@grantex/sdk 0.6.0 → 0.7.0

package/dist/decisions/verify.js

@@ -0,0 +1,277 @@
+/**
+ * Offline verification of decision grants (PRD G-3).
+ *
+ * Verification proves that a decision grant is authentic, unexpired and
+ * approves exactly the action about to be performed on the current case
+ * version, and, for four eyes, that two different people approved it. It does
+ * not prove that the grant has not been used: that needs the issuer's atomic
+ * consumption (`grantex.decisions.consume()`), which `enforce()` performs
+ * before it allows the call. The Python SDK implements the same rules
+ * (`grantex.decisions`); the token profile is `spec/decision-grant.md`.
+ */
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from 'jose';
+import { DecisionSubReason } from '../denials.js';
+import { ActionValidationError, computeActionHash, isActionHash, parseDecisionAction } from './action.js';
+export const DECISION_GRANT_TYP = 'decision+jwt';
+export const DECISION_GRANT_AUDIENCE = 'urn:grantex:decision';
+const JTI_RE = /^dgnt_[0-9A-HJKMNP-TV-Z]{26}$/;
+const MAX_TOKEN_LENGTH = 16_384;
+/** A decision grant is absent, unusable or does not match the call. */
+export class DecisionGrantError extends Error {
+    subReason;
+    constructor(subReason, message) {
+        super(message);
+        this.name = 'DecisionGrantError';
+        this.subReason = subReason;
+    }
+}
+const MAX_JWKS_RESOLVERS = 64;
+const jwksResolvers = new Map();
+function remoteKey(jwksUri) {
+    const url = new URL(jwksUri);
+    url.hash = '';
+    const cached = jwksResolvers.get(url.href);
+    if (cached)
+        return cached;
+    const resolver = createRemoteJWKSet(url);
+    if (jwksResolvers.size >= MAX_JWKS_RESOLVERS) {
+        const oldest = jwksResolvers.keys().next().value;
+        if (oldest !== undefined)
+            jwksResolvers.delete(oldest);
+    }
+    jwksResolvers.set(url.href, resolver);
+    return resolver;
+}
+function toAction(value) {
+    try {
+        return parseDecisionAction(value);
+    }
+    catch (err) {
+        if (err instanceof ActionValidationError) {
+            throw new DecisionGrantError(DecisionSubReason.MALFORMED, `expected action is invalid: ${err.message}`);
+        }
+        throw err;
+    }
+}
+function claimString(payload, key) {
+    const value = payload[key];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, `decision grant claim ${key} is missing`);
+    }
+    return value;
+}
+function claimInt(payload, key) {
+    const value = payload[key];
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, `decision grant claim ${key} is invalid`);
+    }
+    return value;
+}
+function parseFourEyes(value) {
+    if (value === undefined)
+        return undefined;
+    const v = value;
+    if (typeof value !== 'object' || value === null || Array.isArray(value) || v['approvals_required'] !== 2 || (v['position'] !== 1 && v['position'] !== 2)) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant four_eyes is invalid');
+    }
+    const firstJti = v['first_jti'];
+    const firstSub = v['first_sub'];
+    if (v['position'] === 2 && (typeof firstJti !== 'string' || typeof firstSub !== 'string')) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'the second approval must name the first');
+    }
+    return {
+        approvalsRequired: 2,
+        position: v['position'],
+        ...(typeof firstJti === 'string' ? { firstJti } : {}),
+        ...(typeof firstSub === 'string' ? { firstSub } : {}),
+    };
+}
+/**
+ * Verifies one decision grant against the action about to be performed.
+ * Refusals (`DecisionGrantError.subReason`): `malformed` (type, signature,
+ * issuer, audience, claims, or an `action_hash` that is not the hash of the
+ * `action` claim), `unknown_grant` (another developer), `wrong_case`,
+ * `action_mismatch` (another action or connector), `case_changed`, `expired`.
+ * Single use is not checked here.
+ */
+export async function verifyDecisionGrant(token, expectedAction, caseVersion, options) {
+    if (typeof token !== 'string' || token.length === 0 || token.length > MAX_TOKEN_LENGTH) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant must be a compact JWT');
+    }
+    const expected = toAction(expectedAction);
+    if (typeof caseVersion !== 'string' || caseVersion.length === 0) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'caseVersion is required');
+    }
+    const algorithms = (options.algorithms ?? ['RS256', 'ES256']).filter((a) => a === 'RS256' || a === 'ES256');
+    let header;
+    try {
+        header = decodeProtectedHeader(token);
+    }
+    catch {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant is not a JWT');
+    }
+    if (header.typ !== DECISION_GRANT_TYP) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, `decision grant typ must be ${DECISION_GRANT_TYP}`);
+    }
+    if (typeof header.kid !== 'string' || header.kid.length === 0) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant has no kid');
+    }
+    if (typeof header.alg !== 'string' || !algorithms.includes(header.alg)) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, `decision grant algorithm ${String(header.alg)} is not allowed`);
+    }
+    const key = options.key ?? (options.jwksUri !== undefined ? remoteKey(options.jwksUri) : undefined);
+    if (key === undefined)
+        throw new Error('verifyDecisionGrant needs jwksUri or key');
+    let payload;
+    try {
+        const verifyOptions = {
+            issuer: options.issuer,
+            audience: DECISION_GRANT_AUDIENCE,
+            algorithms,
+            typ: DECISION_GRANT_TYP,
+            requiredClaims: ['iss', 'aud', 'sub', 'jti', 'iat', 'exp'],
+            // Time is checked below against `now`, after the signature.
+            currentDate: new Date(0),
+        };
+        ({ payload } = typeof key === 'function'
+            ? await jwtVerify(token, key, verifyOptions)
+            : await jwtVerify(token, key, verifyOptions));
+    }
+    catch (err) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, `decision grant signature, issuer or audience is invalid: ${err instanceof Error ? err.message : 'verification failed'}`);
+    }
+    const jti = claimString(payload, 'jti');
+    if (!JTI_RE.test(jti))
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant jti is malformed');
+    let action;
+    try {
+        action = parseDecisionAction(payload['action']);
+    }
+    catch {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant action is malformed');
+    }
+    const actionHash = claimString(payload, 'action_hash');
+    if (!isActionHash(actionHash) || computeActionHash(action) !== actionHash) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant action_hash does not match its action');
+    }
+    const amr = payload['amr'];
+    if (!Array.isArray(amr) || !amr.every((v) => typeof v === 'string')) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant amr is invalid');
+    }
+    const acr = payload['acr'];
+    if (acr !== undefined && typeof acr !== 'string') {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant acr is invalid');
+    }
+    if (payload['dwell_source'] !== 'server') {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant dwell time was not measured by the issuer');
+    }
+    const memoHash = claimString(payload, 'memo_hash');
+    const policyScoreHash = claimString(payload, 'policy_score_hash');
+    if (!isActionHash(memoHash) || !isActionHash(policyScoreHash)) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant memo or policy score hash is malformed');
+    }
+    const iat = claimInt(payload, 'iat');
+    const exp = claimInt(payload, 'exp');
+    if (exp <= iat || exp - iat > 86_400) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant lifetime exceeds 24 hours');
+    }
+    const memoRef = payload['memo_ref'];
+    const policyScoreRef = payload['policy_score_ref'];
+    const fourEyes = parseFourEyes(payload['four_eyes']);
+    const grant = {
+        token,
+        jti,
+        iss: claimString(payload, 'iss'),
+        sub: claimString(payload, 'sub'),
+        dev: claimString(payload, 'dev'),
+        idp: claimString(payload, 'idp'),
+        approverAuth: claimString(payload, 'approver_auth'),
+        ...(typeof acr === 'string' ? { acr } : {}),
+        amr: amr,
+        authTime: claimInt(payload, 'auth_time'),
+        action,
+        actionHash,
+        connector: claimString(payload, 'connector'),
+        caseVersion: claimString(payload, 'case_version'),
+        dwellMs: claimInt(payload, 'dwell_ms'),
+        dwellSource: 'server',
+        decisionRequest: claimString(payload, 'decision_request'),
+        memoHash,
+        policyScoreHash,
+        iat,
+        exp,
+        ...(typeof memoRef === 'string' ? { memoRef } : {}),
+        ...(typeof policyScoreRef === 'string' ? { policyScoreRef } : {}),
+        ...(fourEyes !== undefined ? { fourEyes } : {}),
+    };
+    if (options.developerId !== undefined && grant.dev !== options.developerId) {
+        throw new DecisionGrantError(DecisionSubReason.UNKNOWN_GRANT, 'decision grant was issued to another developer');
+    }
+    if (grant.action.case_id !== expected.case_id) {
+        throw new DecisionGrantError(DecisionSubReason.WRONG_CASE, 'decision grant is for another case');
+    }
+    if (grant.actionHash !== computeActionHash(expected)) {
+        throw new DecisionGrantError(DecisionSubReason.ACTION_MISMATCH, 'decision grant approves a different action');
+    }
+    if (options.connector !== undefined && grant.connector !== options.connector) {
+        throw new DecisionGrantError(DecisionSubReason.ACTION_MISMATCH, 'decision grant approves an action on another connector');
+    }
+    if (grant.caseVersion !== caseVersion) {
+        throw new DecisionGrantError(DecisionSubReason.CASE_CHANGED, 'decision grant was approved for another case version');
+    }
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const tolerance = options.clockTolerance ?? 0;
+    if (grant.iat > now + tolerance + 60) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grant is issued in the future');
+    }
+    if (now >= grant.exp + tolerance) {
+        throw new DecisionGrantError(DecisionSubReason.EXPIRED, 'decision grant has expired');
+    }
+    return grant;
+}
+/**
+ * Verifies the decision grants for one action, including four eyes: with two
+ * approvals required (from the manifest, or because a grant says so) exactly
+ * two grants with different `sub` are needed, the second naming the first.
+ */
+export async function verifyDecisionGrants(tokens, expectedAction, caseVersion, options) {
+    const approvalsRequired = options.approvalsRequired ?? 1;
+    if (approvalsRequired !== 1 && approvalsRequired !== 2)
+        throw new Error('approvalsRequired must be 1 or 2');
+    if (!Array.isArray(tokens)) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'decision grants must be an array of tokens');
+    }
+    if (tokens.length === 0)
+        throw new DecisionGrantError(DecisionSubReason.ABSENT, 'no decision grant was presented');
+    if (tokens.length > 2)
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'at most two decision grants can be presented');
+    const expected = toAction(expectedAction);
+    const grants = [];
+    for (const token of tokens)
+        grants.push(await verifyDecisionGrant(token, expected, caseVersion, options));
+    const required = grants.some((g) => g.fourEyes !== undefined) ? 2 : approvalsRequired;
+    if (new Set(grants.map((g) => g.jti)).size !== grants.length) {
+        throw new DecisionGrantError(DecisionSubReason.SAME_APPROVER, 'the same decision grant was presented twice');
+    }
+    if (grants.length < required) {
+        throw new DecisionGrantError(DecisionSubReason.FOUR_EYES_INCOMPLETE, 'this decision needs two approvals from different people');
+    }
+    if (grants.length > required) {
+        throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'more decision grants than this decision needs');
+    }
+    let ordered = grants;
+    if (required === 2) {
+        const [first, second] = [...grants].sort((a, b) => (a.fourEyes?.position ?? 0) - (b.fourEyes?.position ?? 0));
+        if (first.sub === second.sub) {
+            throw new DecisionGrantError(DecisionSubReason.SAME_APPROVER, 'both decision grants were approved by the same person');
+        }
+        if (first.fourEyes?.position !== 1 || second.fourEyes?.position !== 2
+            || second.fourEyes.firstJti !== first.jti || second.fourEyes.firstSub !== first.sub
+            || first.decisionRequest !== second.decisionRequest) {
+            throw new DecisionGrantError(DecisionSubReason.MALFORMED, 'the second approval does not reference the first');
+        }
+        ordered = [first, second];
+    }
+    return { grants: ordered, action: expected, actionHash: computeActionHash(expected), caseVersion, approvalsRequired: required };
+}
+//# sourceMappingURL=verify.js.map

package/dist/decisions/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/decisions/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,SAAS,EAAyC,MAAM,MAAM,CAAC;AACnH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,EAAuB,MAAM,aAAa,CAAC;AAE/H,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAE9D,MAAM,MAAM,GAAG,+BAA+B,CAAC;AAC/C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,uEAAuE;AACvE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAClC,SAAS,CAAoB;IACtC,YAAY,SAA4B,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AA0ED,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEzD,SAAS,SAAS,CAAC,OAAe;IAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,aAAa,CAAC,IAAI,IAAI,kBAAkB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAA2B,CAAC;QACvE,IAAI,MAAM,KAAK,SAAS;YAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB,EAAE,GAAW;IACnD,MAAM,KAAK,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,wBAAwB,GAAG,aAAa,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,OAAmB,EAAE,GAAW;IAChD,MAAM,KAAK,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,wBAAwB,GAAG,aAAa,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACzJ,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,yCAAyC,CAAC,CAAC;IACvG,CAAC;IACD,OAAO;QACL,iBAAiB,EAAE,CAAC;QACpB,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;QACvB,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAa,EACb,cAA8B,EAC9B,WAAmB,EACnB,OAAmC;IAEnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QACvF,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,UAAU,GAAa,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC;IACtH,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,8BAA8B,kBAAkB,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,4BAA4B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpG,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAEnF,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,uBAAuB;YACjC,UAAU;YACV,GAAG,EAAE,kBAAkB;YACvB,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;YAC1D,4DAA4D;YAC5D,WAAW,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC;SACzB,CAAC;QACF,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,GAAG,KAAK,UAAU;YACtC,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC;YAC5C,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,CAAC,SAAS,EAC3B,4DAA4D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,EAAE,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC;IACpH,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,oCAAoC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;QAC1E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,sDAAsD,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,+BAA+B,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,0DAA0D,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAClE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,uDAAuD,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,0CAA0C,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACrD,MAAM,KAAK,GAAkB;QAC3B,KAAK;QACL,GAAG;QACH,GAAG,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC;QAChC,GAAG,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC;QAChC,GAAG,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC;QAChC,GAAG,EAAE,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC;QAChC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC;QACnD,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,EAAE,GAAe;QACpB,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;QACxC,MAAM;QACN,UAAU;QACV,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC;QAC5C,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC;QACjD,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;QACtC,WAAW,EAAE,QAAQ;QACrB,eAAe,EAAE,WAAW,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACzD,QAAQ;QACR,eAAe;QACf,GAAG;QACH,GAAG;QACH,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IAEF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QAC3E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,aAAa,EAAE,gDAAgD,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,UAAU,EAAE,oCAAoC,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7E,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,eAAe,EAAE,wDAAwD,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,YAAY,EAAE,sDAAsD,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,GAAG,GAAG,GAAG,GAAG,SAAS,GAAG,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAyB,EACzB,cAA8B,EAC9B,WAAmB,EACnB,OAAoC;IAEpC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACzD,IAAI,iBAAiB,KAAK,CAAC,IAAI,iBAAiB,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC5G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,4CAA4C,CAAC,CAAC;IAC1G,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;IACnH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;IACjI,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAE1G,MAAM,QAAQ,GAAU,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7F,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,aAAa,EAAE,6CAA6C,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,oBAAoB,EAAE,yDAAyD,CAAC,CAAC;IAClI,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,+CAA+C,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAmC,CAAC;QAChJ,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;QACzH,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC;eAC9D,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG;eAChF,KAAK,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,EAAE,CAAC;YACxD,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,EAAE,kDAAkD,CAAC,CAAC;QAChH,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AAClI,CAAC"}

package/dist/denials.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Denial taxonomy for `enforce()` (PRD Appendix B).
+ *
+ * Every denied `EnforceResult` carries a `reasonCode` and, where one applies,
+ * a `subReason`. `reason` stays a human-readable sentence; code against
+ * `reasonCode`. The codes are stable, low-cardinality strings suitable for
+ * metric labels and audit records, identical to the Python SDK's.
+ */
+export declare const DenialReason: {
+    /** The grant's purpose matches none of the tool's `allowed_purposes`, or it has none. */
+    readonly PURPOSE_NOT_ALLOWED: 'purpose_not_allowed';
+    /** No scope in the grant covers the connector or tool. */
+    readonly TOOL_NOT_GRANTED: 'tool_not_granted';
+    /** A scope covers the connector but at a lower permission level. */
+    readonly PERMISSION_INSUFFICIENT: 'permission_insufficient';
+    /** A call cap, cost-unit budget or amount cap would be exceeded, or cannot be evaluated. */
+    readonly CAP_EXCEEDED: 'cap_exceeded';
+    /** The tool declares `requires_decision` and no decision grant was given. */
+    readonly DECISION_REQUIRED: 'decision_required';
+    /** A decision grant was given but is not valid for this action. */
+    readonly DECISION_INVALID: 'decision_invalid';
+    /** The grant has been revoked. */
+    readonly GRANT_REVOKED: 'grant_revoked';
+    /** The grant's data region does not permit this call. */
+    readonly REGION_MISMATCH: 'region_mismatch';
+    /** No manifest is loaded for the connector, or it does not declare the tool. */
+    readonly MANIFEST_UNKNOWN_TOOL: 'manifest_unknown_tool';
+    /** The grant token failed verification. Not part of Appendix B, which assumes a verified grant. */
+    readonly TOKEN_INVALID: 'token_invalid';
+};
+export type DenialReason = (typeof DenialReason)[keyof typeof DenialReason];
+/** Sub-reasons for `manifest_unknown_tool`. */
+export declare const ManifestSubReason: {
+    readonly UNKNOWN_CONNECTOR: 'unknown_connector';
+    readonly UNKNOWN_TOOL: 'unknown_tool';
+    readonly INVALID_DECLARATION: 'invalid_declaration';
+};
+/** Sub-reasons for `cap_exceeded`. */
+export declare const CapSubReason: {
+    /** `amount` is above a `capped:N` scope. */
+    readonly AMOUNT_CAP: 'amount_cap';
+    /** `amount` is not a finite number. */
+    readonly INVALID_AMOUNT: 'invalid_amount';
+    /** A `capped:N` scope carries a malformed cap. */
+    readonly MALFORMED_CAP: 'malformed_cap';
+    /** The tool declares caps or cost units and they cannot be metered: no meter, or its backend is unavailable. */
+    readonly METER_UNAVAILABLE: 'meter_unavailable';
+    /**
+     * A call cap or cost-unit budget would be exceeded (error code E1008). `details`
+     * carries `code`, `limit`, `window`, `used`, `requested`, `scope` and `kind`.
+     */
+    readonly LIMIT_REACHED: 'limit_reached';
+    /** A per-case cap applies and no `caseId` was given. */
+    readonly CASE_REQUIRED: 'case_required';
+    readonly INVALID_CASE_ID: 'invalid_case_id';
+    /** `costComponents` names a unit the tool does not declare. */
+    readonly INVALID_COST_COMPONENT: 'invalid_cost_component';
+};
+/** Sub-reasons for `purpose_not_allowed`. */
+export declare const PurposeSubReason: {
+    /** The grant carries no purpose. */
+    readonly MISSING: 'missing';
+    /** The grant's purpose matches none of the tool's patterns. */
+    readonly NOT_MATCHED: 'not_matched';
+    /** The grant's purpose is malformed or not in the purpose vocabulary. */
+    readonly UNKNOWN_PURPOSE: 'unknown_purpose';
+};
+/** Sub-reasons for `tool_not_granted`. */
+export declare const ToolSubReason: {
+    /** The grant's tools entry for the connector does not list the tool. */
+    readonly NOT_IN_AUTHORIZATION_DETAILS: 'not_in_authorization_details';
+};
+/**
+ * Sub-reasons for `grant_revoked` (PRD G-6). A call is denied both when the
+ * grant is known to be revoked and when the client cannot tell: an SDK that
+ * has lost the revocation feed must not keep authorising calls.
+ */
+export declare const RevocationSubReason: {
+    /** The auth service says this grant or token is revoked. */
+    readonly REVOKED: 'revoked';
+    /** The grant is suspended: revoked reversibly, pending a decision. */
+    readonly SUSPENDED: 'suspended';
+    /** A grant above this one in the delegation chain is revoked or suspended. */
+    readonly PARENT_REVOKED: 'parent_revoked';
+    /** The revocation feed has not heard from the auth service inside its staleness bound. */
+    readonly FEED_STALE: 'feed_stale';
+    /** The deployment does not serve the revocation feed, or it is not ready. */
+    readonly FEED_UNAVAILABLE: 'feed_unavailable';
+    /** An online revocation check could not be completed. */
+    readonly STATUS_UNAVAILABLE: 'status_unavailable';
+};
+export type RevocationSubReason = (typeof RevocationSubReason)[keyof typeof RevocationSubReason];
+/** Sub-reasons for `token_invalid`. */
+export declare const TokenSubReason: {
+    /** The `authorization_details` claim cannot be read unambiguously. */
+    readonly MALFORMED_AUTHORIZATION_DETAILS: 'malformed_authorization_details';
+};
+/**
+ * Sub-reasons for `decision_required` and `decision_invalid` (PRD G-3;
+ * `spec/decision-grant.md`). The first four are PRD Appendix B's; the auth
+ * service and the Python SDK use the same values.
+ */
+export declare const DecisionSubReason: {
+    /** The grant approves a different action (tool, decision, subject, amount or connector). */
+    readonly ACTION_MISMATCH: 'action_mismatch';
+    /** The grant is past its expiry. */
+    readonly EXPIRED: 'expired';
+    /** The grant has already been used. */
+    readonly CONSUMED: 'consumed';
+    /** Both grants of a four-eyes decision name the same approver. */
+    readonly SAME_APPROVER: 'same_approver';
+    /** The case changed (new case version) after the decision was approved. */
+    readonly CASE_CHANGED: 'case_changed';
+    /** The grant approves an action on another case. */
+    readonly WRONG_CASE: 'wrong_case';
+    /** The approver's authentication was not step-up (auth service only). */
+    readonly STEP_UP_REQUIRED: 'step_up_required';
+    /** The decision request was cancelled and its grants revoked. */
+    readonly REVOKED: 'revoked';
+    /** The issuer does not know the grant, or it belongs to another developer. */
+    readonly UNKNOWN_GRANT: 'unknown_grant';
+    /** The grant, or the action to compare it with, cannot be read. */
+    readonly MALFORMED: 'malformed';
+    /** The decision needs two approvals and fewer were presented. */
+    readonly FOUR_EYES_INCOMPLETE: 'four_eyes_incomplete';
+    /** The grant could not be consumed at the issuer (network, server or configuration). */
+    readonly CONSUME_UNAVAILABLE: 'consume_unavailable';
+    /** No decision grant was presented (reported as `decision_required`). */
+    readonly ABSENT: 'absent';
+};
+export type DecisionSubReason = (typeof DecisionSubReason)[keyof typeof DecisionSubReason];
+//# sourceMappingURL=denials.d.ts.map

package/dist/denials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"denials.d.ts","sourceRoot":"","sources":["../src/denials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,YAAY;IACvB,yFAAyF;aACzF,mBAAmB,EAAE,qBAAqB;IAC1C,0DAA0D;aAC1D,gBAAgB,EAAE,kBAAkB;IACpC,oEAAoE;aACpE,uBAAuB,EAAE,yBAAyB;IAClD,4FAA4F;aAC5F,YAAY,EAAE,cAAc;IAC5B,6EAA6E;aAC7E,iBAAiB,EAAE,mBAAmB;IACtC,mEAAmE;aACnE,gBAAgB,EAAE,kBAAkB;IACpC,kCAAkC;aAClC,aAAa,EAAE,eAAe;IAC9B,yDAAyD;aACzD,eAAe,EAAE,iBAAiB;IAClC,gFAAgF;aAChF,qBAAqB,EAAE,uBAAuB;IAC9C,mGAAmG;aACnG,aAAa,EAAE,eAAe;CACtB,CAAC;AAEX,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE5E,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB;aAC5B,iBAAiB,EAAE,mBAAmB;aACtC,YAAY,EAAE,cAAc;aAC5B,mBAAmB,EAAE,qBAAqB;CAClC,CAAC;AAEX,sCAAsC;AACtC,eAAO,MAAM,YAAY;IACvB,4CAA4C;aAC5C,UAAU,EAAE,YAAY;IACxB,uCAAuC;aACvC,cAAc,EAAE,gBAAgB;IAChC,kDAAkD;aAClD,aAAa,EAAE,eAAe;IAC9B,gHAAgH;aAChH,iBAAiB,EAAE,mBAAmB;IACtC;;;OAGG;aACH,aAAa,EAAE,eAAe;IAC9B,wDAAwD;aACxD,aAAa,EAAE,eAAe;aAC9B,eAAe,EAAE,iBAAiB;IAClC,+DAA+D;aAC/D,sBAAsB,EAAE,wBAAwB;CACxC,CAAC;AAEX,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB;IAC3B,oCAAoC;aACpC,OAAO,EAAE,SAAS;IAClB,+DAA+D;aAC/D,WAAW,EAAE,aAAa;IAC1B,yEAAyE;aACzE,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,0CAA0C;AAC1C,eAAO,MAAM,aAAa;IACxB,wEAAwE;aACxE,4BAA4B,EAAE,8BAA8B;CACpD,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;IAC9B,4DAA4D;aAC5D,OAAO,EAAE,SAAS;IAClB,sEAAsE;aACtE,SAAS,EAAE,WAAW;IACtB,8EAA8E;aAC9E,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;aAC1F,UAAU,EAAE,YAAY;IACxB,6EAA6E;aAC7E,gBAAgB,EAAE,kBAAkB;IACpC,yDAAyD;aACzD,kBAAkB,EAAE,oBAAoB;CAChC,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEjG,uCAAuC;AACvC,eAAO,MAAM,cAAc;IACzB,sEAAsE;aACtE,+BAA+B,EAAE,iCAAiC;CAC1D,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC5B,4FAA4F;aAC5F,eAAe,EAAE,iBAAiB;IAClC,oCAAoC;aACpC,OAAO,EAAE,SAAS;IAClB,uCAAuC;aACvC,QAAQ,EAAE,UAAU;IACpB,kEAAkE;aAClE,aAAa,EAAE,eAAe;IAC9B,2EAA2E;aAC3E,YAAY,EAAE,cAAc;IAC5B,oDAAoD;aACpD,UAAU,EAAE,YAAY;IACxB,yEAAyE;aACzE,gBAAgB,EAAE,kBAAkB;IACpC,iEAAiE;aACjE,OAAO,EAAE,SAAS;IAClB,8EAA8E;aAC9E,aAAa,EAAE,eAAe;IAC9B,mEAAmE;aACnE,SAAS,EAAE,WAAW;IACtB,iEAAiE;aACjE,oBAAoB,EAAE,sBAAsB;IAC5C,wFAAwF;aACxF,mBAAmB,EAAE,qBAAqB;IAC1C,yEAAyE;aACzE,MAAM,EAAE,QAAQ;CACR,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/denials.js

@@ -0,0 +1,129 @@
+/**
+ * Denial taxonomy for `enforce()` (PRD Appendix B).
+ *
+ * Every denied `EnforceResult` carries a `reasonCode` and, where one applies,
+ * a `subReason`. `reason` stays a human-readable sentence; code against
+ * `reasonCode`. The codes are stable, low-cardinality strings suitable for
+ * metric labels and audit records, identical to the Python SDK's.
+ */
+export const DenialReason = {
+    /** The grant's purpose matches none of the tool's `allowed_purposes`, or it has none. */
+    PURPOSE_NOT_ALLOWED: 'purpose_not_allowed',
+    /** No scope in the grant covers the connector or tool. */
+    TOOL_NOT_GRANTED: 'tool_not_granted',
+    /** A scope covers the connector but at a lower permission level. */
+    PERMISSION_INSUFFICIENT: 'permission_insufficient',
+    /** A call cap, cost-unit budget or amount cap would be exceeded, or cannot be evaluated. */
+    CAP_EXCEEDED: 'cap_exceeded',
+    /** The tool declares `requires_decision` and no decision grant was given. */
+    DECISION_REQUIRED: 'decision_required',
+    /** A decision grant was given but is not valid for this action. */
+    DECISION_INVALID: 'decision_invalid',
+    /** The grant has been revoked. */
+    GRANT_REVOKED: 'grant_revoked',
+    /** The grant's data region does not permit this call. */
+    REGION_MISMATCH: 'region_mismatch',
+    /** No manifest is loaded for the connector, or it does not declare the tool. */
+    MANIFEST_UNKNOWN_TOOL: 'manifest_unknown_tool',
+    /** The grant token failed verification. Not part of Appendix B, which assumes a verified grant. */
+    TOKEN_INVALID: 'token_invalid',
+};
+/** Sub-reasons for `manifest_unknown_tool`. */
+export const ManifestSubReason = {
+    UNKNOWN_CONNECTOR: 'unknown_connector',
+    UNKNOWN_TOOL: 'unknown_tool',
+    INVALID_DECLARATION: 'invalid_declaration',
+};
+/** Sub-reasons for `cap_exceeded`. */
+export const CapSubReason = {
+    /** `amount` is above a `capped:N` scope. */
+    AMOUNT_CAP: 'amount_cap',
+    /** `amount` is not a finite number. */
+    INVALID_AMOUNT: 'invalid_amount',
+    /** A `capped:N` scope carries a malformed cap. */
+    MALFORMED_CAP: 'malformed_cap',
+    /** The tool declares caps or cost units and they cannot be metered: no meter, or its backend is unavailable. */
+    METER_UNAVAILABLE: 'meter_unavailable',
+    /**
+     * A call cap or cost-unit budget would be exceeded (error code E1008). `details`
+     * carries `code`, `limit`, `window`, `used`, `requested`, `scope` and `kind`.
+     */
+    LIMIT_REACHED: 'limit_reached',
+    /** A per-case cap applies and no `caseId` was given. */
+    CASE_REQUIRED: 'case_required',
+    INVALID_CASE_ID: 'invalid_case_id',
+    /** `costComponents` names a unit the tool does not declare. */
+    INVALID_COST_COMPONENT: 'invalid_cost_component',
+};
+/** Sub-reasons for `purpose_not_allowed`. */
+export const PurposeSubReason = {
+    /** The grant carries no purpose. */
+    MISSING: 'missing',
+    /** The grant's purpose matches none of the tool's patterns. */
+    NOT_MATCHED: 'not_matched',
+    /** The grant's purpose is malformed or not in the purpose vocabulary. */
+    UNKNOWN_PURPOSE: 'unknown_purpose',
+};
+/** Sub-reasons for `tool_not_granted`. */
+export const ToolSubReason = {
+    /** The grant's tools entry for the connector does not list the tool. */
+    NOT_IN_AUTHORIZATION_DETAILS: 'not_in_authorization_details',
+};
+/**
+ * Sub-reasons for `grant_revoked` (PRD G-6). A call is denied both when the
+ * grant is known to be revoked and when the client cannot tell: an SDK that
+ * has lost the revocation feed must not keep authorising calls.
+ */
+export const RevocationSubReason = {
+    /** The auth service says this grant or token is revoked. */
+    REVOKED: 'revoked',
+    /** The grant is suspended: revoked reversibly, pending a decision. */
+    SUSPENDED: 'suspended',
+    /** A grant above this one in the delegation chain is revoked or suspended. */
+    PARENT_REVOKED: 'parent_revoked',
+    /** The revocation feed has not heard from the auth service inside its staleness bound. */
+    FEED_STALE: 'feed_stale',
+    /** The deployment does not serve the revocation feed, or it is not ready. */
+    FEED_UNAVAILABLE: 'feed_unavailable',
+    /** An online revocation check could not be completed. */
+    STATUS_UNAVAILABLE: 'status_unavailable',
+};
+/** Sub-reasons for `token_invalid`. */
+export const TokenSubReason = {
+    /** The `authorization_details` claim cannot be read unambiguously. */
+    MALFORMED_AUTHORIZATION_DETAILS: 'malformed_authorization_details',
+};
+/**
+ * Sub-reasons for `decision_required` and `decision_invalid` (PRD G-3;
+ * `spec/decision-grant.md`). The first four are PRD Appendix B's; the auth
+ * service and the Python SDK use the same values.
+ */
+export const DecisionSubReason = {
+    /** The grant approves a different action (tool, decision, subject, amount or connector). */
+    ACTION_MISMATCH: 'action_mismatch',
+    /** The grant is past its expiry. */
+    EXPIRED: 'expired',
+    /** The grant has already been used. */
+    CONSUMED: 'consumed',
+    /** Both grants of a four-eyes decision name the same approver. */
+    SAME_APPROVER: 'same_approver',
+    /** The case changed (new case version) after the decision was approved. */
+    CASE_CHANGED: 'case_changed',
+    /** The grant approves an action on another case. */
+    WRONG_CASE: 'wrong_case',
+    /** The approver's authentication was not step-up (auth service only). */
+    STEP_UP_REQUIRED: 'step_up_required',
+    /** The decision request was cancelled and its grants revoked. */
+    REVOKED: 'revoked',
+    /** The issuer does not know the grant, or it belongs to another developer. */
+    UNKNOWN_GRANT: 'unknown_grant',
+    /** The grant, or the action to compare it with, cannot be read. */
+    MALFORMED: 'malformed',
+    /** The decision needs two approvals and fewer were presented. */
+    FOUR_EYES_INCOMPLETE: 'four_eyes_incomplete',
+    /** The grant could not be consumed at the issuer (network, server or configuration). */
+    CONSUME_UNAVAILABLE: 'consume_unavailable',
+    /** No decision grant was presented (reported as `decision_required`). */
+    ABSENT: 'absent',
+};
+//# sourceMappingURL=denials.js.map

package/dist/denials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denials.js","sourceRoot":"","sources":["../src/denials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,yFAAyF;IACzF,mBAAmB,EAAE,qBAAqB;IAC1C,0DAA0D;IAC1D,gBAAgB,EAAE,kBAAkB;IACpC,oEAAoE;IACpE,uBAAuB,EAAE,yBAAyB;IAClD,4FAA4F;IAC5F,YAAY,EAAE,cAAc;IAC5B,6EAA6E;IAC7E,iBAAiB,EAAE,mBAAmB;IACtC,mEAAmE;IACnE,gBAAgB,EAAE,kBAAkB;IACpC,kCAAkC;IAClC,aAAa,EAAE,eAAe;IAC9B,yDAAyD;IACzD,eAAe,EAAE,iBAAiB;IAClC,gFAAgF;IAChF,qBAAqB,EAAE,uBAAuB;IAC9C,mGAAmG;IACnG,aAAa,EAAE,eAAe;CACtB,CAAC;AAIX,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,mBAAmB,EAAE,qBAAqB;CAClC,CAAC;AAEX,sCAAsC;AACtC,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,4CAA4C;IAC5C,UAAU,EAAE,YAAY;IACxB,uCAAuC;IACvC,cAAc,EAAE,gBAAgB;IAChC,kDAAkD;IAClD,aAAa,EAAE,eAAe;IAC9B,gHAAgH;IAChH,iBAAiB,EAAE,mBAAmB;IACtC;;;OAGG;IACH,aAAa,EAAE,eAAe;IAC9B,wDAAwD;IACxD,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;IAClC,+DAA+D;IAC/D,sBAAsB,EAAE,wBAAwB;CACxC,CAAC;AAEX,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,oCAAoC;IACpC,OAAO,EAAE,SAAS;IAClB,+DAA+D;IAC/D,WAAW,EAAE,aAAa;IAC1B,yEAAyE;IACzE,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,0CAA0C;AAC1C,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,wEAAwE;IACxE,4BAA4B,EAAE,8BAA8B;CACpD,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,4DAA4D;IAC5D,OAAO,EAAE,SAAS;IAClB,sEAAsE;IACtE,SAAS,EAAE,WAAW;IACtB,8EAA8E;IAC9E,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,UAAU,EAAE,YAAY;IACxB,6EAA6E;IAC7E,gBAAgB,EAAE,kBAAkB;IACpC,yDAAyD;IACzD,kBAAkB,EAAE,oBAAoB;CAChC,CAAC;AAIX,uCAAuC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,sEAAsE;IACtE,+BAA+B,EAAE,iCAAiC;CAC1D,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,4FAA4F;IAC5F,eAAe,EAAE,iBAAiB;IAClC,oCAAoC;IACpC,OAAO,EAAE,SAAS;IAClB,uCAAuC;IACvC,QAAQ,EAAE,UAAU;IACpB,kEAAkE;IAClE,aAAa,EAAE,eAAe;IAC9B,2EAA2E;IAC3E,YAAY,EAAE,cAAc;IAC5B,oDAAoD;IACpD,UAAU,EAAE,YAAY;IACxB,yEAAyE;IACzE,gBAAgB,EAAE,kBAAkB;IACpC,iEAAiE;IACjE,OAAO,EAAE,SAAS;IAClB,8EAA8E;IAC9E,aAAa,EAAE,eAAe;IAC9B,mEAAmE;IACnE,SAAS,EAAE,WAAW;IACtB,iEAAiE;IACjE,oBAAoB,EAAE,sBAAsB;IAC5C,wFAAwF;IACxF,mBAAmB,EAAE,qBAAqB;IAC1C,yEAAyE;IACzE,MAAM,EAAE,QAAQ;CACR,CAAC"}

package/dist/evidence/build.d.ts

@@ -0,0 +1,63 @@
+type Json = Record<string, any>;
+/**
+ * How identifiers and content digests appear in a package. Every class not in
+ * `disclosed` (`approver`, `content`, `principal`, `record`, `subject`) is keyed
+ * per case with `key` (at least 32 bytes, never written to the package; `keyId`
+ * names it). Disclosing every class needs no key and produces scheme `none`.
+ */
+export interface PrivacySettings {
+    key?: Uint8Array;
+    keyId?: string;
+    disclosed?: readonly string[];
+}
+export interface BuiltPackage {
+    document: Json;
+    data: Uint8Array;
+    root: string;
+}
+export interface EvidenceRecord {
+    type: string;
+    at: string;
+    data: Json;
+    source: {
+        authority: 'platform' | 'tenant';
+        recorded_at: string;
+        audit_entry_id?: string;
+        audit_hash?: string;
+        late?: true;
+    };
+    ext?: Json;
+}
+/** The canonical bytes of a package document. */
+export declare function serializePackage(document: Json): Uint8Array;
+/**
+ * Build a package from a case header and entry records. Values are given in the
+ * clear (decisions carry the token's `action_hash`) and keyed here according to
+ * `privacy`. The result is checked with the verification rules, so an invalid
+ * package is refused with `EvidenceBuildError`.
+ */
+export declare function buildPackage(input: {
+    case: Json;
+    entries: readonly EvidenceRecord[] | readonly Json[];
+    privacy: PrivacySettings;
+}): BuiltPackage;
+/**
+ * The platform audit entry that records a package's root. Its agent, DID and
+ * grant are empty, its principal is `platform` and its metadata carries the
+ * platform marker, none of which a tenant can write through `/v1/audit/log`.
+ */
+export declare function anchorAuditEntry(document: Json, options: {
+    auditEntryId: string;
+    timestamp: string;
+    prevHash: string | null;
+}): Json;
+/** A copy of `document` with `anchor` set; the root is unchanged. */
+export declare function attachAnchor(document: Json, auditEntry: Json): Json;
+/** A copy of `document` with `signature` set; the root is unchanged. */
+export declare function attachSignature(document: Json, signature: Json | {
+    alg: string;
+    jws: string;
+    kid: string;
+}): Json;
+export {};
+//# sourceMappingURL=build.d.ts.map

package/dist/evidence/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/evidence/build.ts"],"names":[],"mappings":"AASA,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAIhC;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,IAAI,CAAC;IACf,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE;QAAE,SAAS,EAAE,UAAU,GAAG,QAAQ,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;IAC7H,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,iDAAiD;AACjD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,IAAI,GAAG,UAAU,CAE3D;AA0FD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,IAAI,EAAE,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAAG,YAAY,CA2ChJ;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAyBpI;AAED,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,GAAG,IAAI,CAInE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIjH"}