@mudraid/adapter-node 1.1.0

package/dist/executionBinding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executionBinding.js","sourceRoot":"","sources":["../src/executionBinding.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,aAAa,EAAuC,MAAM,mBAAmB,CAAC;AAUtF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE/G,MAAM,UAAU,aAAa,CAAC,QAAwB,EAAE,MAA4B,EAAE,OAAyB;IAC7G,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAChI,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5I,IAAI,KAAK,GAAG,OAAO,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACtK,MAAM,QAAQ,GAAe;QAC3B,OAAO,EAAE,6BAA6B,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI;QACtF,mBAAmB,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;QAChF,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,wBAAwB,CAAC;QAClG,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,gBAAgB,CAAC;QAC1E,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,kBAAkB,CAAC;QAC7E,cAAc,EAAE,QAAQ,CAAC,OAAO,EAAE,qBAAqB,EAAE,QAAQ,CAAC,MAAM;QACxE,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;KAC7C,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClJ,OAAO,EAAC,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,EAAE;YAC1D,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,cAAc,CAAC;YAC1G,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,WAAW,EAAE,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC;SAChG,EAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAgB;IAC3C,IAAI,IAAI,CAAC,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC"}

package/dist/httpAuthority.d.ts

@@ -0,0 +1,32 @@
+import { type BundleBinding, type VerifiedBundle } from './signedBundle.js';
+import type { DecideResult } from './types.js';
+import { type ExecutionContext } from './executionBinding.js';
+export type InvocationContext = ExecutionContext;
+export interface AuthorityOptions {
+    readonly apiBase: string;
+    readonly adapterToken: string;
+    readonly binding: BundleBinding;
+    readonly timeoutMs?: number;
+    readonly adapterType?: 'node_server_adapter' | 'node_sidecar';
+    readonly fetch?: typeof fetch;
+}
+export declare class HttpAuthority {
+    private readonly base;
+    private readonly token;
+    private readonly binding;
+    private readonly timeout;
+    private readonly adapterType;
+    private readonly fetcher;
+    private current;
+    private lastAccepted;
+    private decisionKeys;
+    private refreshPending;
+    private observed;
+    constructor(options: AuthorityOptions);
+    get bundle(): VerifiedBundle | undefined;
+    private request;
+    /** Single-flight refresh. A failed refresh never activates unverified data. */
+    refresh(): Promise<boolean>;
+    private refreshOnce;
+    decide(toolName: string, context: InvocationContext, snapshot?: VerifiedBundle | undefined): Promise<DecideResult>;
+}

package/dist/httpAuthority.js

@@ -0,0 +1,196 @@
+/** Authenticated, bounded authority transport. No decision or upstream retries. */
+import { randomUUID } from 'node:crypto';
+import { instant, object, verifyBundle, verifyClaims } from './signedBundle.js';
+import { bindExecution } from './executionBinding.js';
+function keyMap(entries) {
+    if (!Array.isArray(entries))
+        throw new Error('Invalid verification key set');
+    const keys = Object.create(null);
+    for (const entry of entries) {
+        const row = object(entry);
+        if (typeof row['key_id'] !== 'string' || typeof row['public_key_pem'] !== 'string' || Object.hasOwn(keys, row['key_id']))
+            throw new Error('Invalid verification key');
+        keys[row['key_id']] = row['public_key_pem'];
+    }
+    return keys;
+}
+export class HttpAuthority {
+    base;
+    token;
+    binding;
+    timeout;
+    adapterType;
+    fetcher;
+    current;
+    lastAccepted;
+    decisionKeys = Object.create(null);
+    refreshPending;
+    observed;
+    constructor(options) {
+        this.base = new URL(options.apiBase);
+        if (this.base.protocol !== 'https:' || this.base.username || this.base.password || this.base.search || this.base.hash || this.base.pathname !== '/')
+            throw new Error('Authority must be an HTTPS origin');
+        if (!options.adapterToken || options.adapterToken.length > 256 || /\s/.test(options.adapterToken))
+            throw new Error('Invalid adapter credential');
+        this.token = options.adapterToken;
+        this.adapterType = options.adapterType ?? 'node_server_adapter';
+        this.binding = Object.freeze({ ...options.binding });
+        this.timeout = options.timeoutMs ?? 5000;
+        if (!Number.isSafeInteger(this.timeout) || this.timeout < 1 || this.timeout > 30000)
+            throw new Error('Invalid authority timeout');
+        this.fetcher = options.fetch ?? globalThis.fetch;
+    }
+    get bundle() {
+        return this.current && this.current.expiresAt > Date.now() ? this.current : undefined;
+    }
+    async request(path, method, body, authenticated = true) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeout);
+        try {
+            const response = await this.fetcher(new URL(`/api/v1/adapter/enforcement/${path}`, this.base), {
+                method, redirect: 'error', signal: controller.signal,
+                headers: { Accept: 'application/json', ...(authenticated ? { Authorization: `Bearer ${this.token}` } : {}), ...(body === undefined ? {} : { 'Content-Type': 'application/json' }) },
+                ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            });
+            if (!response.ok || !response.body)
+                throw new Error('Authority unavailable');
+            const reader = response.body.getReader();
+            const chunks = [];
+            let size = 0;
+            try {
+                while (true) {
+                    const item = await reader.read();
+                    if (item.done)
+                        break;
+                    size += item.value.byteLength;
+                    if (size > 2 * 1024 * 1024)
+                        throw new Error('Authority response too large');
+                    chunks.push(item.value);
+                }
+            }
+            finally {
+                await reader.cancel();
+            }
+            return object(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /** Single-flight refresh. A failed refresh never activates unverified data. */
+    refresh() {
+        if (!this.refreshPending)
+            this.refreshPending = this.refreshOnce().finally(() => { this.refreshPending = undefined; });
+        return this.refreshPending;
+    }
+    async refreshOnce() {
+        try {
+            const heartbeat = await this.request('heartbeat', 'POST');
+            if (heartbeat['platform_id'] !== this.binding.platformId) {
+                this.current = undefined;
+                return false;
+            }
+            const keyResponse = await this.request('keys', 'GET', undefined, false);
+            const bundleKeys = keyMap(keyResponse['keys']);
+            this.decisionKeys = Object.create(null);
+            if (Array.isArray(keyResponse['key_sets'])) {
+                for (const item of keyResponse['key_sets']) {
+                    const set = object(item);
+                    if (set['purpose'] === 'enforcement_decision_signing')
+                        this.decisionKeys = keyMap(set['keys']);
+                }
+            }
+            const served = await this.request('bundle', 'GET');
+            const verified = verifyBundle(served, bundleKeys, this.binding, this.lastAccepted);
+            // Heartbeat attribution is authoritative; a stale advertised bundle is not active.
+            if (heartbeat['desired_bundle_version'] !== verified.version || heartbeat['desired_payload_digest'] !== verified.digest)
+                throw new Error('Desired bundle mismatch');
+            this.current = verified;
+            this.lastAccepted = verified;
+            const now = new Date().toISOString();
+            const observedAt = this.observed?.version === verified.version && this.observed.digest === verified.digest
+                ? this.observed.at : undefined;
+            await this.request('acknowledgements', 'POST', {
+                report_id: randomUUID(), received_version: verified.version, received_at: now,
+                validated_version: verified.version, validated_at: now, active_version: verified.version,
+                active_at: now, bundle_digest: verified.digest,
+                ...(observedAt === undefined ? {} : { first_observed_decision_at: observedAt }),
+            });
+            return true;
+        }
+        catch {
+            // Fail closed until the next verified refresh; do not hide key revocation
+            // behind a cached bundle after an authoritative key-set replacement.
+            this.current = undefined;
+            return false;
+        }
+    }
+    async decide(toolName, context, snapshot = this.bundle) {
+        if (!snapshot || snapshot !== this.bundle)
+            return { status: 'unconfigured' };
+        const mapped = snapshot.actions[toolName];
+        if (!mapped)
+            return { status: 'deny', reason: 'action_unmapped' };
+        if (!context.presentedAuthorization || context.presentedAuthorization.length > 8192)
+            return { status: 'deny', reason: 'credential_missing' };
+        const decisionId = randomUUID();
+        const action = mapped['action_key'];
+        try {
+            const bound = bindExecution(snapshot, mapped, context);
+            const response = await this.request('decide', 'POST', {
+                schema_version: 'mudraid.enforce.decide-request/1', decision_id: decisionId,
+                adapter: { type: this.adapterType, version: '1.1.0' },
+                bundle: { version: snapshot.version, payload_digest: snapshot.digest },
+                surface: snapshot.surface, action: mapped,
+                request: { transport: 'mcp_streamable_http', http_method: context.httpMethod, path: context.path },
+                presented_authorization: context.presentedAuthorization, execution: bound.execution,
+            });
+            if (response['schema_version'] !== '2.0' || response['decision_id'] !== decisionId)
+                throw new Error('Unbound decision');
+            const now = Date.now();
+            const decidedAt = instant(response['decided_at']);
+            if (decidedAt > now + 30000 || now - decidedAt > 60000)
+                throw new Error('Stale decision');
+            if (instant(response['deadline_at']) <= now)
+                throw new Error('Expired decision');
+            // This new runtime always requires signed decisions; there is no downgrade toggle.
+            const signature = object(response['signature']);
+            const claims = object(signature['claims']);
+            const keyId = signature['key_id'];
+            const profile = 'mudraid.decision.signature/1';
+            if (typeof keyId !== 'string' || !Object.hasOwn(this.decisionKeys, keyId) || signature['profile'] !== profile || signature['algorithm'] !== 'RS256' || claims['profile'] !== profile || claims['algorithm'] !== 'RS256' || claims['key_id'] !== keyId)
+                throw new Error('Invalid decision signature');
+            verifyClaims(claims, signature['signature'], this.decisionKeys[keyId]);
+            if (claims['execution_request_digest'] !== bound.digest)
+                throw new Error('Execution binding mismatch');
+            for (const field of ['decision_id', 'decision', 'outcome', 'decided_at', 'deadline_at']) {
+                if ((claims[field] ?? null) !== (response[field] ?? null))
+                    throw new Error('Altered decision');
+            }
+            const reason = object(response['reason']);
+            if (claims['reason_primary'] !== reason['primary'])
+                throw new Error('Altered reason');
+            for (const [field, expected] of Object.entries({ platform_id: this.binding.platformId, environment: this.binding.environment, resource: this.binding.resource, action_key: action, bundle_version: snapshot.version })) {
+                if (claims[field] !== expected)
+                    throw new Error('Decision binding mismatch');
+            }
+            if (instant(claims['not_before']) > now + 30000 || instant(claims['expires_at']) <= now)
+                throw new Error('Invalid decision window');
+            if (snapshot !== this.bundle)
+                throw new Error('Bundle changed during decision');
+            if (response['decision'] !== 'allow' && response['decision'] !== 'deny')
+                throw new Error('Invalid decision outcome');
+            // Observation is a verified decision, not proof that the application
+            // executed it. Report on the next refresh without delaying execution or
+            // replaying a decision. Keep at most one bundle's observation in memory.
+            if (this.observed?.version !== snapshot.version || this.observed.digest !== snapshot.digest) {
+                this.observed = { version: snapshot.version, digest: snapshot.digest, at: new Date(now).toISOString() };
+            }
+            return { status: response['decision'], decisionId, ...(typeof reason['primary'] === 'string' ? { reason: reason['primary'] } : {}) };
+        }
+        catch {
+            return { status: 'error' };
+        }
+    }
+}
+//# sourceMappingURL=httpAuthority.js.map

package/dist/httpAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpAuthority.js","sourceRoot":"","sources":["../src/httpAuthority.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAA4D,MAAM,mBAAmB,CAAC;AAG1I,OAAO,EAAC,aAAa,EAAwB,MAAM,uBAAuB,CAAC;AAW3E,SAAS,MAAM,CAAC,OAAgB;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC7E,MAAM,IAAI,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACtK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,aAAa;IACP,IAAI,CAAM;IACV,KAAK,CAAS;IACd,OAAO,CAAgB;IACvB,OAAO,CAAS;IAChB,WAAW,CAAyC;IACpD,OAAO,CAAe;IAC/B,OAAO,CAA6B;IACpC,YAAY,CAA6B;IACzC,YAAY,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAA+B;IAC7C,QAAQ,CAA4D;IAE5E,YAAY,OAAyB;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC1M,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACjJ,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;QAChE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,OAAO,CAAC,OAAO,EAAC,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClI,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,IAAc,EAAE,aAAa,GAAG,IAAI;QACtF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,+BAA+B,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC7F,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;gBACpD,OAAO,EAAE,EAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAC,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,cAAc,EAAE,kBAAkB,EAAC,CAAC,EAAC;gBAC7K,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAC,CAAC;aAC5D,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBACjC,IAAI,IAAI,CAAC,IAAI;wBAAE,MAAM;oBACrB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;oBAC9B,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;oBAC5E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvH,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACzD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YACxE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC3C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzB,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,8BAA8B;wBAAE,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjG,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACnF,mFAAmF;YACnF,IAAI,SAAS,CAAC,wBAAwB,CAAC,KAAK,QAAQ,CAAC,OAAO,IAAI,SAAS,CAAC,wBAAwB,CAAC,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACpK,IAAI,CAAC,OAAO,GAAG,QAAQ,CAAC;YACxB,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBACxG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACjC,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,MAAM,EAAE;gBAC7C,SAAS,EAAE,UAAU,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG;gBAC7E,iBAAiB,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,cAAc,EAAE,QAAQ,CAAC,OAAO;gBACxF,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM;gBAC9C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,0BAA0B,EAAE,UAAU,EAAC,CAAC;aAC9E,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,OAA0B,EAAE,QAAQ,GAAG,IAAI,CAAC,MAAM;QAC/E,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,EAAC,MAAM,EAAE,cAAc,EAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,OAAO,EAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAC,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,sBAAsB,IAAI,OAAO,CAAC,sBAAsB,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,EAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAC,CAAC;QAC3I,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE;gBACpD,cAAc,EAAE,kCAAkC,EAAE,WAAW,EAAE,UAAU;gBAC3E,OAAO,EAAE,EAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAC;gBACnD,MAAM,EAAE,EAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,EAAC;gBACpE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM;gBACzC,OAAO,EAAE,EAAC,SAAS,EAAE,qBAAqB,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAC;gBAChG,uBAAuB,EAAE,OAAO,CAAC,sBAAsB,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;aACpF,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,gBAAgB,CAAC,KAAK,KAAK,IAAI,QAAQ,CAAC,aAAa,CAAC,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YAClD,IAAI,SAAS,GAAG,GAAG,GAAG,KAAK,IAAI,GAAG,GAAG,SAAS,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC1F,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACjF,mFAAmF;YACnF,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,8BAA8B,CAAC;YAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,OAAO,IAAI,SAAS,CAAC,WAAW,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACrS,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,0BAA0B,CAAC,KAAK,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACvG,KAAK,MAAM,KAAK,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;gBACxF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC,SAAS,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACtF,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,OAAO,EAAC,CAAC,EAAE,CAAC;gBACrN,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,GAAG,GAAG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACpI,IAAI,QAAQ,KAAK,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAChF,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YACrH,qEAAqE;YACrE,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC5F,IAAI,CAAC,QAAQ,GAAG,EAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAC,CAAC;YACxG,CAAC;YACD,OAAO,EAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC;QACnI,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;QAC3B,CAAC;IACH,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@mudraid/adapter-node` — framework-neutral TypeScript/Node server adapter for
+ * MudraID enforcement (EP-120-US-05, first slice).
+ *
+ * Public surface: the typed decision vocabulary, the V2 control loop, and the
+ * injectable `/decide` seam. The framework hooks (Express/Fastify/MCP), the real
+ * HTTP `/decide` client, and live fact extraction are DEFERRED remainders.
+ */
+export { ADAPTER_DECISION_CONTRACT_VERSION, MAX_TOOL_NAME_LEN, RESERVED_HEADER_PREFIX, type AdapterCode, type Decision, type DecideClient, type DecideResult, type DecideStatus, type JsonShape, type Outcome, type ReasonTier, type RequestFacts, type TrustedContextHeader, } from './types.js';
+export { evaluateV2, isReservedHeader, newDecisionId, normalizeStrippedHeaders, shouldForward, validToolName, } from './controlLoop.js';
+export { staticDecideClient, throwingDecideClient } from './decideClient.js';
+export { verifyBundle, type BundleBinding, type VerifiedBundle } from './signedBundle.js';
+export { HttpAuthority, type AuthorityOptions, type InvocationContext } from './httpAuthority.js';

package/dist/index.js

@@ -0,0 +1,14 @@
+/**
+ * `@mudraid/adapter-node` — framework-neutral TypeScript/Node server adapter for
+ * MudraID enforcement (EP-120-US-05, first slice).
+ *
+ * Public surface: the typed decision vocabulary, the V2 control loop, and the
+ * injectable `/decide` seam. The framework hooks (Express/Fastify/MCP), the real
+ * HTTP `/decide` client, and live fact extraction are DEFERRED remainders.
+ */
+export { ADAPTER_DECISION_CONTRACT_VERSION, MAX_TOOL_NAME_LEN, RESERVED_HEADER_PREFIX, } from './types.js';
+export { evaluateV2, isReservedHeader, newDecisionId, normalizeStrippedHeaders, shouldForward, validToolName, } from './controlLoop.js';
+export { staticDecideClient, throwingDecideClient } from './decideClient.js';
+export { verifyBundle } from './signedBundle.js';
+export { HttpAuthority } from './httpAuthority.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,iCAAiC,EACjC,iBAAiB,EACjB,sBAAsB,GAWvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE7E,OAAO,EAAE,YAAY,EAA2C,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAiD,MAAM,oBAAoB,CAAC"}

package/dist/signedBundle.d.ts

@@ -0,0 +1,20 @@
+export type JsonObject = Record<string, unknown>;
+export interface BundleBinding {
+    readonly platformId: string;
+    readonly environment: string;
+    readonly resource: string;
+}
+export interface VerifiedBundle {
+    readonly version: number;
+    readonly digest: string;
+    readonly expiresAt: number;
+    readonly surface: Readonly<JsonObject>;
+    readonly actions: Readonly<Record<string, Readonly<JsonObject>>>;
+}
+export declare function object(value: unknown): JsonObject;
+/** Python sort_keys/ensure_ascii canonicalization used by the authority. */
+export declare function canonicalJson(value: unknown): string;
+export declare function instant(value: unknown): number;
+export declare function verifyClaims(claims: JsonObject, encoded: unknown, pem: unknown): void;
+/** Verify signatures, content, exact tenant binding, time and rollback fencing. */
+export declare function verifyBundle(input: unknown, keys: Readonly<Record<string, string>>, binding: BundleBinding, active?: VerifiedBundle, now?: number): VerifiedBundle;

package/dist/signedBundle.js

@@ -0,0 +1,129 @@
+/** Public-key-only verification of the control plane's signed bundle contract. */
+import { createHash, createPublicKey, verify } from 'node:crypto';
+export function object(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('Invalid object');
+    return value;
+}
+/** Python sort_keys/ensure_ascii canonicalization used by the authority. */
+export function canonicalJson(value) {
+    if (value === null || typeof value === 'boolean')
+        return JSON.stringify(value);
+    if (typeof value === 'number') {
+        if (!Number.isSafeInteger(value))
+            throw new Error('Unsupported canonical number');
+        return JSON.stringify(value);
+    }
+    if (typeof value === 'string') {
+        return JSON.stringify(value).replace(/[\u007f-\uffff]/g, c => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    const record = object(value);
+    // Python compares Unicode code points; JavaScript's default compares UTF-16.
+    const compare = (a, b) => {
+        const aa = Array.from(a, c => c.codePointAt(0));
+        const bb = Array.from(b, c => c.codePointAt(0));
+        for (let i = 0; i < Math.min(aa.length, bb.length); i++) {
+            if (aa[i] !== bb[i])
+                return aa[i] - bb[i];
+        }
+        return aa.length - bb.length;
+    };
+    return `{${Object.keys(record).sort(compare).map(k => `${canonicalJson(k)}:${canonicalJson(record[k])}`).join(',')}}`;
+}
+export function instant(value) {
+    if (typeof value !== 'string' || !/(Z|[+-]\d{2}:\d{2})$/.test(value))
+        throw new Error('Invalid timestamp');
+    const time = Date.parse(value);
+    if (!Number.isFinite(time))
+        throw new Error('Invalid timestamp');
+    return time;
+}
+export function verifyClaims(claims, encoded, pem) {
+    if (typeof encoded !== 'string' || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(encoded) || !encoded)
+        throw new Error('Invalid signature');
+    if (typeof pem !== 'string')
+        throw new Error('Unknown signing key');
+    const key = createPublicKey(pem);
+    if (key.asymmetricKeyType !== 'rsa' || (key.asymmetricKeyDetails?.modulusLength ?? 0) < 2048)
+        throw new Error('Invalid signing key');
+    if (!verify('RSA-SHA256', Buffer.from(canonicalJson(claims)), key, Buffer.from(encoded, 'base64')))
+        throw new Error('Invalid signature');
+}
+function equal(actual, expected) {
+    if (actual !== expected)
+        throw new Error('Bundle binding mismatch');
+}
+function freeze(value) {
+    if (value !== null && typeof value === 'object') {
+        for (const child of Object.values(value))
+            freeze(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+/** Verify signatures, content, exact tenant binding, time and rollback fencing. */
+export function verifyBundle(input, keys, binding, active, now = Date.now()) {
+    const envelope = object(input);
+    const payload = object(envelope['payload']);
+    const claims = object(envelope['signature_claims']);
+    const version = envelope['bundle_version'];
+    if (typeof version !== 'number' || !Number.isSafeInteger(version) || version < 1)
+        throw new Error('Invalid bundle version');
+    equal(envelope['schema_version'], '1.0');
+    equal(payload['schema_version'], '1.0');
+    equal(payload['bundle_version'], version);
+    const digest = createHash('sha256').update(canonicalJson(payload)).digest('hex');
+    equal(envelope['payload_digest'], digest);
+    const keyId = envelope['signature_key_id'];
+    if (typeof keyId !== 'string' || !Object.hasOwn(keys, keyId))
+        throw new Error('Unknown signing key');
+    const profile = 'mudraid.bundle.signature/1';
+    equal(envelope['signature_profile'], profile);
+    equal(envelope['signature_algorithm'], 'RS256');
+    equal(claims['profile'], profile);
+    equal(claims['algorithm'], 'RS256');
+    equal(claims['key_id'], keyId);
+    verifyClaims(claims, envelope['signature_value'], keys[keyId]);
+    equal(claims['payload_digest'], digest);
+    equal(claims['bundle_version'], version);
+    const content = object(payload['content']);
+    const surface = object(content['surface']);
+    for (const [field, expected] of [
+        ['platform_id', binding.platformId], ['environment', binding.environment],
+        ['canonical_resource_uri', binding.resource],
+    ]) {
+        if (!expected.trim())
+            throw new Error('Unbound surface');
+        equal(surface[field], expected);
+        equal(claims[field], expected);
+    }
+    const starts = instant(claims['not_before']);
+    const expires = instant(claims['expires_at']);
+    if (starts > now || expires <= now || expires <= starts)
+        throw new Error('Bundle outside validity window');
+    const evaluation = object(content['evaluation']);
+    for (const [field, expected] of Object.entries({ mode: 'live', on_timeout: 'deny', on_error: 'deny', on_unmapped_action: 'deny', on_stale_bundle: 'deny', forward: 'once', decide_required: true, retry_forwarded_request: false }))
+        equal(evaluation[field], expected);
+    const matcher = object(content['matcher']);
+    equal(matcher['kind'], 'mcp_tool_exact');
+    const entries = matcher['actions'];
+    if (!Array.isArray(entries) || entries.length === 0 || entries.length > 10000)
+        throw new Error('Invalid action map');
+    const actions = Object.create(null);
+    for (const entry of entries) {
+        const action = object(entry);
+        const tool = action['tool_name'];
+        const actionKey = action['action_key'];
+        if (typeof tool !== 'string' || !tool || Buffer.byteLength(tool) > 512 || Object.hasOwn(actions, tool))
+            throw new Error('Invalid or ambiguous tool');
+        if (typeof actionKey !== 'string' || !actionKey || Buffer.byteLength(actionKey) > 512)
+            throw new Error('Invalid action');
+        actions[tool] = JSON.parse(JSON.stringify(action));
+    }
+    if (active && (version < active.version || (version === active.version && digest !== active.digest)))
+        throw new Error('Bundle rollback or conflict');
+    return freeze({ version, digest, expiresAt: expires, surface: JSON.parse(JSON.stringify(surface)), actions });
+}
+//# sourceMappingURL=signedBundle.js.map

package/dist/signedBundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signedBundle.js","sourceRoot":"","sources":["../src/signedBundle.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgBlE,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3G,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,6EAA6E;IAC7E,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE;QAC/C,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACxD,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;QAC9C,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC;IAC/B,CAAC,CAAC;IACF,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AACxH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAkB,EAAE,OAAgB,EAAE,GAAY;IAC7E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,kEAAkE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvK,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,aAAa,IAAI,CAAC,CAAC,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACrI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAC3I,CAAC;AAED,SAAS,KAAK,CAAC,MAAe,EAAE,QAAiB;IAC/C,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,MAAM,CAAI,KAAQ;IACzB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAC1B,KAAc,EAAE,IAAsC,EAAE,OAAsB,EAC9E,MAAuB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEzC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5H,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,KAAK,CAAC,CAAC;IACxC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,4BAA4B,CAAC;IAC7C,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9C,KAAK,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC,CAAC;IAChD,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IACpC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/B,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC;IACxC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI;QAC9B,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC;QACzE,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,CAAC;KACpC,EAAE,CAAC;QACX,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACzD,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9C,IAAI,MAAM,GAAG,GAAG,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IACjD,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAC,CAAC;QAAE,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtQ,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3C,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACrH,MAAM,OAAO,GAAyC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACrJ,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzH,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAe,CAAC;IACnE,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACrJ,OAAO,MAAM,CAAC,EAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAe,EAAE,OAAO,EAAC,CAAC,CAAC;AAC5H,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Typed decision vocabulary for the MudraID Node server adapter.
+ *
+ * These types are the TypeScript mirror of the portable adapter-decision
+ * contract `mudraid.adapter.decision/1`
+ * (`shared/mudraid_contracts/mudraid_contracts/adapters/decision.py`) and of the
+ * Python middleware V2 control loop
+ * (`sdks/mudraid-middleware-python/src/mudraid_middleware/_v2_control_loop.py`).
+ *
+ * The whole point of this adapter is EXACT parity: the same facts must produce
+ * the same outcome + adapter code as the Kong Lua handler and the Python
+ * middleware. So every value here is a closed union — never a bare `string` —
+ * so a divergent code is a compile error, not a silent runtime drift.
+ */
+/** Versioned identifier of the portable contract this adapter reproduces. */
+export declare const ADAPTER_DECISION_CONTRACT_VERSION: "mudraid.adapter.decision/1";
+/** Reserved request-header prefix, stripped before evaluation (contract A03-04). */
+export declare const RESERVED_HEADER_PREFIX: "x-mudraid-";
+/** Bounded canonical action-name length in bytes (matches `MAX_TOOL_NAME_LEN`). */
+export declare const MAX_TOOL_NAME_LEN: 512;
+/** Closed outcome vocabulary — byte-identical to the contract's `OUTCOMES`. */
+export type Outcome = 'allow' | 'deny' | 'not_safely_decided';
+/** Which tier produced the reason: pre-decision framing vs. authorization. */
+export type ReasonTier = 'transport' | 'authorization';
+/** Shape of the parsed request body, as the fact extractor classifies it. */
+export type JsonShape = 'object' | 'array' | 'scalar' | 'not_json';
+/**
+ * Stable, agent-facing adapter error codes. Identical to the codes the Kong Lua
+ * handler and the Python middleware surface, so a Node caller sees the SAME code
+ * for the SAME failure. `null` on an allow / pass-through (nothing to surface).
+ */
+export type AdapterCode = 'ENFORCE_METHOD_NOT_ALLOWED' | 'ENFORCE_BODY_TOO_LARGE' | 'ENFORCE_BODY_UNREADABLE' | 'ENFORCE_MALFORMED_REQUEST' | 'ENFORCE_BATCH_UNSUPPORTED' | 'ENFORCE_MESSAGE_NOT_ALLOWED' | 'ENFORCE_ACTION_UNMAPPED' | 'ENFORCE_NO_VALID_BUNDLE' | 'ENFORCE_DECISION_DENY' | 'ENFORCE_DECIDE_UNAVAILABLE';
+/**
+ * The failure-aware outcome vocabulary a live `/decide` call reports back to the
+ * control loop.
+ *
+ *  - `allow` / `deny` — an authority decision was reached;
+ *  - `timeout` / `error` / `unreachable` / `unconfigured` /
+ *    `credential_unconfigured` — the call could not be completed; every one is
+ *    deny-closed (`not_safely_decided`), never optimistically allowed.
+ */
+export type DecideStatus = 'allow' | 'deny' | 'timeout' | 'error' | 'unreachable' | 'unconfigured' | 'credential_unconfigured';
+/** The outcome of one live `/decide` call, as the adapter sees it. */
+export interface DecideResult {
+    readonly status: DecideStatus;
+    /** A `/decide`-supplied deny reason code (only meaningful on `status: 'deny'`). */
+    readonly reason?: string;
+    /** Correlation id forwarded as trusted context on an allow. */
+    readonly decisionId?: string;
+}
+/**
+ * The injectable `/decide` seam. The control loop invokes it EXACTLY at the
+ * `/decide` branch (a mapped `tools/call` on an active bundle) and nowhere else.
+ * Tests inject a fake so no network is required; the real HTTP client is a
+ * deferred remainder of this story.
+ */
+export type DecideClient = (action: string) => Promise<DecideResult>;
+/**
+ * The normalized facts a single evaluation consumes. Mirrors the portable
+ * contract's decision facts. Fact *extraction* from a live framework request is
+ * a deferred remainder; the decision *tree* lives only in `evaluateV2`, so
+ * extraction and decision never drift into two competing policy copies.
+ */
+export interface RequestFacts {
+    /** Whether this surface is a bundled (protected) MudraID surface. */
+    readonly protected: boolean;
+    /** Reserved `x-mudraid-*` headers the client presented (original case kept). */
+    readonly reservedHeadersPresented?: readonly string[];
+    /** Whether a verified signed bundle is currently active. */
+    readonly bundleActive: boolean;
+    readonly method: string;
+    readonly bodyReadable?: boolean;
+    readonly bodyTooLarge?: boolean;
+    readonly jsonShape?: JsonShape;
+    readonly jsonrpc?: string | null;
+    readonly rpcMethod?: string | null;
+    readonly toolName?: string | null;
+    /** Whether an exact canonical action is mapped for this tool. */
+    readonly actionMapped?: boolean;
+    /** Resolved canonical action name, if distinct from `toolName`. */
+    readonly action?: string | null;
+}
+/** A trusted-context header injected downstream, only on a bound allow. */
+export type TrustedContextHeader = readonly [name: string, value: string];
+/** The normalized outcome of one V2 evaluation. */
+export interface Decision {
+    readonly outcome: Outcome;
+    readonly reasonCode: string;
+    readonly reasonTier: ReasonTier;
+    readonly httpStatus: number;
+    readonly adapterCode: AdapterCode | null;
+    /** Stable agent-facing message; never contains secrets or token material. */
+    readonly message: string;
+    /** Reserved headers stripped from the request before evaluation. */
+    readonly strippedReservedHeaders: readonly string[];
+    /** Injected only on an authorized allow; empty on every pass-through/deny. */
+    readonly trustedContext: readonly TrustedContextHeader[];
+}

package/dist/types.js

@@ -0,0 +1,21 @@
+/**
+ * Typed decision vocabulary for the MudraID Node server adapter.
+ *
+ * These types are the TypeScript mirror of the portable adapter-decision
+ * contract `mudraid.adapter.decision/1`
+ * (`shared/mudraid_contracts/mudraid_contracts/adapters/decision.py`) and of the
+ * Python middleware V2 control loop
+ * (`sdks/mudraid-middleware-python/src/mudraid_middleware/_v2_control_loop.py`).
+ *
+ * The whole point of this adapter is EXACT parity: the same facts must produce
+ * the same outcome + adapter code as the Kong Lua handler and the Python
+ * middleware. So every value here is a closed union — never a bare `string` —
+ * so a divergent code is a compile error, not a silent runtime drift.
+ */
+/** Versioned identifier of the portable contract this adapter reproduces. */
+export const ADAPTER_DECISION_CONTRACT_VERSION = 'mudraid.adapter.decision/1';
+/** Reserved request-header prefix, stripped before evaluation (contract A03-04). */
+export const RESERVED_HEADER_PREFIX = 'x-mudraid-';
+/** Bounded canonical action-name length in bytes (matches `MAX_TOOL_NAME_LEN`). */
+export const MAX_TOOL_NAME_LEN = 512;
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iCAAiC,GAAG,4BAAqC,CAAC;AAEvF,oFAAoF;AACpF,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAqB,CAAC;AAE5D,mFAAmF;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAY,CAAC"}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@mudraid/adapter-node",
+  "version": "1.1.0",
+  "private": false,
+  "description": "Framework-neutral TypeScript/Node server adapter implementing the portable MudraID adapter-decision V2 control loop (EP-120-US-05, first slice).",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@types/node": "20.17.9",
+    "typescript": "5.6.3",
+    "vitest": "2.1.8"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MudraID/mudraid-adapter-node.git"
+  }
+}