@mudraid/sidecar 1.1.1 → 1.1.2

package/README.md

@@ -55,3 +55,15 @@ The image uses a build stage and runs compiled code as the unprivileged Node use
 ## Qualification still pending
 
 Exact body bytes, caller, HTTP target and action/configuration are now bound to the signed decision, and the sidecar forwards its owned authorized snapshot. Trusted business-fact profiles and policy projection remain unimplemented; the runtime must not be represented as proving independent business-state truth or a committed operation. Standalone installed-package checks also do not establish network bypass resistance, containment-channel convergence, graceful drain, chaos/soak behavior or multi-architecture publication. These require their respective runtime evidence before broader support claims.
+
+
+### Authorization expires before forwarding
+
+A verified decision that arrives after its deadline is refused with HTTP 503,
+`ENFORCE_DECIDE_UNAVAILABLE`, and reason `deadline_exceeded`. The message explains
+that authorization expired and this attempt was not forwarded. This differs
+from an unreachable authority; it does not mean that permission was denied.
+The adapter does not automatically retry. A deliberate retry must obtain a fresh
+decision. Use application-level idempotency for operations that could already
+have executed in an earlier attempt; this error makes no claim about those
+other attempts. Never reuse an expired decision or disable expiry validation.

package/dist/build-inputs.json

@@ -2,7 +2,7 @@
   "schema": "mudraid.sidecar.build-inputs/1",
   "bundledCore": {
     "name": "@mudraid/adapter-node",
-    "version": "1.1.1",
+    "version": "1.1.2",
     "license": "Apache-2.0"
   },
   "inputs": [
@@ -36,7 +36,7 @@
     },
     {
       "path": "adapter-node/src/controlLoop.ts",
-      "sha256": "ab76d5f9032564729bd6a3bf7cbd388a3d155cf9986b16e98c5e191beccce5be"
+      "sha256": "e51bdeccd9369006f30a5df6fda3d31aa88d718728143bf4b0d1087ef446040a"
     },
     {
       "path": "adapter-node/src/decideClient.ts",
@@ -48,7 +48,7 @@
     },
     {
       "path": "adapter-node/src/httpAuthority.ts",
-      "sha256": "fea3fdcd0bd0fe736f68dc80c97257f5edac10d10fa1671285fa9e0652d5d090"
+      "sha256": "cdf8f7e18ef8d71d90a88b5dd9cab455b70a6193ded98be84392eca8aa468acb"
     },
     {
       "path": "adapter-node/src/index.ts",
@@ -60,7 +60,7 @@
     },
     {
       "path": "adapter-node/src/types.ts",
-      "sha256": "c3f95641c1a014bde935963a15728473a22a3ae4c2979c5f9b3bfcdac981d444"
+      "sha256": "f2e4f0a1441bb96122c418c0559a6015eb8234a7fb03014027680eacb722fb55"
     }
   ]
 }

package/dist/{chunk-XEUNXTTV.js → chunk-5SXBQNJF.js}

@@ -350,7 +350,7 @@ var HttpAuthority = class {
       const response = await this.request("decide", "POST", {
         schema_version: "mudraid.enforce.decide-request/1",
         decision_id: decisionId,
-        adapter: { type: this.adapterType, version: "1.1.1" },
+        adapter: { type: this.adapterType, version: "1.1.2" },
         bundle: { version: snapshot.version, payload_digest: snapshot.digest },
         // Bundle display metadata is not part of the strict decision contract.
         surface: {
@@ -367,7 +367,7 @@ var HttpAuthority = class {
       const now = Date.now();
       const decidedAt = instant(response["decided_at"]);
       if (decidedAt > now + 3e4 || now - decidedAt > 6e4) throw new Error("Stale decision");
-      if (instant(response["deadline_at"]) <= now) throw new Error("Expired decision");
+      const deadline = instant(response["deadline_at"]);
       const signature = object(response["signature"]);
       const claims = object(signature["claims"]);
       const keyId = signature["key_id"];
@@ -386,6 +386,7 @@ var HttpAuthority = class {
       if (instant(claims["not_before"]) > now + 3e4 || instant(claims["expires_at"]) <= now) throw new Error("Invalid decision window");
       if (snapshot !== this.bundle) throw new Error("Bundle changed during decision");
       if (response["decision"] !== "allow" && response["decision"] !== "deny") throw new Error("Invalid decision outcome");
+      if (deadline <= Date.now()) return { status: "expired" };
       if (this.observed?.version !== snapshot.version || this.observed.digest !== snapshot.digest) {
         this.observed = { version: snapshot.version, digest: snapshot.digest, at: new Date(now).toISOString() };
       }
@@ -409,6 +410,7 @@ var DEFAULT_PUBLIC_METHODS = /* @__PURE__ */ new Set([
   "tools/list"
 ]);
 var DECIDE_UNAVAILABLE_REASONS = {
+  expired: "deadline_exceeded",
   timeout: "deadline_exceeded",
   error: "authority_source_unavailable",
   unreachable: "authority_source_unavailable",
@@ -637,6 +639,17 @@ async function evaluateV2(facts, decide) {
       stripped
     );
   }
+  if (result.status === "expired") {
+    return deny(
+      "deadline_exceeded",
+      "authorization",
+      503,
+      "ENFORCE_DECIDE_UNAVAILABLE",
+      "Authorization expired before this request could be forwarded. This attempt was not forwarded. Obtain fresh authorization before retrying; do not automatically retry operations that may already have executed in another attempt.",
+      stripped,
+      "not_safely_decided"
+    );
+  }
   const reason = DECIDE_UNAVAILABLE_REASONS[result.status] ?? "authority_source_unavailable";
   return deny(
     reason,

package/dist/index.js

@@ -8,7 +8,7 @@ import {
   main,
   staticDecideClient,
   throwingDecideClient
-} from "./chunk-XEUNXTTV.js";
+} from "./chunk-5SXBQNJF.js";
 export {
   DEFAULT_MAX_BODY_BYTES,
   HttpAuthority,

package/dist/server.js

@@ -1,6 +1,6 @@
 import {
   main
-} from "./chunk-XEUNXTTV.js";
+} from "./chunk-5SXBQNJF.js";
 
 // src/cli.ts
 main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mudraid/sidecar",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "private": false,
   "description": "Customer-hosted MudraID enforcement proxy with authenticated configuration and signed decisions.",
   "license": "Apache-2.0",
@@ -21,11 +21,11 @@
     "node": ">=20"
   },
   "devDependencies": {
-    "@types/node": "20.17.9",
-    "tsx": "4.19.2",
+    "@types/node": "20.19.43",
+    "esbuild": "0.28.2",
+    "tsx": "4.23.15",
     "typescript": "5.6.3",
-    "vitest": "2.1.8",
-    "esbuild": "0.23.1"
+    "vitest": "4.1.11"
   },
   "exports": {
     ".": "./dist/index.js"