@decionis/agent-safe-pipeline 0.4.1 → 0.5.0

package/dist/testing/LocalAuthority.js

@@ -12,6 +12,13 @@
  * create a request bound to the exact intent hash, wait for the ceremony,
  * verify the receipt, re-evaluate policy, then expose a normal grant.
  *
+ * A claim re-derives authority from current state before it consumes
+ * anything, as the hosted revalidator does: a policy released since the grant
+ * fails `POLICY_VERSION_STALE`, a material signal published since the grant
+ * fails `SIGNAL_VERSION_STALE`, and a concurrency scope another open claim
+ * holds fails `AUTHORIZATION_SCOPE_BUSY` (or `CURRENT_STATE_UNRESOLVED` while
+ * that claim's outcome is unknown). None of them burns the grant.
+ *
  * Grants, claims, escalations, and commit outcomes are synthetic in-memory
  * state. Nothing here is a real policy, tenant, or credential.
  */
@@ -19,6 +26,7 @@ import { createHash, createPublicKey, generateKeyPairSync, randomBytes, randomUU
 import { createServer } from "node:http";
 import { z } from "zod";
 import { readBody } from "./LocalPresence.js";
+import { LocalAssumptionBreaches } from "./LocalAssumptionBreaches.js";
 import { verifySignedSignals, } from "./SignedSignals.js";
 export const LOCAL_AUTHORITY_API_KEY = "test-key";
 export const AUTONOMOUS_LIMIT_MINOR = 10_000;
@@ -29,6 +37,43 @@ const MAX_RECORDED_BODY_CHARS = 4_096;
 const SOCKET_TIMEOUT_MS = 10_000;
 const GRANT_TTL_MS = 60_000;
 const CLAIM_LEASE_MS = 30_000;
+/**
+ * `ExecutionTargetPrecondition`, the contract's, written here again rather
+ * than imported, so the fixture checks the package's precondition with an
+ * independent reading: what a runtime states in `context.agent_safe` about
+ * the target's state before asking.
+ */
+const TargetPreconditionContract = z
+    .object({
+    version: z.string().regex(/^[\x21-\x7e]{1,256}$/),
+    state: z
+        .string()
+        .min(1)
+        .max(200)
+        .regex(/^\P{Cc}+$/u)
+        .optional(),
+    source: z
+        .string()
+        .min(1)
+        .max(200)
+        .regex(/^[a-z0-9][\w.:/#-]*$/i),
+    read_at: z.string().datetime(),
+})
+    .strict();
+/**
+ * The precondition an intent's context states: the parsed contract, null when
+ * it states none, or `undefined` when it states one the contract refuses.
+ */
+function preconditionIn(context) {
+    const namespace = context["agent_safe"];
+    if (namespace === null || typeof namespace !== "object" || Array.isArray(namespace))
+        return null;
+    const raw = namespace["precondition"];
+    if (raw === undefined)
+        return null;
+    const parsed = TargetPreconditionContract.safeParse(raw);
+    return parsed.success ? parsed.data : undefined;
+}
 /** The issuer the fixture's grants and attestations name; a provider double checks it. */
 export const LOCAL_AUTHORITY_ISSUER = "synthetic-authority";
 /** Where the fixture publishes its attestation key, at the path Decionis documents. */
@@ -316,6 +361,13 @@ export class LocalAuthority {
     legacyVerifyReceipt;
     verifyAttestation;
     policy;
+    /** How many policy releases are active or behind; the first is `synthetic-policy-v1`. */
+    policyReleases = 1;
+    /** Every material signal ingested, by id: the reference and the value it carries. */
+    signals = new Map();
+    materialSignalsOf;
+    tenantKeys;
+    addressableGrants;
     managedApproverId;
     trustedEffectObserverIds;
     clock;
@@ -329,6 +381,13 @@ export class LocalAuthority {
      * says the executor must refuse.
      */
     misbindNextPayloadDigest = false;
+    /**
+     * The hosted assumption breaches: a finalization whose receipt or
+     * observation contradicts its grant holds the grant's scope, and
+     * `assumptionBreaches.clear(citations)` is the governed release or
+     * recovery review that cites it.
+     */
+    assumptionBreaches = new LocalAssumptionBreaches();
     overrides = {
         enforce: [],
         status: [],
@@ -344,6 +403,11 @@ export class LocalAuthority {
     escalationRouting;
     server = null;
     port = 0;
+    allowanceDrawsOf;
+    /** Each allowance's limit, by key, as the policy writer last set it. */
+    allowanceLimits = new Map();
+    /** What each issued grant drew, by jti. */
+    grantDraws = new Map();
     constructor(options = {}) {
         if (process.env.NODE_ENV === "production")
             throw new Error("LOCAL_DOUBLE_FORBIDDEN");
@@ -354,6 +418,9 @@ export class LocalAuthority {
         this.legacyVerifyReceipt = options.verifyReceipt;
         this.verifyAttestation = options.verifyAttestation;
         this.policy = options.policy ?? defaultPolicy;
+        this.materialSignalsOf = options.materialSignals ?? (() => []);
+        this.tenantKeys = options.tenantKeys ?? {};
+        this.addressableGrants = options.addressableGrants === true;
         this.managedApproverId = options.managedApproverId ?? "synthetic-managed-approver";
         this.trustedEffectObserverIds = options.trustedEffectObserverIds ?? [];
         this.clock = options.clock ?? Date.now;
@@ -362,6 +429,7 @@ export class LocalAuthority {
             privateKey: keys.privateKey,
             publicJwk: keys.publicKey.export({ format: "jwk" }),
         };
+        this.allowanceDrawsOf = options.allowanceDraws ?? (() => []);
     }
     /** The fixture's JWKS, as `GET /.well-known/decionis-execution-grant-jwks.json` serves it. */
     get jwks() {
@@ -392,6 +460,9 @@ export class LocalAuthority {
                 ...(grant.expectedEffectDigest === null
                     ? {}
                     : { expected_effect_digest: grant.expectedEffectDigest }),
+                ...(grant.expectedStateVersion === null
+                    ? {}
+                    : { expected_state_version: grant.expectedStateVersion }),
                 execution_nonce: grant.nonce,
                 execution_correlation_id: grant.correlationId ?? "",
             },
@@ -427,6 +498,51 @@ export class LocalAuthority {
             purpose: input.purpose ?? "effect_receipt",
         });
     }
+    /** The policy release decisions are made under now, as `policy_version` names it. */
+    get policyVersion() {
+        return `synthetic-policy-v${this.policyReleases}`;
+    }
+    /**
+     * Activates the next policy release, with a new policy hook or the same
+     * one: the governance authority's own act, which no API key can perform
+     * here or hosted. Every grant decided under an earlier release then fails
+     * at claim with `POLICY_VERSION_STALE`, and a new decision is made under
+     * this one. Returns the release now active.
+     */
+    releasePolicy(policy) {
+        if (policy !== undefined)
+            this.policy = policy;
+        this.policyReleases += 1;
+        return this.policyVersion;
+    }
+    /**
+     * Ingests a material signal's current value, as the hosted
+     * `POST /v1/protocol/signals/envelopes` does for a system of record. Each
+     * call is a new version, so a grant that read an earlier one fails at
+     * claim with `SIGNAL_VERSION_STALE`.
+     */
+    publishSignal(signalId, value) {
+        const reference = {
+            signal_id: signalId,
+            version: String(Number(this.signals.get(signalId)?.reference.version ?? 0) + 1),
+            observed_at: new Date(this.clock()).toISOString(),
+            value_digest: hashBinding(value),
+        };
+        this.signals.set(signalId, { reference, value });
+        return reference;
+    }
+    /** The published material signals a request names, in id order. */
+    materialSignalsFor(request) {
+        const ids = [...new Set(this.materialSignalsOf(request))].sort();
+        const published = ids.flatMap((id) => {
+            const signal = this.signals.get(id);
+            return signal === undefined ? [] : [signal];
+        });
+        return {
+            references: published.map((signal) => signal.reference),
+            values: Object.fromEntries(published.map((signal) => [signal.reference.signal_id, signal.value])),
+        };
+    }
     /** The key a signed signal's `kid` names, when it was registered to sign signals. */
     signedSignalKey(kid) {
         const key = this.providerKeys.get(kid);
@@ -540,6 +656,65 @@ export class LocalAuthority {
         }
         return record("EFFECT_RECEIPT_VERIFIED", described);
     }
+    /**
+     * Defines an allowance, or changes its limit: the policy writer's act
+     * (hosted, `PUT /v1/authority/allowances/{key}` with `policy:write`), which
+     * no decision key can perform here or hosted. Raising it is a top-up.
+     */
+    setAllowance(key, limit) {
+        if (!Number.isSafeInteger(limit) || limit < 0)
+            throw new Error("ALLOWANCE_LIMIT_INVALID");
+        this.allowanceLimits.set(key, limit);
+    }
+    /** What an allowance holds now; null for a key no allowance is defined under. */
+    allowanceUsage(key) {
+        const limit = this.allowanceLimits.get(key);
+        if (limit === undefined)
+            return null;
+        let reserved = 0;
+        let held = 0;
+        let consumed = 0;
+        for (const grant of this.grants.values()) {
+            for (const draw of this.grantDraws.get(grant.jti) ?? []) {
+                if (draw.allowance_key !== key || draw.amount === null)
+                    continue;
+                if (!grant.claimed) {
+                    if (grant.expiresAt * 1_000 > this.clock())
+                        reserved += draw.amount;
+                }
+                else if (grant.finalized === "COMMITTED") {
+                    consumed += draw.amount;
+                }
+                else if (grant.finalized !== "FAILED") {
+                    held += draw.amount;
+                }
+            }
+        }
+        return { reserved, held, consumed, available: Math.max(0, limit - reserved - held - consumed) };
+    }
+    /**
+     * An ALLOW's grant, once its draws are reserved, as hosted reserves them
+     * with the grant; or the same decision as `BLOCK` with the refusal code and
+     * no grant. Never ESCALATE: no approval creates capacity.
+     */
+    grantWithinAllowances(request, decision, approval) {
+        const draws = this.allowanceDrawsOf(request);
+        const refused = draws.find((draw) => draw.amount === null) !== undefined
+            ? "ALLOWANCE_AMOUNT_INVALID"
+            : draws.some((draw) => this.allowanceUsage(draw.allowance_key) === null)
+                ? "ALLOWANCE_UNDEFINED"
+                : draws.some((draw) => draw.amount > this.allowanceUsage(draw.allowance_key).available)
+                    ? "ALLOWANCE_EXHAUSTED"
+                    : null;
+        if (refused !== null) {
+            const reasons = Array.isArray(decision.reason_codes) ? decision.reason_codes : [];
+            return { ...decision, status: "BLOCK", reason_codes: [...reasons, refused] };
+        }
+        const granted = this.grantDecision(request, decision, approval);
+        if (draws.length > 0)
+            this.grantDraws.set(String(granted.execution_token_jti), draws);
+        return granted;
+    }
     get baseUrl() {
         return `${LOOPBACK_ORIGIN}:${this.port}`;
     }
@@ -623,7 +798,14 @@ export class LocalAuthority {
                 next: {},
             });
         }
-        if (req.headers.authorization !== `Bearer ${this.apiKey}`) {
+        // The policy lifecycle takes an account session, never an API key, as the
+        // hosted contract says: no key, an agent's or an executor's or this
+        // double's own, can propose, accept or release a policy. This double
+        // holds no account sessions at all; `releasePolicy` is the only way in.
+        if (url.pathname === "/v1/policies" || url.pathname.startsWith("/v1/policies/")) {
+            return this.send(res, record, 401, { error: "ACCOUNT_SESSION_REQUIRED" });
+        }
+        if (req.headers.authorization !== `Bearer ${this.apiKey}` && this.tenantOf(record) === null) {
             return this.send(res, record, 401, { error: "UNAUTHORIZED" });
         }
         const dossierLookup = url.pathname.match(/^\/v1\/protocol\/dossiers\/([^/]+)$/);
@@ -676,6 +858,13 @@ export class LocalAuthority {
                 return this.send(res, record, 404, { error: "NOT_FOUND" });
         }
     }
+    /** The organisation a request's key is bound to, or null for the unbound `apiKey` or no key. */
+    tenantOf(record) {
+        const presented = record.headers.authorization?.match(/^Bearer (.+)$/)?.[1];
+        return presented !== undefined && Object.hasOwn(this.tenantKeys, presented)
+            ? (this.tenantKeys[presented] ?? null)
+            : null;
+    }
     /** A grant resource addressed by an id that is not the presented token's grant: refused, as hosted. */
     grantIdMismatch(record, grantId) {
         const token = record.body?.execution_token;
@@ -749,13 +938,17 @@ export class LocalAuthority {
         if (!parsed.success)
             return { status: 400, body: { error: "REQUEST_INVALID" } };
         const request = parsed.data;
+        const tenant = this.tenantOf(record);
+        if (tenant !== null && tenant !== request.tenant_id) {
+            return { status: 403, body: { error: "AUTHORITY_TENANT_MISMATCH" } };
+        }
         if (record.headers["idempotency-key"] !== request.intent_id) {
             return { status: 400, body: { error: "IDEMPOTENCY_KEY_MISMATCH" } };
         }
         const bindingError = this.assertBinding(request, record);
         if (bindingError !== null)
             return { status: 400, body: { error: bindingError } };
-        const evaluation = this.evaluate(request);
+        const evaluation = this.heldByBreach(request, this.evaluate(request));
         if (evaluation.error !== undefined)
             return { status: 409, body: { error: evaluation.error } };
         this.decisions += 1;
@@ -766,10 +959,26 @@ export class LocalAuthority {
         if (evaluation.status !== "ALLOW" || request.mode !== "ENFORCEMENT") {
             return { status: 200, body: this.remember(request, decision) };
         }
-        return {
-            status: 200,
-            body: this.remember(request, this.grantDecision(request, decision, evaluation.approval)),
-        };
+        const granted = this.grantWithinAllowances(request, decision, evaluation.approval);
+        // Only a grant has a scope to hold: a refusal for want of an allowance has no token.
+        const token = granted.execution_token;
+        if (typeof token === "string") {
+            this.assumptionBreaches.granted(token, LocalAssumptionBreaches.scopeOf(request), evaluation.reasonCode === "POLICY_AUTONOMOUS_LIMIT");
+        }
+        return { status: 200, body: this.remember(request, granted) };
+    }
+    /**
+     * The starter policy's assumption-breach rule: an ALLOW the policy gave on
+     * its own becomes ESCALATE while a breach holds the scope. A person's
+     * approval is that person's decision, and stands.
+     */
+    heldByBreach(request, evaluation) {
+        if (evaluation.reasonCode !== "POLICY_AUTONOMOUS_LIMIT")
+            return evaluation;
+        if (this.assumptionBreaches.openIn(LocalAssumptionBreaches.scopeOf(request)).length === 0) {
+            return evaluation;
+        }
+        return { status: "ESCALATE", reasonCode: "ASSUMPTION_BREACH_OPEN", approval: null };
     }
     /** Keeps a minted decision for its dossier route, with the envelope when links are on. */
     remember(request, decision) {
@@ -840,7 +1049,7 @@ export class LocalAuthority {
         if ("refused" in signed) {
             return { status: "BLOCK", reasonCode: signed.refused, approval: null, error: signed.refused };
         }
-        const verdict = this.policy(signed.facts === undefined ? request : { ...request, signed_signals: signed.facts });
+        const verdict = this.policy(this.policyInput(request, signed.facts));
         if (verdict === "BLOCK") {
             return { status: "BLOCK", reasonCode: "POLICY_HARD_LIMIT_EXCEEDED", approval: null };
         }
@@ -877,6 +1086,15 @@ export class LocalAuthority {
         }
         return { status: "ALLOW", reasonCode: "PRESENCE_RECEIPT_VERIFIED", approval: humanApproval };
     }
+    /** The request as the policy hook reads it, with the signals that reach it. */
+    policyInput(request, signedFacts) {
+        const material = this.materialSignalsFor(request).values;
+        return {
+            ...request,
+            ...(signedFacts === undefined ? {} : { signed_signals: signedFacts }),
+            ...(Object.keys(material).length === 0 ? {} : { material_signals: material }),
+        };
+    }
     verifyEvidence(approval, request, requiredRole) {
         if (this.presence !== undefined) {
             return this.presence.verifyReceiptDetailed(approval, {
@@ -898,7 +1116,7 @@ export class LocalAuthority {
             should_execute: false,
             reason_codes: [...reasonCodes],
             action_hash: request.intent_hash,
-            policy_version: "synthetic-policy-v1",
+            policy_version: this.policyVersion,
             mode: request.mode,
             execution_token: null,
             execution_token_expires_at: null,
@@ -931,9 +1149,18 @@ export class LocalAuthority {
     grantDecision(request, decision, approval) {
         const issuedAt = Math.floor(this.clock() / 1_000);
         const expiresAt = Math.min(Math.floor((this.clock() + GRANT_TTL_MS) / 1_000), Math.floor(Date.parse(request.expires_at) / 1_000));
-        const jti = `synthetic-jti-${randomUUID()}`;
-        const token = `synthetic-grant.${jti}`;
+        const jti = this.addressableGrants ? randomUUID() : `synthetic-jti-${randomUUID()}`;
+        const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
+        const token = this.addressableGrants
+            ? `${encode({ alg: "none", typ: "synthetic-grant" })}.${encode({ jti, org_id: request.tenant_id })}.unsigned`
+            : `synthetic-grant.${jti}`;
         const bindingDigest = `sha256:${createHash("sha256").update(request.intent_hash).digest("hex")}`;
+        const materialSignals = this.materialSignalsFor(request).references;
+        // The hosted claim store's conflict domains, one per material signal the
+        // grant binds. Hosted, a grant that binds none holds its execution target
+        // instead; this double does not, so that flows written before it modelled
+        // scopes, such as two open card claims on one card, keep their behaviour.
+        const scopes = materialSignals.map((signal) => `signal:${signal.signal_id}`);
         this.grants.set(token, {
             jti,
             tenantId: request.tenant_id,
@@ -949,7 +1176,11 @@ export class LocalAuthority {
             bindingDigest,
             payloadDigest: hashBinding(request.action.parameters),
             expectedEffectDigest: request.expected_effect_digest ?? null,
+            expectedStateVersion: preconditionIn(request.context)?.version ?? null,
             receiptDossierId: approval?.receiptDossierId ?? null,
+            policyVersion: this.policyVersion,
+            materialSignals,
+            scopes,
             claimed: false,
             claimToken: null,
             receipt: null,
@@ -1078,7 +1309,7 @@ export class LocalAuthority {
             outcome = "ALLOW";
             if (managed.finalDecision === null) {
                 this.decisions += 1;
-                managed.finalDecision = this.grantDecision(managed.request, this.baseDecision({ ...managed.request, mode: "ENFORCEMENT" }, "ALLOW", state.reasonCodes), null);
+                managed.finalDecision = this.grantWithinAllowances(managed.request, this.baseDecision({ ...managed.request, mode: "ENFORCEMENT" }, "ALLOW", state.reasonCodes), null);
             }
             decision = managed.finalDecision;
         }
@@ -1091,17 +1322,21 @@ export class LocalAuthority {
         else if (state.status === "FAILED") {
             outcome = "ERROR";
         }
+        // A reauthorization whose allowance cannot be reserved ends BLOCKED, as hosted.
+        const refused = decision?.status === "BLOCK" ? decision : null;
         return {
             status: 200,
             body: {
                 escalation_id: managed.escalationId,
                 intent_id: managed.request.intent_id,
                 action_hash: managed.request.intent_hash,
-                status: state.status,
-                outcome,
+                status: refused === null ? state.status : "BLOCKED",
+                outcome: refused === null ? outcome : "BLOCK",
                 expires_at: managed.request.expires_at,
-                reason_codes: state.reasonCodes,
-                decision,
+                reason_codes: refused === null
+                    ? state.reasonCodes
+                    : [...refused.reason_codes, "REAUTHORIZATION_BLOCKED"],
+                decision: refused === null ? decision : null,
             },
         };
     }
@@ -1176,9 +1411,7 @@ export class LocalAuthority {
             return done("FAILED", ["PRESENCE_VERIFICATION_FAILED", verification.reasonCode]);
         // PRESENCE_VERIFIED and REAUTHORIZING are passed through within one lookup, as Decionis does.
         const signed = this.signedSignalsOf(managed.request);
-        const reevaluated = this.policy("refused" in signed || signed.facts === undefined
-            ? managed.request
-            : { ...managed.request, signed_signals: signed.facts });
+        const reevaluated = this.policy(this.policyInput(managed.request, "refused" in signed ? undefined : signed.facts));
         if (reevaluated === "BLOCK")
             return done("BLOCKED", ["REAUTHORIZATION_BLOCKED"]);
         return done("GRANT_READY", ["PRESENCE_RECEIPT_VERIFIED"]);
@@ -1211,6 +1444,9 @@ export class LocalAuthority {
             status,
             body: { valid: false, reason_codes: [reasonCode], claims: null },
         });
+        const tenant = this.tenantOf(record);
+        if (tenant !== null && tenant !== intent.data.tenant_id)
+            return rejected("TENANT_MISMATCH", 403);
         const bindingError = this.assertBinding({ ...intent.data, intent_hash: parsed.data.intent_hash }, record);
         if (bindingError !== null)
             return rejected(bindingError);
@@ -1232,8 +1468,32 @@ export class LocalAuthority {
             parsed.data.evidence?.humanApproval?.receiptDossierId !== grant.receiptDossierId) {
             return rejected("PRESENCE_APPROVAL_STALE");
         }
+        // Authority is re-derived from current state before anything is claimed,
+        // in the hosted order, so a stale grant never burns its nonce: the policy
+        // release first, then every material signal the decision read.
+        if (grant.policyVersion !== this.policyVersion)
+            return rejected("POLICY_VERSION_STALE");
+        if (grant.materialSignals.some((bound) => this.signals.get(bound.signal_id)?.reference.version !== bound.version)) {
+            return rejected("SIGNAL_VERSION_STALE");
+        }
+        // A breach opened since the grant was issued: the policy re-run no longer
+        // approves it, after the release and the signals, as the hosted claim orders it.
+        if (this.assumptionBreaches.holdsClaim(parsed.data.execution_token)) {
+            return rejected("POLICY_STATE_CHANGED");
+        }
         if (grant.claimed)
             return rejected("NONCE_REPLAY_DETECTED");
+        // A scope is held from the claim until the outcome is known: a commit or
+        // a failure releases it, an INDETERMINATE keeps it until reconciled.
+        const holders = [...this.grants.values()].filter((other) => other.claimed &&
+            other.tenantId === grant.tenantId &&
+            (other.finalized === null || other.finalized === "INDETERMINATE") &&
+            other.scopes.some((scope) => grant.scopes.includes(scope)));
+        if (holders.some((other) => other.finalized === "INDETERMINATE")) {
+            return rejected("CURRENT_STATE_UNRESOLVED");
+        }
+        if (holders.length > 0)
+            return rejected("AUTHORIZATION_SCOPE_BUSY");
         grant.claimed = true;
         grant.claimToken = randomBytes(32).toString("base64url");
         grant.correlationId = parsed.data.commit_correlation_id ?? intent.data.intent_id;
@@ -1276,6 +1536,9 @@ export class LocalAuthority {
                         ...(grant.expectedEffectDigest === null
                             ? {}
                             : { expected_effect_digest: grant.expectedEffectDigest }),
+                        ...(grant.expectedStateVersion === null
+                            ? {}
+                            : { expected_state_version: grant.expectedStateVersion }),
                     },
                     jti: grant.jti,
                     iat: grant.issuedAt,
@@ -1376,6 +1639,16 @@ export class LocalAuthority {
         }
         grant.finalized = parsed.data.outcome;
         grant.receipt = receipt;
+        const assumptionBreach = this.assumptionBreaches.finalized({
+            token: parsed.data.execution_token,
+            grantJti: grant.jti,
+            dossierId: grant.dossierId,
+            outcome: parsed.data.outcome,
+            expectedEffectDigest: grant.expectedEffectDigest,
+            observedEffectDigest: evidence?.observed_effect_digest ?? null,
+            evidenceDigest: evidence?.evidence_digest ?? null,
+            receipt,
+        });
         // Byte-for-byte the hosted success body: the commit's own decision-chain
         // evidence is queued, not yet recorded, so a successful finalization still
         // carries `COMMIT_EVIDENCE_PENDING`.
@@ -1399,6 +1672,7 @@ export class LocalAuthority {
                             recorded: true,
                         },
                     }),
+                ...(assumptionBreach === null ? {} : { assumption_breach: assumptionBreach }),
                 reason_codes: ["COMMIT_EVIDENCE_PENDING"],
             },
         };
@@ -1429,6 +1703,8 @@ export class LocalAuthority {
             return "INTENT_TIME_ORDER_INVALID";
         if (expiresAt - capturedAt > 300_000)
             return "INTENT_LIFETIME_TOO_LONG";
+        if (preconditionIn(request.context) === undefined)
+            return "INTENT_PRECONDITION_INVALID";
         return null;
     }
     async respond(res, record, route, computed) {