@decionis/mcp 0.2.0 → 0.3.0

package/dist/ManagedAgentHookCli.js

@@ -42279,6 +42279,19 @@ var FinalizationEffectEvidenceSchema = external_exports.union([
   EffectEvidenceSchema,
   ExecutionEffectEvidenceSchema
 ]);
+var EffectReceiptRecordSchema = external_exports.object({
+  token: external_exports.string().min(1).max(2e4),
+  token_digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/),
+  verified: external_exports.boolean(),
+  verification_code: external_exports.string().min(1).max(100),
+  provider_key_id: external_exports.string().min(1).max(200).nullable(),
+  issuer: external_exports.string().min(1).max(500).nullable(),
+  receipt_jti: external_exports.string().min(1).max(200).nullable(),
+  effect_status: external_exports.enum(["EFFECTED", "REFUSED", "INDETERMINATE"]).nullable(),
+  effect_digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/).nullable(),
+  effect_reference: external_exports.string().min(1).max(2e3).nullable(),
+  effected_at: external_exports.string().datetime().nullable()
+}).strict();
 function validateExecutionEffectEvidence(input) {
   if (!input.expected_request_digest) return "EFFECT_REQUEST_BINDING_UNAVAILABLE";
   if (input.effect_evidence.request_digest !== input.expected_request_digest) {
@@ -42302,6 +42315,7 @@ var ExecutionCommitEvidenceSchema = external_exports.object({
   recorded_at: external_exports.string().datetime(),
   downstream_evidence_digest: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/),
   effect_evidence: FinalizationEffectEvidenceSchema.nullable().optional(),
+  effect_receipt: EffectReceiptRecordSchema.nullable().optional(),
   evidence_hash: external_exports.string().regex(/^sha256:[0-9a-f]{64}$/)
 }).strict().superRefine((evidence, context) => {
   const expectedClaimState = evidence.commit_outcome === "COMMITTED" ? "FINALIZED" : evidence.commit_outcome === "FAILED" ? "FAILED" : "INDETERMINATE";
@@ -42673,10 +42687,22 @@ var AuthorityVerificationRequirementsSchema = external_exports.object({
     });
   }
 });
+var AuthorityApprovalTierSchema = external_exports.object({
+  priority: external_exports.number().int().min(1).max(5),
+  principal_ids: external_exports.array(external_exports.string().min(1).max(200)).min(1).max(10)
+}).strict();
 var AuthorityResolutionPolicySchema = external_exports.object({
   quorum: external_exports.literal(1),
   delegation: external_exports.enum(["DISALLOWED", "REQUIREMENT_REFRESH"]),
-  fallback_role_ids: external_exports.array(external_exports.string().regex(/^[A-Z][A-Z0-9_]{1,63}$/)).max(10).default([])
+  fallback_role_ids: external_exports.array(external_exports.string().regex(/^[A-Z][A-Z0-9_]{1,63}$/)).max(10).default([]),
+  /**
+   * An approval chain. Absent, the requirement is one ceremony by one subject
+   * (`quorum` 1). Present, the policy names who approves in priority tiers and
+   * the requirement is met only by one valid proof from every tier; Decionis
+   * keeps no chain state — the orchestrator (or Presence) runs it and Decionis
+   * verifies each proof against the tier it comes from.
+   */
+  tiers: external_exports.array(AuthorityApprovalTierSchema).min(1).max(5).optional()
 }).strict().superRefine((policy, context) => {
   if (new Set(policy.fallback_role_ids).size !== policy.fallback_role_ids.length) {
     context.addIssue({
@@ -42685,6 +42711,24 @@ var AuthorityResolutionPolicySchema = external_exports.object({
       message: "fallback role ids must be unique"
     });
   }
+  if (policy.tiers) {
+    const priorities = policy.tiers.map((tier) => tier.priority);
+    if (priorities.some((priority, index) => index > 0 && priority <= priorities[index - 1])) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["tiers"],
+        message: "tier priorities must be unique and ascending"
+      });
+    }
+    const principals = policy.tiers.flatMap((tier) => tier.principal_ids);
+    if (new Set(principals).size !== principals.length) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["tiers"],
+        message: "a principal belongs to one tier only"
+      });
+    }
+  }
 });
 var AuthorityRequirementOriginatorSchema = external_exports.object({
   organization_id: external_exports.string().min(1).max(200),
@@ -42750,6 +42794,13 @@ var AuthorityRequirementSchema = external_exports.object({
       message: "fallback roles must not repeat the primary role"
     });
   }
+  if (requirement.resolution.tiers && requirement.selector.kind !== "ROLE") {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["resolution", "tiers"],
+      message: "an approval chain names its members' trusted role through a ROLE selector"
+    });
+  }
   if (requirement.orchestration?.mode === "MANAGED" && requirement.selector.kind === "PRINCIPAL" && requirement.selector.role_id === void 0) {
     context.addIssue({
       code: external_exports.ZodIssueCode.custom,
@@ -45891,17 +45942,21 @@ var connectors = [
   // ── Enterprise ────────────────────────────────────────────────────────
   {
     // SAP PartnerEdge Solution Review approved 2026-06-22 (solution id
-    // 2004368, docs/marketplace/sap/solution-hub-listing.md). The PartnerEdge
+    // 2004368; listing evidence now lives in decionis/Commerce
+    // docs/marketplace/sap/solution-hub-listing.md). The PartnerEdge
     // solution URL is partner-gated (anonymous fetch 404s — sweep
-    // 2026-08-10), so it is deliberately NOT an install channel here; the
-    // customer-deployable BTP deployment kit ships next. Dual-gate wording
-    // from the owning listing copy.
+    // 2026-08-10), so it is deliberately NOT an install channel here.
+    // The CAP application and the customer-deployable BTP kit are
+    // Commerce-owned (decionis/Commerce apps/sap + commerce-dashboard): the
+    // decionis.com channel URLs below 301 to commerce.decionis.com like every
+    // other Commerce-owned row, and this repo no longer ships the kit
+    // artifacts or pins their version (drift-gated in Commerce, not here).
+    // Dual-gate wording from the owning listing copy.
     slug: "sap",
     name: "Decionis Governed Execution Gate for SAP",
     vendor: "SAP",
     category: "enterprise",
     status: "validated",
-    version: "0.1.0",
     summary: "Dual-gate governed execution for SAP S/4HANA, BTP, and CAP-side workflows \u2014 vendor payment release, procurement approval, and finance controls checked before they execute, with a signed Decision Dossier written back to the governed document.",
     capabilities: [
       "dual-gate-execution",
@@ -45918,20 +45973,14 @@ var connectors = [
     installation: [
       {
         // Customer-deployed BTP kit (curated CAP source, mbt build →
-        // cf deploy) — shipped in the same change that makes the URL resolve
-        // (rule 1.1 by construction).
+        // cf deploy). The kit page, zip, checksum, manifest and SBOM are
+        // served by Commerce; this URL resolves through the reviewed 301 in
+        // CommerceOwnership.mjs (rule 1.1 by redirect, not by local file).
         kind: "hosted_download",
         url: `${SITE}/marketplace/sap/deployment-kit`,
         label: "SAP BTP deployment kit (customer-deployed)"
       }
     ],
-    package: {
-      artifact: "/marketplace/sap/deployment-kit/decionis-sap-deployment-kit-0.1.0.zip",
-      sha256Path: "/marketplace/sap/deployment-kit/decionis-sap-deployment-kit-0.1.0.sha256.txt",
-      manifestPath: "/marketplace/sap/deployment-kit/manifest.json",
-      sbomPath: "/marketplace/sap/deployment-kit/SBOM.json",
-      format: "sap-mta-deployment-kit"
-    },
     documentation: `${SITE}/marketplace/sap`,
     verification: {
       validatedBy: "SAP PartnerEdge Solution Review",
@@ -50322,7 +50371,8 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
     const verification = _AuthorityPolicyParser.parseVerification(record.verification_requirements);
     const resolution = _AuthorityPolicyParser.parseResolution(record.resolution, selector);
     const expiresInSeconds = asNumber(record.expires_in_seconds);
-    if (!reasonCodes || !selector || !verification || !resolution || expiresInSeconds == null || !Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > 3600) {
+    const maxExpiresInSeconds = resolution?.tiers === void 0 ? _AuthorityPolicyParser.MAX_CEREMONY_SECONDS : _AuthorityPolicyParser.MAX_CHAIN_SECONDS;
+    if (!reasonCodes || !selector || !verification || !resolution || expiresInSeconds == null || !Number.isInteger(expiresInSeconds) || expiresInSeconds < 60 || expiresInSeconds > maxExpiresInSeconds) {
       return null;
     }
     return {
@@ -50333,6 +50383,8 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
       expires_in_seconds: expiresInSeconds
     };
   }
+  static MAX_CEREMONY_SECONDS = 3600;
+  static MAX_CHAIN_SECONDS = 7 * 24 * 3600;
   static policyKeys = /* @__PURE__ */ new Set([
     "reason_codes",
     "selector",
@@ -50414,7 +50466,7 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
     const record = asRecord3(input);
     if (!_AuthorityPolicyParser.hasOnlyKeys(
       record,
-      /* @__PURE__ */ new Set(["quorum", "delegation", "fallback_role_ids"])
+      /* @__PURE__ */ new Set(["quorum", "delegation", "fallback_role_ids", "tiers"])
     ) || record.quorum !== 1 || record.delegation !== "DISALLOWED" && record.delegation !== "REQUIREMENT_REFRESH" || !Array.isArray(record.fallback_role_ids) || record.fallback_role_ids.length > 10) {
       return null;
     }
@@ -50424,12 +50476,46 @@ var AuthorityPolicyParser = class _AuthorityPolicyParser {
     if (fallbackRoles.length !== record.fallback_role_ids.length || new Set(fallbackRoles).size !== fallbackRoles.length || selector?.kind === "ROLE" && fallbackRoles.includes(selector.role_id)) {
       return null;
     }
+    const tiers = _AuthorityPolicyParser.parseTiers(record.tiers);
+    if (record.tiers !== void 0 && tiers === null) return null;
+    if (tiers && selector?.kind !== "ROLE") return null;
     return {
       quorum: 1,
       delegation: record.delegation,
-      fallback_role_ids: fallbackRoles
+      fallback_role_ids: fallbackRoles,
+      ...tiers ? { tiers } : {}
     };
   }
+  /** Priority tiers of principals; unique ascending priorities, a principal in one tier only. */
+  static parseTiers(input) {
+    if (input === void 0) return null;
+    if (!Array.isArray(input) || input.length < 1 || input.length > 5) return null;
+    const tiers = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const value of input) {
+      const tier = asRecord3(value);
+      if (!_AuthorityPolicyParser.hasOnlyKeys(tier, /* @__PURE__ */ new Set(["priority", "principal_ids"]))) {
+        return null;
+      }
+      const priority = asNumber(tier.priority);
+      if (priority == null || !Number.isInteger(priority) || priority < 1 || priority > 5 || tiers.length > 0 && priority <= tiers[tiers.length - 1].priority) {
+        return null;
+      }
+      if (!Array.isArray(tier.principal_ids) || tier.principal_ids.length < 1 || tier.principal_ids.length > 10) {
+        return null;
+      }
+      const principalIds = tier.principal_ids.filter(
+        (id) => typeof id === "string" && id.length >= 1 && id.length <= 200
+      );
+      if (principalIds.length !== tier.principal_ids.length) return null;
+      for (const id of principalIds) {
+        if (seen.has(id)) return null;
+        seen.add(id);
+      }
+      tiers.push({ priority, principal_ids: principalIds });
+    }
+    return tiers;
+  }
   static parseRegions(input) {
     if (input === void 0) return null;
     if (!Array.isArray(input) || input.length < 1 || input.length > 100) return null;
@@ -52765,6 +52851,19 @@ var AgentTaskGatewayRoutes = class {
 var PROTOCOL_SERVICE = "decionis-protocol";
 var PROTOCOL_VERSION = "1.0.0";
 
+// ../protocol/src/discovery/GlamaClaimRoutes.ts
+var GlamaClaimRoutes = class {
+  register(app) {
+    app.get(
+      "/.well-known/glama.json",
+      async (_request, reply) => reply.header("cache-control", "public, max-age=300").send({
+        $schema: "https://glama.ai/mcp/schemas/connector.json",
+        claim: "glama_claim_BUHrLznF-9qs1cZEwwb2AN5CkXK7tNjS"
+      })
+    );
+  }
+};
+
 // ../protocol/src/health/HealthRoutes.ts
 function registerHealthRoutes(app, deps) {
   const { store } = deps;
@@ -53684,6 +53783,27 @@ var policy_bundle_schema_default = {
           maxItems: 10,
           uniqueItems: true,
           items: { type: "string", pattern: "^[A-Z][A-Z0-9_]{1,63}$" }
+        },
+        tiers: {
+          type: "array",
+          minItems: 1,
+          maxItems: 5,
+          description: "An approval chain: priority tiers of principals, asked at once; one valid proof from every tier satisfies the requirement. Requires a ROLE selector naming the members' trusted role.",
+          items: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+              priority: { type: "integer", minimum: 1, maximum: 5 },
+              principal_ids: {
+                type: "array",
+                minItems: 1,
+                maxItems: 10,
+                uniqueItems: true,
+                items: { type: "string", minLength: 1, maxLength: 200 }
+              }
+            },
+            required: ["priority", "principal_ids"]
+          }
         }
       },
       required: ["quorum", "delegation", "fallback_role_ids"]
@@ -53707,7 +53827,8 @@ var policy_bundle_schema_default = {
         expires_in_seconds: {
           type: "integer",
           minimum: 60,
-          maximum: 3600
+          maximum: 604800,
+          description: "How long the requirement lives. At most 3600 for one ceremony; a requirement whose resolution names tiers is an approval chain and may run to a week."
         }
       },
       required: [
@@ -54993,6 +55114,171 @@ var affiliateRewardsVerticalPack = {
   }
 };
 
+// ../protocol/src/verticals/commerce/CommercePack.ts
+var commerceVerticalPack = {
+  key: "commerce",
+  display_name: "Commerce Gate",
+  description: "Governance for storefront and marketplace decisions \u2014 price and promotion changes, inventory mutations, order acceptance and release, and refunds \u2014 against the merchant's margin, inventory and refund floors.",
+  workflow_keys: [
+    "commerce",
+    "commerce_order_release",
+    "commerce_refund_approve",
+    "commerce_refund_request",
+    "commerce_price_change",
+    "commerce_promotion_change",
+    "commerce_inventory_mutation",
+    "commerce_order_acceptance"
+  ],
+  default_domain: "COMMERCE",
+  signal_mappings: [
+    { domain: "COMMERCE", metric_name: "net_margin_percent", source_hint: "commerce_connector" },
+    { domain: "COMMERCE", metric_name: "available_inventory", source_hint: "commerce_connector" },
+    { domain: "COMMERCE", metric_name: "refund_amount", source_hint: "commerce_connector" }
+  ],
+  policy_bundle: {
+    version: "commerce-v1",
+    rules: [
+      {
+        rule_id: "reject_refund_above_refundable",
+        name: "Reject refunds above the refundable balance",
+        decision_domain: "COMMERCE",
+        when: {
+          all: [{ field: "signals.refund_exceeds_refundable", operator: "EQ", value: true }]
+        },
+        then: { action: "AUTO_REJECT", severity: "urgent", sla_minutes: 60 },
+        priority: 400,
+        enabled: true,
+        rationale: "A refund that exceeds what the order has left to refund is never sent."
+      },
+      {
+        rule_id: "escalate_order_release",
+        name: "A held order is released only by an approver",
+        decision_domain: "COMMERCE",
+        when: {
+          all: [{ field: "workflow_key", operator: "EQ", value: "commerce_order_release" }]
+        },
+        then: { action: "ESCALATE", severity: "elevated", sla_minutes: 240 },
+        priority: 360,
+        enabled: true,
+        rationale: "Releasing an order the gate held is its own decision and needs an approver to prove who made it."
+      },
+      {
+        rule_id: "escalate_large_refund",
+        name: "Escalate refunds above the unattended limit",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.refund_amount", operator: "GT", value: 1e3 }] },
+        then: { action: "ESCALATE", severity: "elevated", sla_minutes: 240 },
+        priority: 350,
+        enabled: true,
+        rationale: "A refund above the unattended limit needs a named approver before it is sent."
+      },
+      {
+        rule_id: "review_repeat_refund",
+        name: "Review a second refund on the same line",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.prior_refund_count", operator: "GT", value: 0 }] },
+        then: { action: "REQUIRE_REVIEW", severity: "elevated", sla_minutes: 240 },
+        priority: 340,
+        enabled: true,
+        rationale: "A refund on an order line that was already refunded is the double-refund case."
+      },
+      {
+        rule_id: "review_margin_floor",
+        name: "Protect minimum margin",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.net_margin_percent", operator: "LT", value: 12 }] },
+        then: { action: "REQUIRE_REVIEW", severity: "elevated", sla_minutes: 240 },
+        priority: 300,
+        enabled: true,
+        rationale: "Review commerce actions that would take net margin below the merchant floor."
+      },
+      {
+        rule_id: "review_inventory_floor",
+        name: "Protect low inventory",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.available_inventory", operator: "LT", value: 10 }] },
+        then: { action: "REQUIRE_REVIEW", severity: "elevated", sla_minutes: 240 },
+        priority: 250,
+        enabled: true,
+        rationale: "Review fulfilment when source-of-truth inventory is below the safety floor."
+      },
+      {
+        rule_id: "review_discount_stacking",
+        name: "Review stacked promotions",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "signals.discount_count", operator: "GT", value: 1 }] },
+        then: { action: "REQUIRE_REVIEW", severity: "elevated", sla_minutes: 240 },
+        priority: 200,
+        enabled: true,
+        rationale: "Review carts that combine more discount sources than the merchant allows."
+      },
+      {
+        rule_id: "approve_routine_commerce",
+        name: "Approve routine commerce actions",
+        decision_domain: "COMMERCE",
+        when: { all: [{ field: "decision_type", operator: "EXISTS", value: true }] },
+        then: { action: "AUTO_APPROVE", severity: "routine", sla_minutes: 30 },
+        priority: 10,
+        enabled: true,
+        rationale: "A storefront action proceeds when no floor is breached and nothing is held."
+      }
+    ]
+  },
+  resolver_overrides: {
+    // Whatever engine scored it, a storefront decision is a commerce decision.
+    domain_by_engine: {
+      finance: "COMMERCE",
+      software: "COMMERCE",
+      procure: "COMMERCE",
+      hiring: "COMMERCE"
+    },
+    intent_domain_hints: [
+      {
+        domain: "COMMERCE",
+        keywords: [
+          "commerce",
+          "order",
+          "refund",
+          "price",
+          "promotion",
+          "discount",
+          "inventory",
+          "listing",
+          "cart",
+          "checkout",
+          "merchant",
+          "storefront",
+          "marketplace"
+        ]
+      }
+    ],
+    evidence_required_keywords: ["refund", "release"],
+    missing_evidence_fields: ["purchase_order_id"],
+    base_confidence: 0.6,
+    attachment_confidence_bonus: 0.08,
+    intake_confidence_bonus: 0.02,
+    missing_evidence_penalty: 0.2
+  },
+  execution_templates: {
+    SUCCEEDED: [
+      "Apply the storefront change",
+      "Record the decision dossier",
+      "Notify the merchant"
+    ],
+    NEEDS_EVIDENCE: ["Attach cost or refund evidence", "Confirm the approver", "Re-run evaluation"],
+    FAILED: [
+      "Hold the order or change",
+      "Escalate to the merchant's approver",
+      "Capture the override reason"
+    ]
+  },
+  ui_copy: {
+    recommendation_success: "Proceed with the {domain} action; the merchant's floors hold.",
+    recommendation_needs_evidence: "Attach the cost or refund evidence {domain} needs before approval.",
+    recommendation_failed: "Hold the {domain} action for the merchant's approver."
+  }
+};
+
 // ../protocol/src/verticals/core/CorePack.ts
 var coreVerticalPack = {
   key: "core",
@@ -57790,6 +58076,7 @@ var DEFAULT_VERTICAL_PACK_KEY = "core";
 var packRegistry = new Map([
   [coreVerticalPack.key, coreVerticalPack],
   [affiliateRewardsVerticalPack.key, affiliateRewardsVerticalPack],
+  [commerceVerticalPack.key, commerceVerticalPack],
   [devopsVerticalPack.key, devopsVerticalPack],
   [financeVerticalPack.key, financeVerticalPack],
   [hospitalityVerticalPack.key, hospitalityVerticalPack],
@@ -60962,6 +61249,7 @@ function appendEvaluateDecisionLedgerEvent(store, input) {
 // ../protocol/src/authority/AuthorityRequirementIssuer.ts
 import { randomBytes, randomUUID as randomUUID9 } from "crypto";
 var AuthorityRequirementIssuer = class _AuthorityRequirementIssuer {
+  static MANAGED_CEREMONY_LIFETIME_MS = 5 * 6e4;
   requirementId;
   nonce;
   constructor(dependencies = {}) {
@@ -60993,10 +61281,12 @@ var AuthorityRequirementIssuer = class _AuthorityRequirementIssuer {
     const intentExpiresAtMs = Date.parse(
       typeof agentSafe.expires_at === "string" ? agentSafe.expires_at : ""
     );
+    const chained = authorityPolicy.resolution.tiers !== void 0;
     const expiresAt = new Date(
       Math.min(
         issuedAtMs + authorityPolicy.expires_in_seconds * 1e3,
-        Number.isFinite(intentExpiresAtMs) ? intentExpiresAtMs : Number.POSITIVE_INFINITY
+        Number.isFinite(intentExpiresAtMs) ? intentExpiresAtMs : Number.POSITIVE_INFINITY,
+        managedEscalationId && !chained ? issuedAtMs + _AuthorityRequirementIssuer.MANAGED_CEREMONY_LIFETIME_MS : Number.POSITIVE_INFINITY
       )
     ).toISOString();
     return AuthorityRequirementSchema.parse({
@@ -61020,7 +61310,13 @@ var AuthorityRequirementIssuer = class _AuthorityRequirementIssuer {
       },
       resolution: {
         ...authorityPolicy.resolution,
-        fallback_role_ids: [...authorityPolicy.resolution.fallback_role_ids]
+        fallback_role_ids: [...authorityPolicy.resolution.fallback_role_ids],
+        ...authorityPolicy.resolution.tiers ? {
+          tiers: authorityPolicy.resolution.tiers.map((tier) => ({
+            priority: tier.priority,
+            principal_ids: [...tier.principal_ids]
+          }))
+        } : {}
       },
       originator: {
         organization_id: input.request.org_id,
@@ -62973,161 +63269,6 @@ function resolveSalesforceMode(payload) {
   return SalesforceSurface.resolveMode(payload);
 }
 
-// ../protocol/src/verticals/salesforce/SapCostBasis.ts
-var FETCH_TIMEOUT_MS = 2500;
-var DEFAULTS = {
-  servicePath: "/sap/opu/odata/sap/API_PRODUCT_SRV",
-  entitySet: "A_ProductValuationArea",
-  skuProperty: "Product",
-  costProperty: "StandardPrice"
-};
-var SapCostBasis = class _SapCostBasis {
-  /**
-   * Resolve the S/4HANA OData cost destination. With `orgId`, a per-org override in
-   * `DECIONIS_SAP_SOR_BY_ORG` wins (multi-tenant); otherwise the global env destination
-   * is used. Returns null when neither is configured.
-   */
-  static resolveConfig(env = process.env, orgId) {
-    const o = _SapCostBasis.readPerOrgCostOverride(env, orgId);
-    const baseUrl = String(o?.url ?? env.DECIONIS_SAP_SOR_URL ?? "").trim();
-    if (!baseUrl) return null;
-    return {
-      baseUrl: baseUrl.replace(/\/$/, ""),
-      token: String(o?.token ?? env.DECIONIS_SAP_SOR_TOKEN ?? "").trim() || null,
-      servicePath: String(
-        o?.servicePath ?? env.DECIONIS_SAP_SOR_SERVICE_PATH ?? DEFAULTS.servicePath
-      ).replace(/\/$/, ""),
-      entitySet: String(o?.entitySet ?? env.DECIONIS_SAP_SOR_ENTITY ?? DEFAULTS.entitySet),
-      skuProperty: String(
-        o?.skuProperty ?? env.DECIONIS_SAP_SOR_SKU_PROPERTY ?? DEFAULTS.skuProperty
-      ),
-      costProperty: String(
-        o?.costProperty ?? env.DECIONIS_SAP_SOR_COST_PROPERTY ?? DEFAULTS.costProperty
-      )
-    };
-  }
-  /** The destination is operator-configured, but require TLS and reject internal hosts. */
-  static isSafeUrl(rawUrl) {
-    let url;
-    try {
-      url = new URL(rawUrl);
-    } catch {
-      return false;
-    }
-    if (url.protocol !== "https:") return false;
-    const h = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
-    if (h === "localhost" || h === "127.0.0.1" || h === "::1" || h === "169.254.169.254" || // cloud metadata
-    h.endsWith(".local") || h.endsWith(".internal") || h.startsWith("10.") || h.startsWith("192.168.") || /^172\.(1[6-9]|2\d|3[01])\./.test(h)) {
-      return false;
-    }
-    return true;
-  }
-  static buildCostQueryUrl(config, skus) {
-    const filter = skus.map((sku) => `${config.skuProperty} eq ${_SapCostBasis.odataString(sku)}`).join(" or ");
-    const params = new URLSearchParams({
-      $select: `${config.skuProperty},${config.costProperty}`,
-      $filter: filter,
-      $format: "json"
-    });
-    return `${config.baseUrl}${config.servicePath}/${config.entitySet}?${params.toString()}`;
-  }
-  /**
-   * Returns SKU → SAP cost (or null when SAP can't confirm it). Every requested SKU
-   * is present in the map. Fail-safe: returns all-null on SSRF rejection, missing
-   * transport, non-2xx, or error.
-   */
-  static async fetchCostBasis(config, skus, options = {}) {
-    const result = /* @__PURE__ */ new Map();
-    const unique = [...new Set(skus.filter(Boolean))];
-    for (const sku of unique) result.set(sku, null);
-    if (unique.length === 0) return result;
-    if (!_SapCostBasis.isSafeUrl(config.baseUrl)) return result;
-    const transport = options.transport ?? globalThis.fetch;
-    if (!transport) return result;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-    try {
-      const res = await transport(_SapCostBasis.buildCostQueryUrl(config, unique), {
-        method: "GET",
-        headers: {
-          accept: "application/json",
-          ...config.token ? { authorization: `Bearer ${config.token}` } : {}
-        },
-        signal: controller.signal
-      });
-      if (!res.ok) return result;
-      const rows = _SapCostBasis.extractRows(await res.json());
-      for (const row of rows) {
-        const sku = row[config.skuProperty];
-        if (typeof sku !== "string" || !result.has(sku)) continue;
-        const cost = Number(row[config.costProperty]);
-        result.set(sku, Number.isFinite(cost) ? cost : null);
-      }
-    } catch {
-    } finally {
-      clearTimeout(timer);
-    }
-    return result;
-  }
-  /**
-   * Override each order line's `cost_basis` with the SAP cost when available; lines
-   * SAP can't confirm keep their existing (payload) cost. Pure.
-   */
-  static applyCostBasis(payload, costMap) {
-    const items = Array.isArray(payload.order_items) ? payload.order_items : [];
-    return {
-      ...payload,
-      order_items: items.map((it) => {
-        const matnr = String(it.matnr ?? "");
-        const sapCost = matnr ? costMap.get(matnr) : null;
-        return sapCost != null ? { ...it, cost_basis: sapCost } : it;
-      })
-    };
-  }
-  /** True when at least one SKU got an authoritative SAP cost. */
-  static hasResolvedCost(costMap) {
-    for (const value of costMap.values()) if (value != null) return true;
-    return false;
-  }
-  /** Per-org SAP destination override from `DECIONIS_SAP_SOR_BY_ORG` (JSON keyed by org id). */
-  static readPerOrgCostOverride(env, orgId) {
-    if (!orgId) return null;
-    const raw = env.DECIONIS_SAP_SOR_BY_ORG;
-    if (!raw) return null;
-    try {
-      const map = JSON.parse(raw);
-      const entry = map && typeof map === "object" ? map[orgId] : null;
-      return entry && typeof entry === "object" ? entry : null;
-    } catch {
-      return null;
-    }
-  }
-  static odataString(value) {
-    return `'${value.replace(/'/g, "''")}'`;
-  }
-  /** OData v2 (`d.results`) and v4 (`value`) both supported. */
-  static extractRows(json) {
-    if (!json || typeof json !== "object") return [];
-    const v2 = json.d?.results;
-    if (Array.isArray(v2)) return v2;
-    const v4 = json.value;
-    if (Array.isArray(v4)) return v4;
-    return [];
-  }
-};
-function resolveSapCostConfig(env = process.env, orgId) {
-  return SapCostBasis.resolveConfig(env, orgId);
-}
-async function fetchSapCostBasis(config, skus, options = {}) {
-  return SapCostBasis.fetchCostBasis(config, skus, options);
-}
-function applySapCostBasis(payload, costMap) {
-  return SapCostBasis.applyCostBasis(payload, costMap);
-}
-function hasResolvedCost(costMap) {
-  return SapCostBasis.hasResolvedCost(costMap);
-}
-
 // ../protocol/src/surface-verify/SalesforceVerifyRoutes.ts
 function registerSalesforceVerifyRoutes(app, deps) {
   const { store } = deps;
@@ -63170,26 +63311,10 @@ function registerSalesforceVerifyRoutes(app, deps) {
     const candidateOrg = authedOrgId || asString2(ctx.org_id)?.trim() || process.env.DECIONIS_SALESFORCE_ORG_ID?.trim() || SAP_DEFAULT_ORG_ID;
     const orgId = isLikelyUuid(candidateOrg) ? candidateOrg : SAP_DEFAULT_ORG_ID;
     await ensureSalesforcePolicyBundle(orgId);
-    let evalPayload = payload;
-    let costBasisSource = "payload";
-    if (gate === "execution_authority") {
-      const costConfig = resolveSapCostConfig(process.env, orgId);
-      if (costConfig) {
-        try {
-          const skus = (payload.order_items ?? []).map((it) => String(it.matnr ?? "").trim()).filter(Boolean);
-          const costMap = await fetchSapCostBasis(costConfig, skus);
-          if (hasResolvedCost(costMap)) {
-            evalPayload = applySapCostBasis(payload, costMap);
-            costBasisSource = "sap";
-          }
-        } catch {
-        }
-      }
-    }
     const evalRes = await injectInternalProtocolRoute(app, {
       method: "POST",
       url: "/v1/protocol/evaluate-decision",
-      payload: buildSalesforceEvaluateRequest(evalPayload, gate, orgId)
+      payload: buildSalesforceEvaluateRequest(payload, gate, orgId)
     });
     if (evalRes.statusCode !== 200) {
       return reply.code(502).send({
@@ -63230,11 +63355,19 @@ function registerSalesforceVerifyRoutes(app, deps) {
       ledger_entry_hash: response.ledger_entry_hash ?? null,
       decision_chain: response.decision_chain ?? null,
       idempotent_replay: Boolean(response.idempotent_replay),
-      cost_basis_source: costBasisSource,
+      cost_basis_source: "payload",
       federated: true,
       pipeline: true
     });
   };
+  app.post(
+    "/v1/protocol/surfaces/salesforce/state-admission/verify",
+    (req, reply) => handleSalesforceGate("state_admission", req, reply)
+  );
+  app.post(
+    "/v1/protocol/surfaces/salesforce/execution-authority/verify",
+    (req, reply) => handleSalesforceGate("execution_authority", req, reply)
+  );
   app.post(
     "/salesforce/state-admission/verify",
     (req, reply) => handleSalesforceGate("state_admission", req, reply)
@@ -68926,6 +69059,7 @@ function buildProtocolApp(options) {
   const protocolAuthLookup = options?.mcpAuthLookup ?? null;
   registerInternalAccessGuard(app, process.env, protocolAuthLookup);
   registerHealthRoutes(app, { store });
+  new GlamaClaimRoutes().register(app);
   registerFinanceOverrideRoutes(app, { store });
   registerEvaluateDecisionRoutes(app, { store });
   registerWebexRoutes(app, { store });