@decionis/agent-safe-pipeline 0.3.5 → 0.3.7

package/dist/execution/SafeExecutor.d.ts

@@ -1,9 +1,10 @@
-import type { GateDecision } from "../decision/DecisionAuthority.js";
+import type { DecisionGate } from "../decision/DecisionAuthority.js";
 import type { AuditRecorder } from "../audit/AuditRecorder.js";
 import type { CapturedIntent } from "../intent/ExecutionIntent.js";
+import type { JsonObject } from "../intent/JsonValue.js";
 import type { ActionRegistry } from "./ActionRegistry.js";
-import type { AuthorizationVerifier, ExecutionFinalization, VerifiedAuthorization } from "./AuthorizationVerifier.js";
-export type ExecutionBlockReason = "DECISION_NOT_AUTHORITATIVE" | "DECISION_NOT_ALLOW" | "INTENT_BINDING_MISMATCH" | "INTENT_CONFORMANCE_FAILED" | "AUTHORIZATION_MISSING" | "AUTHORIZATION_INVALID" | "RECOVERY_BINDING_MISMATCH" | "BOUNDARY_MISMATCH" | "WORKLOAD_MISMATCH" | "AUDIT_UNAVAILABLE";
+import type { AuthorizationVerifier, ExecutionCommitOutcome, ExecutionFinalization, VerifiedAuthorization } from "./AuthorizationVerifier.js";
+export type ExecutionBlockReason = "DECISION_NOT_AUTHORITATIVE" | "DECISION_NOT_ALLOW" | "INTENT_BINDING_MISMATCH" | "INTENT_CONFORMANCE_FAILED" | "AUTHORIZATION_MISSING" | "AUTHORIZATION_INVALID" | "RECOVERY_BINDING_MISMATCH" | "RECOVERY_ATTEMPT_UNKNOWN" | "BOUNDARY_MISMATCH" | "WORKLOAD_MISMATCH" | "AUDIT_UNAVAILABLE";
 /**
  * What this executor is, beyond the registry and the verifier it was given.
  *
@@ -24,6 +25,20 @@ export interface SafeExecutorOptions {
      * a policy that requires provenance refuses at the authority instead.
      */
     readonly workloadDigest?: string;
+    /**
+     * This executor's own record of the attempts it dispatched. A recovery
+     * reference is something a caller presents, so its decision and grant are
+     * claims; with a record to hold them against, reconciliation proceeds only
+     * for a binding this executor journaled before dispatch. Absent, the
+     * lookup still runs, and its audit events say `NON_AUTHORITATIVE`, because
+     * nothing here vouches for a binding it was only told about.
+     */
+    readonly attempts?: DispatchedAttempts;
+}
+/** Where an executor reads back the authorizations it dispatched an intent under. */
+export interface DispatchedAttempts {
+    /** Every authorization journaled for this intent, oldest first; none when it was never dispatched here. */
+    authorizationsOf(captured: CapturedIntent): Promise<readonly VerifiedAuthorization[]>;
 }
 export type ExecutionPreDispatchFailureReason = "HANDLER_FAILED_BEFORE_DISPATCH" | "AUDIT_UNAVAILABLE";
 /**
@@ -89,6 +104,8 @@ export type SafeExecutionResult<TResult = unknown> = {
     readonly outcome: "FAILED_BEFORE_DISPATCH";
     readonly executed: false;
     readonly reason: ExecutionPreDispatchFailureReason;
+    /** Why the handler refused, when it threw a `PreDispatchRefusal`. */
+    readonly code?: string;
     readonly result: null;
     readonly authorization: VerifiedAuthorization;
     readonly finalization: ExecutionFinalization;
@@ -111,6 +128,36 @@ export type ExecutionReconciliationResult<TResult = unknown> = {
     readonly result: null;
     readonly authorization: VerifiedAuthorization;
 } | ExecutionBlockedResult | ProviderOutcomeUnknownResult;
+/**
+ * A grant admitted for a later claim. Every check `run` makes before it
+ * consumes a grant has passed, and nothing has been consumed: the grant is
+ * still the authority's to hand out once. Only `hold` issues one, only the
+ * executor that issued it can claim it, and it is claimed at most once.
+ *
+ * This is for an effect that another system performs at a moment this
+ * process does not choose, such as a card authorization the issuer asks
+ * about in milliseconds: the decision is made before, the grant waits here,
+ * and the claim happens when that system asks for it.
+ */
+export interface HeldExecution {
+    readonly captured: CapturedIntent;
+    readonly decision: DecisionGate;
+    /** The grant's own expiry: after it there is nothing left to claim. */
+    readonly expiresAt: string;
+}
+export interface ExecutionHeldResult {
+    readonly outcome: "HELD";
+    readonly executed: false;
+    readonly result: null;
+    readonly authorization: null;
+    readonly held: HeldExecution;
+}
+export type HeldClaimResult = {
+    readonly outcome: "CLAIMED";
+    readonly authorization: VerifiedAuthorization;
+} | ExecutionBlockedResult | Extract<SafeExecutionResult<never>, {
+    outcome: "FAILED_BEFORE_DISPATCH";
+}>;
 export declare class SafeExecutor {
     private readonly registry;
     private readonly verifier;
@@ -118,8 +165,72 @@ export declare class SafeExecutor {
     private readonly hasher;
     private readonly boundaryId;
     private readonly workloadDigest;
+    /** The holds this executor issued and nobody has claimed, keyed by the frozen handle. */
+    private readonly holds;
+    /** The holds claimed and not yet settled, with the authorization each one consumed. */
+    private readonly claims;
+    private readonly attempts;
     constructor(registry: ActionRegistry, verifier: AuthorizationVerifier, audit?: AuditRecorder | undefined, options?: SafeExecutorOptions);
-    run<TResult = unknown>(captured: CapturedIntent, decision: GateDecision): Promise<SafeExecutionResult<TResult>>;
+    run<TResult = unknown>(captured: CapturedIntent, decision: DecisionGate): Promise<SafeExecutionResult<TResult>>;
+    /**
+     * Every check made before a grant may be consumed, with the evidence that
+     * the intent was captured and decided. A refusal is recorded and returned;
+     * null means the decision passed, and so carries a grant.
+     */
+    private admit;
+    /**
+     * Consumes the grant through the verifier, checks what came back against
+     * the decision and the intent, and records the consumption and the start
+     * of execution. Nothing here dispatches.
+     */
+    private consume;
+    /**
+     * Admits a decision exactly as `run` would and holds its grant instead of
+     * consuming it. The intent, the decision and the hold are recorded; the
+     * grant stays unclaimed until `claimHeld` is called with the handle, and an
+     * unclaimed hold simply expires with its grant.
+     */
+    hold(captured: CapturedIntent, decision: DecisionGate): Promise<ExecutionHeldResult | ExecutionBlockedResult>;
+    /**
+     * Admits a hold this executor did not make: one another replica made, or
+     * this process made before a restart, read back from a store the replicas
+     * share. Every check `hold` makes is made again on the way in, and the
+     * record says the hold was adopted. Adoption adds no authority: the grant
+     * is still the authority's to hand out once, so a hold claimed elsewhere
+     * is refused at the claim by the authority or the shared replay store,
+     * never admitted twice by this executor's own memory.
+     */
+    adoptHold(captured: CapturedIntent, decision: DecisionGate): Promise<ExecutionHeldResult | ExecutionBlockedResult>;
+    /**
+     * Registers a claim this executor did not make, so that `settleHeld` can
+     * finalize it here: the hold's intent and decision, and the authorization
+     * the claim returned, as the store that shared them kept them. Nothing is
+     * consumed and nothing is checked against the authority; the finalization
+     * is, as always, the authority's to accept or refuse.
+     */
+    adoptClaim(captured: CapturedIntent, decision: DecisionGate, authorization: VerifiedAuthorization, material?: JsonObject | null): HeldExecution;
+    /**
+     * What another process needs to finalize a claim this executor's verifier
+     * made, for a store the replicas share to keep sealed; null when the
+     * verifier keeps its claims to itself or did not make this one.
+     */
+    claimMaterial(authorization: VerifiedAuthorization): JsonObject | null;
+    private holdWith;
+    /**
+     * Claims a held grant, once. The handle is forgotten before the verifier
+     * is asked, so a second claim of the same hold, concurrent or later, is
+     * refused here without reaching the authority; a handle this executor did
+     * not issue is refused the same way. What the claim returns is checked
+     * exactly as `run` checks it.
+     */
+    claimHeld(held: HeldExecution): Promise<HeldClaimResult>;
+    /**
+     * Reports how a claimed hold ended, once: `COMMITTED` when the effect
+     * happened, `FAILED` when it definitively did not, `INDETERMINATE` when
+     * nobody can say. The terminal record names the outcome, as `run`'s do.
+     */
+    settleHeld(held: HeldExecution, outcome: ExecutionCommitOutcome, receipt?: string | null): Promise<ExecutionFinalization>;
+    private static settledEvent;
     /**
      * Reports the attempt outcome to the verifier's authority, with the
      * provider's effect receipt when the attempt brought one back. A missing,
@@ -130,7 +241,7 @@ export declare class SafeExecutor {
     reconcile<TResult = unknown>(captured: CapturedIntent, recovery: ExecutionRecoveryReference): Promise<ExecutionReconciliationResult<TResult>>;
     /**
      * Observational artifacts carry an explicit non-authoritative marker. They
-     * must never be interpreted as a `GateDecision`, even after an unsafe cast
+     * must never be interpreted as a `DecisionGate`, even after an unsafe cast
      * or a JSON round trip.
      */
     private static isAuthoritativeDecision;
@@ -152,6 +263,7 @@ export declare class SafeExecutor {
     private failedBeforeDispatch;
     private record;
     private static recoveryReference;
+    private static sameBinding;
     private static authorizationFrom;
 }
 //# sourceMappingURL=SafeExecutor.d.ts.map

package/dist/execution/SafeExecutor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SafeExecutor.d.ts","sourceRoot":"","sources":["../../src/execution/SafeExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EACV,qBAAqB,EAErB,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,oBAAoB,GAC5B,4BAA4B,GAC5B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,iCAAiC,GAC3C,gCAAgC,GAAG,mBAAmB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAC7C;IACE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;CAC9C,GACD,sBAAsB,GACtB;IACE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;CAC9C,GACD,CAAC,qBAAqB,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAA;CAAE,CAAC,GAC1E,CAAC,4BAA4B,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC;AAEtF,MAAM,MAAM,6BAA6B,CAAC,OAAO,GAAG,OAAO,IACvD;IACE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD;IACE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD,sBAAsB,GACtB,4BAA4B,CAAC;AAEjC,qBAAa,YAAY;IAOrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IARzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;gBAG5B,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,CAAC,EAAE,aAAa,YAAA,EACtC,OAAO,CAAC,EAAE,mBAAmB;IAMlB,GAAG,CAAC,OAAO,GAAG,OAAO,EAChC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IA2MxC;;;;OAIG;YACW,QAAQ;IAuBtB,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAIlB,SAAS,CAAC,OAAO,GAAG,OAAO,EACtC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAuElD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAQtC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,cAAc;YAeR,KAAK;YAkBL,oBAAoB;YA6BpB,MAAM;IAOpB,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAoBhC,OAAO,CAAC,MAAM,CAAC,iBAAiB;CASjC"}
+{"version":3,"file":"SafeExecutor.d.ts","sourceRoot":"","sources":["../../src/execution/SafeExecutor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,KAAK,EAAkC,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACtB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,MAAM,oBAAoB,GAC5B,4BAA4B,GAC5B,oBAAoB,GACpB,yBAAyB,GACzB,2BAA2B,GAC3B,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,CAAC;AAExB;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CACxC;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,2GAA2G;IAC3G,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;CACvF;AAED,MAAM,MAAM,iCAAiC,GAC3C,gCAAgC,GAAG,mBAAmB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAED;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,CAAC,OAAO,GAAG,OAAO,IAC7C;IACE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;CAC9C,GACD,sBAAsB,GACtB;IACE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,qEAAqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAC;CAC9C,GACD,CAAC,qBAAqB,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAA;CAAE,CAAC,GAC1E,CAAC,4BAA4B,GAAG;IAAE,QAAQ,CAAC,YAAY,EAAE,qBAAqB,CAAA;CAAE,CAAC,CAAC;AAEtF,MAAM,MAAM,6BAA6B,CAAC,OAAO,GAAG,OAAO,IACvD;IACE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD;IACE,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;CAC/C,GACD,sBAAsB,GACtB,4BAA4B,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAA;CAAE,GAC9E,sBAAsB,GACtB,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE;IAAE,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC,CAAC;AAO/E,qBAAa,YAAY;IAYrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAbzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IAEtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAC3C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkD;IACxE,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuD;IAC9E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;gBAGlC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,CAAC,EAAE,aAAa,YAAA,EACtC,OAAO,CAAC,EAAE,mBAAmB;IAOlB,GAAG,CAAC,OAAO,GAAG,OAAO,EAChC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;IA2GxC;;;;OAIG;YACW,KAAK;IAiDnB;;;;OAIG;YACW,OAAO;IAqErB;;;;;OAKG;IACU,IAAI,CACf,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,GAAG,sBAAsB,CAAC;IAIxD;;;;;;;;OAQG;IACU,SAAS,CACpB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,GACrB,OAAO,CAAC,mBAAmB,GAAG,sBAAsB,CAAC;IAIxD;;;;;;OAMG;IACI,UAAU,CACf,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,YAAY,EACtB,aAAa,EAAE,qBAAqB,EACpC,QAAQ,GAAE,UAAU,GAAG,IAAW,GACjC,aAAa;IAuBhB;;;;OAIG;IACI,aAAa,CAAC,aAAa,EAAE,qBAAqB,GAAG,UAAU,GAAG,IAAI;YAK/D,QAAQ;IA8BtB;;;;;;OAMG;IACU,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC;IAYrE;;;;OAIG;IACU,UAAU,CACrB,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,GAAE,MAAM,GAAG,IAAW,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IA0BjC,OAAO,CAAC,MAAM,CAAC,YAAY;IAM3B;;;;OAIG;YACW,QAAQ;IAuBtB,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAIlB,SAAS,CAAC,OAAO,GAAG,OAAO,EACtC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAwFlD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,uBAAuB;IAQtC;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,cAAc;YAeR,KAAK;YAkBL,oBAAoB;YAmCpB,MAAM;IAOpB,OAAO,CAAC,MAAM,CAAC,iBAAiB;IAoBhC,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B,OAAO,CAAC,MAAM,CAAC,iBAAiB;CASjC"}

package/dist/execution/SafeExecutor.js

@@ -7,15 +7,108 @@ export class SafeExecutor {
     hasher = new CanonicalIntentHasher();
     boundaryId;
     workloadDigest;
+    /** The holds this executor issued and nobody has claimed, keyed by the frozen handle. */
+    holds = new WeakMap();
+    /** The holds claimed and not yet settled, with the authorization each one consumed. */
+    claims = new WeakMap();
+    attempts;
     constructor(registry, verifier, audit, options) {
         this.registry = registry;
         this.verifier = verifier;
         this.audit = audit;
         this.boundaryId = options?.boundaryId ?? null;
         this.workloadDigest = options?.workloadDigest ?? null;
+        this.attempts = options?.attempts ?? null;
     }
     async run(captured, decision) {
         const startedAt = Date.now();
+        const refused = await this.admit(captured, decision, startedAt);
+        if (refused !== null)
+            return refused;
+        const claim = await this.consume(captured, decision, startedAt);
+        if (claim.outcome !== "CLAIMED")
+            return claim;
+        const authorization = claim.authorization;
+        const attempt = await this.registry.executeTracked(captured, authorization);
+        if (attempt.status === "FAILED_BEFORE_DISPATCH") {
+            return await this.failedBeforeDispatch(captured, decision, authorization, "HANDLER_FAILED_BEFORE_DISPATCH", startedAt, attempt.code);
+        }
+        if (attempt.status === "REFUSED_AFTER_DISPATCH") {
+            // The provider said no. That is an outcome, so it is finalized `FAILED`
+            // rather than left indeterminate, and `executed` is false rather than
+            // null: nothing about it is unknown.
+            const finalization = await this.finalize(captured, decision, authorization, "FAILED", attempt.receipt);
+            const result = {
+                outcome: "DEFINITELY_NOT_EXECUTED",
+                executed: false,
+                recovered: false,
+                reason: attempt.reason,
+                result: null,
+                authorization,
+                finalization,
+            };
+            // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+            await this.record({
+                eventType: "EXECUTION_REFUSED_AFTER_DISPATCH",
+                captured,
+                decision,
+                authorization,
+                reasonCodes: [attempt.reason, SafeExecutor.finalizationCode(finalization)],
+                durationMs: Date.now() - startedAt,
+            });
+            // Stryker restore all
+            return result;
+        }
+        if (attempt.status === "UNKNOWN_AFTER_DISPATCH") {
+            const finalization = await this.finalize(captured, decision, authorization, "INDETERMINATE", attempt.receipt);
+            const result = {
+                outcome: "UNKNOWN_AFTER_DISPATCH",
+                executed: null,
+                reason: "PROVIDER_OUTCOME_UNKNOWN",
+                result: null,
+                authorization,
+                recovery: SafeExecutor.recoveryReference(captured, authorization),
+                finalization,
+            };
+            // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+            await this.record({
+                eventType: "EXECUTION_OUTCOME_UNKNOWN",
+                captured,
+                decision,
+                authorization,
+                reasonCodes: [result.reason, SafeExecutor.finalizationCode(finalization)],
+                durationMs: Date.now() - startedAt,
+            });
+            // Stryker restore all
+            return result;
+        }
+        const finalization = await this.finalize(captured, decision, authorization, "COMMITTED", attempt.receipt);
+        const result = {
+            outcome: "COMPLETED",
+            executed: true,
+            recovered: false,
+            result: attempt.result,
+            authorization,
+            finalization,
+        };
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        await this.record({
+            eventType: "EXECUTION_COMPLETED",
+            captured,
+            decision,
+            authorization,
+            reasonCodes: [SafeExecutor.finalizationCode(finalization)],
+            durationMs: Date.now() - startedAt,
+        });
+        // Stryker restore all
+        return result;
+    }
+    /**
+     * Every check made before a grant may be consumed, with the evidence that
+     * the intent was captured and decided. A refusal is recorded and returned;
+     * null means the decision passed, and so carries a grant.
+     */
+    async admit(captured, decision, startedAt) {
         // Stryker disable next-line all: Audit payload mapping is covered by lifecycle event assertions.
         const intentRecorded = await this.record({ eventType: "INTENT_CAPTURED", captured });
         // An observational artifact (shadow observation, serialized audit event) is
@@ -55,6 +148,14 @@ export class SafeExecutor {
             return await this.block(captured, decision, "WORKLOAD_MISMATCH", startedAt);
         }
         this.registry.validate(captured);
+        return null;
+    }
+    /**
+     * Consumes the grant through the verifier, checks what came back against
+     * the decision and the intent, and records the consumption and the start
+     * of execution. Nothing here dispatches.
+     */
+    async consume(captured, decision, startedAt) {
         let authorization;
         try {
             authorization = await this.verifier.verifyAndConsume(captured, decision);
@@ -103,79 +204,141 @@ export class SafeExecutor {
         if (this.audit?.requiresDeliveryBeforeExecution === true && !executionRecorded) {
             return await this.failedBeforeDispatch(captured, decision, authorization, "AUDIT_UNAVAILABLE", startedAt);
         }
-        const attempt = await this.registry.executeTracked(captured, authorization);
-        if (attempt.status === "FAILED_BEFORE_DISPATCH") {
-            return await this.failedBeforeDispatch(captured, decision, authorization, "HANDLER_FAILED_BEFORE_DISPATCH", startedAt);
-        }
-        if (attempt.status === "REFUSED_AFTER_DISPATCH") {
-            // The provider said no. That is an outcome, so it is finalized `FAILED`
-            // rather than left indeterminate, and `executed` is false rather than
-            // null: nothing about it is unknown.
-            const finalization = await this.finalize(captured, decision, authorization, "FAILED", attempt.receipt);
-            const result = {
-                outcome: "DEFINITELY_NOT_EXECUTED",
-                executed: false,
-                recovered: false,
-                reason: attempt.reason,
-                result: null,
-                authorization,
-                finalization,
-            };
-            // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
-            await this.record({
-                eventType: "EXECUTION_REFUSED_AFTER_DISPATCH",
-                captured,
-                decision,
-                authorization,
-                reasonCodes: [attempt.reason, SafeExecutor.finalizationCode(finalization)],
-                durationMs: Date.now() - startedAt,
-            });
-            // Stryker restore all
-            return result;
+        return { outcome: "CLAIMED", authorization };
+    }
+    /**
+     * Admits a decision exactly as `run` would and holds its grant instead of
+     * consuming it. The intent, the decision and the hold are recorded; the
+     * grant stays unclaimed until `claimHeld` is called with the handle, and an
+     * unclaimed hold simply expires with its grant.
+     */
+    async hold(captured, decision) {
+        return await this.holdWith(captured, decision, []);
+    }
+    /**
+     * Admits a hold this executor did not make: one another replica made, or
+     * this process made before a restart, read back from a store the replicas
+     * share. Every check `hold` makes is made again on the way in, and the
+     * record says the hold was adopted. Adoption adds no authority: the grant
+     * is still the authority's to hand out once, so a hold claimed elsewhere
+     * is refused at the claim by the authority or the shared replay store,
+     * never admitted twice by this executor's own memory.
+     */
+    async adoptHold(captured, decision) {
+        return await this.holdWith(captured, decision, ["HOLD_ADOPTED"]);
+    }
+    /**
+     * Registers a claim this executor did not make, so that `settleHeld` can
+     * finalize it here: the hold's intent and decision, and the authorization
+     * the claim returned, as the store that shared them kept them. Nothing is
+     * consumed and nothing is checked against the authority; the finalization
+     * is, as always, the authority's to accept or refuse.
+     */
+    adoptClaim(captured, decision, authorization, material = null) {
+        if (!SafeExecutor.isAuthoritativeDecision(decision) ||
+            decision.intentHash !== captured.intentHash ||
+            authorization.intentHash !== captured.intentHash) {
+            throw new Error("CLAIM_ADOPTION_MISMATCH");
         }
-        if (attempt.status === "UNKNOWN_AFTER_DISPATCH") {
-            const finalization = await this.finalize(captured, decision, authorization, "INDETERMINATE", attempt.receipt);
-            const result = {
-                outcome: "UNKNOWN_AFTER_DISPATCH",
-                executed: null,
-                reason: "PROVIDER_OUTCOME_UNKNOWN",
-                result: null,
-                authorization,
-                recovery: SafeExecutor.recoveryReference(captured, authorization),
-                finalization,
-            };
-            // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
-            await this.record({
-                eventType: "EXECUTION_OUTCOME_UNKNOWN",
-                captured,
-                decision,
-                authorization,
-                reasonCodes: [result.reason, SafeExecutor.finalizationCode(finalization)],
-                durationMs: Date.now() - startedAt,
-            });
-            // Stryker restore all
-            return result;
+        if (material !== null) {
+            const adopt = this.verifier.adoptClaim;
+            if (adopt === undefined || !adopt.call(this.verifier, authorization, material)) {
+                throw new Error("CLAIM_MATERIAL_REFUSED");
+            }
         }
-        const finalization = await this.finalize(captured, decision, authorization, "COMMITTED", attempt.receipt);
-        const result = {
-            outcome: "COMPLETED",
-            executed: true,
-            recovered: false,
-            result: attempt.result,
-            authorization,
-            finalization,
-        };
+        const held = Object.freeze({
+            captured,
+            decision,
+            expiresAt: authorization.expiresAt,
+        });
+        this.claims.set(held, authorization);
+        return held;
+    }
+    /**
+     * What another process needs to finalize a claim this executor's verifier
+     * made, for a store the replicas share to keep sealed; null when the
+     * verifier keeps its claims to itself or did not make this one.
+     */
+    claimMaterial(authorization) {
+        const material = this.verifier.claimMaterial;
+        return material === undefined ? null : material.call(this.verifier, authorization);
+    }
+    async holdWith(captured, decision, reasonCodes) {
+        const startedAt = Date.now();
+        const refused = await this.admit(captured, decision, startedAt);
+        if (refused !== null)
+            return refused;
+        const admitted = decision;
         // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
-        await this.record({
-            eventType: "EXECUTION_COMPLETED",
+        const heldRecorded = await this.record({
+            eventType: "GRANT_HELD",
             captured,
             decision,
+            ...(reasonCodes.length === 0 ? {} : { reasonCodes: [...reasonCodes] }),
+            durationMs: Date.now() - startedAt,
+        });
+        // Stryker restore all
+        if (this.audit?.requiresDeliveryBeforeExecution === true && !heldRecorded) {
+            return await this.block(captured, decision, "AUDIT_UNAVAILABLE", startedAt);
+        }
+        const held = Object.freeze({
+            captured,
+            decision,
+            expiresAt: admitted.authorization.expiresAt,
+        });
+        this.holds.set(held, admitted);
+        return { outcome: "HELD", executed: false, result: null, authorization: null, held };
+    }
+    /**
+     * Claims a held grant, once. The handle is forgotten before the verifier
+     * is asked, so a second claim of the same hold, concurrent or later, is
+     * refused here without reaching the authority; a handle this executor did
+     * not issue is refused the same way. What the claim returns is checked
+     * exactly as `run` checks it.
+     */
+    async claimHeld(held) {
+        const startedAt = Date.now();
+        const decision = this.holds.get(held);
+        if (decision === undefined) {
+            return await this.block(held.captured, held.decision, "AUTHORIZATION_INVALID", startedAt);
+        }
+        this.holds.delete(held);
+        const claim = await this.consume(held.captured, decision, startedAt);
+        if (claim.outcome === "CLAIMED")
+            this.claims.set(held, claim.authorization);
+        return claim;
+    }
+    /**
+     * Reports how a claimed hold ended, once: `COMMITTED` when the effect
+     * happened, `FAILED` when it definitively did not, `INDETERMINATE` when
+     * nobody can say. The terminal record names the outcome, as `run`'s do.
+     */
+    async settleHeld(held, outcome, receipt = null) {
+        const startedAt = Date.now();
+        const authorization = this.claims.get(held);
+        if (authorization === undefined)
+            throw new Error("HELD_EXECUTION_NOT_CLAIMED");
+        this.claims.delete(held);
+        const finalization = await this.finalize(held.captured, held.decision, authorization, outcome, receipt);
+        const eventType = SafeExecutor.settledEvent(outcome);
+        // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
+        await this.record({
+            eventType,
+            captured: held.captured,
+            decision: held.decision,
             authorization,
             reasonCodes: [SafeExecutor.finalizationCode(finalization)],
             durationMs: Date.now() - startedAt,
         });
         // Stryker restore all
-        return result;
+        return finalization;
+    }
+    static settledEvent(outcome) {
+        if (outcome === "COMMITTED")
+            return "EXECUTION_COMPLETED";
+        if (outcome === "FAILED")
+            return "EXECUTION_REFUSED_AFTER_DISPATCH";
+        return "EXECUTION_OUTCOME_UNKNOWN";
     }
     /**
      * Reports the attempt outcome to the verifier's authority, with the
@@ -211,8 +374,22 @@ export class SafeExecutor {
             !this.intentConforms(captured)) {
             return await this.block(captured, undefined, "RECOVERY_BINDING_MISMATCH", startedAt);
         }
-        const reconciliation = await this.registry.reconcile(captured, recovery.idempotencyKey);
+        // The decision and grant are the caller's claim until the executor's own
+        // record confirms them; the provider is not asked about a binding that
+        // was never dispatched here.
+        let authority = "NON_AUTHORITATIVE";
+        if (this.attempts !== null) {
+            const recorded = await this.attempts.authorizationsOf(captured);
+            if (recorded.length === 0) {
+                return await this.block(captured, undefined, "RECOVERY_ATTEMPT_UNKNOWN", startedAt);
+            }
+            if (!recorded.some((candidate) => SafeExecutor.sameBinding(candidate, recovery))) {
+                return await this.block(captured, undefined, "RECOVERY_BINDING_MISMATCH", startedAt);
+            }
+            authority = "AUTHORITATIVE";
+        }
         const authorization = SafeExecutor.authorizationFrom(recovery);
+        const reconciliation = await this.registry.reconcile(captured, recovery.idempotencyKey);
         if (reconciliation.status === "COMPLETED") {
             const result = {
                 outcome: "COMPLETED",
@@ -226,6 +403,7 @@ export class SafeExecutor {
                 eventType: "RECONCILIATION_COMPLETED",
                 captured,
                 authorization,
+                authority,
                 durationMs: Date.now() - startedAt,
             });
             // Stryker restore all
@@ -245,6 +423,7 @@ export class SafeExecutor {
                 eventType: "RECONCILIATION_NOT_EXECUTED",
                 captured,
                 authorization,
+                authority,
                 reasonCodes: [result.reason],
                 durationMs: Date.now() - startedAt,
             });
@@ -264,6 +443,7 @@ export class SafeExecutor {
             eventType: "RECONCILIATION_UNKNOWN",
             captured,
             authorization,
+            authority,
             reasonCodes: [result.reason],
             durationMs: Date.now() - startedAt,
         });
@@ -272,7 +452,7 @@ export class SafeExecutor {
     }
     /**
      * Observational artifacts carry an explicit non-authoritative marker. They
-     * must never be interpreted as a `GateDecision`, even after an unsafe cast
+     * must never be interpreted as a `DecisionGate`, even after an unsafe cast
      * or a JSON round trip.
      */
     static isAuthoritativeDecision(decision) {
@@ -325,7 +505,7 @@ export class SafeExecutor {
         // Stryker restore all
         return { outcome: "BLOCKED", executed: false, reason, result: null, authorization: null };
     }
-    async failedBeforeDispatch(captured, decision, authorization, reason, startedAt) {
+    async failedBeforeDispatch(captured, decision, authorization, reason, startedAt, code) {
         // The grant was consumed but no side effect was attempted.
         const finalization = await this.finalize(captured, decision, authorization, "FAILED");
         // Stryker disable all: Audit payload mapping is covered by lifecycle event assertions.
@@ -334,7 +514,11 @@ export class SafeExecutor {
             captured,
             decision,
             authorization,
-            reasonCodes: [reason, SafeExecutor.finalizationCode(finalization)],
+            reasonCodes: [
+                reason,
+                ...(code === undefined ? [] : [code]),
+                SafeExecutor.finalizationCode(finalization),
+            ],
             durationMs: Date.now() - startedAt,
         });
         // Stryker restore all
@@ -342,6 +526,7 @@ export class SafeExecutor {
             outcome: "FAILED_BEFORE_DISPATCH",
             executed: false,
             reason,
+            ...(code === undefined ? {} : { code }),
             result: null,
             authorization,
             finalization,
@@ -367,6 +552,13 @@ export class SafeExecutor {
             idempotencyKey: captured.intent.idempotencyKey,
         });
     }
+    static sameBinding(recorded, recovery) {
+        return (recorded.decisionId === recovery.decisionId &&
+            recorded.dossierId === recovery.dossierId &&
+            recorded.grantId === recovery.grantId &&
+            recorded.intentHash === recovery.intentHash &&
+            recorded.expiresAt === recovery.expiresAt);
+    }
     static authorizationFrom(recovery) {
         return Object.freeze({
             decisionId: recovery.decisionId,