@decionis/agent-safe-pipeline 0.3.7 → 0.4.0

package/dist/http/AuthorityPaths.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Every execution-authority path this package calls, in one place, as the
+ * REST resources Decionis serves them (`decionis-outcome-infrastructure`
+ * plan §3.0): a decision binds a grant, and a grant has claims, receipts and
+ * reconciliations, each created by a POST. The verb routes these replace
+ * stay registered on the authority as aliases of the same handlers, and are
+ * named here only for the one case that needs them: a grant whose id cannot
+ * be read from its token.
+ *
+ * A grant's id is its `jti`: the id the authority returns as
+ * `execution_token_jti`, records with the grant, and signs into the token.
+ */
+export declare class AuthorityPaths {
+    /** Evaluate an intent and bind a single-use grant: `POST`. */
+    static readonly GRANTS = "/v1/authority/grants";
+    /**
+     * The verb routes the REST resources replace. Deprecated on the authority
+     * and kept there as aliases on the same handlers, for clients that predate
+     * the resources.
+     */
+    static readonly LEGACY: Readonly<{
+        enforceAndBind: "/v1/authority/enforce-and-bind";
+        verifyToken: "/v1/execution/verify-token";
+        claimToken: "/v1/execution/claim-token";
+        finalizeToken: "/v1/execution/finalize-token";
+    }>;
+    /** Read and verify one grant: `GET`. */
+    static grant(grantId: string): string;
+    /** Claim a grant, once, immediately before the write: `POST`. */
+    static claims(grantId: string): string;
+    /** Record how the claimed attempt ended (finalize): `POST`. */
+    static receipts(grantId: string): string;
+    /** Report how an attempt finalized `INDETERMINATE` resolved: `POST`. */
+    static reconciliations(grantId: string): string;
+    /** One managed escalation: `GET` its state, `DELETE` to cancel it. */
+    static escalation(escalationId: string): string;
+    /** Where to claim the grant an execution token stands for. */
+    static claimFor(executionToken: string): string;
+    /** Where to record the receipt for the grant an execution token stands for. */
+    static receiptFor(executionToken: string): string;
+    /**
+     * The grant id a Decionis execution token names (its `jti`), read without
+     * verifying anything: it only addresses the resource, and the authority
+     * verifies the token itself and refuses a path whose id is not the
+     * token's. Null for a token that is not a JWT or whose `jti` is not a UUID
+     * (the only grant id the authority routes), in which case the caller uses
+     * the legacy alias.
+     */
+    static grantIdOf(executionToken: string): string | null;
+}
+//# sourceMappingURL=AuthorityPaths.d.ts.map

package/dist/http/AuthorityPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityPaths.d.ts","sourceRoot":"","sources":["../../src/http/AuthorityPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,qBAAa,cAAc;IACzB,8DAA8D;IAC9D,gBAAuB,MAAM,0BAA0B;IAEvD;;;;OAIG;IACH,gBAAuB,MAAM;;;;;OAK1B;IAEH,wCAAwC;WAC1B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAI5C,iEAAiE;WACnD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAI7C,+DAA+D;WACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAI/C,wEAAwE;WAC1D,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAItD,sEAAsE;WACxD,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAItD,8DAA8D;WAChD,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAKtD,+EAA+E;WACjE,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAOxD;;;;;;;OAOG;WACW,SAAS,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;CAY/D"}

package/dist/http/AuthorityPaths.js

@@ -0,0 +1,84 @@
+/**
+ * Every execution-authority path this package calls, in one place, as the
+ * REST resources Decionis serves them (`decionis-outcome-infrastructure`
+ * plan §3.0): a decision binds a grant, and a grant has claims, receipts and
+ * reconciliations, each created by a POST. The verb routes these replace
+ * stay registered on the authority as aliases of the same handlers, and are
+ * named here only for the one case that needs them: a grant whose id cannot
+ * be read from its token.
+ *
+ * A grant's id is its `jti`: the id the authority returns as
+ * `execution_token_jti`, records with the grant, and signs into the token.
+ */
+export class AuthorityPaths {
+    /** Evaluate an intent and bind a single-use grant: `POST`. */
+    static GRANTS = "/v1/authority/grants";
+    /**
+     * The verb routes the REST resources replace. Deprecated on the authority
+     * and kept there as aliases on the same handlers, for clients that predate
+     * the resources.
+     */
+    static LEGACY = Object.freeze({
+        enforceAndBind: "/v1/authority/enforce-and-bind",
+        verifyToken: "/v1/execution/verify-token",
+        claimToken: "/v1/execution/claim-token",
+        finalizeToken: "/v1/execution/finalize-token",
+    });
+    /** Read and verify one grant: `GET`. */
+    static grant(grantId) {
+        return `${AuthorityPaths.GRANTS}/${encodeURIComponent(grantId)}`;
+    }
+    /** Claim a grant, once, immediately before the write: `POST`. */
+    static claims(grantId) {
+        return `${AuthorityPaths.grant(grantId)}/claims`;
+    }
+    /** Record how the claimed attempt ended (finalize): `POST`. */
+    static receipts(grantId) {
+        return `${AuthorityPaths.grant(grantId)}/receipts`;
+    }
+    /** Report how an attempt finalized `INDETERMINATE` resolved: `POST`. */
+    static reconciliations(grantId) {
+        return `${AuthorityPaths.grant(grantId)}/reconciliations`;
+    }
+    /** One managed escalation: `GET` its state, `DELETE` to cancel it. */
+    static escalation(escalationId) {
+        return `/v1/authority/escalations/${encodeURIComponent(escalationId)}`;
+    }
+    /** Where to claim the grant an execution token stands for. */
+    static claimFor(executionToken) {
+        const grantId = AuthorityPaths.grantIdOf(executionToken);
+        return grantId === null ? AuthorityPaths.LEGACY.claimToken : AuthorityPaths.claims(grantId);
+    }
+    /** Where to record the receipt for the grant an execution token stands for. */
+    static receiptFor(executionToken) {
+        const grantId = AuthorityPaths.grantIdOf(executionToken);
+        return grantId === null
+            ? AuthorityPaths.LEGACY.finalizeToken
+            : AuthorityPaths.receipts(grantId);
+    }
+    /**
+     * The grant id a Decionis execution token names (its `jti`), read without
+     * verifying anything: it only addresses the resource, and the authority
+     * verifies the token itself and refuses a path whose id is not the
+     * token's. Null for a token that is not a JWT or whose `jti` is not a UUID
+     * (the only grant id the authority routes), in which case the caller uses
+     * the legacy alias.
+     */
+    static grantIdOf(executionToken) {
+        const parts = executionToken.split(".");
+        const payload = parts[1];
+        if (parts.length !== 3 || payload === undefined || payload.length === 0)
+            return null;
+        try {
+            const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+            const jti = claims?.jti;
+            return typeof jti === "string" && GRANT_ID.test(jti) ? jti : null;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+/** A grant id as the authority mints and routes it: a UUID, which no path segment has to escape. */
+const GRANT_ID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+//# sourceMappingURL=AuthorityPaths.js.map

package/dist/http/AuthorityPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthorityPaths.js","sourceRoot":"","sources":["../../src/http/AuthorityPaths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,cAAc;IACzB,8DAA8D;IACvD,MAAM,CAAU,MAAM,GAAG,sBAAsB,CAAC;IAEvD;;;;OAIG;IACI,MAAM,CAAU,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5C,cAAc,EAAE,gCAAgC;QAChD,WAAW,EAAE,4BAA4B;QACzC,UAAU,EAAE,2BAA2B;QACvC,aAAa,EAAE,8BAA8B;KAC9C,CAAC,CAAC;IAEH,wCAAwC;IACjC,MAAM,CAAC,KAAK,CAAC,OAAe;QACjC,OAAO,GAAG,cAAc,CAAC,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,iEAAiE;IAC1D,MAAM,CAAC,MAAM,CAAC,OAAe;QAClC,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACnD,CAAC;IAED,+DAA+D;IACxD,MAAM,CAAC,QAAQ,CAAC,OAAe;QACpC,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;IACrD,CAAC;IAED,wEAAwE;IACjE,MAAM,CAAC,eAAe,CAAC,OAAe;QAC3C,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC5D,CAAC;IAED,sEAAsE;IAC/D,MAAM,CAAC,UAAU,CAAC,YAAoB;QAC3C,OAAO,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;IACzE,CAAC;IAED,8DAA8D;IACvD,MAAM,CAAC,QAAQ,CAAC,cAAsB;QAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9F,CAAC;IAED,+EAA+E;IACxE,MAAM,CAAC,UAAU,CAAC,cAAsB;QAC7C,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACzD,OAAO,OAAO,KAAK,IAAI;YACrB,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa;YACrC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,SAAS,CAAC,cAAsB;QAC5C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;YACzF,MAAM,GAAG,GAAI,MAA4C,EAAE,GAAG,CAAC;YAC/D,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;;AAGH,oGAAoG;AACpG,MAAM,QAAQ,GAAG,4DAA4D,CAAC"}

package/dist/shadow/ShadowPipeline.d.ts

@@ -1,5 +1,5 @@
 import type { AuditRecorder } from "../audit/AuditRecorder.js";
-import type { DecisionAuthority, DecisionVerdict } from "../decision/DecisionAuthority.js";
+import type { DecisionAuthority, DecisionEvidence, DecisionVerdict } from "../decision/DecisionAuthority.js";
 import type { CapturedIntent } from "../intent/ExecutionIntent.js";
 export type ShadowObservationStatus = "OBSERVED" | "UNAVAILABLE" | "TIMED_OUT" | "INVALID" | "ABORTED";
 /**
@@ -53,6 +53,8 @@ export interface ShadowPipelineOptions {
 export interface ShadowObserveOptions {
     /** Cancels the observation only; production execution is never cancelled by this pipeline. */
     readonly signal?: AbortSignal;
+    /** Evidence the proposal carried, such as a producer's signed signals, observed as the authority would see it. */
+    readonly evidence?: DecisionEvidence;
 }
 /**
  * Runs an existing production execution unchanged while asking an authority

package/dist/shadow/ShadowPipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ShadowPipeline.d.ts","sourceRoot":"","sources":["../../src/shadow/ShadowPipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EAEhB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,MAAM,uBAAuB,GACjC,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,CAAC,OAAO,IACvC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3D,0FAA0F;AAC1F,MAAM,WAAW,SAAS,CAAC,OAAO;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO;IACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,sGAAsG;IACtG,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAaD;;;;GAIG;AACH,qBAAa,cAAc;IAMvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAL5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAGlB,SAAS,EAAE,iBAAiB,EAC7C,OAAO,GAAE,qBAA0B;IAarC;;;;OAIG;IACU,OAAO,CAAC,OAAO,EAC1B,QAAQ,EAAE,cAAc,EACxB,iBAAiB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,EACnD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAW9B,6FAA6F;IAChF,OAAO,CAAC,OAAO,EAC1B,QAAQ,EAAE,cAAc,EACxB,iBAAiB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,EACnD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IASrC,OAAO,CAAC,QAAQ;YAwCF,MAAM;IAiBpB,OAAO,CAAC,MAAM,CAAC,KAAK;IAWpB,6FAA6F;IAC7F,OAAO,CAAC,MAAM,CAAC,QAAQ;IAyCvB,OAAO,CAAC,MAAM,CAAC,mBAAmB;CAUnC"}
+{"version":3,"file":"ShadowPipeline.d.ts","sourceRoot":"","sources":["../../src/shadow/ShadowPipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EACV,iBAAiB,EACjB,gBAAgB,EAEhB,eAAe,EAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,MAAM,MAAM,uBAAuB,GACjC,UAAU,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;AAEnE;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,CAAC,OAAO,IACvC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAE3D,0FAA0F;AAC1F,MAAM,WAAW,SAAS,CAAC,OAAO;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,gBAAgB,CAAC,OAAO;IACvC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACtD,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,sGAAsG;IACtG,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,kHAAkH;IAClH,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CACtC;AAaD;;;;GAIG;AACH,qBAAa,cAAc;IAMvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAL5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;gBAGlB,SAAS,EAAE,iBAAiB,EAC7C,OAAO,GAAE,qBAA0B;IAarC;;;;OAIG;IACU,OAAO,CAAC,OAAO,EAC1B,QAAQ,EAAE,cAAc,EACxB,iBAAiB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,EACnD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAW9B,6FAA6F;IAChF,OAAO,CAAC,OAAO,EAC1B,QAAQ,EAAE,cAAc,EACxB,iBAAiB,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,EACnD,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IASrC,OAAO,CAAC,QAAQ;YA4CF,MAAM;IAiBpB,OAAO,CAAC,MAAM,CAAC,KAAK;IAWpB,6FAA6F;IAC7F,OAAO,CAAC,MAAM,CAAC,QAAQ;IAyCvB,OAAO,CAAC,MAAM,CAAC,mBAAmB;CAUnC"}

package/dist/shadow/ShadowPipeline.js

@@ -31,7 +31,7 @@ export class ShadowPipeline {
      * never rejects and never delays production.
      */
     async observe(captured, existingExecution, options = {}) {
-        const observation = this.evaluate(captured, options.signal);
+        const observation = this.evaluate(captured, options.signal, options.evidence);
         let production;
         try {
             production = { status: "COMPLETED", result: await existingExecution() };
@@ -50,7 +50,7 @@ export class ShadowPipeline {
             observation: await run.observation,
         });
     }
-    evaluate(captured, signal) {
+    evaluate(captured, signal, evidence) {
         const startedAt = this.clock();
         const settled = new Promise((resolve) => {
             let done = false;
@@ -71,7 +71,7 @@ export class ShadowPipeline {
             signal?.addEventListener("abort", onAbort, { once: true });
             // Promise.resolve().then isolates a synchronously throwing authority.
             void Promise.resolve()
-                .then(async () => await this.authority.evaluate(captured))
+                .then(async () => await this.authority.evaluate(captured, evidence))
                 .then((decision) => finish(ShadowPipeline.classify(captured, decision)), () => finish(ShadowPipeline.empty("UNAVAILABLE")));
         });
         return settled.then(async (classified) => {

package/dist/shadow/ShadowPipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"ShadowPipeline.js","sourceRoot":"","sources":["../../src/shadow/ShadowPipeline.ts"],"names":[],"mappings":"AAiEA,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAO1E;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAMN;IALF,KAAK,CAA4B;IACjC,SAAS,CAAS;IAClB,KAAK,CAAe;IAErC,YACmB,SAA4B,EAC7C,UAAiC,EAAE;QADlB,cAAS,GAAT,SAAS,CAAmB;QAG7C,IAAI,SAAS,CAAC,cAAc,KAAK,aAAa,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,OAAO,CAClB,QAAwB,EACxB,iBAAmD,EACnD,UAAgC,EAAE;QAElC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,UAA4C,CAAC;QACjD,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,iBAAiB,EAAE,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,6FAA6F;IACtF,KAAK,CAAC,OAAO,CAClB,QAAwB,EACxB,iBAAmD,EACnD,UAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,WAAW,EAAE,MAAM,GAAG,CAAC,WAAW;SACnC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,QAAwB,EAAE,MAAoB;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,UAAsB,EAAQ,EAAE;gBAC9C,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,OAAO,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1F,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,sEAAsE;YACtE,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;iBACzD,IAAI,CACH,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EACjE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAClD,CAAC;QACN,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACvC,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC;gBACnD,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,eAAe;gBAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,GAAG,UAAU;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;gBACvD,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC;aAClD,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACzC,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,QAAwB,EAAE,WAA8B;QAC3E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,kBAAkB;YAC7B,SAAS,EAAE,eAAe;YAC1B,QAAQ;YACR,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;YACzE,GAAG,CAAC,WAAW,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;YAClF,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;YAC/E,WAAW,EAAE,CAAC,UAAU,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,KAAK,CAC7E,CAAC,EACD,gBAAgB,CACjB;YACD,UAAU,EAAE,WAAW,CAAC,UAAU;SACnC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,MAA+B,EAAE,cAAwB,EAAE;QAC9E,OAAO;YACL,MAAM;YACN,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;YACf,WAAW;YACX,cAAc,EAAE,KAAK;SACtB,CAAC;IACJ,CAAC;IAED,6FAA6F;IACrF,MAAM,CAAC,QAAQ,CAAC,QAAwB,EAAE,QAAsB;QACtE,MAAM,SAAS,GAAG,QAAoD,CAAC;QACvE,IACE,SAAS,KAAK,IAAI;YAClB,OAAO,SAAS,KAAK,QAAQ;YAC7B,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;YACrC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,UAAU,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,IAAI,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1F,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;YACrC,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,gBAAgB;YAC/C,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAChF,CAAC;YACD,OAAO,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YACjD,OAAO,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,cAAc,GAClB,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,CAAC;QAClF,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAClC,0FAA0F;YAC1F,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC;gBACvC,cAAc;aACf,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC;YACvC,cAAc;SACf,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAAC,KAAc;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"ShadowPipeline.js","sourceRoot":"","sources":["../../src/shadow/ShadowPipeline.ts"],"names":[],"mappings":"AAoEA,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAkB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAO1E;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAMN;IALF,KAAK,CAA4B;IACjC,SAAS,CAAS;IAClB,KAAK,CAAe;IAErC,YACmB,SAA4B,EAC7C,UAAiC,EAAE;QADlB,cAAS,GAAT,SAAS,CAAmB;QAG7C,IAAI,SAAS,CAAC,cAAc,KAAK,aAAa,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAChG,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,OAAO,CAClB,QAAwB,EACxB,iBAAmD,EACnD,UAAgC,EAAE;QAElC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,UAA4C,CAAC;QACjD,IAAI,CAAC;YACH,UAAU,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,iBAAiB,EAAE,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,UAAU,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,6FAA6F;IACtF,KAAK,CAAC,OAAO,CAClB,QAAwB,EACxB,iBAAmD,EACnD,UAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,WAAW,EAAE,MAAM,GAAG,CAAC,WAAW;SACnC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CACd,QAAwB,EACxB,MAAoB,EACpB,QAA2B;QAE3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,UAAsB,EAAQ,EAAE;gBAC9C,IAAI,IAAI;oBAAE,OAAO;gBACjB,IAAI,GAAG,IAAI,CAAC;gBACZ,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9C,OAAO,CAAC,UAAU,CAAC,CAAC;YACtB,CAAC,CAAC;YACF,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACpE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1F,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,sEAAsE;YACtE,KAAK,OAAO,CAAC,OAAO,EAAE;iBACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;iBACnE,IAAI,CACH,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,EACjE,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAClD,CAAC;QACN,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACvC,MAAM,WAAW,GAAsB,MAAM,CAAC,MAAM,CAAC;gBACnD,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,eAAe;gBAC1B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,GAAG,UAAU;gBACb,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;gBACvD,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC;aAClD,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACzC,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,QAAwB,EAAE,WAA8B;QAC3E,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACtB,SAAS,EAAE,kBAAkB;YAC7B,SAAS,EAAE,eAAe;YAC1B,QAAQ;YACR,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;YACzE,GAAG,CAAC,WAAW,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC;YAClF,GAAG,CAAC,WAAW,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC;YAC/E,WAAW,EAAE,CAAC,UAAU,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC,KAAK,CAC7E,CAAC,EACD,gBAAgB,CACjB;YACD,UAAU,EAAE,WAAW,CAAC,UAAU;SACnC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,MAA+B,EAAE,cAAwB,EAAE;QAC9E,OAAO;YACL,MAAM;YACN,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,IAAI;YACf,WAAW;YACX,cAAc,EAAE,KAAK;SACtB,CAAC;IACJ,CAAC;IAED,6FAA6F;IACrF,MAAM,CAAC,QAAQ,CAAC,QAAwB,EAAE,QAAsB;QACtE,MAAM,SAAS,GAAG,QAAoD,CAAC;QACvE,IACE,SAAS,KAAK,IAAI;YAClB,OAAO,SAAS,KAAK,QAAQ;YAC7B,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;YACrC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC;YAChC,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,UAAU,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,IAAI,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1F,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;YACrC,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,gBAAgB;YAC/C,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAChF,CAAC;YACD,OAAO,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,SAAS,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC;YACjD,OAAO,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,cAAc,GAClB,SAAS,CAAC,aAAa,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,CAAC;QAClF,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAClC,0FAA0F;YAC1F,OAAO;gBACL,MAAM,EAAE,aAAa;gBACrB,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC;gBACvC,cAAc;aACf,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;YAChC,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,WAAW,EAAE,CAAC,GAAG,SAAS,CAAC,WAAW,CAAC;YACvC,cAAc;SACf,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAAC,KAAc;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/testing/Index.d.ts

@@ -8,5 +8,6 @@
 export { FixtureAuthorizationVerifier, FixtureDecisionAuthority, createFixtureAuthorityPair, type FixtureAuthorityPair, type FixtureCommitRecord, type FixtureVerdictResolver, type UnsafeFixtureAuthorityOptions, } from "../decision/FixtureDecisionAuthority.js";
 export { InMemoryReplayStore } from "../execution/ReplayStore.js";
 export { LocalPresence, LOCAL_PRESENCE_API_KEY, readBody, type LocalAuthenticator, type LocalCeremonyResponse, type LocalPresenceOptions, type LocalPresenceRequestRecord, type LocalReceipt, type LocalReceiptBinding, type LocalReceiptVerification, type LocalVerificationRecord, type LocalVerificationStatus, } from "./LocalPresence.js";
-export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, EFFECT_RECEIPT_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, type LocalAuthorityOptions, type LocalClaimAttestationClaims, type LocalEffectReceiptCode, type LocalEffectReceiptRecord, type LocalProviderKey, type LocalAuthorityPolicy, type LocalAuthorityRequestRecord, type LocalGrantRecord, type LocalManagedEscalationRecord, type LocalRouteOverride, } from "./LocalAuthority.js";
+export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, EFFECT_RECEIPT_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, type LocalAuthorityOptions, type LocalClaimAttestationClaims, type LocalEffectReceiptCode, type LocalEffectReceiptRecord, type LocalProviderKey, PROVIDER_KEY_PURPOSES, type LocalAuthorityPolicy, type LocalAuthorityPolicyInput, type LocalProviderKeyPurpose, type LocalAuthorityRequestRecord, type LocalGrantRecord, type LocalManagedEscalationRecord, type LocalRouteOverride, } from "./LocalAuthority.js";
+export { SIGNED_SIGNAL_MAX_LIFETIME_SECONDS, SIGNED_SIGNAL_REFUSAL_CODES, SIGNED_SIGNAL_TYPE, mintSignedSignal, signedSignalFacts, verifySignedSignal, verifySignedSignals, type SignedSignalClaims, type SignedSignalCoverage, type SignedSignalFacts, type SignedSignalIntentView, type SignedSignalKey, type SignedSignalRefusalCode, type SignedSignalVerification, type VerifiedSignedSignal, } from "./SignedSignals.js";
 //# sourceMappingURL=Index.d.ts.map

package/dist/testing/Index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"Index.d.ts","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,EACR,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kCAAkC,EAClC,2BAA2B,EAC3B,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,GAC1B,MAAM,oBAAoB,CAAC"}

package/dist/testing/Index.js

@@ -8,5 +8,6 @@
 export { FixtureAuthorizationVerifier, FixtureDecisionAuthority, createFixtureAuthorityPair, } from "../decision/FixtureDecisionAuthority.js";
 export { InMemoryReplayStore } from "../execution/ReplayStore.js";
 export { LocalPresence, LOCAL_PRESENCE_API_KEY, readBody, } from "./LocalPresence.js";
-export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, EFFECT_RECEIPT_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, } from "./LocalAuthority.js";
+export { AUTONOMOUS_LIMIT_MINOR, CLAIM_ATTESTATION_TYPE, EFFECT_RECEIPT_TYPE, HUMAN_LIMIT_MINOR, LocalAuthority, LOCAL_AUTHORITY_API_KEY, LOCAL_AUTHORITY_ISSUER, LOCAL_AUTHORITY_JWKS_PATH, hashBinding, stableStringify, PROVIDER_KEY_PURPOSES, } from "./LocalAuthority.js";
+export { SIGNED_SIGNAL_MAX_LIFETIME_SECONDS, SIGNED_SIGNAL_REFUSAL_CODES, SIGNED_SIGNAL_TYPE, mintSignedSignal, signedSignalFacts, verifySignedSignal, verifySignedSignals, } from "./SignedSignals.js";
 //# sourceMappingURL=Index.js.map

package/dist/testing/Index.js.map

@@ -1 +1 @@
-{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,GAK3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,GAUT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,GAWhB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"Index.js","sourceRoot":"","sources":["../../src/testing/Index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,0BAA0B,GAK3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,QAAQ,GAUT,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,eAAe,EAMf,qBAAqB,GAQtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kCAAkC,EAClC,2BAA2B,EAC3B,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,GASpB,MAAM,oBAAoB,CAAC"}

package/dist/testing/LocalAuthority.d.ts

@@ -18,6 +18,7 @@
 import { type KeyObject } from "node:crypto";
 import { z } from "zod";
 import { type LocalPresence } from "./LocalPresence.js";
+import { type SignedSignalFacts } from "./SignedSignals.js";
 export declare const LOCAL_AUTHORITY_API_KEY = "test-key";
 export declare const AUTONOMOUS_LIMIT_MINOR = 10000;
 export declare const HUMAN_LIMIT_MINOR = 100000;
@@ -44,6 +45,9 @@ declare const AuthorityRequestSchema: z.ZodObject<{
             provider: z.ZodLiteral<"attestation">;
             attestation: z.ZodString;
         }, z.core.$strict>], "provider">>;
+        signals: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            token: z.ZodString;
+        }, z.core.$strict>>>;
     }, z.core.$strict>>;
     escalation: z.ZodOptional<z.ZodObject<{
         mode: z.ZodLiteral<"MANAGED">;
@@ -87,6 +91,9 @@ declare const AuthorityRequestSchema: z.ZodObject<{
     }, z.core.$strict>;
     expected_effect_digest: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+/** What a registered key may sign, as the hosted `ExecutionProviderKeyPurpose` names it. */
+export declare const PROVIDER_KEY_PURPOSES: readonly ["effect_receipt", "presence_attestation", "usage_report", "signed_signal"];
+export type LocalProviderKeyPurpose = (typeof PROVIDER_KEY_PURPOSES)[number];
 export type LocalAuthorityRequest = z.infer<typeof AuthorityRequestSchema>;
 type Verdict = "ALLOW" | "ESCALATE" | "BLOCK";
 type ManagedStatus = "PENDING_PRESENCE" | "PRESENCE_REQUESTED" | "AWAITING_APPROVER" | "PRESENCE_VERIFIED" | "REAUTHORIZING" | "GRANT_READY" | "EXPIRED" | "REJECTED" | "BLOCKED" | "CANCELLED" | "FAILED";
@@ -96,7 +103,15 @@ type LifecycleEntry = ManagedStatus | {
 };
 type Decision = Record<string, unknown>;
 /** Verdict for an intent evaluated without evidence; evidence handling stays generic. */
-export type LocalAuthorityPolicy = (request: LocalAuthorityRequest) => Verdict;
+/**
+ * What a policy hook sees: the request, and the facts of every signed signal
+ * it carried, verified, under `signed_signals` by name, as the hosted
+ * authority writes them under `agent_safe.signed_signals`.
+ */
+export type LocalAuthorityPolicyInput = LocalAuthorityRequest & {
+    readonly signed_signals?: Readonly<Record<string, SignedSignalFacts>>;
+};
+export type LocalAuthorityPolicy = (request: LocalAuthorityPolicyInput) => Verdict;
 export interface LocalRouteOverride {
     readonly status?: number;
     readonly body?: unknown;
@@ -164,6 +179,7 @@ export interface LocalProviderKey {
     readonly issuer: string;
     readonly publicKey: KeyObject;
     readonly label: string | null;
+    readonly purpose: LocalProviderKeyPurpose;
 }
 export interface LocalManagedEscalationRecord {
     readonly escalationId: string;
@@ -324,7 +340,17 @@ export declare class LocalAuthority {
         readonly issuer: string;
         readonly publicJwk: JsonWebKey;
         readonly label?: string;
+        /** What the key may sign; a receipt key by default, as the hosted route defaults. */
+        readonly purpose?: LocalProviderKeyPurpose;
     }): void;
+    /** The key a signed signal's `kid` names, when it was registered to sign signals. */
+    private signedSignalKey;
+    /**
+     * The signed signals a request carries, verified as the hosted authority
+     * verifies them, as facts by name for the policy hook; a refusal names its
+     * code, and the route answers it with a 409 like a refused attestation.
+     */
+    private signedSignalsOf;
     /**
      * Reads a receipt the way the hosted authority does: the protected header
      * names an Ed25519 key the organisation registered; the signature verifies
@@ -347,6 +373,14 @@ export declare class LocalAuthority {
     /** Statuses returned, in order, for the next managed escalation instead of orchestration. */
     scriptNextManagedLifecycle(statuses: readonly LifecycleEntry[]): void;
     private handle;
+    /** A grant resource addressed by an id that is not the presented token's grant: refused, as hosted. */
+    private grantIdMismatch;
+    /**
+     * `POST /v1/authority/grants/{grantId}/reconciliations`: how an attempt
+     * finalized `INDETERMINATE` resolved, from the executor that claimed it.
+     * Recorded once; the grant is never reopened.
+     */
+    private reconcile;
     /** `POST /v1/execution/provider-keys`: the public half only, or a 400 naming why. */
     private registerProviderKeyRoute;
     private enforceAndBind;

package/dist/testing/LocalAuthority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LocalAuthority.d.ts","sourceRoot":"","sources":["../../src/testing/LocalAuthority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElE,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAClD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAQzC,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAC3F,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AACvE,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAiJjE,mGAAmG;AACnG,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AA+CH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,KAAK,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAC9C,KAAK,aAAa,GACd,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,QAAQ,CAAC;AACb,KAAK,cAAc,GAAG,aAAa,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACxF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOxC,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC;AAE/E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,GAAG,IAAI,CAAC;IAC3D,8FAA8F;IAC9F,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;CAC1C;AAED,6FAA6F;AAC7F,MAAM,MAAM,sBAAsB,GAC9B,yBAAyB,GACzB,0BAA0B,GAC1B,4BAA4B,GAC5B,kCAAkC,GAClC,iCAAiC,CAAC;AAEtC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAMD,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gGAAgG;IAChG,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAC3E,UAAU,EAAE,MAAM,KACf,OAAO,CAAC;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAC3F,OAAO,CAAC;IACb,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QAC9F,QAAQ,CAAC,YAAY,EAAE;YACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YACpC,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,CAAC;SAChD,CAAC;KACH,CAAC;CACH;AAED,qEAAqE;AACrE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAEzF,+FAA+F;AAC/F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,0CAA0C,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAyBD,qBAAa,cAAc;IACzB,oFAAoF;IACpF,SAAgB,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IAC7D,8CAA8C;IAC9C,SAAgB,MAAM,gCAAuC;IAC7D,4DAA4D;IAC5D,SAAgB,WAAW,4CAAmD;IAC9E,wGAAwG;IACxG,SAAgB,YAAY,gCAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyC;IAC7E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6C;IAC/E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAoB;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG7B;IACF,4FAA4F;IAC5F,SAAgB,gBAAgB,4BAA4B;IAC5D;;;;;OAKG;IACI,wBAAwB,UAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAKxB;IACF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;IACnF,OAAO,CAAC,oBAAoB,CAAiC;IAC7D,OAAO,CAAC,SAAS,CAAK;IACtB,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGrB;IACJ,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;IAC5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6C;IAC/E,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;gBAEE,OAAO,GAAE,qBAA0B;IAmBtD,8FAA8F;IAC9F,IAAW,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAMvE;IAED;;;;OAIG;IACH,OAAO,CAAC,MAAM;IA+Cd;;;;OAIG;IACI,mBAAmB,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,IAAI;IASR;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2FzB,IAAW,OAAO,IAAI,MAAM,CAE3B;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQlC;;;;OAIG;IACI,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAIjF,6FAA6F;IACtF,0BAA0B,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;YAI9D,MAAM;IA4FpB,qFAAqF;IACrF,OAAO,CAAC,wBAAwB;IAwBhC,OAAO,CAAC,cAAc;IA2BtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ;IAkBhB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA0CrB,wFAAwF;IACxF,OAAO,CAAC,QAAQ;IA6ChB,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,aAAa;IAgDrB,qGAAqG;IACrG,OAAO,CAAC,WAAW;IAgDnB,iGAAiG;IACjG,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,aAAa;IA8CrB,OAAO,CAAC,QAAQ;IA8BhB,qFAAqF;IACrF,OAAO,CAAC,OAAO;IAqDf,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,KAAK;IA+Fb,OAAO,CAAC,QAAQ;IAkHhB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAIzB,+EAA+E;IAC/E,OAAO,CAAC,aAAa;YAiBP,OAAO;IAmCrB,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,MAAM,CAAC,UAAU;CAU1B"}
+{"version":3,"file":"LocalAuthority.d.ts","sourceRoot":"","sources":["../../src/testing/LocalAuthority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAQL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAEL,KAAK,iBAAiB,EAGvB,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,uBAAuB,aAAa,CAAC;AAClD,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,iBAAiB,SAAU,CAAC;AAQzC,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAC3F,eAAO,MAAM,sBAAsB,mCAAmC,CAAC;AACvE,kFAAkF;AAClF,eAAO,MAAM,mBAAmB,gCAAgC,CAAC;AAuJjE,mGAAmG;AACnG,QAAA,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1B,CAAC;AAsCH,4FAA4F;AAC5F,eAAO,MAAM,qBAAqB,sFAKxB,CAAC;AACX,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAsB7E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE3E,KAAK,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAC9C,KAAK,aAAa,GACd,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,eAAe,GACf,aAAa,GACb,SAAS,GACT,UAAU,GACV,SAAS,GACT,WAAW,GACX,QAAQ,CAAC;AACb,KAAK,cAAc,GAAG,aAAa,GAAG;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AACxF,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAOxC,yFAAyF;AACzF;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,qBAAqB,GAAG;IAC9D,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;CACvE,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,OAAO,CAAC;AAEnF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;IAC1D,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,WAAW,GAAG,QAAQ,GAAG,eAAe,GAAG,IAAI,CAAC;IAC3D,8FAA8F;IAC9F,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAAC;CAC1C;AAED,6FAA6F;AAC7F,MAAM,MAAM,sBAAsB,GAC9B,yBAAyB,GACzB,0BAA0B,GAC1B,4BAA4B,GAC5B,kCAAkC,GAClC,iCAAiC,CAAC;AAEtC,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,aAAa,EAAE,UAAU,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAMD,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;CAC3C;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAC;IACxC,mFAAmF;IACnF,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,gGAAgG;IAChG,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,aAAa,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,QAAQ,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,EAC3E,UAAU,EAAE,MAAM,KACf,OAAO,CAAC;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAC3F,OAAO,CAAC;IACb,gFAAgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE;QAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;YAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC;QAC9F,QAAQ,CAAC,YAAY,EAAE;YACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;YACpC,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,iBAAiB,CAAC;SAChD,CAAC;KACH,CAAC;CACH;AAED,qEAAqE;AACrE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAEzF,+FAA+F;AAC/F,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;QAC1C,QAAQ,CAAC,0CAA0C,EAAE,MAAM,CAAC;QAC5D,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;QACzC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAStD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAyBD,qBAAa,cAAc;IACzB,oFAAoF;IACpF,SAAgB,QAAQ,EAAE,2BAA2B,EAAE,CAAM;IAC7D,8CAA8C;IAC9C,SAAgB,MAAM,gCAAuC;IAC7D,4DAA4D;IAC5D,SAAgB,WAAW,4CAAmD;IAC9E,wGAAwG;IACxG,SAAgB,YAAY,gCAAuC;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAyC;IAC7E,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6C;IAC/E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuB;IAC9C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAoB;IAC7D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAe;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG7B;IACF,4FAA4F;IAC5F,SAAgB,gBAAgB,4BAA4B;IAC5D;;;;;OAKG;IACI,wBAAwB,UAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAKxB;IACF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmD;IACnF,OAAO,CAAC,oBAAoB,CAAiC;IAC7D,OAAO,CAAC,SAAS,CAAK;IACtB,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGrB;IACJ,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAU;IAC5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6C;IAC/E,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,IAAI,CAAK;gBAEE,OAAO,GAAE,qBAA0B;IAmBtD,8FAA8F;IAC9F,IAAW,IAAI,IAAI;QAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAMvE;IAED;;;;OAIG;IACH,OAAO,CAAC,MAAM;IA+Cd;;;;OAIG;IACI,mBAAmB,CAAC,KAAK,EAAE;QAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,qFAAqF;QACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;KAC5C,GAAG,IAAI;IAUR,qFAAqF;IACrF,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAwBvB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IA2FzB,IAAW,OAAO,IAAI,MAAM,CAE3B;IAEY,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAWtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQlC;;;;OAIG;IACI,UAAU,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAIjF,6FAA6F;IACtF,0BAA0B,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;YAI9D,MAAM;IA8GpB,uGAAuG;IACvG,OAAO,CAAC,eAAe;IAUvB;;;;OAIG;IACH,OAAO,CAAC,SAAS;IA2BjB,qFAAqF;IACrF,OAAO,CAAC,wBAAwB;IAyBhC,OAAO,CAAC,cAAc;IA2BtB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ;IAkBhB;;;;;OAKG;IACH,OAAO,CAAC,aAAa;IA0CrB,wFAAwF;IACxF,OAAO,CAAC,QAAQ;IAmDhB,OAAO,CAAC,cAAc;IAgBtB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,aAAa;IAgDrB,qGAAqG;IACrG,OAAO,CAAC,WAAW;IAgDnB,iGAAiG;IACjG,OAAO,CAAC,eAAe;IAiDvB,OAAO,CAAC,aAAa;IA8CrB,OAAO,CAAC,QAAQ;IA8BhB,qFAAqF;IACrF,OAAO,CAAC,OAAO;IA0Df,OAAO,CAAC,aAAa;IAmBrB,OAAO,CAAC,KAAK;IA+Fb,OAAO,CAAC,QAAQ;IAkHhB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAIzB,+EAA+E;IAC/E,OAAO,CAAC,aAAa;YAiBP,OAAO;IAmCrB,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,MAAM,CAAC,UAAU;CAU1B"}

package/dist/testing/LocalAuthority.js

@@ -19,6 +19,7 @@ import { createHash, createPublicKey, generateKeyPairSync, randomBytes, randomUU
 import { createServer } from "node:http";
 import { z } from "zod";
 import { readBody } from "./LocalPresence.js";
+import { verifySignedSignals, } from "./SignedSignals.js";
 export const LOCAL_AUTHORITY_API_KEY = "test-key";
 export const AUTONOMOUS_LIMIT_MINOR = 10_000;
 export const HUMAN_LIMIT_MINOR = 100_000;
@@ -173,6 +174,12 @@ const AuthorityEvidenceSchema = z.strictObject({
         }),
     ])
         .optional(),
+    /** A producer's signed standing signals (`SignedSignalEvidence`), at most eight. */
+    signals: z
+        .array(z.strictObject({ token: z.string().max(20_000).regex(COMPACT_JWS) }))
+        .min(1)
+        .max(8)
+        .optional(),
 });
 /** `ExecutionAuthorityRequest`: the binding plus hash, mode, evidence, and managed constraints. */
 const AuthorityRequestSchema = z.strictObject({
@@ -206,6 +213,22 @@ const FinalizeRequestSchema = z.strictObject({
     // is verified and recorded, never a reason to refuse the finalization.
     effect_receipt: z.string().min(1).max(20_000).regex(COMPACT_JWS).optional(),
 });
+const ReconcileRequestSchema = z.strictObject({
+    execution_token: z.string().min(1).max(20_000),
+    claim_token: z.string().regex(/^[\w-]{43,128}$/),
+    commit_correlation_id: boundedId,
+    outcome: z.enum(["COMMITTED", "FAILED"]),
+    reconciliation_note: z.string().min(1).max(2_000).optional(),
+    downstream_evidence: z.record(z.string(), z.unknown()).optional(),
+    effect_evidence: z.unknown().optional(),
+});
+/** What a registered key may sign, as the hosted `ExecutionProviderKeyPurpose` names it. */
+export const PROVIDER_KEY_PURPOSES = [
+    "effect_receipt",
+    "presence_attestation",
+    "usage_report",
+    "signed_signal",
+];
 /** `ExecutionProviderKeyRegistrationRequest`: the public half of an Ed25519 key. */
 const ProviderKeyRegistrationSchema = z.strictObject({
     org_id: z.uuid().optional(),
@@ -221,6 +244,7 @@ const ProviderKeyRegistrationSchema = z.strictObject({
         use: z.literal("sig").optional(),
     }),
     label: z.string().max(200).optional(),
+    purpose: z.enum(PROVIDER_KEY_PURPOSES).optional(),
 });
 const BINDING_KEYS = Object.keys(IntentBindingSchema.shape);
 function effectStatus(value) {
@@ -392,7 +416,37 @@ export class LocalAuthority {
             issuer: input.issuer,
             publicKey: createPublicKey({ key: input.publicJwk, format: "jwk" }),
             label: input.label ?? null,
+            purpose: input.purpose ?? "effect_receipt",
+        });
+    }
+    /** The key a signed signal's `kid` names, when it was registered to sign signals. */
+    signedSignalKey(kid) {
+        const key = this.providerKeys.get(kid);
+        return key !== undefined && key.purpose === "signed_signal"
+            ? { kid: key.kid, issuer: key.issuer, publicKey: key.publicKey }
+            : null;
+    }
+    /**
+     * The signed signals a request carries, verified as the hosted authority
+     * verifies them, as facts by name for the policy hook; a refusal names its
+     * code, and the route answers it with a 409 like a refused attestation.
+     */
+    signedSignalsOf(request) {
+        const signals = request.evidence?.signals;
+        if (signals === undefined)
+            return { facts: undefined };
+        const verification = verifySignedSignals(signals.map((signal) => signal.token), {
+            orgId: request.tenant_id,
+            findKey: (kid) => this.signedSignalKey(kid),
+            intent: {
+                action: request.action.type,
+                actorId: request.actor.id,
+                resource: request.action.resource,
+                parameters: request.action.parameters,
+            },
+            nowMs: this.clock(),
         });
+        return verification.ok ? { facts: verification.facts } : { refused: verification.code };
     }
     /**
      * Reads a receipt the way the hosted authority does: the protected header
@@ -584,9 +638,25 @@ export class LocalAuthority {
         if (req.headers["content-type"] !== "application/json") {
             return this.send(res, record, 415, { error: "UNSUPPORTED_MEDIA_TYPE" });
         }
+        // The grant's REST resources, as the hosted authority serves them: the
+        // path names the grant by its id, which must be the presented token's.
+        const grantResource = url.pathname.match(/^\/v1\/authority\/grants\/([^/]+)\/(claims|receipts|reconciliations)$/);
+        if (grantResource !== null) {
+            const mismatch = this.grantIdMismatch(record, decodeURIComponent(grantResource[1] ?? ""));
+            if (mismatch !== null)
+                return this.send(res, record, 409, mismatch);
+            if (grantResource[2] === "claims") {
+                return this.respond(res, record, "claim", this.claim(record));
+            }
+            if (grantResource[2] === "receipts") {
+                return this.respond(res, record, "finalize", this.finalize(record));
+            }
+            return this.send(res, record, ...this.reconcile(record));
+        }
         switch (url.pathname) {
             case "/v1/execution/provider-keys":
                 return this.send(res, record, ...this.registerProviderKeyRoute(record));
+            case "/v1/authority/grants":
             case "/v1/authority/enforce-and-bind":
                 return this.respond(res, record, "enforce", this.enforceAndBind(record));
             case "/v1/execution/claim-token":
@@ -598,6 +668,48 @@ export class LocalAuthority {
                 return this.send(res, record, 404, { error: "NOT_FOUND" });
         }
     }
+    /** A grant resource addressed by an id that is not the presented token's grant: refused, as hosted. */
+    grantIdMismatch(record, grantId) {
+        const token = record.body?.execution_token;
+        const grant = typeof token === "string" ? this.grants.get(token) : undefined;
+        if (grant === undefined || grant.jti === grantId)
+            return null;
+        return { valid: false, reason_codes: ["GRANT_ID_MISMATCH"] };
+    }
+    /**
+     * `POST /v1/authority/grants/{grantId}/reconciliations`: how an attempt
+     * finalized `INDETERMINATE` resolved, from the executor that claimed it.
+     * Recorded once; the grant is never reopened.
+     */
+    reconcile(record) {
+        const parsed = ReconcileRequestSchema.safeParse(record.body);
+        if (!parsed.success)
+            return [400, { error: "REQUEST_INVALID" }];
+        const refused = (reasonCode) => [
+            409,
+            { reconciled: false, reason_codes: [reasonCode] },
+        ];
+        const grant = this.grants.get(parsed.data.execution_token);
+        if (grant === undefined)
+            return refused("GRANT_INVALID");
+        if (!grant.claimed || grant.claimToken !== parsed.data.claim_token) {
+            return refused("NONCE_REPLAY_DETECTED");
+        }
+        if (grant.correlationId !== parsed.data.commit_correlation_id) {
+            return refused("EXECUTION_CORRELATION_MISMATCH");
+        }
+        if (grant.finalized !== "INDETERMINATE")
+            return refused("EXECUTION_NOT_INDETERMINATE");
+        grant.finalized = parsed.data.outcome;
+        return [
+            200,
+            {
+                reconciled: true,
+                resolution: parsed.data.outcome === "COMMITTED" ? "FINALIZED" : "FAILED",
+                reason_codes: [],
+            },
+        ];
+    }
     /** `POST /v1/execution/provider-keys`: the public half only, or a 400 naming why. */
     registerProviderKeyRoute(record) {
         const parsed = ProviderKeyRegistrationSchema.safeParse(record.body);
@@ -609,6 +721,7 @@ export class LocalAuthority {
             issuer: body.issuer,
             publicJwk: { kty: body.public_jwk.kty, crv: body.public_jwk.crv, x: body.public_jwk.x },
             ...(body.label === undefined ? {} : { label: body.label }),
+            ...(body.purpose === undefined ? {} : { purpose: body.purpose }),
         });
         return [
             201,
@@ -715,7 +828,11 @@ export class LocalAuthority {
     }
     /** Policy plus evidence handling: a valid receipt turns an escalation into an allow. */
     evaluate(request) {
-        const verdict = this.policy(request);
+        const signed = this.signedSignalsOf(request);
+        if ("refused" in signed) {
+            return { status: "BLOCK", reasonCode: signed.refused, approval: null, error: signed.refused };
+        }
+        const verdict = this.policy(signed.facts === undefined ? request : { ...request, signed_signals: signed.facts });
         if (verdict === "BLOCK") {
             return { status: "BLOCK", reasonCode: "POLICY_HARD_LIMIT_EXCEEDED", approval: null };
         }
@@ -1050,7 +1167,10 @@ export class LocalAuthority {
         if (!verification.ok)
             return done("FAILED", ["PRESENCE_VERIFICATION_FAILED", verification.reasonCode]);
         // PRESENCE_VERIFIED and REAUTHORIZING are passed through within one lookup, as Decionis does.
-        const reevaluated = this.policy(managed.request);
+        const signed = this.signedSignalsOf(managed.request);
+        const reevaluated = this.policy("refused" in signed || signed.facts === undefined
+            ? managed.request
+            : { ...managed.request, signed_signals: signed.facts });
         if (reevaluated === "BLOCK")
             return done("BLOCKED", ["REAUTHORIZATION_BLOCKED"]);
         return done("GRANT_READY", ["PRESENCE_RECEIPT_VERIFIED"]);