@decionis/agent-safe-pipeline 0.3.7 → 0.3.8

package/dist/testing/SignedSignals.js

@@ -0,0 +1,291 @@
+import { createHash, sign, verify } from "node:crypto";
+/**
+ * Signed producer signals, as the hosted authority verifies them and as this
+ * package's doubles and tests mint them.
+ *
+ * A producer (a card-presence provider such as `koard`) signs a standing
+ * statement about a subject: the cardholder granted this agent permission to
+ * buy on their behalf, within these limits, until then (Koard's "Tap to
+ * Authenticate"). The agent's proposal carries that compact JWS as evidence;
+ * the authority verifies it against the key the organisation registered for
+ * the producer (purpose `signed_signal`) or an admitted provider's JWKS,
+ * writes the verified FACTS under `agent_safe.signed_signals.<name>` for
+ * policy to name with `required_signals`, and records those facts in the
+ * binding, never the token. This module is that contract, letter for letter,
+ * so a test against the local double proves what the hosted route proves.
+ */
+export const SIGNED_SIGNAL_TYPE = "decionis-signed-signal+jwt";
+export const SIGNED_SIGNAL_REFUSAL_CODES = [
+    "SIGNED_SIGNAL_MALFORMED",
+    "SIGNED_SIGNAL_KEY_UNKNOWN",
+    "SIGNED_SIGNAL_SIGNATURE_INVALID",
+    "SIGNED_SIGNAL_EXPIRED",
+    "SIGNED_SIGNAL_AUDIENCE_MISMATCH",
+    "SIGNED_SIGNAL_ISSUER_MISMATCH",
+    "SIGNED_SIGNAL_NOT_VERIFIED",
+    "SIGNED_SIGNAL_DUPLICATE_NAME",
+];
+/** A standing signal may live thirty days; a tap for one intent lives five minutes. */
+export const SIGNED_SIGNAL_MAX_LIFETIME_SECONDS = 30 * 24 * 60 * 60;
+const CLOCK_TOLERANCE_SECONDS = 300;
+const SIGNAL_NAME = /^[a-z][a-z0-9_]{0,63}$/;
+const OPEN_NAME = /^[a-z][a-z0-9_.:-]*$/;
+const ACTION_NAME = /^[a-z][a-z0-9._:-]*$/;
+const CURRENCY = /^[a-z]{3}$/i;
+const SIGNAL_KEYS = new Set([
+    "name",
+    "method",
+    "result",
+    "agent",
+    "scope",
+    "limits",
+    "card_token_ref",
+]);
+/** Decionis Presence's own provider name; a producer can never speak as it. */
+const RESERVED_PRODUCER = "presence";
+function text(value, max) {
+    return typeof value === "string" && value.length > 0 && value.length <= max ? value : null;
+}
+/** A primary account number must never reach a decision record. */
+function looksLikePan(value) {
+    const digits = value.replace(/[\s-]/g, "");
+    if (!/^\d{12,19}$/.test(digits))
+        return false;
+    let sum = 0;
+    for (let index = 0; index < digits.length; index += 1) {
+        let digit = Number(digits[digits.length - 1 - index]);
+        if (index % 2 === 1) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function decodeSegment(segment) {
+    try {
+        const parsed = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+        return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The `signal` claim read strictly: any key the contract does not name refuses the token. */
+function signalClaims(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).some((key) => !SIGNAL_KEYS.has(key)))
+        return null;
+    const name = text(record.name, 64);
+    const method = text(record.method, 64);
+    if (name === null || !SIGNAL_NAME.test(name) || method === null || !OPEN_NAME.test(method)) {
+        return null;
+    }
+    if (record.result !== "VERIFIED" && record.result !== "FAILED")
+        return null;
+    const claims = { name, method, result: record.result };
+    if (record.agent !== undefined) {
+        const agent = text(record.agent, 200);
+        if (agent === null)
+            return null;
+        claims.agent = agent;
+    }
+    if (record.scope !== undefined) {
+        const scope = record.scope;
+        const actions = scope !== null && typeof scope === "object" ? scope.actions : undefined;
+        if (!Array.isArray(actions) ||
+            actions.length === 0 ||
+            actions.length > 32 ||
+            Object.keys(scope).length !== 1 ||
+            !actions.every((action) => typeof action === "string" && action.length <= 120 && ACTION_NAME.test(action))) {
+            return null;
+        }
+        claims.scope = { actions: [...actions] };
+    }
+    if (record.limits !== undefined) {
+        const limits = record.limits;
+        if (limits === null ||
+            typeof limits !== "object" ||
+            Object.keys(limits).length !== 2 ||
+            typeof limits.currency !== "string" ||
+            !CURRENCY.test(limits.currency) ||
+            typeof limits.amount_minor !== "number" ||
+            !Number.isSafeInteger(limits.amount_minor) ||
+            limits.amount_minor < 0) {
+            return null;
+        }
+        claims.limits = { currency: limits.currency.toUpperCase(), amount_minor: limits.amount_minor };
+    }
+    if (record.card_token_ref !== undefined) {
+        const ref = text(record.card_token_ref, 200);
+        if (ref === null || looksLikePan(ref))
+            return null;
+        claims.card_token_ref = ref;
+    }
+    return claims;
+}
+/**
+ * Verifies one token the way the hosted authority does: the protected header
+ * names an Ed25519 key registered for the producer with purpose
+ * `signed_signal`; the signature verifies under it; the issuer is the one
+ * registered with the key and the audience is the organisation; the claims
+ * are bounded, carry no card number, and the lifetime is within the cap.
+ */
+export function verifySignedSignal(token, options) {
+    const refuse = (code) => ({ ok: false, code });
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return refuse("SIGNED_SIGNAL_MALFORMED");
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    const header = decodeSegment(encodedHeader);
+    const payload = decodeSegment(encodedPayload);
+    if (header === null || payload === null)
+        return refuse("SIGNED_SIGNAL_MALFORMED");
+    const kid = text(header.kid, 200);
+    if (header.alg !== "EdDSA" ||
+        header.typ !== SIGNED_SIGNAL_TYPE ||
+        kid === null ||
+        kid.trim() !== kid) {
+        return refuse("SIGNED_SIGNAL_MALFORMED");
+    }
+    const key = options.findKey(kid);
+    if (key === null)
+        return refuse("SIGNED_SIGNAL_KEY_UNKNOWN");
+    const signed = Buffer.from(`${encodedHeader}.${encodedPayload}`, "ascii");
+    if (!verify(null, signed, key.publicKey, Buffer.from(encodedSignature, "base64url"))) {
+        return refuse("SIGNED_SIGNAL_SIGNATURE_INVALID");
+    }
+    const nowMs = options.nowMs ?? Date.now();
+    const issuer = text(payload.iss, 100);
+    const subject = text(payload.sub, 200);
+    const signalId = text(payload.jti, 200);
+    const iat = payload.iat;
+    const exp = payload.exp;
+    const claims = signalClaims(payload.signal);
+    if (issuer === null ||
+        payload.aud === undefined ||
+        subject === null ||
+        looksLikePan(subject) ||
+        signalId === null ||
+        typeof iat !== "number" ||
+        typeof exp !== "number" ||
+        !Number.isFinite(iat) ||
+        !Number.isFinite(exp) ||
+        exp <= iat ||
+        exp - iat > SIGNED_SIGNAL_MAX_LIFETIME_SECONDS ||
+        iat * 1_000 > nowMs + CLOCK_TOLERANCE_SECONDS * 1_000 ||
+        claims === null) {
+        return refuse("SIGNED_SIGNAL_MALFORMED");
+    }
+    if (issuer === RESERVED_PRODUCER || issuer !== key.issuer)
+        return refuse("SIGNED_SIGNAL_ISSUER_MISMATCH");
+    if (payload.aud !== options.orgId)
+        return refuse("SIGNED_SIGNAL_AUDIENCE_MISMATCH");
+    if (exp * 1_000 + CLOCK_TOLERANCE_SECONDS * 1_000 <= nowMs)
+        return refuse("SIGNED_SIGNAL_EXPIRED");
+    if (claims.result !== "VERIFIED")
+        return refuse("SIGNED_SIGNAL_NOT_VERIFIED");
+    return {
+        ok: true,
+        signal: {
+            name: claims.name,
+            producer: key.issuer,
+            method: claims.method,
+            subject,
+            signal_id: signalId,
+            key_id: key.kid,
+            issued_at: new Date(iat * 1_000).toISOString(),
+            expires_at: new Date(exp * 1_000).toISOString(),
+            evidence_digest: `sha256:${createHash("sha256").update(token, "utf8").digest("hex")}`,
+            claims,
+        },
+    };
+}
+/**
+ * The facts a verified signal contributes against one intent. `covers` says
+ * what the signal asserts about the intent (null when it asserts nothing on
+ * that axis); `covers_intent` is true when nothing it asserts is false. A
+ * limit the intent gives nothing to check against is not covered.
+ */
+export function signedSignalFacts(verified, intent) {
+    const { claims } = verified;
+    const amountMinor = intent.parameters.amountMinor;
+    const currency = intent.parameters.currency;
+    const cardTokenRef = intent.parameters.cardTokenRef;
+    const covers = {
+        action: claims.scope === undefined ? null : claims.scope.actions.includes(intent.action),
+        agent: claims.agent === undefined ? null : claims.agent === intent.actorId,
+        amount: claims.limits === undefined
+            ? null
+            : typeof amountMinor === "number" &&
+                Number.isSafeInteger(amountMinor) &&
+                amountMinor >= 0 &&
+                amountMinor <= claims.limits.amount_minor,
+        currency: claims.limits === undefined
+            ? null
+            : typeof currency === "string" && currency.toUpperCase() === claims.limits.currency,
+        card: claims.card_token_ref === undefined
+            ? null
+            : cardTokenRef === claims.card_token_ref ||
+                intent.resource === `card:${claims.card_token_ref}`,
+    };
+    return {
+        verified: true,
+        producer: verified.producer,
+        method: verified.method,
+        subject: verified.subject,
+        signal_id: verified.signal_id,
+        key_id: verified.key_id,
+        issued_at: verified.issued_at,
+        expires_at: verified.expires_at,
+        evidence_digest: verified.evidence_digest,
+        ...(claims.agent === undefined ? {} : { agent: claims.agent }),
+        ...(claims.scope === undefined ? {} : { scope: { actions: [...claims.scope.actions] } }),
+        ...(claims.limits === undefined ? {} : { limits: { ...claims.limits } }),
+        ...(claims.card_token_ref === undefined ? {} : { card_token_ref: claims.card_token_ref }),
+        covers,
+        covers_intent: Object.values(covers).every((entry) => entry !== false),
+    };
+}
+/** Every token verified and its facts keyed by name; two tokens with one name refuse the request. */
+export function verifySignedSignals(tokens, options) {
+    const facts = {};
+    for (const token of tokens) {
+        const verification = verifySignedSignal(token, options);
+        if (!verification.ok)
+            return verification;
+        if (facts[verification.signal.name] !== undefined) {
+            return { ok: false, code: "SIGNED_SIGNAL_DUPLICATE_NAME" };
+        }
+        facts[verification.signal.name] = signedSignalFacts(verification.signal, options.intent);
+    }
+    return { ok: true, facts };
+}
+/**
+ * Mints a token as a producer does, for tests and demos: an Ed25519 private
+ * key, the key id the organisation registered, and the claims. The lifetime
+ * defaults to one day.
+ */
+export function mintSignedSignal(input) {
+    const issuedAt = Math.floor((input.issuedAtMs ?? Date.now()) / 1_000);
+    const header = { alg: "EdDSA", typ: SIGNED_SIGNAL_TYPE, kid: input.kid, ...input.header };
+    const payload = {
+        iss: input.issuer,
+        aud: input.audience,
+        sub: input.subject,
+        iat: issuedAt,
+        exp: issuedAt + (input.lifetimeSeconds ?? 24 * 60 * 60),
+        jti: input.jti ?? `signal-${issuedAt}-${Math.random().toString(36).slice(2, 10)}`,
+        signal: input.signal,
+    };
+    const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+    const signingInput = `${encode(header)}.${encode(payload)}`;
+    const signature = sign(null, Buffer.from(signingInput, "ascii"), input.privateKey);
+    return `${signingInput}.${signature.toString("base64url")}`;
+}
+//# sourceMappingURL=SignedSignals.js.map

package/dist/testing/SignedSignals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignedSignals.js","sourceRoot":"","sources":["../../src/testing/SignedSignals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,yBAAyB;IACzB,2BAA2B;IAC3B,iCAAiC;IACjC,uBAAuB;IACvB,iCAAiC;IACjC,+BAA+B;IAC/B,4BAA4B;IAC5B,8BAA8B;CACtB,CAAC;AAGX,uFAAuF;AACvF,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACpE,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,SAAS,GAAG,sBAAsB,CAAC;AACzC,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,gBAAgB;CACjB,CAAC,CAAC;AACH,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAyErC,SAAS,IAAI,CAAC,KAAc,EAAE,GAAW;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7F,CAAC;AAED,mEAAmE;AACnE,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,IAAI,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACvF,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,MAAM,GAQR,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAqC,CAAC;QAC3D,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACvB,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,OAAO,CAAC,MAAM,GAAG,EAAE;YACnB,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,MAAM,KAAK,CAAC;YACzC,CAAC,OAAO,CAAC,KAAK,CACZ,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAC3F,EACD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,GAAI,OAAoB,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAA+D,CAAC;QACtF,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;YAChC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC/B,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACvC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;YAC1C,MAAM,CAAC,YAAY,GAAG,CAAC,EACvB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,MAAM,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,GAAG,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,OAIC;IAED,MAAM,MAAM,GAAG,CAAC,IAA6B,EAA4B,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACjE,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAAiC,CAAC;IAC5F,MAAM,MAAM,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClC,IACE,MAAM,CAAC,GAAG,KAAK,OAAO;QACtB,MAAM,CAAC,GAAG,KAAK,kBAAkB;QACjC,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,EAClB,CAAC;QACD,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACrF,OAAO,MAAM,CAAC,iCAAiC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,IACE,MAAM,KAAK,IAAI;QACf,OAAO,CAAC,GAAG,KAAK,SAAS;QACzB,OAAO,KAAK,IAAI;QAChB,YAAY,CAAC,OAAO,CAAC;QACrB,QAAQ,KAAK,IAAI;QACjB,OAAO,GAAG,KAAK,QAAQ;QACvB,OAAO,GAAG,KAAK,QAAQ;QACvB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,GAAG,IAAI,GAAG;QACV,GAAG,GAAG,GAAG,GAAG,kCAAkC;QAC9C,GAAG,GAAG,KAAK,GAAG,KAAK,GAAG,uBAAuB,GAAG,KAAK;QACrD,MAAM,KAAK,IAAI,EACf,CAAC;QACD,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,GAAG,CAAC,MAAM;QACvD,OAAO,MAAM,CAAC,+BAA+B,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,iCAAiC,CAAC,CAAC;IACpF,IAAI,GAAG,GAAG,KAAK,GAAG,uBAAuB,GAAG,KAAK,IAAI,KAAK;QACxD,OAAO,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,4BAA4B,CAAC,CAAC;IAC9E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,GAAG,CAAC,MAAM;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO;YACP,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,GAAG,CAAC,GAAG;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;YAC9C,UAAU,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;YAC/C,eAAe,EAAE,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YACrF,MAAM;SACP;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAA8B,EAC9B,MAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC;IAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;IAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC;IACpD,MAAM,MAAM,GAAyB;QACnC,MAAM,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACxF,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO;QAC1E,MAAM,EACJ,MAAM,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,WAAW,KAAK,QAAQ;gBAC/B,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;gBACjC,WAAW,IAAI,CAAC;gBAChB,WAAW,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY;QAC/C,QAAQ,EACN,MAAM,CAAC,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ;QACvF,IAAI,EACF,MAAM,CAAC,cAAc,KAAK,SAAS;YACjC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,YAAY,KAAK,MAAM,CAAC,cAAc;gBACtC,MAAM,CAAC,QAAQ,KAAK,QAAQ,MAAM,CAAC,cAAc,EAAE;KAC1D,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACxF,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACxE,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QACzF,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,mBAAmB,CACjC,MAAyB,EACzB,OAKC;IAID,MAAM,KAAK,GAAsC,EAAE,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,YAAY,CAAC;QAC1C,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC;QAC7D,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAYhC;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;IAC1F,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,MAAM;QACjB,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,KAAK,CAAC,OAAO;QAClB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,QAAQ,GAAG,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;QACvD,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,UAAU,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QACjF,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE,CACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACnF,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decionis/agent-safe-pipeline",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "Execution Authority for AI agents: agents propose, Decionis independently decides ALLOW / ESCALATE / BLOCK, Presence verifies human approval on escalation, and a SafeExecutor runs only on a single-use intent-bound grant. Every decision leaves a Decision Dossier.",
   "keywords": [
     "execution-authority",