@nboconnect/connect 0.1.0

package/dist/runtimeTokenReleaseGate.js

@@ -0,0 +1,115 @@
+import { evaluateConnectRuntimeTokenShadowV1, } from './runtimeTokenShadow.js';
+import { replayConnectRuntimeTokenShadowV1, } from './runtimeTokenReplay.js';
+import { requestConnectRuntimeTokenShadowV1 } from './runtimeTokenRequest.js';
+function stableSerialize(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableSerialize).join(',')}]`;
+    return `{${Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => `${JSON.stringify(key)}:${stableSerialize(entry)}`)
+        .join(',')}}`;
+}
+function sameJson(left, right) {
+    return stableSerialize(left) === stableSerialize(right);
+}
+function mask(value) {
+    if (value.length <= 8)
+        return 'masked:opaque';
+    return `masked:${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function buildReplayFixture(releaseCase, evaluated, requested) {
+    return {
+        schemaVersion: 'nbo.connect.runtime_token_replay_fixture.v1',
+        fixtureId: `release:${releaseCase.caseId}`,
+        request: releaseCase.request,
+        expected: {
+            registryVersion: releaseCase.request.catalog.registryVersion,
+            wouldAuthorize: evaluated.wouldAuthorize,
+            denialCodes: evaluated.denialCodes,
+            missingApprovals: requested.missingApprovals,
+            blockedLiveValueGates: requested.blockedLiveValueGates,
+            dashboard: releaseCase.dashboard,
+        },
+        persisted: releaseCase.persisted,
+    };
+}
+function requestCreated(evaluated, requested) {
+    return requested.mode === 'shadow_request'
+        && requested.wouldAllow === evaluated.wouldAuthorize
+        && sameJson(requested.reviewPacket.denialCodes, evaluated.denialCodes)
+        && requested.reviewPacket.humanApprovalRequired
+        && requested.tokenIssued === false
+        && requested.acceptedForAuthentication === false
+        && (requested.proposedTokenEnvelope === null
+            || (requested.proposedTokenEnvelope.tokenIssued === false
+                && requested.proposedTokenEnvelope.usableForAuthentication === false));
+}
+function persistenceConsistent(releaseCase, evaluated) {
+    return releaseCase.persisted.auditRef.length > 0
+        && releaseCase.persisted.organizationId === releaseCase.request.organizationId
+        && releaseCase.persisted.nodeId === releaseCase.request.nodeId
+        && releaseCase.persisted.decision === (evaluated.wouldAuthorize ? 'would_allow' : 'would_deny');
+}
+function safetyConsistent(requested, replay) {
+    return requested.tokenIssued === false
+        && requested.acceptedForAuthentication === false
+        && replay.safety.tokenIssued === false
+        && replay.safety.acceptedForAuthentication === false
+        && replay.safety.liveValueActionAttempted === false
+        && replay.safety.rawClaimsExposed === false;
+}
+export function runConnectRuntimeTokenShadowReleaseGateV1(fixture) {
+    if (fixture.schemaVersion !== 'nbo.connect.runtime_token_shadow_release_fixture.v1') {
+        throw new Error('CONNECT_RUNTIME_TOKEN_SHADOW_RELEASE_FIXTURE_SCHEMA_INVALID');
+    }
+    if (fixture.cases.length < 2) {
+        throw new Error('CONNECT_RUNTIME_TOKEN_SHADOW_RELEASE_REQUIRES_ALLOW_AND_DENY_CASES');
+    }
+    const cases = fixture.cases.map((releaseCase) => {
+        const evaluated = evaluateConnectRuntimeTokenShadowV1(releaseCase.request);
+        const requested = requestConnectRuntimeTokenShadowV1(releaseCase.request);
+        const replay = replayConnectRuntimeTokenShadowV1(buildReplayFixture(releaseCase, evaluated, requested));
+        const requestWasCreated = requestCreated(evaluated, requested);
+        const persisted = persistenceConsistent(releaseCase, evaluated);
+        const dashboard = replay.checks.dashboardProjectionConsistent;
+        const safe = safetyConsistent(requested, replay);
+        return {
+            caseId: releaseCase.caseId,
+            decision: evaluated.wouldAuthorize ? 'would_allow' : 'would_deny',
+            denialCodes: evaluated.denialCodes,
+            requestDigest: replay.requestDigest,
+            decisionDigest: replay.decisionDigest,
+            maskedAuditRef: mask(releaseCase.persisted.auditRef),
+            checks: {
+                requestCreated: requestWasCreated,
+                persistenceConsistent: persisted,
+                dashboardProjectionConsistent: dashboard,
+                replayConsistent: replay.ok,
+                safetyConsistent: safe,
+            },
+        };
+    });
+    const allowCaseCount = cases.filter((item) => item.decision === 'would_allow').length;
+    const denyCaseCount = cases.filter((item) => item.decision === 'would_deny').length;
+    const ok = allowCaseCount > 0 && denyCaseCount > 0
+        && cases.every((item) => Object.values(item.checks).every(Boolean));
+    return {
+        schemaVersion: 'nbo.connect.runtime_token_shadow_release_proof.v1',
+        mode: 'release_gate',
+        ok,
+        caseCount: cases.length,
+        allowCaseCount,
+        denyCaseCount,
+        cases,
+        safety: {
+            tokenIssued: false,
+            acceptedForAuthentication: false,
+            liveValueActionAttempted: false,
+            rawClaimsExposed: false,
+        },
+    };
+}
+//# sourceMappingURL=runtimeTokenReleaseGate.js.map

package/dist/runtimeTokenReleaseGate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeTokenReleaseGate.js","sourceRoot":"","sources":["../src/runtimeTokenReleaseGate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,GAGpC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iCAAiC,GAGlC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kCAAkC,EAAE,MAAM,0BAA0B,CAAC;AA4C9E,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SACxD,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;SACzE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAc;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC9C,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,kBAAkB,CACzB,WAAmD,EACnD,SAA4C,EAC5C,SAAgE;IAEhE,OAAO;QACL,aAAa,EAAE,6CAA6C;QAC5D,SAAS,EAAE,WAAW,WAAW,CAAC,MAAM,EAAE;QAC1C,OAAO,EAAE,WAAW,CAAC,OAAO;QAC5B,QAAQ,EAAE;YACR,eAAe,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe;YAC5D,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;YAC5C,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;YACtD,SAAS,EAAE,WAAW,CAAC,SAAS;SACjC;QACD,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,SAA4C,EAC5C,SAAgE;IAEhE,OAAO,SAAS,CAAC,IAAI,KAAK,gBAAgB;WACrC,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,cAAc;WACjD,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC;WACnE,SAAS,CAAC,YAAY,CAAC,qBAAqB;WAC5C,SAAS,CAAC,WAAW,KAAK,KAAK;WAC/B,SAAS,CAAC,yBAAyB,KAAK,KAAK;WAC7C,CAAC,SAAS,CAAC,qBAAqB,KAAK,IAAI;eACvC,CAAC,SAAS,CAAC,qBAAqB,CAAC,WAAW,KAAK,KAAK;mBACpD,SAAS,CAAC,qBAAqB,CAAC,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,qBAAqB,CAC5B,WAAmD,EACnD,SAA4C;IAE5C,OAAO,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;WAC3C,WAAW,CAAC,SAAS,CAAC,cAAc,KAAK,WAAW,CAAC,OAAO,CAAC,cAAc;WAC3E,WAAW,CAAC,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,OAAO,CAAC,MAAM;WAC3D,WAAW,CAAC,SAAS,CAAC,QAAQ,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAgE,EAChE,MAAwC;IAExC,OAAO,SAAS,CAAC,WAAW,KAAK,KAAK;WACjC,SAAS,CAAC,yBAAyB,KAAK,KAAK;WAC7C,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK;WACnC,MAAM,CAAC,MAAM,CAAC,yBAAyB,KAAK,KAAK;WACjD,MAAM,CAAC,MAAM,CAAC,wBAAwB,KAAK,KAAK;WAChD,MAAM,CAAC,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,OAAkD;IAElD,IAAI,OAAO,CAAC,aAAa,KAAK,qDAAqD,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QAC9C,MAAM,SAAS,GAAG,mCAAmC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,SAAS,GAAG,kCAAkC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,iCAAiC,CAC9C,kBAAkB,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CACtD,CAAC;QACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC;QAC9D,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO;YACL,MAAM,EAAE,WAAW,CAAC,MAAM;YAC1B,QAAQ,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,aAAsB,CAAC,CAAC,CAAC,YAAqB;YACnF,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC;YACpD,MAAM,EAAE;gBACN,cAAc,EAAE,iBAAiB;gBACjC,qBAAqB,EAAE,SAAS;gBAChC,6BAA6B,EAAE,SAAS;gBACxC,gBAAgB,EAAE,MAAM,CAAC,EAAE;gBAC3B,gBAAgB,EAAE,IAAI;aACvB;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,MAAM,CAAC;IACtF,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,MAAM,CAAC;IACpF,MAAM,EAAE,GAAG,cAAc,GAAG,CAAC,IAAI,aAAa,GAAG,CAAC;WAC7C,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEtE,OAAO;QACL,aAAa,EAAE,mDAAmD;QAClE,IAAI,EAAE,cAAc;QACpB,EAAE;QACF,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,cAAc;QACd,aAAa;QACb,KAAK;QACL,MAAM,EAAE;YACN,WAAW,EAAE,KAAK;YAClB,yBAAyB,EAAE,KAAK;YAChC,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,KAAK;SACxB;KACF,CAAC;AACJ,CAAC"}

package/dist/runtimeTokenReplay.d.ts

@@ -0,0 +1,56 @@
+import { type ConnectRuntimeTokenShadowDenialCodeV1, type ConnectRuntimeTokenShadowRequestV1, type ConnectRuntimeTokenShadowResultV1 } from './runtimeTokenShadow.js';
+export type ConnectRuntimeTokenReplayFixtureV1 = {
+    schemaVersion: 'nbo.connect.runtime_token_replay_fixture.v1';
+    fixtureId: string;
+    request: ConnectRuntimeTokenShadowRequestV1;
+    expected: {
+        registryVersion: string;
+        wouldAuthorize: boolean;
+        denialCodes: ConnectRuntimeTokenShadowDenialCodeV1[];
+        missingApprovals: string[];
+        blockedLiveValueGates: string[];
+        dashboard: ConnectRuntimeTokenShadowResultV1['dashboard'];
+    };
+    persisted: {
+        auditRef: string;
+        organizationId: string;
+        nodeId: string;
+        decision: 'would_allow' | 'would_deny';
+    };
+};
+export type ConnectRuntimeTokenReplayProofV1 = {
+    schemaVersion: 'nbo.connect.runtime_token_replay_proof.v1';
+    mode: 'replay_only';
+    fixtureId: string;
+    ok: boolean;
+    environment: 'sandbox';
+    registryVersion: string;
+    requestDigest: string;
+    decisionDigest: string;
+    decision: 'would_allow' | 'would_deny';
+    denialCodes: ConnectRuntimeTokenShadowDenialCodeV1[];
+    maskedBindings: {
+        organizationId: string;
+        nodeId: string;
+        persona: string;
+        capabilityId: string;
+        actionId: string;
+        scope: string;
+    };
+    checks: {
+        registryVersionConsistent: boolean;
+        bindingsConsistent: boolean;
+        decisionConsistent: boolean;
+        gatesConsistent: boolean;
+        auditReferenceConsistent: boolean;
+        dashboardProjectionConsistent: boolean;
+    };
+    safety: {
+        tokenIssued: false;
+        acceptedForAuthentication: false;
+        liveValueActionAttempted: false;
+        rawClaimsExposed: false;
+    };
+};
+export declare function replayConnectRuntimeTokenShadowV1(fixture: ConnectRuntimeTokenReplayFixtureV1): ConnectRuntimeTokenReplayProofV1;
+//# sourceMappingURL=runtimeTokenReplay.d.ts.map

package/dist/runtimeTokenReplay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeTokenReplay.d.ts","sourceRoot":"","sources":["../src/runtimeTokenReplay.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,qCAAqC,EAC1C,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACvC,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,kCAAkC,GAAG;IAC/C,aAAa,EAAE,6CAA6C,CAAC;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,kCAAkC,CAAC;IAC5C,QAAQ,EAAE;QACR,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,EAAE,OAAO,CAAC;QACxB,WAAW,EAAE,qCAAqC,EAAE,CAAC;QACrD,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;QAChC,SAAS,EAAE,iCAAiC,CAAC,WAAW,CAAC,CAAC;KAC3D,CAAC;IACF,SAAS,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,aAAa,GAAG,YAAY,CAAC;KACxC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,gCAAgC,GAAG;IAC7C,aAAa,EAAE,2CAA2C,CAAC;IAC3D,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,EAAE,SAAS,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,aAAa,GAAG,YAAY,CAAC;IACvC,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACrD,cAAc,EAAE;QACd,cAAc,EAAE,MAAM,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,MAAM,EAAE;QACN,yBAAyB,EAAE,OAAO,CAAC;QACnC,kBAAkB,EAAE,OAAO,CAAC;QAC5B,kBAAkB,EAAE,OAAO,CAAC;QAC5B,eAAe,EAAE,OAAO,CAAC;QACzB,wBAAwB,EAAE,OAAO,CAAC;QAClC,6BAA6B,EAAE,OAAO,CAAC;KACxC,CAAC;IACF,MAAM,EAAE;QACN,WAAW,EAAE,KAAK,CAAC;QACnB,yBAAyB,EAAE,KAAK,CAAC;QACjC,wBAAwB,EAAE,KAAK,CAAC;QAChC,gBAAgB,EAAE,KAAK,CAAC;KACzB,CAAC;CACH,CAAC;AAqDF,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,gCAAgC,CAqFlC"}

package/dist/runtimeTokenReplay.js

@@ -0,0 +1,137 @@
+import { createHash } from 'node:crypto';
+import { evaluateConnectRuntimeTokenShadowV1, } from './runtimeTokenShadow.js';
+function stableSerialize(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableSerialize).join(',')}]`;
+    const entries = Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .sort(([left], [right]) => left.localeCompare(right));
+    return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableSerialize(entry)}`).join(',')}}`;
+}
+function digest(value) {
+    return `sha256:${createHash('sha256').update(stableSerialize(value)).digest('hex')}`;
+}
+function mask(value) {
+    if (value.length <= 8)
+        return 'masked:opaque';
+    return `masked:${value.slice(0, 4)}...${value.slice(-4)}`;
+}
+function deriveMissingApprovals(result) {
+    const approvals = ['human_or_connector_authorization_review'];
+    if (result.denialCodes.includes('AUTHORIZATION_WITHDRAWN'))
+        approvals.push('authorization_restoration');
+    if (result.denialCodes.includes('REGISTRY_VERSION_MISMATCH'))
+        approvals.push('capability_registry_sync');
+    if (result.denialCodes.includes('TOKEN_REVOKED') || result.denialCodes.includes('TOKEN_REPLAYED')) {
+        approvals.push('new_single_use_request_review');
+    }
+    return approvals;
+}
+function deriveBlockedGates(result) {
+    return result.denialCodes.includes('LIVE_VALUE_ACTION_BLOCKED')
+        ? ['production_live_value_gates_disabled']
+        : [];
+}
+function sameJson(left, right) {
+    return stableSerialize(left) === stableSerialize(right);
+}
+function assertFixtureShape(fixture) {
+    if (fixture.schemaVersion !== 'nbo.connect.runtime_token_replay_fixture.v1') {
+        throw new Error('CONNECT_RUNTIME_TOKEN_REPLAY_FIXTURE_SCHEMA_INVALID');
+    }
+    if (!fixture.fixtureId || fixture.request.environment !== 'sandbox') {
+        throw new Error('CONNECT_RUNTIME_TOKEN_REPLAY_FIXTURE_SANDBOX_ONLY');
+    }
+    if (fixture.request.claims.registryVersion !== fixture.request.catalog.registryVersion
+        || fixture.request.catalog.registryVersion !== fixture.expected.registryVersion) {
+        throw new Error('CONNECT_RUNTIME_TOKEN_REPLAY_REGISTRY_VERSION_MISMATCH');
+    }
+}
+export function replayConnectRuntimeTokenShadowV1(fixture) {
+    assertFixtureShape(fixture);
+    const result = evaluateConnectRuntimeTokenShadowV1(fixture.request);
+    const request = fixture.request;
+    const expected = fixture.expected;
+    const dashboard = result.dashboard;
+    const registryVersionConsistent = request.claims.registryVersion === request.catalog.registryVersion
+        && expected.registryVersion === request.catalog.registryVersion;
+    const bindingsConsistent = [
+        [dashboard.organizationId, request.organizationId],
+        [dashboard.nodeId, request.nodeId],
+        [dashboard.persona, request.persona],
+        [dashboard.capabilityId, request.capabilityId],
+        [dashboard.actionId, request.actionId],
+        [dashboard.scope, request.scope],
+    ].every(([actual, expectedValue]) => actual === expectedValue);
+    const decisionConsistent = result.wouldAuthorize === expected.wouldAuthorize
+        && sameJson(result.denialCodes, expected.denialCodes);
+    const gatesConsistent = sameJson(deriveMissingApprovals(result), expected.missingApprovals)
+        && sameJson(deriveBlockedGates(result), expected.blockedLiveValueGates);
+    const auditReferenceConsistent = fixture.persisted.auditRef.length > 0
+        && fixture.persisted.organizationId === request.organizationId
+        && fixture.persisted.nodeId === request.nodeId
+        && fixture.persisted.decision === (result.wouldAuthorize ? 'would_allow' : 'would_deny');
+    const dashboardProjectionConsistent = sameJson({
+        ...dashboard,
+        tokenRef: undefined,
+        auditRef: undefined,
+    }, {
+        ...expected.dashboard,
+        tokenRef: undefined,
+        auditRef: undefined,
+    });
+    const decision = result.wouldAuthorize ? 'would_allow' : 'would_deny';
+    const decisionDigest = digest({
+        registryVersion: request.catalog.registryVersion,
+        wouldAuthorize: result.wouldAuthorize,
+        denialCodes: result.denialCodes,
+        bindings: {
+            organizationId: request.organizationId,
+            nodeId: request.nodeId,
+            persona: request.persona,
+            capabilityId: request.capabilityId,
+            actionId: request.actionId,
+            scope: request.scope,
+        },
+        missingApprovals: deriveMissingApprovals(result),
+        blockedLiveValueGates: deriveBlockedGates(result),
+    });
+    return {
+        schemaVersion: 'nbo.connect.runtime_token_replay_proof.v1',
+        mode: 'replay_only',
+        fixtureId: fixture.fixtureId,
+        ok: registryVersionConsistent && bindingsConsistent && decisionConsistent && gatesConsistent
+            && auditReferenceConsistent && dashboardProjectionConsistent,
+        environment: 'sandbox',
+        registryVersion: request.catalog.registryVersion,
+        requestDigest: digest(request),
+        decisionDigest,
+        decision,
+        denialCodes: result.denialCodes,
+        maskedBindings: {
+            organizationId: mask(request.organizationId),
+            nodeId: mask(request.nodeId),
+            persona: mask(request.persona),
+            capabilityId: mask(request.capabilityId),
+            actionId: mask(request.actionId),
+            scope: mask(request.scope),
+        },
+        checks: {
+            registryVersionConsistent,
+            bindingsConsistent,
+            decisionConsistent,
+            gatesConsistent,
+            auditReferenceConsistent,
+            dashboardProjectionConsistent,
+        },
+        safety: {
+            tokenIssued: false,
+            acceptedForAuthentication: false,
+            liveValueActionAttempted: false,
+            rawClaimsExposed: false,
+        },
+    };
+}
+//# sourceMappingURL=runtimeTokenReplay.js.map

package/dist/runtimeTokenReplay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeTokenReplay.js","sourceRoot":"","sources":["../src/runtimeTokenReplay.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,mCAAmC,GAIpC,MAAM,yBAAyB,CAAC;AAyDjC,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;SAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC5G,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,IAAI,CAAC,KAAa;IACzB,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC9C,OAAO,UAAU,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAyC;IACvE,MAAM,SAAS,GAAG,CAAC,yCAAyC,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzG,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClG,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAyC;IACnE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC7D,CAAC,CAAC,CAAC,sCAAsC,CAAC;QAC1C,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAc;IAC7C,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA2C;IACrE,IAAI,OAAO,CAAC,aAAa,KAAK,6CAA6C,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe;WACjF,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,OAA2C;IAE3C,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,mCAAmC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,yBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,eAAe;WAC/F,QAAQ,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;IAClE,MAAM,kBAAkB,GAAG;QACzB,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC;QAClD,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC;QAClC,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC;QACpC,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC;QAC9C,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC;QACtC,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;KACjC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC;IAC/D,MAAM,kBAAkB,GAAG,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;WACvE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,QAAQ,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC;WACtF,QAAQ,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC1E,MAAM,wBAAwB,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;WACjE,OAAO,CAAC,SAAS,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;WAC3D,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;WAC3C,OAAO,CAAC,SAAS,CAAC,QAAQ,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC3F,MAAM,6BAA6B,GAAG,QAAQ,CAAC;QAC7C,GAAG,SAAS;QACZ,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,SAAS;KACpB,EAAE;QACD,GAAG,QAAQ,CAAC,SAAS;QACrB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,SAAS;KACpB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC;IACtE,MAAM,cAAc,GAAG,MAAM,CAAC;QAC5B,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;QAChD,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE;YACR,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB;QACD,gBAAgB,EAAE,sBAAsB,CAAC,MAAM,CAAC;QAChD,qBAAqB,EAAE,kBAAkB,CAAC,MAAM,CAAC;KAClD,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE,2CAA2C;QAC1D,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,EAAE,EAAE,yBAAyB,IAAI,kBAAkB,IAAI,kBAAkB,IAAI,eAAe;eACvF,wBAAwB,IAAI,6BAA6B;QAC9D,WAAW,EAAE,SAAS;QACtB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;QAChD,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC;QAC9B,cAAc;QACd,QAAQ;QACR,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE;YACd,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5B,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YACxC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAChC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;SAC3B;QACD,MAAM,EAAE;YACN,yBAAyB;YACzB,kBAAkB;YAClB,kBAAkB;YAClB,eAAe;YACf,wBAAwB;YACxB,6BAA6B;SAC9B;QACD,MAAM,EAAE;YACN,WAAW,EAAE,KAAK;YAClB,yBAAyB,EAAE,KAAK;YAChC,wBAAwB,EAAE,KAAK;YAC/B,gBAAgB,EAAE,KAAK;SACxB;KACF,CAAC;AACJ,CAAC"}

package/dist/runtimeTokenRequest.d.ts

@@ -0,0 +1,50 @@
+import { type ConnectRuntimeTokenShadowRequestV1, type ConnectRuntimeTokenShadowResultV1 } from './runtimeTokenShadow.js';
+export type ConnectRuntimeTokenProposedEnvelopeV1 = {
+    envelopeType: 'proposed_connect_action';
+    tokenType: 'connect_action';
+    environment: 'sandbox';
+    organizationId: string;
+    nodeId: string;
+    persona: string;
+    capabilityId: string;
+    actionId: string;
+    scope: string;
+    proposedLifetimeSeconds: 300;
+    proposedExpiresAt: string;
+    tokenIssued: false;
+    usableForAuthentication: false;
+};
+export type ConnectRuntimeTokenRequestReviewPacketV1 = {
+    packetId: string;
+    packetType: 'runtime_token_request_review';
+    humanApprovalRequired: true;
+    decision: 'would_allow' | 'would_deny';
+    organizationId: string;
+    nodeId: string;
+    persona: string;
+    capabilityId: string;
+    actionId: string;
+    scope: string;
+    proposedExpiresAt: string;
+    reason: string;
+    missingApprovals: string[];
+    blockedLiveValueGates: string[];
+    denialCodes: ConnectRuntimeTokenShadowResultV1['denialCodes'];
+};
+export type ConnectRuntimeTokenRequestResultV1 = {
+    schemaVersion: 'nbo.connect.runtime_token_request.v1';
+    requestId: string;
+    mode: 'shadow_request';
+    wouldAllow: boolean;
+    reason: string;
+    missingApprovals: string[];
+    blockedLiveValueGates: string[];
+    proposedExpiresAt: string;
+    auditRef: string;
+    reviewPacket: ConnectRuntimeTokenRequestReviewPacketV1;
+    proposedTokenEnvelope: ConnectRuntimeTokenProposedEnvelopeV1 | null;
+    tokenIssued: false;
+    acceptedForAuthentication: false;
+};
+export declare function requestConnectRuntimeTokenShadowV1(request: ConnectRuntimeTokenShadowRequestV1): ConnectRuntimeTokenRequestResultV1;
+//# sourceMappingURL=runtimeTokenRequest.d.ts.map

package/dist/runtimeTokenRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeTokenRequest.d.ts","sourceRoot":"","sources":["../src/runtimeTokenRequest.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EACvC,MAAM,yBAAyB,CAAC;AAEjC,MAAM,MAAM,qCAAqC,GAAG;IAClD,YAAY,EAAE,yBAAyB,CAAC;IACxC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,SAAS,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB,EAAE,GAAG,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,KAAK,CAAC;IACnB,uBAAuB,EAAE,KAAK,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,wCAAwC,GAAG;IACrD,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,8BAA8B,CAAC;IAC3C,qBAAqB,EAAE,IAAI,CAAC;IAC5B,QAAQ,EAAE,aAAa,GAAG,YAAY,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,WAAW,EAAE,iCAAiC,CAAC,aAAa,CAAC,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,aAAa,EAAE,sCAAsC,CAAC;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,gBAAgB,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,wCAAwC,CAAC;IACvD,qBAAqB,EAAE,qCAAqC,GAAG,IAAI,CAAC;IACpE,WAAW,EAAE,KAAK,CAAC;IACnB,yBAAyB,EAAE,KAAK,CAAC;CAClC,CAAC;AA0BF,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,kCAAkC,GAC1C,kCAAkC,CAwDpC"}

package/dist/runtimeTokenRequest.js

@@ -0,0 +1,79 @@
+import { randomUUID } from 'node:crypto';
+import { evaluateConnectRuntimeTokenShadowV1, } from './runtimeTokenShadow.js';
+const PROPOSED_LIFETIME_SECONDS = 300;
+function getMissingApprovals(result) {
+    const approvals = ['human_or_connector_authorization_review'];
+    if (result.denialCodes.includes('AUTHORIZATION_WITHDRAWN'))
+        approvals.push('authorization_restoration');
+    if (result.denialCodes.includes('REGISTRY_VERSION_MISMATCH'))
+        approvals.push('capability_registry_sync');
+    if (result.denialCodes.includes('TOKEN_REVOKED') || result.denialCodes.includes('TOKEN_REPLAYED')) {
+        approvals.push('new_single_use_request_review');
+    }
+    return approvals;
+}
+function getBlockedLiveValueGates(result) {
+    return result.denialCodes.includes('LIVE_VALUE_ACTION_BLOCKED')
+        ? ['production_live_value_gates_disabled']
+        : [];
+}
+function getReason(result) {
+    return result.wouldAuthorize
+        ? 'Shadow policy would allow this bounded sandbox action; human or connector authorization is still required and no token is issued.'
+        : `Shadow policy denied this request: ${result.denialCodes.join(', ')}.`;
+}
+export function requestConnectRuntimeTokenShadowV1(request) {
+    const result = evaluateConnectRuntimeTokenShadowV1(request);
+    const requestId = randomUUID();
+    const proposedExpiresAt = new Date((request.nowSeconds + PROPOSED_LIFETIME_SECONDS) * 1000).toISOString();
+    const reason = getReason(result);
+    const missingApprovals = getMissingApprovals(result);
+    const blockedLiveValueGates = getBlockedLiveValueGates(result);
+    const reviewPacket = {
+        packetId: `runtime-token-request:${requestId}`,
+        packetType: 'runtime_token_request_review',
+        humanApprovalRequired: true,
+        decision: result.wouldAuthorize ? 'would_allow' : 'would_deny',
+        organizationId: request.organizationId,
+        nodeId: request.nodeId,
+        persona: request.persona,
+        capabilityId: request.capabilityId,
+        actionId: request.actionId,
+        scope: request.scope,
+        proposedExpiresAt,
+        reason,
+        missingApprovals,
+        blockedLiveValueGates,
+        denialCodes: result.denialCodes,
+    };
+    return {
+        schemaVersion: 'nbo.connect.runtime_token_request.v1',
+        requestId,
+        mode: 'shadow_request',
+        wouldAllow: result.wouldAuthorize,
+        reason,
+        missingApprovals,
+        blockedLiveValueGates,
+        proposedExpiresAt,
+        auditRef: result.audit.auditRef,
+        reviewPacket,
+        proposedTokenEnvelope: result.wouldAuthorize ? {
+            envelopeType: 'proposed_connect_action',
+            tokenType: 'connect_action',
+            environment: 'sandbox',
+            organizationId: request.organizationId,
+            nodeId: request.nodeId,
+            persona: request.persona,
+            capabilityId: request.capabilityId,
+            actionId: request.actionId,
+            scope: request.scope,
+            proposedLifetimeSeconds: PROPOSED_LIFETIME_SECONDS,
+            proposedExpiresAt,
+            tokenIssued: false,
+            usableForAuthentication: false,
+        } : null,
+        tokenIssued: false,
+        acceptedForAuthentication: false,
+    };
+}
+//# sourceMappingURL=runtimeTokenRequest.js.map

package/dist/runtimeTokenRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeTokenRequest.js","sourceRoot":"","sources":["../src/runtimeTokenRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,mCAAmC,GAGpC,MAAM,yBAAyB,CAAC;AAoDjC,MAAM,yBAAyB,GAAG,GAAY,CAAC;AAE/C,SAAS,mBAAmB,CAAC,MAAyC;IACpE,MAAM,SAAS,GAAG,CAAC,yCAAyC,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACxG,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAAE,SAAS,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACzG,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAClG,SAAS,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAyC;IACzE,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,2BAA2B,CAAC;QAC7D,CAAC,CAAC,CAAC,sCAAsC,CAAC;QAC1C,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,MAAyC;IAC1D,OAAO,MAAM,CAAC,cAAc;QAC1B,CAAC,CAAC,mIAAmI;QACrI,CAAC,CAAC,sCAAsC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,OAA2C;IAE3C,MAAM,MAAM,GAAG,mCAAmC,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAChC,CAAC,OAAO,CAAC,UAAU,GAAG,yBAAyB,CAAC,GAAG,IAAI,CACxD,CAAC,WAAW,EAAE,CAAC;IAChB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,qBAAqB,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,YAAY,GAA6C;QAC7D,QAAQ,EAAE,yBAAyB,SAAS,EAAE;QAC9C,UAAU,EAAE,8BAA8B;QAC1C,qBAAqB,EAAE,IAAI;QAC3B,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;QAC9D,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,iBAAiB;QACjB,MAAM;QACN,gBAAgB;QAChB,qBAAqB;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;KAChC,CAAC;IAEF,OAAO;QACL,aAAa,EAAE,sCAAsC;QACrD,SAAS;QACT,IAAI,EAAE,gBAAgB;QACtB,UAAU,EAAE,MAAM,CAAC,cAAc;QACjC,MAAM;QACN,gBAAgB;QAChB,qBAAqB;QACrB,iBAAiB;QACjB,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ;QAC/B,YAAY;QACZ,qBAAqB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YAC7C,YAAY,EAAE,yBAAyB;YACvC,SAAS,EAAE,gBAAgB;YAC3B,WAAW,EAAE,SAAS;YACtB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,uBAAuB,EAAE,yBAAyB;YAClD,iBAAiB;YACjB,WAAW,EAAE,KAAK;YAClB,uBAAuB,EAAE,KAAK;SAC/B,CAAC,CAAC,CAAC,IAAI;QACR,WAAW,EAAE,KAAK;QAClB,yBAAyB,EAAE,KAAK;KACjC,CAAC;AACJ,CAAC"}

package/dist/runtimeTokenShadow.d.ts

@@ -0,0 +1,75 @@
+import type { ConnectCatalogSnapshotV1 } from './index.js';
+export type ConnectRuntimeTokenClaimsV1 = {
+    iss: 'nbo-connect';
+    aud: 'nbo-connect-action';
+    sub: string;
+    jti: string;
+    tokenType: 'connect_action';
+    environment: 'sandbox';
+    organizationId: string;
+    nodeId: string;
+    persona: string;
+    capabilityId: string;
+    actionId: string;
+    scope: string;
+    registryVersion: string;
+    iat: number;
+    exp: number;
+    authorizationRef: string;
+};
+export type ConnectRuntimeTokenShadowRequestV1 = {
+    claims: Partial<ConnectRuntimeTokenClaimsV1>;
+    environment: 'sandbox' | 'production';
+    organizationId: string;
+    nodeId: string;
+    persona: string;
+    capabilityId: string;
+    actionId: string;
+    scope: string;
+    nowSeconds: number;
+    catalog: ConnectCatalogSnapshotV1;
+    revokedJtis?: readonly string[];
+    consumedJtis?: readonly string[];
+    authorizationActive?: boolean;
+};
+export type ConnectRuntimeTokenShadowDenialCodeV1 = 'MALFORMED_CLAIMS' | 'ISSUER_MISMATCH' | 'AUDIENCE_MISMATCH' | 'TOKEN_TYPE_MISMATCH' | 'ENVIRONMENT_MISMATCH' | 'REQUIRED_CLAIM_MISSING' | 'TOKEN_NOT_YET_VALID' | 'TOKEN_EXPIRED' | 'TOKEN_LIFETIME_TOO_LONG' | 'ORGANIZATION_MISMATCH' | 'NODE_MISMATCH' | 'PERSONA_MISMATCH' | 'CAPABILITY_MISMATCH' | 'ACTION_MISMATCH' | 'SCOPE_MISMATCH' | 'REGISTRY_VERSION_MISMATCH' | 'AUTHORIZATION_WITHDRAWN' | 'TOKEN_REVOKED' | 'TOKEN_REPLAYED' | 'CAPABILITY_NOT_FOUND' | 'PERSONA_NOT_ALLOWED' | 'ACTION_NOT_ALLOWED' | 'SCOPE_NOT_ALLOWED' | 'LIVE_VALUE_ACTION_BLOCKED';
+export type ConnectRuntimeTokenShadowAuditV1 = {
+    schemaVersion: 'nbo.connect.runtime_token_shadow_audit.v1';
+    auditRef: string;
+    outcome: 'RUNTIME_TOKEN_SHADOW_WOULD_ALLOW' | 'RUNTIME_TOKEN_SHADOW_DENIED';
+    tokenRef: string;
+    organizationId: string | null;
+    nodeId: string | null;
+    persona: string | null;
+    capabilityId: string | null;
+    actionId: string | null;
+    scope: string | null;
+    denialCodes: ConnectRuntimeTokenShadowDenialCodeV1[];
+    acceptedForAuthentication: false;
+    liveValueActionAttempted: false;
+    evaluatedAt: string;
+};
+export type ConnectRuntimeTokenShadowDashboardProjectionV1 = {
+    tokenRef: string;
+    auditRef: string;
+    status: 'would_allow' | 'would_deny';
+    environment: 'sandbox' | 'production';
+    organizationId: string | null;
+    nodeId: string | null;
+    persona: string | null;
+    capabilityId: string | null;
+    actionId: string | null;
+    scope: string | null;
+    denialCodes: ConnectRuntimeTokenShadowDenialCodeV1[];
+    acceptedForAuthentication: false;
+};
+export type ConnectRuntimeTokenShadowResultV1 = {
+    mode: 'shadow_only';
+    wouldAuthorize: boolean;
+    acceptedForAuthentication: false;
+    denialCodes: ConnectRuntimeTokenShadowDenialCodeV1[];
+    audit: ConnectRuntimeTokenShadowAuditV1;
+    dashboard: ConnectRuntimeTokenShadowDashboardProjectionV1;
+};
+export declare function evaluateConnectRuntimeTokenShadowV1(request: ConnectRuntimeTokenShadowRequestV1): ConnectRuntimeTokenShadowResultV1;
+//# sourceMappingURL=runtimeTokenShadow.d.ts.map

package/dist/runtimeTokenShadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeTokenShadow.d.ts","sourceRoot":"","sources":["../src/runtimeTokenShadow.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,MAAM,2BAA2B,GAAG;IACxC,GAAG,EAAE,aAAa,CAAC;IACnB,GAAG,EAAE,oBAAoB,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,gBAAgB,CAAC;IAC5B,WAAW,EAAE,SAAS,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,MAAM,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC7C,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,wBAAwB,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,qCAAqC,GAC7C,kBAAkB,GAClB,iBAAiB,GACjB,mBAAmB,GACnB,qBAAqB,GACrB,sBAAsB,GACtB,wBAAwB,GACxB,qBAAqB,GACrB,eAAe,GACf,yBAAyB,GACzB,uBAAuB,GACvB,eAAe,GACf,kBAAkB,GAClB,qBAAqB,GACrB,iBAAiB,GACjB,gBAAgB,GAChB,2BAA2B,GAC3B,yBAAyB,GACzB,eAAe,GACf,gBAAgB,GAChB,sBAAsB,GACtB,qBAAqB,GACrB,oBAAoB,GACpB,mBAAmB,GACnB,2BAA2B,CAAC;AAEhC,MAAM,MAAM,gCAAgC,GAAG;IAC7C,aAAa,EAAE,2CAA2C,CAAC;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,kCAAkC,GAAG,6BAA6B,CAAC;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACrD,yBAAyB,EAAE,KAAK,CAAC;IACjC,wBAAwB,EAAE,KAAK,CAAC;IAChC,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,8CAA8C,GAAG;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,GAAG,YAAY,CAAC;IACrC,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACrD,yBAAyB,EAAE,KAAK,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,yBAAyB,EAAE,KAAK,CAAC;IACjC,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACrD,KAAK,EAAE,gCAAgC,CAAC;IACxC,SAAS,EAAE,8CAA8C,CAAC;CAC3D,CAAC;AAmHF,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,kCAAkC,GAC1C,iCAAiC,CAgEnC"}