@decionis/agent-safe-pipeline 0.4.0 → 0.4.1

package/dist/intent/ExecutionIntent.js.map

@@ -1 +1 @@
-{"version":3,"file":"ExecutionIntent.js","sourceRoot":"","sources":["../../src/intent/ExecutionIntent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAmB,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,sBAAsB,CAAC,CAAC;AACjC,qFAAqF;AACrF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAC;AAElE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,KAAK,EAAE,iBAAiB;IACxB,gBAAgB,EAAE,sBAAsB;IACxC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE;IACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjD;;;;OAIG;IACH,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,UAAU,EAAE,gBAAgB;IAC5B,gBAAgB,EAAE,sBAAsB;IACxC,OAAO,EAAE,gBAAgB;IACzB,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE;IACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAClD,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"ExecutionIntent.js","sourceRoot":"","sources":["../../src/intent/ExecutionIntent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAmB,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,sBAAsB,CAAC,CAAC;AACjC,qFAAqF;AACrF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,eAAe,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,eAAe,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,iBAAiB,CAAC;AAElE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,KAAK,EAAE,iBAAiB;IACxB,gBAAgB,EAAE,sBAAsB;IACxC,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;IACrC,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE;IACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC7C,iFAAiF;IACjF,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjD;;;;OAIG;IACH,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,UAAU,EAAE,gBAAgB;IAC5B,gBAAgB,EAAE,sBAAsB;IACxC,OAAO,EAAE,gBAAgB;IACzB,aAAa,EAAE,SAAS,CAAC,QAAQ,EAAE;IACnC,oBAAoB,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC7C,gBAAgB,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAClD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/intent/IntentBindingSchema.d.ts

@@ -36,6 +36,12 @@ export declare const AuthorityIntentBindingSchema: z.ZodObject<{
         environment: z.ZodOptional<z.ZodString>;
         endpoint: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
+    policy_projection: z.ZodOptional<z.ZodObject<{
+        decision_type: z.ZodString;
+        transaction_type: z.ZodNullable<z.ZodString>;
+        workflow_key: z.ZodNullable<z.ZodString>;
+        channel: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
     expected_effect_digest: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 /** What the schema accepts; the tests hold it to the `AuthorityIntentBinding` wire interface. */

package/dist/intent/IntentBindingSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IntentBindingSchema.d.ts","sourceRoot":"","sources":["../../src/intent/IntentBindingSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,2FAC6D,CAAC;AAU3F;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsCrC,CAAC;AAEL,iGAAiG;AACjG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOjE"}
+{"version":3,"file":"IntentBindingSchema.d.ts","sourceRoot":"","sources":["../../src/intent/IntentBindingSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,2FAC6D,CAAC;AAW3F;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA+CrC,CAAC;AAEL,iGAAiG;AACjG,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAEvF;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOjE"}

package/dist/intent/IntentBindingSchema.js

@@ -9,6 +9,7 @@ const actionType = z
     .max(120)
     .regex(/^[a-z][a-z0-9._:-]*$/);
 const sha256Digest = z.string().regex(/^sha256:[0-9a-f]{64}$/);
+const projectionValue = z.string().min(1).max(120);
 /**
  * The `agent-safe.intent/1` binding as it is hashed and sent, as a strict
  * schema: what `CanonicalIntentHasher.bindingOf` produces, and what an
@@ -49,6 +50,15 @@ export const AuthorityIntentBindingSchema = z
         endpoint: z.string().min(1).max(500).optional(),
     })
         .strict(),
+    policy_projection: z
+        .object({
+        decision_type: projectionValue,
+        transaction_type: projectionValue.nullable(),
+        workflow_key: projectionValue.nullable(),
+        channel: projectionValue.nullable(),
+    })
+        .strict()
+        .optional(),
     expected_effect_digest: sha256Digest.optional(),
 })
     .strict()

package/dist/intent/IntentBindingSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"IntentBindingSchema.js","sourceRoot":"","sources":["../../src/intent/IntentBindingSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEnE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAC3B,wFAAwF,CAAC;AAE3F,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,sBAAsB,CAAC,CAAC;AACjC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAClD,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,UAAU,EAAE,gBAAgB;KAC7B,CAAC;SACD,MAAM,EAAE;IACX,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;IAC5F,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC;QACN,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,UAAU;QACrB,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,MAAM,EAAE;IACX,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE;KACR,IAAI,CAAC;IACJ,KAAK,EAAE,6BAA6B;IACpC,WAAW,EACT,2MAA2M;CAC9M,CAAC,CAAC;AAKL;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,4BAA4B,EAAE;QAC7D,MAAM,EAAE,eAAe;QACvB,EAAE,EAAE,OAAO;KACZ,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"IntentBindingSchema.js","sourceRoot":"","sources":["../../src/intent/IntentBindingSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEnE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAC3B,wFAAwF,CAAC;AAE3F,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,sBAAsB,CAAC,CAAC;AACjC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;AAC/D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEnD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,EAAE,EAAE,UAAU;QACd,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,UAAU,CAAC,QAAQ,EAAE;QAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAClD,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACpC,UAAU,EAAE,gBAAgB;KAC7B,CAAC;SACD,MAAM,EAAE;IACX,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;IAC5F,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC;QACN,MAAM,EAAE,UAAU;QAClB,SAAS,EAAE,UAAU;QACrB,WAAW,EAAE,UAAU,CAAC,QAAQ,EAAE;QAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;KAChD,CAAC;SACD,MAAM,EAAE;IACX,iBAAiB,EAAE,CAAC;SACjB,MAAM,CAAC;QACN,aAAa,EAAE,eAAe;QAC9B,gBAAgB,EAAE,eAAe,CAAC,QAAQ,EAAE;QAC5C,YAAY,EAAE,eAAe,CAAC,QAAQ,EAAE;QACxC,OAAO,EAAE,eAAe,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,sBAAsB,EAAE,YAAY,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE;KACR,IAAI,CAAC;IACJ,KAAK,EAAE,6BAA6B;IACpC,WAAW,EACT,2MAA2M;CAC9M,CAAC,CAAC;AAKL;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,CAAC,4BAA4B,EAAE;QAC7D,MAAM,EAAE,eAAe;QACvB,EAAE,EAAE,OAAO;KACZ,CAAC,CAAC;IACH,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC;IACvC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,gBAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;AACrD,CAAC"}

package/dist/intent/IntentCapture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IntentCapture.d.ts","sourceRoot":"","sources":["../../src/intent/IntentCapture.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;gBAE/B,OAAO,CAAC,EAAE,oBAAoB;IAQ1C,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,GAAG,cAAc;IAsChG,6EAA6E;IAChE,eAAe,CAC1B,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,oBAAoB,GACjC,OAAO,CAAC,cAAc,CAAC;CAK3B"}
+{"version":3,"file":"IntentCapture.d.ts","sourceRoot":"","sources":["../../src/intent/IntentCapture.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAKL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC;IACxC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAa;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAe;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA4B;gBAE/B,OAAO,CAAC,EAAE,oBAAoB;IAQ1C,OAAO,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,GAAG,cAAc;IAyChG,6EAA6E;IAChE,eAAe,CAC1B,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,oBAAoB,GACjC,OAAO,CAAC,cAAc,CAAC;CAK3B"}

package/dist/intent/IntentCapture.js

@@ -47,6 +47,9 @@ export class IntentCapture {
             ...(trusted.expectedEffectDigest === undefined
                 ? {}
                 : { expectedEffectDigest: trusted.expectedEffectDigest }),
+            ...(trusted.policyProjection === undefined
+                ? {}
+                : { policyProjection: trusted.policyProjection }),
             idempotencyKey: trusted.idempotencyKey,
         });
         return this.hasher.capture(intent);

package/dist/intent/IntentCapture.js.map

@@ -1 +1 @@
-{"version":3,"file":"IntentCapture.js","sourceRoot":"","sources":["../../src/intent/IntentCapture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,GAI3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAUnE,MAAM,OAAO,aAAa;IACP,MAAM,CAAwB;IAC9B,KAAK,CAAa;IAClB,QAAQ,CAAe;IACvB,UAAU,CAAS;IACnB,KAAK,CAA4B;IAElD,YAAmB,OAA8B;QAC/C,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,UAAU,CAAC;QAChD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;IAEM,OAAO,CAAC,aAA4B,EAAE,YAAkC;QAC7E,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,CAAC,gCAAgC,EAAE,GAAG,qBAAqB,CAAC,CAAC;QAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC;YACzC,OAAO,EAAE,qBAAqB;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,OAAO,EACL,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC3B,CAAC,CAAC,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAC/D,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC3D,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,6EAA6E;IACtE,KAAK,CAAC,eAAe,CAC1B,aAA4B,EAC5B,YAAkC;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"IntentCapture.js","sourceRoot":"","sources":["../../src/intent/IntentCapture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gCAAgC,EAChC,0BAA0B,GAI3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAUnE,MAAM,OAAO,aAAa;IACP,MAAM,CAAwB;IAC9B,KAAK,CAAa;IAClB,QAAQ,CAAe;IACvB,UAAU,CAAS;IACnB,KAAK,CAA4B;IAElD,YAAmB,OAA8B;QAC/C,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,UAAU,CAAC;QAChD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,IAAI,CAAC,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC9B,CAAC;IAEM,OAAO,CAAC,aAA4B,EAAE,YAAkC;QAC7E,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/D,0EAA0E;QAC1E,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,CAAC,gCAAgC,EAAE,GAAG,qBAAqB,CAAC,CAAC;QAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC;YACzC,OAAO,EAAE,qBAAqB;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,OAAO,EACL,OAAO,CAAC,OAAO,KAAK,SAAS;gBAC3B,CAAC,CAAC,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAC/D,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAC3D,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACxC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACnD,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,6EAA6E;IACtE,KAAK,CAAC,eAAe,CAC1B,aAA4B,EAC5B,YAAkC;QAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrE,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/profile/ApiProfile.d.ts

@@ -0,0 +1,154 @@
+import { z } from "zod";
+import type { JsonObject, JsonValue } from "../intent/JsonValue.js";
+/**
+ * `agent-safe.profile.api/1`: a platform API described as data, so that every
+ * component that turns one of its calls into an intent turns it into the same
+ * one. A profile maps method + path (and, where an API overloads a path, an
+ * exact query value) to an action type, and names the facts a decision reads
+ * by JSON pointer into the call. The gateway reads it to govern an agent's
+ * call; a native executor's `prepare` reads it to describe the call it is
+ * about to make. One mapping, no code coupling between them.
+ */
+export declare const API_PROFILE_CONTRACT = "agent-safe.profile.api/1";
+export declare const API_PROFILE_SCHEMA_ID = "https://github.com/decionis/agent-safe-pipeline/blob/master/spec/profiles/api/v1/schema.json";
+/** The methods a profile governs; a read is never an operation. */
+export declare const API_PROFILE_METHODS: readonly ["POST", "PUT", "PATCH", "DELETE"];
+export type ApiProfileMethod = (typeof API_PROFILE_METHODS)[number];
+/**
+ * Fact names a profile may not use. The first group is what the gateway
+ * already states in an intent's context; the second is what the Decionis
+ * authority states itself, or reads from the request rather than the context,
+ * so a fact of that name would be shadowed or refused there.
+ */
+export declare const RESERVED_FACT_NAMES: readonly string[];
+/** The most elements one `*` pointer collects; more is not a fact, it is a payload. */
+export declare const MAX_FACT_ELEMENTS = 100;
+/** The longest string a fact carries; a longer value is not stated. */
+export declare const MAX_FACT_STRING = 1000;
+export declare const ApiPolicyProjectionSchema: z.ZodObject<{
+    decision_type: z.ZodString;
+    transaction_type: z.ZodNullable<z.ZodString>;
+    workflow_key: z.ZodNullable<z.ZodString>;
+    channel: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const ApiOperationSchema: z.ZodObject<{
+    id: z.ZodString;
+    method: z.ZodEnum<{
+        POST: "POST";
+        PUT: "PUT";
+        PATCH: "PATCH";
+        DELETE: "DELETE";
+    }>;
+    path: z.ZodString;
+    query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    action: z.ZodString;
+    summary: z.ZodString;
+    facts: z.ZodRecord<z.ZodString, z.ZodString>;
+    policy_projection: z.ZodNullable<z.ZodObject<{
+        decision_type: z.ZodString;
+        transaction_type: z.ZodNullable<z.ZodString>;
+        workflow_key: z.ZodNullable<z.ZodString>;
+        channel: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const ApiProfileDefinitionSchema: z.ZodObject<{
+    profile: z.ZodLiteral<"agent-safe.profile.api/1">;
+    id: z.ZodString;
+    platform: z.ZodString;
+    title: z.ZodString;
+    prefixes: z.ZodArray<z.ZodUnion<readonly [z.ZodLiteral<"">, z.ZodString]>>;
+    operations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        method: z.ZodEnum<{
+            POST: "POST";
+            PUT: "PUT";
+            PATCH: "PATCH";
+            DELETE: "DELETE";
+        }>;
+        path: z.ZodString;
+        query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        action: z.ZodString;
+        summary: z.ZodString;
+        facts: z.ZodRecord<z.ZodString, z.ZodString>;
+        policy_projection: z.ZodNullable<z.ZodObject<{
+            decision_type: z.ZodString;
+            transaction_type: z.ZodNullable<z.ZodString>;
+            workflow_key: z.ZodNullable<z.ZodString>;
+            channel: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ApiPolicyProjection = z.infer<typeof ApiPolicyProjectionSchema>;
+export type ApiOperationDefinition = z.infer<typeof ApiOperationSchema>;
+export type ApiProfileDefinition = z.infer<typeof ApiProfileDefinitionSchema>;
+/** One call as a component is about to make it, or as the gateway received it. */
+export interface ApiRequest {
+    readonly method: string;
+    /** The URL path, as sent (percent-encoded); without query or fragment. */
+    readonly path: string;
+    readonly query?: {
+        readonly [key: string]: string | readonly string[];
+    };
+    /** The parsed JSON body, when there is one. */
+    readonly body?: JsonValue;
+}
+/** What a profile says about one call. */
+export interface ApiProfileMatch {
+    readonly profile: string;
+    readonly operation: string;
+    readonly action: string;
+    /** Every fact whose pointer resolved to a statable value; the others are absent. */
+    readonly facts: JsonObject;
+    readonly policyProjection: ApiPolicyProjection | null;
+}
+export declare class ApiProfileError extends Error {
+    readonly code: "API_PROFILE_INVALID";
+    readonly detail: string;
+    constructor(code: "API_PROFILE_INVALID", detail: string);
+}
+/**
+ * One profile, validated and compiled. Matching is deterministic and total:
+ * the first operation, in profile order, whose method, path and query match
+ * is the call's operation; a call no operation matches is not described by
+ * the profile and the caller decides what that means.
+ */
+export declare class ApiProfile {
+    readonly definition: ApiProfileDefinition;
+    private readonly compiled;
+    private constructor();
+    /** Validates a definition (closed schema, unique operations, pointers, reserved names) and compiles it. */
+    static parse(value: unknown): ApiProfile;
+    get id(): string;
+    get platform(): string;
+    /** Every action type the profile can produce, for a registry to be sealed over. */
+    actions(): readonly string[];
+    operation(id: string): ApiOperationDefinition | null;
+    /**
+     * The operation a method, path and query select, before any body is read:
+     * what the gateway needs to decide whether to govern a call.
+     */
+    operationFor(method: string, path: string, query?: ApiRequest["query"]): ApiOperationDefinition | null;
+    /** The operation, action type, facts and policy projection of one call; null when no operation matches. */
+    match(request: ApiRequest): ApiProfileMatch | null;
+    private select;
+    /** A template as an anchored expression: placeholders take one segment's text, never a `/`. */
+    private static compile;
+    private static escape;
+    /** A placeholder's value: percent-decoded, OData quotes removed; null when it does not decode. */
+    private static decode;
+    private static queryMatches;
+    private static queryRoot;
+    /** RFC 6901 reference tokens, unescaped; one `*` token at most. */
+    private static pointerSegments;
+    /**
+     * The value at a pointer, when it is statable: a string (at most 1000
+     * characters), a finite number or a boolean; or, through one `*`, an array
+     * of up to 100 of them, every element statable. Anything else is absent.
+     */
+    private static read;
+    private static walk;
+    private static statable;
+}
+/** The published JSON Schema of a profile definition, generated from the validator above. */
+export declare function apiProfileJsonSchema(): Record<string, unknown>;
+//# sourceMappingURL=ApiProfile.d.ts.map

package/dist/profile/ApiProfile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiProfile.d.ts","sourceRoot":"","sources":["../../src/profile/ApiProfile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAiB,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAE/D,eAAO,MAAM,qBAAqB,iGAC8D,CAAC;AAEjG,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,6CAA8C,CAAC;AAC/E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAmChD,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,uEAAuE;AACvE,eAAO,MAAM,eAAe,OAAO,CAAC;AASpC,eAAO,MAAM,yBAAyB;;;;;kBAKpC,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;kBAqB7B,CAAC;AAEH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkBrC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC5E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACxE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;IACxE,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACvD;AAED,qBAAa,eAAgB,SAAQ,KAAK;aAEtB,IAAI,EAAE,qBAAqB;aAC3B,MAAM,EAAE,MAAM;gBADd,IAAI,EAAE,qBAAqB,EAC3B,MAAM,EAAE,MAAM;CAKjC;AASD;;;;;GAKG;AACH,qBAAa,UAAU;aAGe,UAAU,EAAE,oBAAoB;IAFpE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IAExD,OAAO;IAoCP,2GAA2G;WAC7F,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU;IAa/C,IAAW,EAAE,IAAI,MAAM,CAEtB;IAED,IAAW,QAAQ,IAAI,MAAM,CAE5B;IAED,mFAAmF;IAC5E,OAAO,IAAI,SAAS,MAAM,EAAE;IAI5B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI;IAI3D;;;OAGG;IACI,YAAY,CACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,UAAU,CAAC,OAAO,CAAM,GAC9B,sBAAsB,GAAG,IAAI;IAIhC,2GAA2G;IACpG,KAAK,CAAC,OAAO,EAAE,UAAU,GAAG,eAAe,GAAG,IAAI;IA0BzD,OAAO,CAAC,MAAM;IA0Bd,+FAA+F;IAC/F,OAAO,CAAC,MAAM,CAAC,OAAO;IA2BtB,OAAO,CAAC,MAAM,CAAC,MAAM;IAIrB,kGAAkG;IAClG,OAAO,CAAC,MAAM,CAAC,MAAM;IAarB,OAAO,CAAC,MAAM,CAAC,YAAY;IAU3B,OAAO,CAAC,MAAM,CAAC,SAAS;IASxB,mEAAmE;IACnE,OAAO,CAAC,MAAM,CAAC,eAAe;IAa9B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,IAAI;IAenB,OAAO,CAAC,MAAM,CAAC,IAAI;IAmBnB,OAAO,CAAC,MAAM,CAAC,QAAQ;CAMxB;AAED,6FAA6F;AAC7F,wBAAgB,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAa9D"}

package/dist/profile/ApiProfile.js

@@ -0,0 +1,369 @@
+import { z } from "zod";
+/**
+ * `agent-safe.profile.api/1`: a platform API described as data, so that every
+ * component that turns one of its calls into an intent turns it into the same
+ * one. A profile maps method + path (and, where an API overloads a path, an
+ * exact query value) to an action type, and names the facts a decision reads
+ * by JSON pointer into the call. The gateway reads it to govern an agent's
+ * call; a native executor's `prepare` reads it to describe the call it is
+ * about to make. One mapping, no code coupling between them.
+ */
+export const API_PROFILE_CONTRACT = "agent-safe.profile.api/1";
+export const API_PROFILE_SCHEMA_ID = "https://github.com/decionis/agent-safe-pipeline/blob/master/spec/profiles/api/v1/schema.json";
+/** The methods a profile governs; a read is never an operation. */
+export const API_PROFILE_METHODS = ["POST", "PUT", "PATCH", "DELETE"];
+/**
+ * Fact names a profile may not use. The first group is what the gateway
+ * already states in an intent's context; the second is what the Decionis
+ * authority states itself, or reads from the request rather than the context,
+ * so a fact of that name would be shadowed or refused there.
+ */
+export const RESERVED_FACT_NAMES = [
+    "request_sha256",
+    "body_sha256",
+    "body_bytes",
+    "content_type",
+    "body_embedded",
+    "ingress",
+    "claimed_principal",
+    "api_profile",
+    "agent_safe",
+    "action_context",
+    "amount",
+    "risk_score",
+    "channel",
+    "objective_profile",
+    "mode",
+    "decision_band",
+    "transaction_type",
+    "workflow_key",
+    "vertical_pack",
+    "policy_version",
+    "org_id",
+    "decision_type",
+    "decision_domain",
+    "signals",
+    "signal_provenance",
+    "history",
+    "override",
+    "evidence",
+    "attachments",
+    "attachment_count",
+    "policy",
+    "context",
+    "intake",
+    "runtime_attribution",
+];
+/** The most elements one `*` pointer collects; more is not a fact, it is a payload. */
+export const MAX_FACT_ELEMENTS = 100;
+/** The longest string a fact carries; a longer value is not stated. */
+export const MAX_FACT_STRING = 1000;
+const PLACEHOLDER = /\{([A-Z]\w{0,63})\}/gi;
+const TEMPLATE = /^(\/[^/?#%\\\s]+)+$/;
+const POINTER = /^\/(path|query|body)(\/.*)?$/;
+const name = z.string().regex(/^[a-z][a-z0-9_]{0,63}$/);
+const projectionText = z.string().trim().min(1).max(120);
+export const ApiPolicyProjectionSchema = z.strictObject({
+    decision_type: projectionText,
+    transaction_type: projectionText.nullable(),
+    workflow_key: projectionText.nullable(),
+    channel: projectionText.nullable(),
+});
+export const ApiOperationSchema = z.strictObject({
+    /** The operation's name in the profile, unique, dotted lower camel case. */
+    id: z
+        .string()
+        .regex(/^[a-z][A-Za-z0-9]*(\.[a-z][A-Za-z0-9]*)*$/)
+        .max(120),
+    method: z.enum(API_PROFILE_METHODS),
+    /** A path template: literal text and `{name}` placeholders, each within one segment. */
+    path: z.string().max(500).regex(TEMPLATE),
+    /** Exact query values the call must carry to be this operation (an API that overloads a path). */
+    query: z.record(z.string().regex(/^[a-z][\w.-]{0,63}$/), z.string().max(200)).optional(),
+    /** The intent's action type. */
+    action: z
+        .string()
+        .max(120)
+        .regex(/^[a-z][a-z0-9._:-]*$/),
+    summary: z.string().trim().min(1).max(300),
+    /** Fact name → RFC 6901 pointer into `{ path, query, body }`; one `*` segment collects an array. */
+    facts: z.record(name, z.string().max(300).regex(POINTER)),
+    /** The policy path the authority decides the call under, when the profile states one. */
+    policy_projection: ApiPolicyProjectionSchema.nullable(),
+});
+export const ApiProfileDefinitionSchema = z.strictObject({
+    profile: z.literal(API_PROFILE_CONTRACT),
+    /** `<platform>/<api>/<version>`, the profile's directory under `profiles/`. */
+    id: z
+        .string()
+        .regex(/^[a-z][a-z0-9]*\/[a-z][a-z0-9]*\/v\d+(\.\d+)?$/)
+        .max(120),
+    platform: z
+        .string()
+        .regex(/^[a-z][a-z0-9-]*$/)
+        .max(80),
+    title: z.string().trim().min(1).max(200),
+    /** Path templates an operation's path may follow; `""` is the bare path. Tried in order. */
+    prefixes: z
+        .array(z.union([z.literal(""), z.string().max(300).regex(TEMPLATE)]))
+        .min(1)
+        .max(8),
+    operations: z.array(ApiOperationSchema).min(1).max(200),
+});
+export class ApiProfileError extends Error {
+    code;
+    detail;
+    constructor(code, detail) {
+        super(code);
+        this.code = code;
+        this.detail = detail;
+        this.name = "ApiProfileError";
+    }
+}
+/**
+ * One profile, validated and compiled. Matching is deterministic and total:
+ * the first operation, in profile order, whose method, path and query match
+ * is the call's operation; a call no operation matches is not described by
+ * the profile and the caller decides what that means.
+ */
+export class ApiProfile {
+    definition;
+    compiled;
+    constructor(definition) {
+        this.definition = definition;
+        const ids = new Set();
+        const signatures = new Set();
+        this.compiled = definition.operations.map((operation) => {
+            if (ids.has(operation.id))
+                throw new ApiProfileError("API_PROFILE_INVALID", `duplicate operation ${operation.id}`);
+            ids.add(operation.id);
+            const signature = `${operation.method} ${operation.path.replace(PLACEHOLDER, "{}")} ${JSON.stringify(Object.entries(operation.query ?? {}).sort(([a], [b]) => a.localeCompare(b)))}`;
+            if (signatures.has(signature))
+                throw new ApiProfileError("API_PROFILE_INVALID", `operation ${operation.id} repeats another operation's method, path and query`);
+            signatures.add(signature);
+            for (const fact of Object.keys(operation.facts)) {
+                if (RESERVED_FACT_NAMES.includes(fact))
+                    throw new ApiProfileError("API_PROFILE_INVALID", `operation ${operation.id} names the reserved fact ${fact}`);
+            }
+            for (const pointer of Object.values(operation.facts))
+                ApiProfile.pointerSegments(pointer, operation.id);
+            const matchers = [];
+            const placeholders = [];
+            for (const prefix of definition.prefixes) {
+                const { pattern, names } = ApiProfile.compile(`${prefix}${operation.path}`, operation.id);
+                matchers.push(pattern);
+                placeholders.push(names);
+            }
+            return { definition: operation, matchers, placeholders };
+        });
+    }
+    /** Validates a definition (closed schema, unique operations, pointers, reserved names) and compiles it. */
+    static parse(value) {
+        const parsed = ApiProfileDefinitionSchema.safeParse(value);
+        if (!parsed.success)
+            throw new ApiProfileError("API_PROFILE_INVALID", parsed.error.issues
+                .slice(0, 3)
+                .map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`)
+                .join("; "));
+        return new ApiProfile(parsed.data);
+    }
+    get id() {
+        return this.definition.id;
+    }
+    get platform() {
+        return this.definition.platform;
+    }
+    /** Every action type the profile can produce, for a registry to be sealed over. */
+    actions() {
+        return [...new Set(this.definition.operations.map((operation) => operation.action))];
+    }
+    operation(id) {
+        return this.definition.operations.find((operation) => operation.id === id) ?? null;
+    }
+    /**
+     * The operation a method, path and query select, before any body is read:
+     * what the gateway needs to decide whether to govern a call.
+     */
+    operationFor(method, path, query = {}) {
+        return this.select(method, path, query)?.operation.definition ?? null;
+    }
+    /** The operation, action type, facts and policy projection of one call; null when no operation matches. */
+    match(request) {
+        const selected = this.select(request.method, request.path, request.query ?? {});
+        if (selected === null)
+            return null;
+        const { operation, parameters } = selected;
+        const root = {
+            path: parameters,
+            query: ApiProfile.queryRoot(request.query ?? {}),
+            ...(request.body === undefined ? {} : { body: request.body }),
+        };
+        const facts = {};
+        for (const [fact, pointer] of Object.entries(operation.definition.facts)) {
+            const value = ApiProfile.read(root, ApiProfile.pointerSegments(pointer, operation.definition.id));
+            if (value !== undefined)
+                facts[fact] = value;
+        }
+        return {
+            profile: this.definition.id,
+            operation: operation.definition.id,
+            action: operation.definition.action,
+            facts,
+            policyProjection: operation.definition.policy_projection,
+        };
+    }
+    select(method, path, query) {
+        const upper = method.toUpperCase();
+        if (!path.startsWith("/") || /[?#]/.test(path))
+            return null;
+        for (const operation of this.compiled) {
+            if (operation.definition.method !== upper)
+                continue;
+            if (!ApiProfile.queryMatches(operation.definition.query ?? {}, query))
+                continue;
+            for (let index = 0; index < operation.matchers.length; index += 1) {
+                const found = operation.matchers[index].exec(path);
+                if (found === null)
+                    continue;
+                const parameters = {};
+                let decodable = true;
+                operation.placeholders[index].forEach((placeholder, position) => {
+                    const decoded = ApiProfile.decode(found[position + 1] ?? "");
+                    if (decoded === null)
+                        decodable = false;
+                    else
+                        parameters[placeholder] = decoded;
+                });
+                if (decodable)
+                    return { operation, parameters };
+            }
+        }
+        return null;
+    }
+    /** A template as an anchored expression: placeholders take one segment's text, never a `/`. */
+    static compile(template, operation) {
+        const names = [];
+        let source = "";
+        let last = 0;
+        for (const found of template.matchAll(PLACEHOLDER)) {
+            const placeholder = found[1];
+            if (names.includes(placeholder))
+                throw new ApiProfileError("API_PROFILE_INVALID", `operation ${operation} repeats the placeholder ${placeholder}`);
+            names.push(placeholder);
+            source += ApiProfile.escape(template.slice(last, found.index)) + "([^/()]+)";
+            last = (found.index ?? 0) + found[0].length;
+        }
+        source += ApiProfile.escape(template.slice(last));
+        if (/[{}]/.test(template.replace(PLACEHOLDER, "")))
+            throw new ApiProfileError("API_PROFILE_INVALID", `operation ${operation} has a malformed placeholder`);
+        return { pattern: new RegExp(`^${source}$`), names };
+    }
+    static escape(text) {
+        return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    }
+    /** A placeholder's value: percent-decoded, OData quotes removed; null when it does not decode. */
+    static decode(raw) {
+        let value;
+        try {
+            value = decodeURIComponent(raw);
+        }
+        catch {
+            return null;
+        }
+        if (value.length >= 2 && value.startsWith("'") && value.endsWith("'"))
+            value = value.slice(1, -1);
+        if (value === "" || value === "." || value === ".." || value.includes("/"))
+            return null;
+        return value;
+    }
+    static queryMatches(expected, query) {
+        return Object.entries(expected).every(([key, value]) => {
+            const actual = query[key];
+            return typeof actual === "string" ? actual === value : false;
+        });
+    }
+    static queryRoot(query) {
+        const root = {};
+        for (const [key, value] of Object.entries(query)) {
+            if (key === "__proto__" || key === "constructor" || key === "prototype")
+                continue;
+            root[key] = typeof value === "string" ? value : [...value];
+        }
+        return root;
+    }
+    /** RFC 6901 reference tokens, unescaped; one `*` token at most. */
+    static pointerSegments(pointer, operation) {
+        const tokens = pointer
+            .slice(1)
+            .split("/")
+            .map((token) => token.replaceAll("~1", "/").replaceAll("~0", "~"));
+        if (tokens.filter((token) => token === "*").length > 1 || /~[^01]|~$/.test(pointer))
+            throw new ApiProfileError("API_PROFILE_INVALID", `operation ${operation} has an invalid fact pointer ${pointer}`);
+        return tokens;
+    }
+    /**
+     * The value at a pointer, when it is statable: a string (at most 1000
+     * characters), a finite number or a boolean; or, through one `*`, an array
+     * of up to 100 of them, every element statable. Anything else is absent.
+     */
+    static read(root, tokens) {
+        const wildcard = tokens.indexOf("*");
+        if (wildcard === -1)
+            return ApiProfile.statable(ApiProfile.walk(root, tokens));
+        const list = ApiProfile.walk(root, tokens.slice(0, wildcard));
+        if (!Array.isArray(list) || list.length === 0 || list.length > MAX_FACT_ELEMENTS)
+            return undefined;
+        const values = [];
+        for (const element of list) {
+            const value = ApiProfile.statable(ApiProfile.walk(element, tokens.slice(wildcard + 1)));
+            if (value === undefined)
+                return undefined;
+            values.push(value);
+        }
+        return values;
+    }
+    static walk(value, tokens) {
+        let current = value;
+        for (const token of tokens) {
+            if (Array.isArray(current)) {
+                if (!/^(?:0|[1-9]\d{0,5})$/.test(token))
+                    return undefined;
+                current = current[Number(token)];
+            }
+            else if (current !== null && typeof current === "object") {
+                current = Object.hasOwn(current, token) ? current[token] : undefined;
+            }
+            else {
+                return undefined;
+            }
+            if (current === undefined)
+                return undefined;
+        }
+        return current;
+    }
+    static statable(value) {
+        if (typeof value === "string")
+            return value.length <= MAX_FACT_STRING ? value : undefined;
+        if (typeof value === "number")
+            return Number.isFinite(value) ? value : undefined;
+        if (typeof value === "boolean")
+            return value;
+        return undefined;
+    }
+}
+/** The published JSON Schema of a profile definition, generated from the validator above. */
+export function apiProfileJsonSchema() {
+    const generated = z.toJSONSchema(ApiProfileDefinitionSchema, {
+        target: "draft-2020-12",
+        io: "input",
+    });
+    const schema = { ...generated };
+    delete schema["$schema"];
+    return {
+        $schema: "https://json-schema.org/draft/2020-12/schema",
+        $id: API_PROFILE_SCHEMA_ID,
+        title: API_PROFILE_CONTRACT,
+        ...schema,
+    };
+}
+//# sourceMappingURL=ApiProfile.js.map