@decionis/agent-safe-pipeline 0.3.5 → 0.3.6

package/dist/decision/edge/EdgeBundleManager.d.ts

@@ -0,0 +1,87 @@
+import { type BundleValidity } from "./BundleWindow.js";
+import type { EdgeBundleSource } from "./EdgeBundleSource.js";
+import type { EdgeModule } from "./EdgeModule.js";
+/** A bundle the module verified and holds under `handle`. */
+export interface LoadedBundle extends BundleValidity {
+    readonly handle: number;
+    readonly bundleId: string;
+    readonly policyVersion: string;
+    readonly kid: string;
+    readonly expiresAt: string;
+}
+/**
+ * What the manager reports. Identifiers, codes and counts only: no URL, no
+ * header, no response body and no credential can reach a field here.
+ */
+export type EdgeBundleEvent = {
+    readonly event: "EDGE_BUNDLE_LOADED";
+    readonly bundle_id: string;
+    readonly policy_version: string;
+    readonly kid: string;
+    readonly expires_at: string;
+} | {
+    readonly event: "EDGE_BUNDLE_REFRESH_FAILED";
+    readonly code: string;
+    readonly failures: number;
+    readonly retry_ms: number;
+} | {
+    readonly event: "EDGE_BUNDLE_EXPIRED";
+    readonly bundle_id: string;
+    readonly policy_version: string;
+};
+export interface EdgeBundleManagerOptions {
+    readonly module: EdgeModule;
+    readonly source: EdgeBundleSource;
+    /** The organisation the bundle must be issued to; the module checks it against `aud`. */
+    readonly orgId: string;
+    /** The routine refresh interval. One hour by default. */
+    readonly refreshSeconds?: number;
+    /** Epoch milliseconds; the only time the module is ever given. */
+    readonly clock?: () => number;
+    readonly onEvent?: (event: EdgeBundleEvent) => void;
+    readonly retryBaseMs?: number;
+    readonly retryMaxMs?: number;
+    readonly minimumMs?: number;
+}
+/**
+ * Keeps one verified bundle loaded in the module and the next one coming.
+ *
+ * The loaded bundle is replaced only by one the module has verified: the new
+ * handle becomes current in one assignment and the old handle is released
+ * after it, so a decision always runs on exactly one of the two. A failed
+ * fetch or a refused bundle leaves the last good bundle in place until its
+ * own expiry, and is retried with backoff. Past its expiry a bundle is
+ * released and nothing is loaded: there is no grace period, because a bundle
+ * past `exp` is one Decionis no longer stands behind.
+ */
+export declare class EdgeBundleManager {
+    private readonly options;
+    private loaded;
+    private failures;
+    private timer;
+    private inflight;
+    private stopped;
+    private readonly clock;
+    private readonly policy;
+    constructor(options: EdgeBundleManagerOptions);
+    /**
+     * The bundle a decision may run on at `now`, or null. A bundle past its
+     * expiry is released here, so the moment it lapses is the moment it stops
+     * being used, whatever the refresh schedule is doing.
+     */
+    current(now: number): LoadedBundle | null;
+    /** Fetches and loads once now; the first call of `start`, and what a test drives. */
+    refresh(): Promise<string | null>;
+    /** The first refresh, awaited, then the schedule. */
+    start(): Promise<void>;
+    /** Stops the schedule and releases the loaded bundle. */
+    stop(): void;
+    private tick;
+    /** One fetch and load. Null when the loaded bundle is current; otherwise the failure's code. */
+    private attempt;
+    private failed;
+    private emit;
+    /** The module's refusal as a log code: its own identifier, upper-cased, and nothing else of it. */
+    private static refusal;
+}
+//# sourceMappingURL=EdgeBundleManager.d.ts.map

package/dist/decision/edge/EdgeBundleManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeBundleManager.d.ts","sourceRoot":"","sources":["../../../src/decision/edge/EdgeBundleManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAC1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB;IACE,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,4BAA4B,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAEN,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAeD;;;;;;;;;;GAUG;AACH,qBAAa,iBAAiB;IAST,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR3C,OAAO,CAAC,MAAM,CAAmE;IACjF,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,KAAK,CAA8C;IAC3D,OAAO,CAAC,QAAQ,CAAuC;IACvD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;gBAEH,OAAO,EAAE,wBAAwB;IAWrE;;;;OAIG;IACI,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAgBhD,qFAAqF;IACxE,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAO9C,qDAAqD;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAKnC,yDAAyD;IAClD,IAAI,IAAI,IAAI;YASL,IAAI;IAgBlB,gGAAgG;YAClF,OAAO;IAgDrB,OAAO,CAAC,MAAM;IAKd,OAAO,CAAC,IAAI;IAQZ,mGAAmG;IACnG,OAAO,CAAC,MAAM,CAAC,OAAO;CAGvB"}

package/dist/decision/edge/EdgeBundleManager.js

@@ -0,0 +1,175 @@
+import { z } from "zod";
+import { BundleWindow } from "./BundleWindow.js";
+const DEFAULT_REFRESH_SECONDS = 3_600;
+/** A file is looked at this often, whatever the routine interval: it changes when an operator says so. */
+const FILE_POLL_MS = 10_000;
+const LoadResultSchema = z.object({
+    handle: z.number().int().min(1).max(0xffffffff),
+    bundle_id: z.string().min(1).max(200),
+    policy_version: z.string().min(1).max(200),
+    kid: z.string().min(1).max(200),
+    not_before: z.string().datetime({ offset: true }),
+    expires_at: z.string().datetime({ offset: true }),
+});
+/**
+ * Keeps one verified bundle loaded in the module and the next one coming.
+ *
+ * The loaded bundle is replaced only by one the module has verified: the new
+ * handle becomes current in one assignment and the old handle is released
+ * after it, so a decision always runs on exactly one of the two. A failed
+ * fetch or a refused bundle leaves the last good bundle in place until its
+ * own expiry, and is retried with backoff. Past its expiry a bundle is
+ * released and nothing is loaded: there is no grace period, because a bundle
+ * past `exp` is one Decionis no longer stands behind.
+ */
+export class EdgeBundleManager {
+    options;
+    loaded = null;
+    failures = 0;
+    timer = null;
+    inflight = null;
+    stopped = false;
+    clock;
+    policy;
+    constructor(options) {
+        this.options = options;
+        this.clock = options.clock ?? Date.now;
+        const refreshMs = (options.refreshSeconds ?? DEFAULT_REFRESH_SECONDS) * 1_000;
+        this.policy = {
+            refreshMs: options.source.kind === "file" ? Math.min(refreshMs, FILE_POLL_MS) : refreshMs,
+            retryBaseMs: options.retryBaseMs ?? 1_000,
+            retryMaxMs: options.retryMaxMs ?? 300_000,
+            minimumMs: options.minimumMs ?? 30_000,
+        };
+    }
+    /**
+     * The bundle a decision may run on at `now`, or null. A bundle past its
+     * expiry is released here, so the moment it lapses is the moment it stops
+     * being used, whatever the refresh schedule is doing.
+     */
+    current(now) {
+        const loaded = this.loaded;
+        if (loaded === null)
+            return null;
+        if (now >= loaded.expiresAtMs) {
+            this.loaded = null;
+            this.options.module.unloadBundle(loaded.handle);
+            this.emit({
+                event: "EDGE_BUNDLE_EXPIRED",
+                bundle_id: loaded.bundleId,
+                policy_version: loaded.policyVersion,
+            });
+            return null;
+        }
+        return BundleWindow.usable(loaded, now) ? loaded : null;
+    }
+    /** Fetches and loads once now; the first call of `start`, and what a test drives. */
+    async refresh() {
+        this.inflight ??= this.attempt().finally(() => {
+            this.inflight = null;
+        });
+        return await this.inflight;
+    }
+    /** The first refresh, awaited, then the schedule. */
+    async start() {
+        this.stopped = false;
+        await this.tick();
+    }
+    /** Stops the schedule and releases the loaded bundle. */
+    stop() {
+        this.stopped = true;
+        if (this.timer !== null)
+            clearTimeout(this.timer);
+        this.timer = null;
+        const loaded = this.loaded;
+        this.loaded = null;
+        if (loaded !== null)
+            this.options.module.unloadBundle(loaded.handle);
+    }
+    async tick() {
+        const failure = await this.refresh();
+        if (this.stopped)
+            return;
+        const delay = BundleWindow.nextDelay(this.policy, this.loaded, this.failures, this.clock());
+        if (failure !== null) {
+            this.emit({
+                event: "EDGE_BUNDLE_REFRESH_FAILED",
+                code: failure,
+                failures: this.failures,
+                retry_ms: delay,
+            });
+        }
+        this.timer = setTimeout(() => void this.tick(), delay);
+        this.timer.unref();
+    }
+    /** One fetch and load. Null when the loaded bundle is current; otherwise the failure's code. */
+    async attempt() {
+        const read = await this.options.source.read();
+        if (!read.ok)
+            return this.failed(read.code);
+        if (this.loaded?.signedBundle === read.signedBundle) {
+            this.failures = 0;
+            return null;
+        }
+        let envelope;
+        try {
+            envelope = this.options.module.loadBundle({
+                signed_bundle: read.signedBundle,
+                org_id: this.options.orgId,
+                now: new Date(this.clock()).toISOString(),
+            });
+        }
+        catch {
+            return this.failed("EDGE_MODULE_FAULTED");
+        }
+        if (!envelope.ok)
+            return this.failed(EdgeBundleManager.refusal(envelope.code));
+        const parsed = LoadResultSchema.safeParse(envelope.result);
+        if (!parsed.success) {
+            const handle = envelope.result?.handle;
+            if (typeof handle === "number")
+                this.options.module.unloadBundle(handle);
+            return this.failed("BUNDLE_LOAD_RESULT_INVALID");
+        }
+        const result = parsed.data;
+        const previous = this.loaded;
+        this.loaded = {
+            handle: result.handle,
+            bundleId: result.bundle_id,
+            policyVersion: result.policy_version,
+            kid: result.kid,
+            notBeforeMs: Date.parse(result.not_before),
+            expiresAtMs: Date.parse(result.expires_at),
+            expiresAt: new Date(Date.parse(result.expires_at)).toISOString(),
+            signedBundle: read.signedBundle,
+        };
+        if (previous !== null)
+            this.options.module.unloadBundle(previous.handle);
+        this.failures = 0;
+        this.emit({
+            event: "EDGE_BUNDLE_LOADED",
+            bundle_id: result.bundle_id,
+            policy_version: result.policy_version,
+            kid: result.kid,
+            expires_at: this.loaded.expiresAt,
+        });
+        return null;
+    }
+    failed(code) {
+        this.failures += 1;
+        return code;
+    }
+    emit(event) {
+        try {
+            this.options.onEvent?.(event);
+        }
+        catch {
+            // Reporting never changes which bundle is loaded.
+        }
+    }
+    /** The module's refusal as a log code: its own identifier, upper-cased, and nothing else of it. */
+    static refusal(code) {
+        return /^[a-z][a-z0-9_]{0,62}$/.test(code) ? code.toUpperCase() : "BUNDLE_REFUSED";
+    }
+}
+//# sourceMappingURL=EdgeBundleManager.js.map

package/dist/decision/edge/EdgeBundleManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeBundleManager.js","sourceRoot":"","sources":["../../../src/decision/edge/EdgeBundleManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAA2C,MAAM,mBAAmB,CAAC;AAoD1F,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,0GAA0G;AAC1G,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,OAAO,iBAAiB;IASQ;IAR5B,MAAM,GAA8D,IAAI,CAAC;IACzE,QAAQ,GAAG,CAAC,CAAC;IACb,KAAK,GAAyC,IAAI,CAAC;IACnD,QAAQ,GAAkC,IAAI,CAAC;IAC/C,OAAO,GAAG,KAAK,CAAC;IACP,KAAK,CAAe;IACpB,MAAM,CAAgB;IAEvC,YAAoC,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QACnE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;QACvC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,GAAG,KAAK,CAAC;QAC9E,IAAI,CAAC,MAAM,GAAG;YACZ,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;YACzF,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,KAAK;YACzC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO;YACzC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,MAAM;SACvC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,OAAO,CAAC,GAAW;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,qBAAqB;gBAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,cAAc,EAAE,MAAM,CAAC,aAAa;aACrC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAED,qFAAqF;IAC9E,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAED,qDAAqD;IAC9C,KAAK,CAAC,KAAK;QAChB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,yDAAyD;IAClD,IAAI;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5F,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,4BAA4B;gBACnC,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,gGAAgG;IACxF,KAAK,CAAC,OAAO;QACnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACpD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;gBACxC,aAAa,EAAE,IAAI,CAAC,YAAY;gBAChC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;gBAC1B,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAI,QAAQ,CAAC,MAA+C,EAAE,MAAM,CAAC;YACjF,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG;YACZ,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,aAAa,EAAE,MAAM,CAAC,cAAc;YACpC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YAC1C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;YAC1C,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE;YAChE,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;QACF,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,CAAC;YACR,KAAK,EAAE,oBAAoB;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;SAClC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,IAAY;QACzB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,IAAI,CAAC,KAAsB;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IAED,mGAAmG;IAC3F,MAAM,CAAC,OAAO,CAAC,IAAY;QACjC,OAAO,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACrF,CAAC;CACF"}

package/dist/decision/edge/EdgeBundleSource.d.ts

@@ -0,0 +1,59 @@
+import { type ClientSource } from "../../http/ClientIdentification.js";
+import { type Credential } from "../../http/Credential.js";
+/**
+ * What a source produced: a signed bundle as a compact JWS, or a code saying
+ * why not. A code is an identifier chosen here; no status text, header,
+ * body or credential from the attempt is carried, so it is safe to log.
+ */
+export type BundleRead = {
+    readonly ok: true;
+    readonly signedBundle: string;
+} | {
+    readonly ok: false;
+    readonly code: string;
+};
+/** Where signed policy bundles come from. */
+export interface EdgeBundleSource {
+    /** `url` fetches from Decionis; `file` reads what an operator placed on disk. */
+    readonly kind: "url" | "file";
+    read(): Promise<BundleRead>;
+}
+/**
+ * Takes the signed bundle out of what a source returned: the issuance
+ * response (`{"signed_bundle": …}`), or the compact JWS on its own, which is
+ * what an operator copying a bundle by hand will most likely place.
+ */
+export declare function signedBundleOf(text: string): BundleRead;
+export interface UrlBundleSourceOptions {
+    /** The Decionis API base URL, the same one the hosted gate calls. */
+    readonly baseUrl: string;
+    /** The organisation's API key (`policy:read`), read at the moment of each request. */
+    readonly apiKey: Credential;
+    readonly timeoutMs?: number;
+    readonly fetch?: typeof fetch;
+    readonly allowInsecureLoopback?: boolean;
+    readonly source?: ClientSource;
+}
+/** `GET /v1/edge/policy-bundles/current`, authenticated with the organisation's API key. */
+export declare class UrlBundleSource implements EdgeBundleSource {
+    readonly kind = "url";
+    private readonly url;
+    private readonly apiKey;
+    private readonly timeoutMs;
+    private readonly fetchImpl;
+    private readonly userAgent;
+    constructor(options: UrlBundleSourceOptions);
+    read(): Promise<BundleRead>;
+}
+/**
+ * A file an operator replaces by hand, for a deployment with no route to
+ * Decionis. It is read on every refresh; the manager loads it only when it
+ * holds a bundle other than the one already loaded.
+ */
+export declare class FileBundleSource implements EdgeBundleSource {
+    private readonly path;
+    readonly kind = "file";
+    constructor(path: string);
+    read(): Promise<BundleRead>;
+}
+//# sourceMappingURL=EdgeBundleSource.d.ts.map

package/dist/decision/edge/EdgeBundleSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeBundleSource.d.ts","sourceRoot":"","sources":["../../../src/decision/edge/EdgeBundleSource.ts"],"names":[],"mappings":"AAGA,OAAO,EAAa,KAAK,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAE7E;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IAC9B,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7B;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAavD;AAED,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAChC;AAED,4FAA4F;AAC5F,qBAAa,eAAgB,YAAW,gBAAgB;IACtD,SAAgB,IAAI,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEhB,OAAO,EAAE,sBAAsB;IAYrC,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;CAyBzC;AAED;;;;GAIG;AACH,qBAAa,gBAAiB,YAAW,gBAAgB;IAGpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFxC,SAAgB,IAAI,UAAU;gBAEM,IAAI,EAAE,MAAM;IAEnC,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;CAWzC"}

package/dist/decision/edge/EdgeBundleSource.js

@@ -0,0 +1,99 @@
+import { readFile } from "node:fs/promises";
+import { AuthorityBaseUrl } from "../../http/AuthorityBaseUrl.js";
+import { BoundedResponseBody } from "../../http/BoundedResponseBody.js";
+import { userAgent } from "../../http/ClientIdentification.js";
+import { credentialReader } from "../../http/Credential.js";
+/** Three non-empty base64url segments: the only shape `load_bundle` accepts. */
+const COMPACT_JWS = /^[\w-]+\.[\w-]+\.[\w-]+$/;
+/** `load_bundle` refuses inputs over 4 MiB; a bundle near that is refused here first. */
+const MAX_BUNDLE_BYTES = 4 * 1024 * 1024;
+/**
+ * Takes the signed bundle out of what a source returned: the issuance
+ * response (`{"signed_bundle": …}`), or the compact JWS on its own, which is
+ * what an operator copying a bundle by hand will most likely place.
+ */
+export function signedBundleOf(text) {
+    const trimmed = text.trim();
+    let candidate = trimmed;
+    if (trimmed.startsWith("{")) {
+        try {
+            candidate = JSON.parse(trimmed).signed_bundle;
+        }
+        catch {
+            return { ok: false, code: "BUNDLE_RESPONSE_INVALID" };
+        }
+    }
+    return typeof candidate === "string" && COMPACT_JWS.test(candidate)
+        ? { ok: true, signedBundle: candidate }
+        : { ok: false, code: "BUNDLE_RESPONSE_INVALID" };
+}
+/** `GET /v1/edge/policy-bundles/current`, authenticated with the organisation's API key. */
+export class UrlBundleSource {
+    kind = "url";
+    url;
+    apiKey;
+    timeoutMs;
+    fetchImpl;
+    userAgent;
+    constructor(options) {
+        const base = AuthorityBaseUrl.normalize(options.baseUrl, options.allowInsecureLoopback === true);
+        this.url = `${base}/v1/edge/policy-bundles/current`;
+        this.apiKey = credentialReader(options.apiKey);
+        this.timeoutMs = Math.min(Math.max(options.timeoutMs ?? 10_000, 1), 30_000);
+        this.fetchImpl = options.fetch ?? fetch;
+        this.userAgent = userAgent(options.source);
+    }
+    async read() {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const response = await this.fetchImpl(this.url, {
+                method: "GET",
+                headers: {
+                    authorization: `Bearer ${this.apiKey()}`,
+                    accept: "application/json",
+                    "user-agent": this.userAgent,
+                },
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                await response.body?.cancel().catch(() => undefined);
+                return { ok: false, code: `BUNDLE_HTTP_${response.status}` };
+            }
+            const text = await BoundedResponseBody.read(response, MAX_BUNDLE_BYTES);
+            return text === null ? { ok: false, code: "BUNDLE_TOO_LARGE" } : signedBundleOf(text);
+        }
+        catch {
+            return { ok: false, code: "BUNDLE_FETCH_FAILED" };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+/**
+ * A file an operator replaces by hand, for a deployment with no route to
+ * Decionis. It is read on every refresh; the manager loads it only when it
+ * holds a bundle other than the one already loaded.
+ */
+export class FileBundleSource {
+    path;
+    kind = "file";
+    constructor(path) {
+        this.path = path;
+    }
+    async read() {
+        let text;
+        try {
+            const bytes = await readFile(this.path);
+            if (bytes.byteLength > MAX_BUNDLE_BYTES)
+                return { ok: false, code: "BUNDLE_TOO_LARGE" };
+            text = bytes.toString("utf8");
+        }
+        catch {
+            return { ok: false, code: "BUNDLE_FILE_UNREADABLE" };
+        }
+        return signedBundleOf(text);
+    }
+}
+//# sourceMappingURL=EdgeBundleSource.js.map

package/dist/decision/edge/EdgeBundleSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeBundleSource.js","sourceRoot":"","sources":["../../../src/decision/edge/EdgeBundleSource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,SAAS,EAAqB,MAAM,oCAAoC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,0BAA0B,CAAC;AAkB7E,gFAAgF;AAChF,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,yFAAyF;AACzF,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAY,OAAO,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,SAAS,GAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAA0C,CAAC,aAAa,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;QACjE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE;QACvC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;AACrD,CAAC;AAaD,4FAA4F;AAC5F,MAAM,OAAO,eAAe;IACV,IAAI,GAAG,KAAK,CAAC;IACZ,GAAG,CAAS;IACZ,MAAM,CAAe;IACrB,SAAS,CAAS;IAClB,SAAS,CAAe;IACxB,SAAS,CAAS;IAEnC,YAAmB,OAA+B;QAChD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CACrC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,qBAAqB,KAAK,IAAI,CACvC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,iCAAiC,CAAC;QACpD,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC9C,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACxC,MAAM,EAAE,kBAAkB;oBAC1B,YAAY,EAAE,IAAI,CAAC,SAAS;iBAC7B;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC/D,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;YACxE,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAGS;IAFpB,IAAI,GAAG,MAAM,CAAC;IAE9B,YAAoC,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAE7C,KAAK,CAAC,IAAI;QACf,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,UAAU,GAAG,gBAAgB;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;YACxF,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;QACvD,CAAC;QACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;CACF"}

package/dist/decision/edge/EdgeDecisionAuthority.d.ts

@@ -0,0 +1,104 @@
+import type { LocalGrants } from "../../execution/LocalAuthorizationVerifier.js";
+import type { ReplayStore } from "../../execution/ReplayStore.js";
+import type { CapturedIntent } from "../../intent/ExecutionIntent.js";
+import { type DecisionAuthority, type DecisionEvaluationMode, type DecisionEvaluationOptions, type DecisionEvidence, type DecisionVerdict, type GateDecision } from "../DecisionAuthority.js";
+import type { EdgeBundleManager } from "./EdgeBundleManager.js";
+import type { EdgeModule } from "./EdgeModule.js";
+/** What happens when no local decision can be made: ask Decionis, or refuse. */
+export type EdgeUnavailablePolicy = "hosted" | "block";
+/**
+ * One line of local evidence. A decision line names the bundle it was made
+ * on and the digest of the evaluation; it carries the identifiers and the
+ * verdict the hosted record carries, and no parameter, amount, or value from
+ * the intent. These lines are what a deployment's edge usage is counted from.
+ */
+export type EdgeDecisionRecord = {
+    readonly event: "EDGE_DECISION";
+    readonly mode: DecisionEvaluationMode;
+    readonly intent_id: string;
+    readonly intent_hash: string;
+    readonly decision_id: string;
+    readonly verdict: DecisionVerdict;
+    readonly reason_codes: readonly string[];
+    readonly policy_version: string;
+    readonly bundle_id: string;
+    readonly kid: string;
+    readonly jti: string;
+    readonly evaluation_digest: string;
+    /** True when the verdict sends the intent on to Decionis (an `ESCALATE` in enforcement). */
+    readonly delegated: boolean;
+} | {
+    readonly event: "EDGE_UNAVAILABLE";
+    readonly mode: DecisionEvaluationMode;
+    readonly intent_id: string;
+    readonly intent_hash: string;
+    readonly reason: string;
+    /** The module's own refusal code, when it gave one. */
+    readonly module_code: string | null;
+    readonly fallback: "HOSTED" | "BLOCK";
+};
+export interface EdgeDecisionAuthorityOptions {
+    readonly module: EdgeModule;
+    readonly bundles: EdgeBundleManager;
+    /**
+     * The hosted authority: Decionis through `enforce-and-bind`. An `ESCALATE`
+     * goes to it, so Presence and attestation flows run as they always have,
+     * and so does an intent the edge cannot decide when `onUnavailable` is
+     * `hosted`.
+     */
+    readonly hosted: DecisionAuthority;
+    /** Where an enforcement `ALLOW` is held for the executor to consume once. */
+    readonly grants: LocalGrants;
+    /**
+     * The single-use store the local verifier claims intents in. When given,
+     * an enforcement decision about an intent that has already run (on this
+     * replica or, with a shared store, on any) is refused before it is made.
+     */
+    readonly replay?: ReplayStore;
+    readonly mode?: DecisionEvaluationMode;
+    /** `hosted` (the default) or `block`. Neither ever allows without a valid bundle. */
+    readonly onUnavailable?: EdgeUnavailablePolicy;
+    readonly clock?: () => number;
+    /** The executor's evidence stream. A decision that cannot be recorded is not made. */
+    readonly record?: (record: EdgeDecisionRecord) => void;
+}
+/**
+ * A `DecisionAuthority` that decides inside the deployment, with the Decionis
+ * edge evaluator: the same verdict hosted `enforce-and-bind` gives for the
+ * same binding and bundle, with no network call on the way.
+ *
+ * - `ALLOW` in enforcement becomes a local authorization, held in
+ *   `LocalGrants` and consumed once by `LocalAuthorizationVerifier`; there is
+ *   no Decionis grant on this path and nothing to claim.
+ * - `BLOCK` is a refusal, as it is hosted.
+ * - `ESCALATE` in enforcement hands the same intent, with the same escalation
+ *   options, to the hosted authority: the human-approval paths are hosted.
+ * - Approval evidence is only ever evaluated hosted.
+ * - No usable bundle, a module fault, or a result this host cannot read
+ *   follows `onUnavailable`: the hosted authority, or a fail-closed `BLOCK`.
+ *
+ * This class is the open host. The evaluator is a separately licensed
+ * module this package does not contain; without it the executor runs on the
+ * hosted authority alone, exactly as it does without this class.
+ */
+export declare class EdgeDecisionAuthority implements DecisionAuthority {
+    private readonly options;
+    readonly evaluationMode: DecisionEvaluationMode;
+    private readonly onUnavailable;
+    private readonly clock;
+    constructor(options: EdgeDecisionAuthorityOptions);
+    evaluate(captured: CapturedIntent, evidence?: DecisionEvidence, options?: DecisionEvaluationOptions): Promise<GateDecision>;
+    private local;
+    private unavailable;
+    /**
+     * Why an enforcement decision must not be made: the intent has already
+     * been claimed, or the store that would say so cannot be asked. Neither is
+     * a decision, so neither is recorded or counted.
+     */
+    private replayed;
+    /** The module must have decided on the bundle this host gave it. */
+    private static sameBundle;
+    /** Unique per intent and evaluation, and derivable from the record that names it. */
+    private static decisionId;
+}
+//# sourceMappingURL=EdgeDecisionAuthority.d.ts.map

package/dist/decision/edge/EdgeDecisionAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeDecisionAuthority.d.ts","sourceRoot":"","sources":["../../../src/decision/edge/EdgeDecisionAuthority.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+CAA+C,CAAC;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,iBAAiB,EAAgB,MAAM,wBAAwB,CAAC;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,gFAAgF;AAChF,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC;CACvC,CAAC;AAEN,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC;IACvC,qFAAqF;IACrF,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;CACxD;AAsBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,qBAAsB,YAAW,iBAAiB;IAK1C,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ3C,SAAgB,cAAc,EAAE,sBAAsB,CAAC;IACvD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAwB;IACtD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAED,OAAO,EAAE,4BAA4B;IAc5D,QAAQ,CACnB,QAAQ,EAAE,cAAc,EACxB,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,YAAY,CAAC;IAqDxB,OAAO,CAAC,KAAK;YAoCC,WAAW;IA0BzB;;;;OAIG;YACW,QAAQ;IAUtB,oEAAoE;IACpE,OAAO,CAAC,MAAM,CAAC,UAAU;IAQzB,qFAAqF;IACrF,OAAO,CAAC,MAAM,CAAC,UAAU;CAM1B"}