@loomwork/effect-runtime 0.0.0-stage → 0.1.0

package/dist/authz.d.ts

@@ -0,0 +1,228 @@
+/**
+ * K12.1 — an authenticated principal chain, populated at the trust boundary
+ * (A2A server / resume API) and propagated immutably through dispatch. The
+ * KERNEL CARRIES IT OPAQUELY and never interprets it — authorizers, budget
+ * scopes, and stores do. Keeping the kernel free of a tenant model is what keeps
+ * Loom a generic execution kernel (P10). Extra fields are allowed; a
+ * `delegation` (K12.4) rides here.
+ */
+export interface PrincipalChain {
+    /** The tenant boundary — an opaque, pseudonymous id (never human PII; see K10). */
+    tenant?: string;
+    /** The acting identity. */
+    actor?: string;
+    /** The identity this action is performed on behalf of (delegation origin). */
+    onBehalfOf?: string;
+    /** K12.4 — a verifiable attenuated-delegation token, checked at the callee. */
+    delegation?: DelegatedGrant;
+    /**
+     * R3k (ADR 0111 D2/D4) — set ONLY by the kernel's principal resolver, never by a caller: the
+     * execution's recorded principal carried a delegation (this is its digest id) that no codec or
+     * resolver could restore. The effect seam refuses every effect of such a principal BEFORE any
+     * authorizer is consulted ({@link principalBlocked}); it never falls back to a broader identity.
+     */
+    delegationUnresolved?: string;
+    /** R3k — the recorded principal was crypto-shredded: every effect is denied (never the resumer's). */
+    principalShredded?: true;
+    /** R3k — the recorded principal could not be rehydrated (a `ref` with no codec, an unknown record version). */
+    principalUnresolved?: string;
+    [key: string]: unknown;
+}
+/**
+ * R3k (ADR 0111 D4) — why the KERNEL refuses every effect of this principal before any
+ * authorizer is asked, or `undefined` when it does not. A `PolicyAuthorizer`, a `GrantTable` or a
+ * 3P authorizer would otherwise judge a chain whose delegation could not be restored on its own
+ * terms (an unattenuated child after a crash is the privilege escalation this closes).
+ */
+export declare function principalBlocked(principal: PrincipalChain | undefined): string | undefined;
+export interface CapabilityRequest {
+    toolId: string;
+    /**
+     * R12 — the sub-resource this call targets, when the effect declares one
+     * (`Effect.resourceOf`): e.g. `"<server>/<tool>"` for `mcp.invoke`. A grant naming
+     * {@link capabilityIds | `<toolId>:<resource>`} authorizes exactly that resource; a grant on
+     * the bare `toolId` still authorizes every resource of the effect (unchanged behaviour).
+     */
+    resource?: string;
+    executionId: string;
+    workflowId: string;
+    stepId: string;
+    /** K12.1 — the authenticated principal chain, if one was established. */
+    principal?: PrincipalChain;
+}
+/**
+ * R12 — the capability ids a request is authorized under: the effect id (covers every resource
+ * of the effect — the legacy, coarse grant) and, when the call names a resource, the qualified
+ * `<toolId>:<resource>` id (covers just that resource).
+ */
+export declare function capabilityId(req: CapabilityRequest): string;
+export declare function capabilityIds(req: CapabilityRequest): readonly string[];
+export interface CapabilityDecision {
+    allowed: boolean;
+    reason?: string;
+}
+export interface CapabilityAuthorizer {
+    authorize(req: CapabilityRequest): CapabilityDecision;
+}
+export declare class CapabilityDeniedError extends Error {
+    readonly toolId: string;
+    readonly reason: string;
+    constructor(toolId: string, reason: string);
+}
+export interface GrantTableOptions {
+    /**
+     * Which field identifies the "principal" whose grants apply. Default: the
+     * workflowId (a flow is the unit of authority). Return `executionId` for
+     * per-execution grants, or read a grant-set id from the request.
+     */
+    principal?: (req: CapabilityRequest) => string;
+}
+/**
+ * The least-privilege authorizer: a static table mapping a principal to the set of
+ * effect ids it may invoke (`"*"` grants all). Anything not explicitly granted is
+ * denied. Grants are declared at boot and cannot be mutated at runtime, so authority
+ * is fixed and auditable.
+ */
+export declare class GrantTable implements CapabilityAuthorizer {
+    private readonly grants;
+    private readonly principalOf;
+    constructor(grants: Record<string, readonly string[]>, options?: GrantTableOptions);
+    authorize(req: CapabilityRequest): CapabilityDecision;
+    /**
+     * A read-only projection of the static grants — principal → granted effect ids,
+     * or `"*"` when all effects are granted. For pre-flight tooling (e.g. `@loomwork/verify`)
+     * that needs to inspect authority without a live {@link CapabilityRequest}.
+     */
+    view(): Record<string, readonly string[] | "*">;
+}
+export interface DelegationAuthorizerOptions {
+    /**
+     * Shared secret used to verify delegation signatures at this trust boundary.
+     *
+     * NOTE this is SYMMETRIC: a party that can verify a token can also mint one.
+     * That is why {@link DelegationAuthorizerOptions.base} is required — see below.
+     */
+    secret: string;
+    /**
+     * The callee's OWN authority — an effect is allowed only if it is in BOTH the
+     * verified delegated set AND the callee's own grants (never ambient escalation).
+     *
+     * REQUIRED, and it is load-bearing for security rather than a convenience.
+     * Because `secret` is symmetric, the verifier is also a valid minter: a callee
+     * can always sign itself a token granting `"*"`, and that token is
+     * cryptographically indistinguishable from a genuine one. The delegation check
+     * therefore cannot bound a callee's authority on its own — only the
+     * intersection with `base` can. With `base` set, minting a token gains a callee
+     * nothing it did not already hold, which is what makes the symmetric secret
+     * safe here.
+     *
+     * This option used to be optional, documented as "omit to allow the full
+     * verified delegated set (the callee delegates all of its authority decisions
+     * upstream)". That mode could not deliver what it claimed: upstream cannot
+     * retain authority over a callee that holds the minting key. Delegating
+     * authority ACROSS a trust boundary needs asymmetric signatures (the verifier
+     * must not be able to mint), which this primitive does not implement.
+     */
+    base: CapabilityAuthorizer;
+    /** Clock for token-expiry checks (epoch ms). Injectable for tests; defaults to `Date.now`. */
+    now?: () => number;
+}
+/**
+ * K12.4 — authorizes an effect against a VERIFIED attenuated delegation carried
+ * in `req.principal.delegation`. The token's signature is checked first (a
+ * forged or tampered delegation is denied outright), then the effect must be in
+ * the **intersection** of the delegated grants and the callee's own authority
+ * (`base`) — a delegate can never invoke an effect the delegator lacked, nor one
+ * the callee itself lacks. No delegation present ⇒ falls through to `base`.
+ *
+ * TRUST MODEL — delegator and callee share one secret, so they are one trust
+ * domain. The signature stops a THIRD party (a caller, a middlebox) forging or
+ * tampering with a grant set in transit; it does not, and cannot, stop the
+ * verifier minting its own. Authority over the callee comes from `base`, never
+ * from the token. Cross-organisation delegation, where the verifier must not be
+ * able to mint, is out of scope for this primitive and needs asymmetric
+ * signatures. See ADR 0024.
+ */
+export declare class DelegationAuthorizer implements CapabilityAuthorizer {
+    private readonly options;
+    constructor(options: DelegationAuthorizerOptions);
+    authorize(req: CapabilityRequest): CapabilityDecision;
+}
+/** A signed delegation: the grant subset a delegator conferred, HMAC-bound. */
+export interface DelegatedGrant {
+    /** The delegated capability ids (effect ids the callee may invoke on the caller's behalf). */
+    grants: string[];
+    /** The principal this token was issued to (bound into the signature). */
+    issuedTo: string;
+    /** Optional absolute expiry (epoch ms), bound into the signature; rejected once past. */
+    exp?: number;
+    /** HMAC-SHA256 over `${issuedTo}\n${sorted grants}[\nexp=…]` with the shared delegation secret. */
+    sig: string;
+}
+/** Mint a delegation token: the delegator signs the subset it confers on `issuedTo`. */
+export declare function signDelegation(secret: string, issuedTo: string, grants: string[], exp?: number): DelegatedGrant;
+/**
+ * R3k (ADR 0111 D1) — a stable, NON-bearer identifier of a token, for the durable principal
+ * record: SHA-256 over the signature, so the log can say which delegation an execution held
+ * without holding anything that can be presented. The token itself is never written.
+ */
+export declare function delegationDigest(token: DelegatedGrant): string;
+/** Verify a delegation's signature (constant-time). A forged/tampered token fails. */
+export declare function verifyDelegation(secret: string, token: DelegatedGrant): boolean;
+/**
+ * Attenuate a delegation to a narrower subset, re-signed for a new holder — only
+ * capabilities already in the token survive, and the parent's expiry is inherited.
+ * Requires the shared secret (the delegator/mint authority performs it); a
+ * pure-holder chained-HMAC variant is a future option.
+ *
+ * "Never broadening" is enforced on BOTH axes:
+ *
+ *  - **Grants.** A capability absent from the parent cannot appear in the child. A parent
+ *    holding `"*"` may attenuate to any concrete subset (that is narrowing) — previously
+ *    such a subset was filtered against the literal `["*"]` array and came back EMPTY, so a
+ *    wildcard delegator could not attenuate at all.
+ *  - **Expiry.** The parent's `exp` is inherited, and `exp` may only be brought EARLIER.
+ *    This was the important one: `exp` used not to be propagated, so attenuating a token
+ *    that expired in an hour produced a child that **never expired** — narrowing the grant
+ *    set while silently making the token immortal.
+ *
+ * Throws on an unverifiable parent. The signature is what makes the grant set trustworthy,
+ * and this function holds the secret — so attenuating an unchecked token would launder a
+ * forged one into a validly signed child. The old contract merely *documented* that the
+ * caller must pass a verified token; a security primitive should not depend on that.
+ */
+export declare function attenuateDelegation(secret: string, token: DelegatedGrant, issuedTo: string, subset: string[], exp?: number): DelegatedGrant;
+import type { Scheduler } from "@loomwork/scheduler";
+import type { Warmer } from "./types";
+export interface EffectRuntimeOptions {
+    /** When set, every effect is authorized against it; ungranted effects are denied (K2). */
+    authorizer?: CapabilityAuthorizer;
+    /**
+     * When set, effects run through this scheduler (M6) — bounded concurrency + priority
+     * ordering across all of a runtime's effects (admission control). Omit for the
+     * zero-overhead direct path.
+     */
+    scheduler?: Scheduler;
+    /** Advisory pre-warm hook, invoked off-log before each effect (M6). */
+    warmer?: Warmer;
+    /** ADR 0119 — where a swallowed delta-sink throw is reported. Defaults to `console.warn`. */
+    onWarn?: (message: string) => void;
+}
+/**
+ * R16 / R17 — THE identity key: `[tenant, actor, onBehalfOf]`, one string, shared by everything that
+ * scopes state to "who" (a conversation's owner, a goal's owner). Two principals are the same identity
+ * iff all three fields are equal (an absent field equals only an absent field), so a delegate acting
+ * `onBehalfOf` someone is a DIFFERENT identity from that someone. A credential (a delegation token)
+ * is not part of identity. Keep one definition: two keys for one idea is how a scope check drifts.
+ */
+export declare function identityKeyOf(i: {
+    tenant?: string;
+    actor: string;
+    onBehalfOf?: string;
+}): string;
+/**
+ * The identity key of a principal, or `undefined` when it names no actor (it can own nothing) or the
+ * kernel marked it unusable ({@link principalBlocked}: shredded, delegation or record unresolved).
+ */
+export declare function principalIdentityKey(principal: PrincipalChain | undefined): string | undefined;
+//# sourceMappingURL=authz.d.ts.map

package/dist/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../src/authz.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,mFAAmF;IACnF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,sGAAsG;IACtG,iBAAiB,CAAC,EAAE,IAAI,CAAC;IACzB,+GAA+G;IAC/G,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAY1F;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,CAE3D;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,iBAAiB,GAAG,SAAS,MAAM,EAAE,CAEvE;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,GAAG,EAAE,iBAAiB,GAAG,kBAAkB,CAAC;CACvD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM3C;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,MAAM,CAAC;CAChD;AAED;;;;;GAKG;AACH,qBAAa,UAAW,YAAW,oBAAoB;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;gBAErD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,EAAE,OAAO,GAAE,iBAAsB;IAKtF,SAAS,CAAC,GAAG,EAAE,iBAAiB,GAAG,kBAAkB;IAerD;;;;OAIG;IACH,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;CAOhD;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;;;;;;;;;;;;OAmBG;IACH,IAAI,EAAE,oBAAoB,CAAC;IAC3B,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,oBAAqB,YAAW,oBAAoB;IACnD,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,2BAA2B;IAYjE,SAAS,CAAC,GAAG,EAAE,iBAAiB,GAAG,kBAAkB;CA8CtD;AAcD,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,8FAA8F;IAC9F,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,GAAG,EAAE,MAAM,CAAC;CACb;AASD,wFAAwF;AACxF,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,cAAc,CAKhB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAE9D;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAO/E;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EAAE,EAChB,GAAG,CAAC,EAAE,MAAM,GACX,cAAc,CAahB;AAED,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,MAAM,WAAW,oBAAoB;IACnC,0FAA0F;IAC1F,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC;;;;OAIG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAS9F"}

package/dist/authz.js

@@ -0,0 +1,281 @@
+"use strict";
+// ── Capability protection (Loom 2.0 K2) — the kernel's authority ring ─────────
+//
+// Every side effect flows through EffectRuntime.execute, so that is the one boundary
+// a library CAN enforce (unlike hardware memory protection). A CapabilityAuthorizer
+// decides, per invocation, whether the calling execution holds the authority to run
+// the effect. Grants are unforgeable: an execution cannot grant itself a capability —
+// grants live only in the authorizer, wired statically at boot (P5). A denied effect
+// never runs; the denial is emitted as a durable EFFECT_DENIED fact (P9) and fails
+// the step. Enforcement is opt-in: no authorizer ⇒ today's permissive behaviour.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationAuthorizer = exports.GrantTable = exports.CapabilityDeniedError = void 0;
+exports.principalBlocked = principalBlocked;
+exports.capabilityId = capabilityId;
+exports.capabilityIds = capabilityIds;
+exports.signDelegation = signDelegation;
+exports.delegationDigest = delegationDigest;
+exports.verifyDelegation = verifyDelegation;
+exports.attenuateDelegation = attenuateDelegation;
+exports.identityKeyOf = identityKeyOf;
+exports.principalIdentityKey = principalIdentityKey;
+/**
+ * R3k (ADR 0111 D4) — why the KERNEL refuses every effect of this principal before any
+ * authorizer is asked, or `undefined` when it does not. A `PolicyAuthorizer`, a `GrantTable` or a
+ * 3P authorizer would otherwise judge a chain whose delegation could not be restored on its own
+ * terms (an unattenuated child after a crash is the privilege escalation this closes).
+ */
+function principalBlocked(principal) {
+    if (principal === undefined)
+        return undefined;
+    if (principal.principalShredded === true) {
+        return "the execution's recorded principal was crypto-shredded";
+    }
+    if (principal.delegationUnresolved !== undefined) {
+        return `the execution's recorded delegation "${String(principal.delegationUnresolved)}" could not be restored (no principalCodec/resolver)`;
+    }
+    if (principal.principalUnresolved !== undefined) {
+        return `the execution's recorded principal could not be restored: ${String(principal.principalUnresolved)}`;
+    }
+    return undefined;
+}
+/**
+ * R12 — the capability ids a request is authorized under: the effect id (covers every resource
+ * of the effect — the legacy, coarse grant) and, when the call names a resource, the qualified
+ * `<toolId>:<resource>` id (covers just that resource).
+ */
+function capabilityId(req) {
+    return req.resource === undefined ? req.toolId : `${req.toolId}:${req.resource}`;
+}
+function capabilityIds(req) {
+    return req.resource === undefined ? [req.toolId] : [req.toolId, `${req.toolId}:${req.resource}`];
+}
+class CapabilityDeniedError extends Error {
+    toolId;
+    reason;
+    constructor(toolId, reason) {
+        super(`Capability denied: effect "${toolId}" — ${reason}`);
+        this.name = "CapabilityDeniedError";
+        this.toolId = toolId;
+        this.reason = reason;
+    }
+}
+exports.CapabilityDeniedError = CapabilityDeniedError;
+/**
+ * The least-privilege authorizer: a static table mapping a principal to the set of
+ * effect ids it may invoke (`"*"` grants all). Anything not explicitly granted is
+ * denied. Grants are declared at boot and cannot be mutated at runtime, so authority
+ * is fixed and auditable.
+ */
+class GrantTable {
+    grants;
+    principalOf;
+    constructor(grants, options = {}) {
+        this.grants = new Map(Object.entries(grants).map(([k, v]) => [k, new Set(v)]));
+        this.principalOf = options.principal ?? ((req) => req.workflowId);
+    }
+    authorize(req) {
+        const principal = this.principalOf(req);
+        const granted = this.grants.get(principal);
+        if (granted === undefined) {
+            return { allowed: false, reason: `principal "${principal}" has no grants` };
+        }
+        if (granted.has("*") || capabilityIds(req).some((id) => granted.has(id))) {
+            return { allowed: true };
+        }
+        return {
+            allowed: false,
+            reason: `effect "${capabilityId(req)}" not granted to "${principal}"`,
+        };
+    }
+    /**
+     * A read-only projection of the static grants — principal → granted effect ids,
+     * or `"*"` when all effects are granted. For pre-flight tooling (e.g. `@loomwork/verify`)
+     * that needs to inspect authority without a live {@link CapabilityRequest}.
+     */
+    view() {
+        const out = {};
+        for (const [principal, set] of this.grants) {
+            out[principal] = set.has("*") ? "*" : [...set];
+        }
+        return out;
+    }
+}
+exports.GrantTable = GrantTable;
+/**
+ * K12.4 — authorizes an effect against a VERIFIED attenuated delegation carried
+ * in `req.principal.delegation`. The token's signature is checked first (a
+ * forged or tampered delegation is denied outright), then the effect must be in
+ * the **intersection** of the delegated grants and the callee's own authority
+ * (`base`) — a delegate can never invoke an effect the delegator lacked, nor one
+ * the callee itself lacks. No delegation present ⇒ falls through to `base`.
+ *
+ * TRUST MODEL — delegator and callee share one secret, so they are one trust
+ * domain. The signature stops a THIRD party (a caller, a middlebox) forging or
+ * tampering with a grant set in transit; it does not, and cannot, stop the
+ * verifier minting its own. Authority over the callee comes from `base`, never
+ * from the token. Cross-organisation delegation, where the verifier must not be
+ * able to mint, is out of scope for this primitive and needs asymmetric
+ * signatures. See ADR 0024.
+ */
+class DelegationAuthorizer {
+    options;
+    constructor(options) {
+        this.options = options;
+        // The type alone is not the enforcement — JS callers and `as any` bypass it,
+        // and an absent `base` silently turns the intersection into a no-op, which
+        // reads as a working gate while bounding nothing.
+        if (options.base === undefined || options.base === null) {
+            throw new Error("DelegationAuthorizer: `base` is required — the delegation secret is symmetric, so a " +
+                "verified token cannot bound a callee's authority on its own (see ADR 0024).");
+        }
+    }
+    authorize(req) {
+        // Defence in depth: the kernel already refuses these before any authorizer (principalBlocked).
+        const blocked = principalBlocked(req.principal);
+        if (blocked !== undefined)
+            return { allowed: false, reason: blocked };
+        const token = req.principal?.delegation;
+        if (token === undefined) {
+            return this.options.base.authorize(req);
+        }
+        if (!verifyDelegation(this.options.secret, token)) {
+            return { allowed: false, reason: "delegation signature invalid (forged or tampered)" };
+        }
+        // Reject expired tokens (exp is signature-bound, so it can't be extended). A token
+        // without exp never expires — the same as before this field existed.
+        if (token.exp !== undefined && (this.options.now?.() ?? Date.now()) >= token.exp) {
+            return { allowed: false, reason: `delegation expired at ${token.exp}` };
+        }
+        // K12.4 — bind the token to its intended holder. A delegation minted for
+        // `issuedTo` may only be presented BY that principal (`req.principal.actor`).
+        // The signature proves authenticity, not that the bearer is the intended
+        // holder — without this check a captured/misrouted token is a confused deputy,
+        // usable by whoever holds it.
+        if (req.principal?.actor !== token.issuedTo) {
+            return {
+                allowed: false,
+                reason: `delegation issued to "${token.issuedTo}" but presented by "${req.principal?.actor ?? "(none)"}"`,
+            };
+        }
+        const delegated = new Set(token.grants);
+        const inDelegated = delegated.has("*") || capabilityIds(req).some((id) => delegated.has(id));
+        if (!inDelegated) {
+            return {
+                allowed: false,
+                reason: `effect "${capabilityId(req)}" not in the delegated grant set`,
+            };
+        }
+        // Intersection: the callee must ALSO hold the authority (no ambient escalation).
+        // This is what bounds a callee that could mint its own token — never the signature.
+        const baseDecision = this.options.base.authorize(req);
+        if (!baseDecision.allowed) {
+            return {
+                allowed: false,
+                reason: `delegated, but the callee itself lacks "${req.toolId}": ${baseDecision.reason ?? ""}`,
+            };
+        }
+        return { allowed: true };
+    }
+}
+exports.DelegationAuthorizer = DelegationAuthorizer;
+// ── K12.4 — verifiable attenuated delegation (macaroon-lite) ─────────────────
+//
+// The evaluation's amendment: "an attenuated grant set carried as a plain
+// request field is forgeable by any caller or middlebox." So a delegation is
+// SIGNED (HMAC) by the delegator and VERIFIED at the callee's trust boundary
+// before its grants are honored. Attenuation can only NARROW: a holder derives
+// a more-restricted token, never a broader one, because the delegated grant set
+// is bound into the signature. The intersection is computed from the VERIFIED
+// set, never a forgeable field.
+const node_crypto_1 = require("node:crypto");
+// `exp` is appended only when present, so tokens without it sign the exact prior payload
+// (backward-compatible), while a tampered `exp` breaks the signature.
+function delegationPayload(issuedTo, grants, exp) {
+    const base = `${issuedTo}\n${[...grants].sort().join(",")}`;
+    return exp !== undefined ? `${base}\nexp=${exp}` : base;
+}
+/** Mint a delegation token: the delegator signs the subset it confers on `issuedTo`. */
+function signDelegation(secret, issuedTo, grants, exp) {
+    const sig = (0, node_crypto_1.createHmac)("sha256", secret)
+        .update(delegationPayload(issuedTo, grants, exp))
+        .digest("hex");
+    return { grants: [...grants], issuedTo, ...(exp !== undefined && { exp }), sig };
+}
+/**
+ * R3k (ADR 0111 D1) — a stable, NON-bearer identifier of a token, for the durable principal
+ * record: SHA-256 over the signature, so the log can say which delegation an execution held
+ * without holding anything that can be presented. The token itself is never written.
+ */
+function delegationDigest(token) {
+    return (0, node_crypto_1.createHash)("sha256").update(String(token.sig)).digest("hex");
+}
+/** Verify a delegation's signature (constant-time). A forged/tampered token fails. */
+function verifyDelegation(secret, token) {
+    const expected = (0, node_crypto_1.createHmac)("sha256", secret)
+        .update(delegationPayload(token.issuedTo, token.grants, token.exp))
+        .digest("hex");
+    const a = Buffer.from(expected, "hex");
+    const b = Buffer.from(token.sig, "hex");
+    return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b);
+}
+/**
+ * Attenuate a delegation to a narrower subset, re-signed for a new holder — only
+ * capabilities already in the token survive, and the parent's expiry is inherited.
+ * Requires the shared secret (the delegator/mint authority performs it); a
+ * pure-holder chained-HMAC variant is a future option.
+ *
+ * "Never broadening" is enforced on BOTH axes:
+ *
+ *  - **Grants.** A capability absent from the parent cannot appear in the child. A parent
+ *    holding `"*"` may attenuate to any concrete subset (that is narrowing) — previously
+ *    such a subset was filtered against the literal `["*"]` array and came back EMPTY, so a
+ *    wildcard delegator could not attenuate at all.
+ *  - **Expiry.** The parent's `exp` is inherited, and `exp` may only be brought EARLIER.
+ *    This was the important one: `exp` used not to be propagated, so attenuating a token
+ *    that expired in an hour produced a child that **never expired** — narrowing the grant
+ *    set while silently making the token immortal.
+ *
+ * Throws on an unverifiable parent. The signature is what makes the grant set trustworthy,
+ * and this function holds the secret — so attenuating an unchecked token would launder a
+ * forged one into a validly signed child. The old contract merely *documented* that the
+ * caller must pass a verified token; a security primitive should not depend on that.
+ */
+function attenuateDelegation(secret, token, issuedTo, subset, exp) {
+    if (!verifyDelegation(secret, token)) {
+        throw new Error("attenuateDelegation: parent delegation failed verification — refusing to sign a child from an unverified token");
+    }
+    const parentIsWildcard = token.grants.includes("*");
+    const narrowed = parentIsWildcard ? [...subset] : subset.filter((g) => token.grants.includes(g));
+    // Inherit the parent's expiry; an explicit `exp` may only tighten it.
+    const inherited = token.exp;
+    const nextExp = inherited === undefined ? exp : exp === undefined ? inherited : Math.min(inherited, exp);
+    return signDelegation(secret, issuedTo, narrowed, nextExp);
+}
+/**
+ * R16 / R17 — THE identity key: `[tenant, actor, onBehalfOf]`, one string, shared by everything that
+ * scopes state to "who" (a conversation's owner, a goal's owner). Two principals are the same identity
+ * iff all three fields are equal (an absent field equals only an absent field), so a delegate acting
+ * `onBehalfOf` someone is a DIFFERENT identity from that someone. A credential (a delegation token)
+ * is not part of identity. Keep one definition: two keys for one idea is how a scope check drifts.
+ */
+function identityKeyOf(i) {
+    return JSON.stringify([i.tenant ?? null, i.actor, i.onBehalfOf ?? null]);
+}
+/**
+ * The identity key of a principal, or `undefined` when it names no actor (it can own nothing) or the
+ * kernel marked it unusable ({@link principalBlocked}: shredded, delegation or record unresolved).
+ */
+function principalIdentityKey(principal) {
+    if (principal === undefined || principalBlocked(principal) !== undefined)
+        return undefined;
+    const actor = principal.actor;
+    if (typeof actor !== "string" || actor.trim() === "")
+        return undefined;
+    return identityKeyOf({
+        actor,
+        ...(typeof principal.tenant === "string" && { tenant: principal.tenant }),
+        ...(typeof principal.onBehalfOf === "string" && { onBehalfOf: principal.onBehalfOf }),
+    });
+}
+//# sourceMappingURL=authz.js.map

package/dist/authz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../src/authz.ts"],"names":[],"mappings":";AAAA,iFAAiF;AACjF,EAAE;AACF,qFAAqF;AACrF,oFAAoF;AACpF,oFAAoF;AACpF,sFAAsF;AACtF,qFAAqF;AACrF,mFAAmF;AACnF,iFAAiF;;;AAuCjF,4CAYC;AAuBD,oCAEC;AAED,sCAEC;AA2ND,wCAUC;AAOD,4CAEC;AAGD,4CAOC;AAwBD,kDAmBC;AA2BD,sCAEC;AAMD,oDASC;AA9XD;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,SAAqC;IACpE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,SAAS,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,wDAAwD,CAAC;IAClE,CAAC;IACD,IAAI,SAAS,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,wCAAwC,MAAM,CAAC,SAAS,CAAC,oBAAoB,CAAC,sDAAsD,CAAC;IAC9I,CAAC;IACD,IAAI,SAAS,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAChD,OAAO,6DAA6D,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC;IAC9G,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAkBD;;;;GAIG;AACH,SAAgB,YAAY,CAAC,GAAsB;IACjD,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;AACnF,CAAC;AAED,SAAgB,aAAa,CAAC,GAAsB;IAClD,OAAO,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;AACnG,CAAC;AAaD,MAAa,qBAAsB,SAAQ,KAAK;IACrC,MAAM,CAAS;IACf,MAAM,CAAS;IACxB,YAAY,MAAc,EAAE,MAAc;QACxC,KAAK,CAAC,8BAA8B,MAAM,OAAO,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AATD,sDASC;AAWD;;;;;GAKG;AACH,MAAa,UAAU;IACJ,MAAM,CAA2B;IACjC,WAAW,CAAqC;IAEjE,YAAY,MAAyC,EAAE,UAA6B,EAAE;QACpF,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpE,CAAC;IAED,SAAS,CAAC,GAAsB;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,SAAS,iBAAiB,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,WAAW,YAAY,CAAC,GAAG,CAAC,qBAAqB,SAAS,GAAG;SACtE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,IAAI;QACF,MAAM,GAAG,GAA4C,EAAE,CAAC;QACxD,KAAK,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AApCD,gCAoCC;AAmCD;;;;;;;;;;;;;;;GAeG;AACH,MAAa,oBAAoB;IACF;IAA7B,YAA6B,OAAoC;QAApC,YAAO,GAAP,OAAO,CAA6B;QAC/D,6EAA6E;QAC7E,2EAA2E;QAC3E,kDAAkD;QAClD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,sFAAsF;gBACpF,6EAA6E,CAChF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS,CAAC,GAAsB;QAC9B,+FAA+F;QAC/F,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mDAAmD,EAAE,CAAC;QACzF,CAAC;QACD,mFAAmF;QACnF,qEAAqE;QACrE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1E,CAAC;QACD,yEAAyE;QACzE,8EAA8E;QAC9E,yEAAyE;QACzE,+EAA+E;QAC/E,8BAA8B;QAC9B,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,yBAAyB,KAAK,CAAC,QAAQ,uBAAuB,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,QAAQ,GAAG;aAC1G,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,WAAW,YAAY,CAAC,GAAG,CAAC,kCAAkC;aACvE,CAAC;QACJ,CAAC;QACD,iFAAiF;QACjF,oFAAoF;QACpF,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,2CAA2C,GAAG,CAAC,MAAM,MAAM,YAAY,CAAC,MAAM,IAAI,EAAE,EAAE;aAC/F,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AA3DD,oDA2DC;AAED,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,gCAAgC;AAEhC,6CAAsE;AActE,yFAAyF;AACzF,sEAAsE;AACtE,SAAS,iBAAiB,CAAC,QAAgB,EAAE,MAAyB,EAAE,GAAY;IAClF,MAAM,IAAI,GAAG,GAAG,QAAQ,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5D,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,wFAAwF;AACxF,SAAgB,cAAc,CAC5B,MAAc,EACd,QAAgB,EAChB,MAAgB,EAChB,GAAY;IAEZ,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC;SACrC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;SAChD,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,KAAqB;IACpD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED,sFAAsF;AACtF,SAAgB,gBAAgB,CAAC,MAAc,EAAE,KAAqB;IACpE,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC;SAC1C,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;SAClE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,mBAAmB,CACjC,MAAc,EACd,KAAqB,EACrB,QAAgB,EAChB,MAAgB,EAChB,GAAY;IAEZ,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,sEAAsE;IACtE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC;IAC5B,MAAM,OAAO,GACX,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3F,OAAO,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAoBD;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,CAA0D;IACtF,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,SAAqC;IACxE,IAAI,SAAS,KAAK,SAAS,IAAI,gBAAgB,CAAC,SAAS,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3F,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACvE,OAAO,aAAa,CAAC;QACnB,KAAK;QACL,GAAG,CAAC,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC;KACtF,CAAC,CAAC;AACL,CAAC"}

package/dist/effects/A2AEffect.d.ts

@@ -0,0 +1,14 @@
+import type { Effect, EffectContext } from "../types";
+/**
+ * @deprecated ADR 0115 — the `a2a` effect belongs to `@loom/plugin-a2a`, which now defines and
+ * exports its own `A2AEffect`. This copy stays for one minor so existing imports keep working
+ * (a re-export would make this kernel-adjacent package depend on a plugin). `"a2a"` is just a
+ * custom kind to the kernel.
+ */
+export declare class A2AEffect<TIn = unknown, TOut = unknown> implements Effect<TIn, TOut> {
+    private readonly fn;
+    readonly kind: "a2a";
+    constructor(fn: (input: TIn, ctx: EffectContext) => Promise<TOut>);
+    execute(input: TIn, ctx: EffectContext): Promise<TOut>;
+}
+//# sourceMappingURL=A2AEffect.d.ts.map

package/dist/effects/A2AEffect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"A2AEffect.d.ts","sourceRoot":"","sources":["../../src/effects/A2AEffect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,qBAAa,SAAS,CAAC,GAAG,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,CAAE,YAAW,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;IAGpE,OAAO,CAAC,QAAQ,CAAC,EAAE;IAF/B,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;gBAEF,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC;IAElF,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAGvD"}

package/dist/effects/A2AEffect.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.A2AEffect = void 0;
+/**
+ * @deprecated ADR 0115 — the `a2a` effect belongs to `@loom/plugin-a2a`, which now defines and
+ * exports its own `A2AEffect`. This copy stays for one minor so existing imports keep working
+ * (a re-export would make this kernel-adjacent package depend on a plugin). `"a2a"` is just a
+ * custom kind to the kernel.
+ */
+class A2AEffect {
+    fn;
+    kind = "a2a";
+    constructor(fn) {
+        this.fn = fn;
+    }
+    execute(input, ctx) {
+        return this.fn(input, ctx);
+    }
+}
+exports.A2AEffect = A2AEffect;
+//# sourceMappingURL=A2AEffect.js.map

package/dist/effects/A2AEffect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"A2AEffect.js","sourceRoot":"","sources":["../../src/effects/A2AEffect.ts"],"names":[],"mappings":";;;AAEA;;;;;GAKG;AACH,MAAa,SAAS;IAGS;IAFpB,IAAI,GAAG,KAAc,CAAC;IAE/B,YAA6B,EAAqD;QAArD,OAAE,GAAF,EAAE,CAAmD;IAAG,CAAC;IAEtF,OAAO,CAAC,KAAU,EAAE,GAAkB;QACpC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;CACF;AARD,8BAQC"}

package/dist/effects/HumanEffect.d.ts

@@ -0,0 +1,13 @@
+import type { Effect, EffectContext } from "../types";
+export interface HumanEffectConfig {
+    on: string;
+    timeout?: number;
+    correlationKey?: (input: unknown) => string;
+}
+export declare class HumanEffect<TIn = unknown, TOut = unknown> implements Effect<TIn, TOut> {
+    private readonly config;
+    readonly kind: "human";
+    constructor(config: HumanEffectConfig);
+    execute(input: TIn, _ctx: EffectContext): Promise<TOut>;
+}
+//# sourceMappingURL=HumanEffect.d.ts.map

package/dist/effects/HumanEffect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HumanEffect.d.ts","sourceRoot":"","sources":["../../src/effects/HumanEffect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAC;CAC7C;AAED,qBAAa,WAAW,CAAC,GAAG,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,CAAE,YAAW,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;IAGtE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAFnC,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;gBAEJ,MAAM,EAAE,iBAAiB;IAEtD,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAUxD"}

package/dist/effects/HumanEffect.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HumanEffect = void 0;
+const core_1 = require("@loomwork/core");
+class HumanEffect {
+    config;
+    kind = "human";
+    constructor(config) {
+        this.config = config;
+    }
+    execute(input, _ctx) {
+        const correlationKey = this.config.correlationKey !== undefined ? this.config.correlationKey(input) : undefined;
+        throw new core_1.SuspendError({
+            on: this.config.on,
+            ...(this.config.timeout !== undefined && { timeout: this.config.timeout }),
+            ...(correlationKey !== undefined && { correlationKey }),
+        });
+    }
+}
+exports.HumanEffect = HumanEffect;
+//# sourceMappingURL=HumanEffect.js.map

package/dist/effects/HumanEffect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HumanEffect.js","sourceRoot":"","sources":["../../src/effects/HumanEffect.ts"],"names":[],"mappings":";;;AAAA,yCAA8C;AAS9C,MAAa,WAAW;IAGO;IAFpB,IAAI,GAAG,OAAgB,CAAC;IAEjC,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;IAAG,CAAC;IAE1D,OAAO,CAAC,KAAU,EAAE,IAAmB;QACrC,MAAM,cAAc,GAClB,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE3F,MAAM,IAAI,mBAAY,CAAC;YACrB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE;YAClB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1E,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;CACF;AAfD,kCAeC"}

package/dist/effects/LazyEffect.d.ts

@@ -0,0 +1,10 @@
+import type { HandlerSpec } from "@loomwork/core";
+import type { Effect, EffectContext } from "../types";
+export declare class LazyEffect<TIn = unknown, TOut = unknown> implements Effect<TIn, TOut> {
+    private readonly spec;
+    readonly kind: "tool";
+    private resolved;
+    constructor(spec: HandlerSpec<TIn, TOut>);
+    execute(input: TIn, ctx: EffectContext): Promise<TOut>;
+}
+//# sourceMappingURL=LazyEffect.d.ts.map

package/dist/effects/LazyEffect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LazyEffect.d.ts","sourceRoot":"","sources":["../../src/effects/LazyEffect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAwC,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxF,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAMtD,qBAAa,UAAU,CAAC,GAAG,GAAG,OAAO,EAAE,IAAI,GAAG,OAAO,CAAE,YAAW,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;IAIrE,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,IAAI,EAAG,MAAM,CAAU;IAChC,OAAO,CAAC,QAAQ,CAAmC;gBAEtB,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC;IAEnD,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAW7D"}