnvelope;
+    /** `decide(handle, {binding, mode, now})`. */
+    decide(handle: number, input: unknown): EdgeEnvelope;
+    /** `unload_bundle(handle)`: true when the handle was loaded and is now released. */
+    unloadBundle(handle: number): boolean;
+    private call;
+    private static envelope;
+}
+//# sourceMappingURL=EdgeModule.d.ts.map

package/dist/decision/edge/EdgeModule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeModule.d.ts","sourceRoot":"","sources":["../../../src/decision/edge/EdgeModule.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,+FAA+F;AAC/F,MAAM,MAAM,mBAAmB,GAC3B,wBAAwB,GACxB,qBAAqB,GACrB,6BAA6B,GAC7B,qBAAqB,CAAC;AAE1B,qBAAa,eAAgB,SAAQ,KAAK;aACL,IAAI,EAAE,mBAAmB;gBAAzB,IAAI,EAAE,mBAAmB;CAI7D;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACtB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAuBlG;;;;;;;;;;;GAWG;AACH,qBAAa,UAAU;IAKD,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ5C,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;IAErE,OAAO;IAEP,6DAA6D;WAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU;IAUhD;;;OAGG;WACW,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,UAAU;IAUnE,kDAAkD;WACpC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,GAAG,UAAU;IAyBnE,yEAAyE;IACzE,IAAW,SAAS,IAAI,OAAO,CAE9B;IAED,mDAAmD;IAC5C,UAAU,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,GAAG,YAAY;IAIhB,8CAA8C;IACvC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,YAAY;IAI3D,oFAAoF;IAC7E,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAU5C,OAAO,CAAC,IAAI;IAuBZ,OAAO,CAAC,MAAM,CAAC,QAAQ;CAYxB"}

package/dist/decision/edge/EdgeModule.js

@@ -0,0 +1,147 @@
+import { readFileSync } from "node:fs";
+/** The module ABI this host speaks: ABI 2's bundle exports plus `decide`. */
+export const EDGE_MODULE_ABI_VERSION = 3;
+export class EdgeModuleError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "EdgeModuleError";
+    }
+}
+const FUNCTIONS = [
+    "alloc",
+    "dealloc",
+    "abi_version",
+    "load_bundle",
+    "evaluate_bundle",
+    "decide",
+    "unload_bundle",
+];
+/**
+ * The host side of the Decionis edge evaluator: the proprietary WebAssembly
+ * module, licensed separately and not part of this package, instantiated with
+ * no imports. This class knows the module's calling convention and nothing of
+ * its policy semantics.
+ *
+ * A module that does not export ABI 3 is refused at construction, so a
+ * process configured for the edge never starts on an older or a foreign
+ * module. A call that traps marks the instance faulted: its memory can no
+ * longer be trusted, so every later call refuses rather than answering from
+ * it.
+ */
+export class EdgeModule {
+    exports;
+    faulted = false;
+    encoder = new TextEncoder();
+    decoder = new TextDecoder("utf-8", { fatal: true });
+    constructor(exports) {
+        this.exports = exports;
+    }
+    /** Reads, compiles and instantiates the module at `path`. */
+    static fromFile(path) {
+        let bytes;
+        try {
+            bytes = readFileSync(path);
+        }
+        catch {
+            throw new EdgeModuleError("EDGE_MODULE_UNREADABLE");
+        }
+        return EdgeModule.fromBytes(bytes);
+    }
+    /**
+     * Compiles and instantiates `bytes` synchronously, so a refusal is a
+     * refusal to start rather than a promise someone forgets to await.
+     */
+    static fromBytes(bytes) {
+        let instance;
+        try {
+            instance = new WebAssembly.Instance(new WebAssembly.Module(bytes), {});
+        }
+        catch {
+            throw new EdgeModuleError("EDGE_MODULE_INVALID");
+        }
+        return EdgeModule.fromExports(instance.exports);
+    }
+    /** Checks an instance's exports against ABI 3. */
+    static fromExports(exports) {
+        if (!(exports["memory"] instanceof WebAssembly.Memory)) {
+            throw new EdgeModuleError("EDGE_MODULE_INVALID");
+        }
+        for (const name of FUNCTIONS) {
+            if (typeof exports[name] !== "function") {
+                // An ABI 2 module lacks `decide`; it is an older module, not a broken one.
+                throw new EdgeModuleError(name === "decide" ? "EDGE_MODULE_ABI_UNSUPPORTED" : "EDGE_MODULE_INVALID");
+            }
+        }
+        const module = new EdgeModule(exports);
+        let version;
+        try {
+            version = module.exports.abi_version();
+        }
+        catch {
+            throw new EdgeModuleError("EDGE_MODULE_INVALID");
+        }
+        if (version !== EDGE_MODULE_ABI_VERSION) {
+            throw new EdgeModuleError("EDGE_MODULE_ABI_UNSUPPORTED");
+        }
+        return module;
+    }
+    /** True once a call trapped; the instance answers nothing after that. */
+    get isFaulted() {
+        return this.faulted;
+    }
+    /** `load_bundle({signed_bundle, org_id, now})`. */
+    loadBundle(input) {
+        return this.call(input, (ptr, len) => this.exports.load_bundle(ptr, len));
+    }
+    /** `decide(handle, {binding, mode, now})`. */
+    decide(handle, input) {
+        return this.call(input, (ptr, len) => this.exports.decide(handle, ptr, len));
+    }
+    /** `unload_bundle(handle)`: true when the handle was loaded and is now released. */
+    unloadBundle(handle) {
+        if (this.faulted)
+            return false;
+        try {
+            return this.exports.unload_bundle(handle) === 1;
+        }
+        catch {
+            this.faulted = true;
+            return false;
+        }
+    }
+    call(input, invoke) {
+        if (this.faulted)
+            throw new EdgeModuleError("EDGE_MODULE_FAULTED");
+        try {
+            const bytes = this.encoder.encode(JSON.stringify(input));
+            const ptr = this.exports.alloc(bytes.length);
+            if (ptr === 0)
+                throw new EdgeModuleError("EDGE_MODULE_FAULTED");
+            // The buffer is read after `alloc`, which may have grown the memory.
+            new Uint8Array(this.exports.memory.buffer, ptr, bytes.length).set(bytes);
+            const packed = invoke(ptr, bytes.length);
+            this.exports.dealloc(ptr, bytes.length);
+            const outPtr = Number(packed >> 32n);
+            const outLen = Number(packed & 0xffffffffn);
+            const text = this.decoder.decode(new Uint8Array(this.exports.memory.buffer, outPtr, outLen).slice());
+            this.exports.dealloc(outPtr, outLen);
+            return EdgeModule.envelope(JSON.parse(text));
+        }
+        catch {
+            this.faulted = true;
+            throw new EdgeModuleError("EDGE_MODULE_FAULTED");
+        }
+    }
+    static envelope(value) {
+        const envelope = value;
+        if (envelope.ok === true && "result" in envelope)
+            return { ok: true, result: envelope.result };
+        if (envelope.ok === false && typeof envelope.error?.code === "string") {
+            return { ok: false, code: envelope.error.code };
+        }
+        throw new EdgeModuleError("EDGE_MODULE_FAULTED");
+    }
+}
+//# sourceMappingURL=EdgeModule.js.map

package/dist/decision/edge/EdgeModule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeModule.js","sourceRoot":"","sources":["../../../src/decision/edge/EdgeModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AASzC,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACL;IAAnC,YAAmC,IAAyB;QAC1D,KAAK,CAAC,IAAI,CAAC,CAAC;QADqB,SAAI,GAAJ,IAAI,CAAqB;QAE1D,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAqBD,MAAM,SAAS,GAAG;IAChB,OAAO;IACP,SAAS;IACT,aAAa;IACb,aAAa;IACb,iBAAiB;IACjB,QAAQ;IACR,eAAe;CACP,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,UAAU;IAKgB;IAJ7B,OAAO,GAAG,KAAK,CAAC;IACP,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAC5B,OAAO,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAErE,YAAqC,OAAoB;QAApB,YAAO,GAAP,OAAO,CAAa;IAAG,CAAC;IAE7D,6DAA6D;IACtD,MAAM,CAAC,QAAQ,CAAC,IAAY;QACjC,IAAI,KAA8B,CAAC;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,SAAS,CAAC,KAA8B;QACpD,IAAI,QAA8B,CAAC;QACnC,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,kDAAkD;IAC3C,MAAM,CAAC,WAAW,CAAC,OAA4B;QACpD,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;gBACxC,2EAA2E;gBAC3E,MAAM,IAAI,eAAe,CACvB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,qBAAqB,CAC1E,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,OAAiC,CAAC,CAAC;QACjE,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,KAAK,uBAAuB,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yEAAyE;IACzE,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,mDAAmD;IAC5C,UAAU,CAAC,KAIjB;QACC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,8CAA8C;IACvC,MAAM,CAAC,MAAc,EAAE,KAAc;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,oFAAoF;IAC7E,YAAY,CAAC,MAAc;QAChC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,KAAc,EAAE,MAA4C;QACvE,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,GAAG,KAAK,CAAC;gBAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;YAChE,qEAAqE;YACrE,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CACnE,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,KAAc;QACpC,MAAM,QAAQ,GAAG,KAIhB,CAAC;QACF,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI,IAAI,QAAQ,IAAI,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/F,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/execution/ActionRegistry.d.ts

@@ -49,6 +49,8 @@ export type ActionExecutionAttempt = {
     readonly receipt: string | null;
 } | {
     readonly status: "FAILED_BEFORE_DISPATCH";
+    /** The handler's own code, when it refused with a `PreDispatchRefusal`. */
+    readonly code?: string;
 } | {
     readonly status: "REFUSED_AFTER_DISPATCH";
     readonly reason: string;
@@ -83,6 +85,27 @@ export declare class ProviderRefusal extends Error {
     /** The provider's own reason, as a code; never its response body. */
     reason: string);
 }
+/**
+ * What a handler throws when it refuses before anything was sent: the request
+ * cannot be built, a credential cannot be resolved, or the payload no longer
+ * matches what the authority bound.
+ *
+ * Any error thrown before the dispatch already counts as a failure before
+ * dispatch. This one says why: its code reaches the execution result and the
+ * audit trail instead of collapsing into HANDLER_FAILED_BEFORE_DISPATCH, so a
+ * payload that changed after the decision reads as PAYLOAD_BINDING_MISMATCH
+ * (BEAP-L3-ADP-05: what can fail before the dispatch boundary fails before
+ * it, and says so). A code that is not upper snake case is replaced with
+ * HANDLER_FAILED_BEFORE_DISPATCH, so a handler cannot write free text into the
+ * audit trail.
+ *
+ * Thrown inside the dispatch it means nothing more than any other error: the
+ * request left, so the outcome is unknown.
+ */
+export declare class PreDispatchRefusal extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
 export declare class ActionRegistry {
     private readonly actions;
     private readonly pendingReconciliations;

package/dist/execution/ActionRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActionRegistry.d.ts","sourceRoot":"","sources":["../../src/execution/ActionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,MAAM,WAAW,sBAAsB,CAAC,WAAW;IACjD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClG;;;;;;OAMG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B,CAAC,WAAW;IACtD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,sBAAsB,CAAC,OAAO,IACtC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,aAAa,CAAC,WAAW,EAAE,OAAO;IACjD,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAClF,gFAAgF;IAChF,SAAS,CAAC,CACR,OAAO,EAAE,2BAA2B,CAAC,WAAW,CAAC,GAChD,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;CAC/E;AAUD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,GAC7C;IACE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,qEAAqE;aACrD,MAAM,EAAE,MAAM;;IAD9B,qEAAqE;IACrD,MAAM,EAAE,MAAM;CAKjC;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAGnC;IACJ,OAAO,CAAC,MAAM,CAAS;IAEhB,QAAQ,CAAC,WAAW,EAAE,OAAO,EAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,GAC3C,IAAI;IAOA,IAAI,IAAI,IAAI;IAKZ,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI;IASlC,OAAO,CAClB,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,qBAAqB,GACnC,OAAO,CAAC,OAAO,CAAC;IAMN,cAAc,CACzB,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,qBAAqB,GACnC,OAAO,CAAC,sBAAsB,CAAC;IAgDrB,SAAS,CACpB,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IA+B3C,OAAO,CAAC,mBAAmB;CAiB5B"}
+{"version":3,"file":"ActionRegistry.d.ts","sourceRoot":"","sources":["../../src/execution/ActionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAExE,MAAM,WAAW,sBAAsB,CAAC,WAAW;IACjD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClG;;;;;;OAMG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B,CAAC,WAAW;IACtD,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,MAAM,sBAAsB,CAAC,OAAO,IACtC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACnC;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAEnC,MAAM,WAAW,aAAa,CAAC,WAAW,EAAE,OAAO;IACjD,QAAQ,CAAC,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAClF,gFAAgF;IAChF,SAAS,CAAC,CACR,OAAO,EAAE,2BAA2B,CAAC,WAAW,CAAC,GAChD,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;CAC/E;AAUD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC3F;IACE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GACD;IAAE,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEnF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,qEAAqE;aACrD,MAAM,EAAE,MAAM;;IAD9B,qEAAqE;IACrD,MAAM,EAAE,MAAM;CAKjC;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAgB,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM;CAMhC;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;IAC/D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAGnC;IACJ,OAAO,CAAC,MAAM,CAAS;IAEhB,QAAQ,CAAC,WAAW,EAAE,OAAO,EAClC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,GAC3C,IAAI;IAOA,IAAI,IAAI,IAAI;IAKZ,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI;IASlC,OAAO,CAClB,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,qBAAqB,GACnC,OAAO,CAAC,OAAO,CAAC;IAMN,cAAc,CACzB,QAAQ,EAAE,cAAc,EACxB,aAAa,EAAE,qBAAqB,GACnC,OAAO,CAAC,sBAAsB,CAAC;IAiDrB,SAAS,CACpB,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IA+B3C,OAAO,CAAC,mBAAmB;CAiB5B"}

package/dist/execution/ActionRegistry.js

@@ -27,6 +27,34 @@ export class ProviderRefusal extends Error {
         this.name = "ProviderRefusal";
     }
 }
+/** A pre-dispatch refusal code: upper snake case, as every reason code here is. */
+const PRE_DISPATCH_CODE = /^[A-Z][A-Z0-9_]{2,63}$/;
+/**
+ * What a handler throws when it refuses before anything was sent: the request
+ * cannot be built, a credential cannot be resolved, or the payload no longer
+ * matches what the authority bound.
+ *
+ * Any error thrown before the dispatch already counts as a failure before
+ * dispatch. This one says why: its code reaches the execution result and the
+ * audit trail instead of collapsing into HANDLER_FAILED_BEFORE_DISPATCH, so a
+ * payload that changed after the decision reads as PAYLOAD_BINDING_MISMATCH
+ * (BEAP-L3-ADP-05: what can fail before the dispatch boundary fails before
+ * it, and says so). A code that is not upper snake case is replaced with
+ * HANDLER_FAILED_BEFORE_DISPATCH, so a handler cannot write free text into the
+ * audit trail.
+ *
+ * Thrown inside the dispatch it means nothing more than any other error: the
+ * request left, so the outcome is unknown.
+ */
+export class PreDispatchRefusal extends Error {
+    code;
+    constructor(code) {
+        const safe = PRE_DISPATCH_CODE.test(code) ? code : "HANDLER_FAILED_BEFORE_DISPATCH";
+        super(safe);
+        this.name = "PreDispatchRefusal";
+        this.code = safe;
+    }
+}
 export class ActionRegistry {
     actions = new Map();
     pendingReconciliations = new Map();
@@ -107,8 +135,10 @@ export class ActionRegistry {
             if (dispatched && error instanceof ProviderRefusal) {
                 return { status: "REFUSED_AFTER_DISPATCH", reason: error.reason, receipt };
             }
-            return dispatched
-                ? { status: "UNKNOWN_AFTER_DISPATCH", receipt }
+            if (dispatched)
+                return { status: "UNKNOWN_AFTER_DISPATCH", receipt };
+            return error instanceof PreDispatchRefusal
+                ? { status: "FAILED_BEFORE_DISPATCH", code: error.code }
                 : { status: "FAILED_BEFORE_DISPATCH" };
         }
     }

package/dist/execution/ActionRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"ActionRegistry.js","sourceRoot":"","sources":["../../src/execution/ActionRegistry.ts"],"names":[],"mappings":"AAmEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB;IAFlB;IACE,qEAAqE;IACrD,MAAc;QAE9B,KAAK,CAAC,MAAM,CAAC,CAAC;QAFE,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC9C,sBAAsB,GAAG,IAAI,GAAG,EAG9C,CAAC;IACI,MAAM,GAAG,KAAK,CAAC;IAEhB,QAAQ,CACb,MAAc,EACd,OAA4C;QAE5C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAA2B,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,IAAI;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAEM,QAAQ,CAAC,QAAwB;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,QAAwB,EACxB,aAAoC;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,QAAwB,EACxB,aAAoC;QAEpC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClE,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,MAAM,QAAQ,GAAqB,MAAM,CAAC,MAAM,CAAC;YAC/C,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc;YAC9C,GAAG,EAAE,KAAK,EACR,SAAiE,EAC/C,EAAE;gBACpB,IAAI,UAAU;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACrE,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,CAAC,KAAa,EAAQ,EAAE;gBAC/B,IAAI,CAAC,UAAU;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACrE,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC;oBAC5B,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,aAAa;oBACb,QAAQ;iBACT,CAAC;gBACF,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,UAAU,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;gBACnD,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7E,CAAC;YACD,OAAO,UAAU;gBACf,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE;gBAC/C,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,QAAwB,EACxB,cAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,IAAI,cAAc,KAAK,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClF,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAElE,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,UAAU,SAAS,cAAc,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,MAAM,OAAO,CAAC;QAEhD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE;aACrC,IAAI,CAAC,KAAK,IAAI,EAAE,CACf,IAAI,CAAC,mBAAmB,CACtB,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,cAAc;SACf,CAAC,CACH,CACF;aACA,KAAK,CAAC,GAAoC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;aACrE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,OAAO,MAAM,cAAc,CAAC;IAC9B,CAAC;IAEO,mBAAmB,CAAC,KAAc;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAChF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;YACvE,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"ActionRegistry.js","sourceRoot":"","sources":["../../src/execution/ActionRegistry.ts"],"names":[],"mappings":"AAuEA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAGtB;IAFlB;IACE,qEAAqE;IACrD,MAAc;QAE9B,KAAK,CAAC,MAAM,CAAC,CAAC;QAFE,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3B,IAAI,CAAS;IAE7B,YAAmB,IAAY;QAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC,CAAC;QACpF,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC9C,sBAAsB,GAAG,IAAI,GAAG,EAG9C,CAAC;IACI,MAAM,GAAG,KAAK,CAAC;IAEhB,QAAQ,CACb,MAAc,EACd,OAA4C;QAE5C,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAA2B,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,IAAI;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,GAAG,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAEM,QAAQ,CAAC,QAAwB;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,OAAO,CAClB,QAAwB,EACxB,aAAoC;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAEM,KAAK,CAAC,cAAc,CACzB,QAAwB,EACxB,aAAoC;QAEpC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClE,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,OAAO,GAAkB,IAAI,CAAC;QAClC,MAAM,QAAQ,GAAqB,MAAM,CAAC,MAAM,CAAC;YAC/C,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc;YAC9C,GAAG,EAAE,KAAK,EACR,SAAiE,EAC/C,EAAE;gBACpB,IAAI,UAAU;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACrE,UAAU,GAAG,IAAI,CAAC;gBAClB,OAAO,MAAM,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,EAAE,CAAC,KAAa,EAAQ,EAAE;gBAC/B,IAAI,CAAC,UAAU;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBACrE,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC;oBAC5B,MAAM,EAAE,QAAQ;oBAChB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,aAAa;oBACb,QAAQ;iBACT,CAAC;gBACF,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,uEAAuE;YACvE,mEAAmE;YACnE,mEAAmE;YACnE,IAAI,UAAU,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;gBACnD,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7E,CAAC;YACD,IAAI,UAAU;gBAAE,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC;YACrE,OAAO,KAAK,YAAY,kBAAkB;gBACxC,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;gBACxD,CAAC,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,SAAS,CACpB,QAAwB,EACxB,cAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChE,IAAI,cAAc,KAAK,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClF,IAAI,CAAC,UAAU,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAElE,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,UAAU,SAAS,cAAc,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,MAAM,OAAO,CAAC;QAEhD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE;aACrC,IAAI,CAAC,KAAK,IAAI,EAAE,CACf,IAAI,CAAC,mBAAmB,CACtB,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;YACxB,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,UAAU,CAAC,IAAI;YAC3B,cAAc;SACf,CAAC,CACH,CACF;aACA,KAAK,CAAC,GAAoC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;aACrE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACrD,OAAO,MAAM,cAAc,CAAC;IAC9B,CAAC;IAEO,mBAAmB,CAAC,KAAc;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAChF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC;YACvE,IAAI,CAAC,MAAM,KAAK,CAAC,EACjB,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/execution/AuthorizationVerifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationVerifier.d.ts","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,EACvB,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACnF,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,GAAG,aAAa,CAAC;IACzD,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAC;IAClD;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CACd,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACnF;AAyID,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqD;IAC5E,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+D;IAEvF;;;;;OAKG;WACW,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,MAAM,EAAE;gBAKvD,OAAO,EAAE,4BAA4B;IAU3C,gBAAgB,CAC3B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAsG3B,QAAQ,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAkB7F;;;;OAIG;IACI,YAAY,CAAC,aAAa,EAAE,qBAAqB,GAAG,qBAAqB,GAAG,IAAI;IAIvF;;;;;OAKG;YACW,IAAI;IAyDlB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAerC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;CAKrC"}
+{"version":3,"file":"AuthorizationVerifier.d.ts","sourceRoot":"","sources":["../../src/execution/AuthorizationVerifier.ts"],"names":[],"mappings":"AAGA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAG1E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAErE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,yFAAyF;AACzF,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG,QAAQ,GAAG,eAAe,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,EACvB,gBAAgB,GAChB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,GACtB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACnF,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,kBAAkB,EAAE,WAAW,GAAG,aAAa,CAAC;IACzD,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnD;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAC;IAClD;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CACd,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;CACnF;AAyID,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqD;IAC5E,0FAA0F;IAC1F,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+D;IAEvF;;;;;OAKG;WACW,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,UAAU,MAAM,EAAE;gBAKvD,OAAO,EAAE,4BAA4B;IAU3C,gBAAgB,CAC3B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA2G3B,QAAQ,CAAC,KAAK,EAAE,8BAA8B,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAkB7F;;;;OAIG;IACI,YAAY,CAAC,aAAa,EAAE,qBAAqB,GAAG,qBAAqB,GAAG,IAAI;IAIvF;;;;;OAKG;YACW,IAAI;IAyDlB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,MAAM,CAAC,sBAAsB;IAerC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,qBAAqB;CAKrC"}

package/dist/execution/AuthorizationVerifier.js

@@ -178,8 +178,13 @@ export class DecionisGrantVerifier {
                     intent_hash: captured.intentHash,
                     intent: CanonicalIntentHasher.bindingOf(captured.intent),
                     // A Presence-bound decision is re-verified by the authority at claim
-                    // time, so the same evidence must accompany the claim.
-                    ...(decision.evidence === undefined ? {} : { evidence: decision.evidence }),
+                    // time, so the same evidence must accompany the claim. A presence
+                    // attestation is verified once, at evaluation, where the authority
+                    // records it with the grant; the claim contract carries Presence
+                    // evidence only, so an attestation is not sent again here.
+                    ...(decision.evidence?.humanApproval?.provider === "presence"
+                        ? { evidence: decision.evidence }
+                        : {}),
                     consumed_by: captured.intent.actor.id,
                     commit_correlation_id: commitCorrelationId,
                 }),