@mudraid/sidecar 1.1.0 → 1.1.2

package/README.md

@@ -55,3 +55,15 @@ The image uses a build stage and runs compiled code as the unprivileged Node use
 ## Qualification still pending
 
 Exact body bytes, caller, HTTP target and action/configuration are now bound to the signed decision, and the sidecar forwards its owned authorized snapshot. Trusted business-fact profiles and policy projection remain unimplemented; the runtime must not be represented as proving independent business-state truth or a committed operation. Standalone installed-package checks also do not establish network bypass resistance, containment-channel convergence, graceful drain, chaos/soak behavior or multi-architecture publication. These require their respective runtime evidence before broader support claims.
+
+
+### Authorization expires before forwarding
+
+A verified decision that arrives after its deadline is refused with HTTP 503,
+`ENFORCE_DECIDE_UNAVAILABLE`, and reason `deadline_exceeded`. The message explains
+that authorization expired and this attempt was not forwarded. This differs
+from an unreachable authority; it does not mean that permission was denied.
+The adapter does not automatically retry. A deliberate retry must obtain a fresh
+decision. Use application-level idempotency for operations that could already
+have executed in an earlier attempt; this error makes no claim about those
+other attempts. Never reuse an expired decision or disable expiry validation.

package/dist/build-inputs.json

@@ -2,38 +2,10 @@
   "schema": "mudraid.sidecar.build-inputs/1",
   "bundledCore": {
     "name": "@mudraid/adapter-node",
-    "version": "1.1.0",
+    "version": "1.1.2",
     "license": "Apache-2.0"
   },
   "inputs": [
-    {
-      "path": "adapter-node/src/controlLoop.ts",
-      "sha256": "ab76d5f9032564729bd6a3bf7cbd388a3d155cf9986b16e98c5e191beccce5be"
-    },
-    {
-      "path": "adapter-node/src/decideClient.ts",
-      "sha256": "34a649478f14e70a694e34f48df917caf2960addb917840d063ecf0c2b2b42b9"
-    },
-    {
-      "path": "adapter-node/src/executionBinding.ts",
-      "sha256": "46f30a08a1c9816d5aa1fb04851980430f30e67e6a6e3d8134ee98ec935d7df6"
-    },
-    {
-      "path": "adapter-node/src/httpAuthority.ts",
-      "sha256": "9d75be27fd2a74e3ba7700e28ff26e1041262e70a8c621e77ba9d1c55b1efc16"
-    },
-    {
-      "path": "adapter-node/src/index.ts",
-      "sha256": "f13da52bce3d35ef7fe08e2fcbb25c05b2946c987eb59293126b19987cf5b951"
-    },
-    {
-      "path": "adapter-node/src/signedBundle.ts",
-      "sha256": "8a559c9ecfc2f69a392b6334159edc4384bd1c4b7033c53c5c38f9fc41f3c87e"
-    },
-    {
-      "path": "adapter-node/src/types.ts",
-      "sha256": "c3f95641c1a014bde935963a15728473a22a3ae4c2979c5f9b3bfcdac981d444"
-    },
     {
       "path": "src/cli.ts",
       "sha256": "848e7ecbeed33be9e9da3786e1b8a90eb29e62a2bd391a23f57d27710ff37d52"
@@ -61,6 +33,34 @@
     {
       "path": "src/upstream.ts",
       "sha256": "804536cd44cf926fd5415b4bba95d03dfe031b7f00688f275184daf3b802caf8"
+    },
+    {
+      "path": "adapter-node/src/controlLoop.ts",
+      "sha256": "e51bdeccd9369006f30a5df6fda3d31aa88d718728143bf4b0d1087ef446040a"
+    },
+    {
+      "path": "adapter-node/src/decideClient.ts",
+      "sha256": "34a649478f14e70a694e34f48df917caf2960addb917840d063ecf0c2b2b42b9"
+    },
+    {
+      "path": "adapter-node/src/executionBinding.ts",
+      "sha256": "46f30a08a1c9816d5aa1fb04851980430f30e67e6a6e3d8134ee98ec935d7df6"
+    },
+    {
+      "path": "adapter-node/src/httpAuthority.ts",
+      "sha256": "cdf8f7e18ef8d71d90a88b5dd9cab455b70a6193ded98be84392eca8aa468acb"
+    },
+    {
+      "path": "adapter-node/src/index.ts",
+      "sha256": "f13da52bce3d35ef7fe08e2fcbb25c05b2946c987eb59293126b19987cf5b951"
+    },
+    {
+      "path": "adapter-node/src/signedBundle.ts",
+      "sha256": "8a559c9ecfc2f69a392b6334159edc4384bd1c4b7033c53c5c38f9fc41f3c87e"
+    },
+    {
+      "path": "adapter-node/src/types.ts",
+      "sha256": "f2e4f0a1441bb96122c418c0559a6015eb8234a7fb03014027680eacb722fb55"
     }
   ]
 }

package/dist/{chunk-AHPE2F3B.js → chunk-5SXBQNJF.js}

@@ -63,7 +63,7 @@ function buildFacts(inbound, config) {
   };
 }
 
-// ../mudraid-adapter-node/src/decideClient.ts
+// vendor/adapter-node/src/decideClient.ts
 function staticDecideClient(result) {
   return async () => result;
 }
@@ -73,10 +73,10 @@ function throwingDecideClient(error) {
   };
 }
 
-// ../mudraid-adapter-node/src/httpAuthority.ts
+// vendor/adapter-node/src/httpAuthority.ts
 import { randomUUID } from "node:crypto";
 
-// ../mudraid-adapter-node/src/signedBundle.ts
+// vendor/adapter-node/src/signedBundle.ts
 import { createHash, createPublicKey, verify } from "node:crypto";
 function object(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid object");
@@ -181,7 +181,7 @@ function verifyBundle(input, keys, binding, active, now = Date.now()) {
   return freeze({ version, digest, expiresAt: expires, surface: JSON.parse(JSON.stringify(surface)), actions });
 }
 
-// ../mudraid-adapter-node/src/executionBinding.ts
+// vendor/adapter-node/src/executionBinding.ts
 import { createHash as createHash2 } from "node:crypto";
 var sha256 = (bytes) => createHash2("sha256").update(bytes).digest("hex");
 function bindExecution(snapshot, action, context) {
@@ -223,7 +223,7 @@ function boundedArgumentBody(body) {
   return Buffer.from(body).toString("base64");
 }
 
-// ../mudraid-adapter-node/src/httpAuthority.ts
+// vendor/adapter-node/src/httpAuthority.ts
 function keyMap(entries) {
   if (!Array.isArray(entries)) throw new Error("Invalid verification key set");
   const keys = /* @__PURE__ */ Object.create(null);
@@ -350,9 +350,14 @@ var HttpAuthority = class {
       const response = await this.request("decide", "POST", {
         schema_version: "mudraid.enforce.decide-request/1",
         decision_id: decisionId,
-        adapter: { type: this.adapterType, version: "1.1.0" },
+        adapter: { type: this.adapterType, version: "1.1.2" },
         bundle: { version: snapshot.version, payload_digest: snapshot.digest },
-        surface: snapshot.surface,
+        // Bundle display metadata is not part of the strict decision contract.
+        surface: {
+          platform_id: snapshot.surface["platform_id"],
+          environment: snapshot.surface["environment"],
+          canonical_resource_uri: snapshot.surface["canonical_resource_uri"]
+        },
         action: mapped,
         request: { transport: "mcp_streamable_http", http_method: context.httpMethod, path: context.path },
         presented_authorization: context.presentedAuthorization,
@@ -362,7 +367,7 @@ var HttpAuthority = class {
       const now = Date.now();
       const decidedAt = instant(response["decided_at"]);
       if (decidedAt > now + 3e4 || now - decidedAt > 6e4) throw new Error("Stale decision");
-      if (instant(response["deadline_at"]) <= now) throw new Error("Expired decision");
+      const deadline = instant(response["deadline_at"]);
       const signature = object(response["signature"]);
       const claims = object(signature["claims"]);
       const keyId = signature["key_id"];
@@ -381,6 +386,7 @@ var HttpAuthority = class {
       if (instant(claims["not_before"]) > now + 3e4 || instant(claims["expires_at"]) <= now) throw new Error("Invalid decision window");
       if (snapshot !== this.bundle) throw new Error("Bundle changed during decision");
       if (response["decision"] !== "allow" && response["decision"] !== "deny") throw new Error("Invalid decision outcome");
+      if (deadline <= Date.now()) return { status: "expired" };
       if (this.observed?.version !== snapshot.version || this.observed.digest !== snapshot.digest) {
         this.observed = { version: snapshot.version, digest: snapshot.digest, at: new Date(now).toISOString() };
       }
@@ -391,11 +397,11 @@ var HttpAuthority = class {
   }
 };
 
-// ../mudraid-adapter-node/src/types.ts
+// vendor/adapter-node/src/types.ts
 var RESERVED_HEADER_PREFIX = "x-mudraid-";
 var MAX_TOOL_NAME_LEN = 512;
 
-// ../mudraid-adapter-node/src/controlLoop.ts
+// vendor/adapter-node/src/controlLoop.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 var CONTROL_VERBS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS", "DELETE"]);
 var DEFAULT_PUBLIC_METHODS = /* @__PURE__ */ new Set([
@@ -404,6 +410,7 @@ var DEFAULT_PUBLIC_METHODS = /* @__PURE__ */ new Set([
   "tools/list"
 ]);
 var DECIDE_UNAVAILABLE_REASONS = {
+  expired: "deadline_exceeded",
   timeout: "deadline_exceeded",
   error: "authority_source_unavailable",
   unreachable: "authority_source_unavailable",
@@ -632,6 +639,17 @@ async function evaluateV2(facts, decide) {
       stripped
     );
   }
+  if (result.status === "expired") {
+    return deny(
+      "deadline_exceeded",
+      "authorization",
+      503,
+      "ENFORCE_DECIDE_UNAVAILABLE",
+      "Authorization expired before this request could be forwarded. This attempt was not forwarded. Obtain fresh authorization before retrying; do not automatically retry operations that may already have executed in another attempt.",
+      stripped,
+      "not_safely_decided"
+    );
+  }
   const reason = DECIDE_UNAVAILABLE_REASONS[result.status] ?? "authority_source_unavailable";
   return deny(
     reason,

package/dist/index.js

@@ -8,7 +8,7 @@ import {
   main,
   staticDecideClient,
   throwingDecideClient
-} from "./chunk-AHPE2F3B.js";
+} from "./chunk-5SXBQNJF.js";
 export {
   DEFAULT_MAX_BODY_BYTES,
   HttpAuthority,

package/dist/server.js

@@ -1,6 +1,6 @@
 import {
   main
-} from "./chunk-AHPE2F3B.js";
+} from "./chunk-5SXBQNJF.js";
 
 // src/cli.ts
 main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mudraid/sidecar",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "private": false,
   "description": "Customer-hosted MudraID enforcement proxy with authenticated configuration and signed decisions.",
   "license": "Apache-2.0",
@@ -21,11 +21,11 @@
     "node": ">=20"
   },
   "devDependencies": {
-    "@types/node": "20.17.9",
-    "tsx": "4.19.2",
+    "@types/node": "20.19.43",
+    "esbuild": "0.28.2",
+    "tsx": "4.23.15",
     "typescript": "5.6.3",
-    "vitest": "2.1.8",
-    "esbuild": "0.23.1"
+    "vitest": "4.1.11"
   },
   "exports": {
     ".": "./dist/index.js"