@nextera.one/axis-server-sdk 1.3.0 → 1.5.0

package/dist/index.js

@@ -47,14 +47,21 @@ __export(index_exports, {
   AXIS_UPLOAD_SESSION_STORE: () => AXIS_UPLOAD_SESSION_STORE,
   AXIS_VERSION: () => import_axis_protocol2.AXIS_VERSION,
   Ats1Codec: () => ats1_exports,
+  AxisContext: () => AxisContext,
+  AxisDemoPubkey: () => AxisDemoPubkey,
+  AxisError: () => AxisError,
   AxisFilesDownloadHandler: () => AxisFilesDownloadHandler,
   AxisFilesFinalizeHandler: () => AxisFilesFinalizeHandler,
   AxisFrameZ: () => AxisFrameZ,
   AxisIdDto: () => AxisIdDto,
+  AxisIp: () => AxisIp,
   AxisPacketTags: () => T,
   AxisPartialType: () => AxisPartialType,
+  AxisRaw: () => AxisRaw,
   AxisResponseDto: () => AxisResponseDto,
+  AxisSensorChainService: () => AxisSensorChainService,
   AxisTlvDto: () => AxisTlvDto,
+  BAND: () => BAND,
   BodyProfile: () => import_axis_protocol2.BodyProfile,
   CAPABILITIES: () => CAPABILITIES,
   ContractViolationError: () => ContractViolationError,
@@ -72,7 +79,10 @@ __export(index_exports, {
   FLAG_CHAIN_REQ: () => import_axis_protocol2.FLAG_CHAIN_REQ,
   FLAG_HAS_WITNESS: () => import_axis_protocol2.FLAG_HAS_WITNESS,
   HANDLER_METADATA_KEY: () => HANDLER_METADATA_KEY,
+  HANDLER_SENSORS_KEY: () => HANDLER_SENSORS_KEY,
   Handler: () => Handler,
+  HandlerDiscoveryService: () => HandlerDiscoveryService,
+  HandlerSensors: () => HandlerSensors,
   INTENT_BODY_KEY: () => INTENT_BODY_KEY,
   INTENT_METADATA_KEY: () => INTENT_METADATA_KEY,
   INTENT_REQUIREMENTS: () => INTENT_REQUIREMENTS,
@@ -99,6 +109,7 @@ __export(index_exports, {
   NCERT_PUB: () => import_axis_protocol2.NCERT_PUB,
   NCERT_SCOPE: () => import_axis_protocol2.NCERT_SCOPE,
   NCERT_SIG: () => import_axis_protocol2.NCERT_SIG,
+  PRE_DECODE_BOUNDARY: () => PRE_DECODE_BOUNDARY,
   PROOF_CAPABILITIES: () => PROOF_CAPABILITIES,
   PROOF_CAPSULE: () => import_axis_protocol2.PROOF_CAPSULE,
   PROOF_JWT: () => import_axis_protocol2.PROOF_JWT,
@@ -113,11 +124,15 @@ __export(index_exports, {
   RESPONSE_TAG_UPDATED_AT: () => RESPONSE_TAG_UPDATED_AT,
   RESPONSE_TAG_UPDATED_BY: () => RESPONSE_TAG_UPDATED_BY,
   RiskDecision: () => RiskDecision,
+  SENSOR_METADATA_KEY: () => SENSOR_METADATA_KEY,
   Schema2002_PasskeyLoginOptionsRes: () => Schema2002_PasskeyLoginOptionsRes,
   Schema2011_PasskeyLoginVerifyReq: () => Schema2011_PasskeyLoginVerifyReq,
   Schema2012_PasskeyLoginVerifyRes: () => Schema2012_PasskeyLoginVerifyRes,
   Schema2021_PasskeyRegisterOptionsReq: () => Schema2021_PasskeyRegisterOptionsReq,
+  Sensor: () => Sensor,
   SensorDecisions: () => SensorDecisions,
+  SensorDiscoveryService: () => SensorDiscoveryService,
+  SensorRegistry: () => SensorRegistry,
   TLV: () => import_axis_protocol.TLV,
   TLV_ACTOR_ID: () => import_axis_protocol2.TLV_ACTOR_ID,
   TLV_AUD: () => import_axis_protocol2.TLV_AUD,
@@ -166,21 +181,26 @@ __export(index_exports, {
   buildAts1Hdr: () => buildAts1Hdr,
   buildDtoDecoder: () => buildDtoDecoder,
   buildPacket: () => buildPacket,
+  buildQueueMessage: () => buildQueueMessage,
   buildReceiptHash: () => buildReceiptHash,
   buildTLVs: () => buildTLVs,
+  buildUnsignedWitness: () => buildUnsignedWitness,
   bytes: () => bytes,
   canAccessResource: () => canAccessResource,
   canonicalJson: () => canonicalJson,
   canonicalJsonExcluding: () => canonicalJsonExcluding,
+  canonicalizeObservation: () => canonicalizeObservation,
   classifyIntent: () => classifyIntent,
   computeReceiptHash: () => computeReceiptHash,
   computeSignaturePayload: () => computeSignaturePayload,
   core: () => core_exports,
+  createObservation: () => createObservation,
   crypto: () => crypto_exports,
   decodeArray: () => import_axis_protocol.decodeArray,
   decodeAxis1Frame: () => decodeAxis1Frame,
   decodeFrame: () => decodeFrame,
   decodeObject: () => import_axis_protocol.decodeObject,
+  decodeQueueMessage: () => decodeQueueMessage,
   decodeTLVs: () => import_axis_protocol.decodeTLVs,
   decodeTLVsList: () => import_axis_protocol.decodeTLVsList,
   decodeVarint: () => import_axis_protocol3.decodeVarint,
@@ -188,13 +208,17 @@ __export(index_exports, {
   encVarint: () => encVarint,
   encodeAxis1Frame: () => encodeAxis1Frame,
   encodeFrame: () => encodeFrame,
+  encodeQueueMessage: () => encodeQueueMessage,
   encodeTLVs: () => import_axis_protocol.encodeTLVs,
   encodeVarint: () => import_axis_protocol3.encodeVarint,
+  endStage: () => endStage,
   engine: () => engine_exports,
   extractDtoSchema: () => extractDtoSchema,
+  finalizeObservation: () => finalizeObservation,
   generateEd25519KeyPair: () => generateEd25519KeyPair,
   getSignTarget: () => getSignTarget,
   hasScope: () => hasScope,
+  hashObservation: () => hashObservation,
   isAdminOpcode: () => isAdminOpcode,
   isKnownOpcode: () => isKnownOpcode,
   isTimestampValid: () => isTimestampValid,
@@ -206,7 +230,10 @@ __export(index_exports, {
   packPasskeyLoginVerifyReq: () => packPasskeyLoginVerifyReq,
   packPasskeyLoginVerifyRes: () => packPasskeyLoginVerifyRes,
   packPasskeyRegisterOptionsReq: () => packPasskeyRegisterOptionsReq,
+  parseAutoClaimEntries: () => parseAutoClaimEntries,
   parseScope: () => parseScope,
+  parseStreamEntries: () => parseStreamEntries,
+  recordSensor: () => recordSensor,
   resolveTimeout: () => resolveTimeout,
   schemas: () => schemas_exports,
   security: () => security_exports,
@@ -214,6 +241,8 @@ __export(index_exports, {
   sensors: () => sensors_exports,
   sha256: () => sha256,
   signFrame: () => signFrame,
+  stableJsonStringify: () => stableJsonStringify,
+  startStage: () => startStage,
   tlv: () => tlv,
   u64be: () => u64be,
   unpackPasskeyLoginOptionsReq: () => unpackPasskeyLoginOptionsReq,
@@ -224,7 +253,8 @@ __export(index_exports, {
   validateFrameShape: () => validateFrameShape,
   varintLength: () => import_axis_protocol3.varintLength,
   varintU: () => varintU,
-  verifyFrameSignature: () => verifyFrameSignature
+  verifyFrameSignature: () => verifyFrameSignature,
+  verifyResponse: () => verifyResponse
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -283,8 +313,24 @@ function IntentSensors(sensors) {
   };
 }
 
-// src/decorators/tlv-field.decorator.ts
+// src/decorators/handler-sensors.decorator.ts
 var import_reflect_metadata4 = require("reflect-metadata");
+var HANDLER_SENSORS_KEY = "axis:handler:sensors";
+function HandlerSensors(sensors) {
+  return (target) => {
+    Reflect.defineMetadata(HANDLER_SENSORS_KEY, sensors, target);
+  };
+}
+
+// src/decorators/sensor.decorator.ts
+var import_common2 = require("@nestjs/common");
+var SENSOR_METADATA_KEY = "axis:sensor";
+function Sensor(options) {
+  return (0, import_common2.SetMetadata)(SENSOR_METADATA_KEY, options ?? true);
+}
+
+// src/decorators/tlv-field.decorator.ts
+var import_reflect_metadata5 = require("reflect-metadata");
 var TLV_FIELDS_KEY = "axis:tlv:fields";
 var TLV_VALIDATORS_KEY = "axis:tlv:validators";
 function TlvField(tag, options) {
@@ -342,7 +388,7 @@ function TlvRange(min, max, message) {
 }
 
 // src/decorators/dto-schema.util.ts
-var import_reflect_metadata5 = require("reflect-metadata");
+var import_reflect_metadata6 = require("reflect-metadata");
 
 // src/core/tlv.ts
 var import_axis_protocol = require("@nextera.one/axis-protocol");
@@ -443,7 +489,7 @@ __decorateClass([
 ], AxisIdDto.prototype, "id", 2);
 
 // src/base/axis-partial-type.ts
-var import_reflect_metadata6 = require("reflect-metadata");
+var import_reflect_metadata7 = require("reflect-metadata");
 function AxisPartialType(BaseDto) {
   class PartialDto extends BaseDto {
   }
@@ -489,7 +535,7 @@ __decorateClass([
 ], AxisResponseDto.prototype, "updated_by", 2);
 
 // src/engine/intent.router.ts
-var import_common2 = require("@nestjs/common");
+var import_common3 = require("@nestjs/common");
 
 // src/sensor/axis-sensor.ts
 var Decision = /* @__PURE__ */ ((Decision2) => {
@@ -594,7 +640,7 @@ var SensorDecisions = {
 var IntentRouter = class {
   constructor(moduleRef) {
     this.moduleRef = moduleRef;
-    this.logger = new import_common2.Logger(IntentRouter.name);
+    this.logger = new import_common3.Logger(IntentRouter.name);
     /** Internal registry of dynamic intent handlers */
     this.handlers = /* @__PURE__ */ new Map();
     /** Per-intent sensor classes (resolved at call time) */
@@ -656,6 +702,7 @@ var IntentRouter = class {
     );
     const prefix = handlerMeta?.intent || instance.name;
     const routes = Reflect.getMetadata(INTENT_ROUTES_KEY, instance.constructor) || [];
+    const handlerSensors = Reflect.getMetadata(HANDLER_SENSORS_KEY, instance.constructor) || [];
     for (const route of routes) {
       const intentName = route.absolute ? route.action : `${prefix}.${route.action}`;
       const fn = instance[route.methodName].bind(instance);
@@ -664,7 +711,12 @@ var IntentRouter = class {
       } else {
         this.register(intentName, fn);
       }
-      this.registerIntentMeta(intentName, Object.getPrototypeOf(instance), String(route.methodName));
+      this.registerIntentMeta(
+        intentName,
+        Object.getPrototypeOf(instance),
+        String(route.methodName),
+        handlerSensors
+      );
     }
     const proto = Object.getPrototypeOf(instance);
     for (const key of Object.getOwnPropertyNames(proto)) {
@@ -673,7 +725,7 @@ var IntentRouter = class {
       if (!this.handlers.has(meta.intent)) {
         this.register(meta.intent, instance[key].bind(instance));
       }
-      this.registerIntentMeta(meta.intent, proto, key);
+      this.registerIntentMeta(meta.intent, proto, key, handlerSensors);
     }
   }
   /**
@@ -809,14 +861,22 @@ var IntentRouter = class {
       this.logger.warn(`${intent} failed in ${ms}ms - ${error}`);
     }
   }
-  registerIntentMeta(intent, proto, methodName) {
+  registerIntentMeta(intent, proto, methodName, handlerSensors) {
     const decoder = Reflect.getMetadata(INTENT_BODY_KEY, proto, methodName);
     if (decoder) {
       this.intentDecoders.set(intent, decoder);
     }
-    const sensors = Reflect.getMetadata(INTENT_SENSORS_KEY, proto, methodName);
-    if (sensors && Array.isArray(sensors) && sensors.length > 0) {
-      this.intentSensors.set(intent, sensors);
+    const intentSensors = Reflect.getMetadata(
+      INTENT_SENSORS_KEY,
+      proto,
+      methodName
+    );
+    const combined = [
+      ...handlerSensors || [],
+      ...Array.isArray(intentSensors) ? intentSensors : []
+    ];
+    if (combined.length > 0) {
+      this.intentSensors.set(intent, combined);
     }
     const meta = Reflect.getMetadata(INTENT_METADATA_KEY, proto, methodName);
     if (meta) {
@@ -915,13 +975,234 @@ IntentRouter.BUILTIN_INTENTS = /* @__PURE__ */ new Set([
   "axis.intent.exec"
 ]);
 IntentRouter = __decorateClass([
-  (0, import_common2.Injectable)(),
-  __decorateParam(0, (0, import_common2.Optional)())
+  (0, import_common3.Injectable)(),
+  __decorateParam(0, (0, import_common3.Optional)())
 ], IntentRouter);
 
+// src/engine/sensor-bands.ts
+var BAND = {
+  /** Pre-decode: raw byte validation, geo, budget, magic */
+  WIRE: 0,
+  /** Post-decode: identity resolution, capsule, proof */
+  IDENTITY: 40,
+  /** Post-decode: authorization, signature, rate limiting */
+  POLICY: 90,
+  /** Post-decode: content validation, TLV, schema, files */
+  CONTENT: 140,
+  /** Post-decode: business logic sensors, streams, WS */
+  BUSINESS: 200,
+  /** Post-decode: audit, logging (always last) */
+  AUDIT: 900
+};
+var PRE_DECODE_BOUNDARY = 40;
+
+// src/engine/observation/stable-json.ts
+function normalize(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => normalize(item));
+  }
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).filter(([, nested]) => nested !== void 0).sort(([left], [right]) => left.localeCompare(right));
+    const normalized = {};
+    for (const [key, nested] of entries) {
+      normalized[key] = normalize(nested);
+    }
+    return normalized;
+  }
+  return value;
+}
+function stableJsonStringify(value) {
+  return JSON.stringify(normalize(value));
+}
+
+// src/engine/observation/observation-queue.codec.ts
+function buildQueueMessage(observation, sourceNodeId, previous, lastError) {
+  const now = Date.now();
+  return {
+    v: 1,
+    observation,
+    attempts: previous ? previous.attempts + 1 : 0,
+    firstEnqueuedAt: previous?.firstEnqueuedAt ?? now,
+    lastEnqueuedAt: now,
+    sourceNodeId,
+    lastError
+  };
+}
+function encodeQueueMessage(message) {
+  return JSON.stringify(message);
+}
+function decodeQueueMessage(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || parsed.v !== 1 || !parsed.observation?.id) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function parseStreamEntries(raw) {
+  if (!Array.isArray(raw)) {
+    return [];
+  }
+  const entries = [];
+  for (const streamRow of raw) {
+    if (!Array.isArray(streamRow) || streamRow.length < 2) {
+      continue;
+    }
+    const messageRows = streamRow[1];
+    if (!Array.isArray(messageRows)) {
+      continue;
+    }
+    for (const row of messageRows) {
+      if (!Array.isArray(row) || row.length < 2) {
+        continue;
+      }
+      const id = String(row[0]);
+      const fields = Array.isArray(row[1]) ? row[1] : [];
+      const fieldMap = fieldsToMap(fields);
+      const payload = fieldMap.get("payload");
+      if (!payload) {
+        continue;
+      }
+      const message = decodeQueueMessage(payload);
+      if (!message) {
+        continue;
+      }
+      entries.push({ id, message });
+    }
+  }
+  return entries;
+}
+function parseAutoClaimEntries(raw) {
+  if (!Array.isArray(raw) || raw.length < 2) {
+    return [];
+  }
+  const rows = Array.isArray(raw[1]) ? raw[1] : [];
+  return parseStreamEntries([["stream", rows]]);
+}
+function fieldsToMap(fields) {
+  const map3 = /* @__PURE__ */ new Map();
+  for (let i = 0; i < fields.length; i += 2) {
+    const key = fields[i];
+    const value = fields[i + 1];
+    if (key !== void 0 && value !== void 0) {
+      map3.set(String(key), String(value));
+    }
+  }
+  return map3;
+}
+
+// src/engine/observation/observation-hash.ts
+var import_crypto = require("crypto");
+function canonicalizeObservation(obs) {
+  const obj = {
+    id: obs.id,
+    startMs: obs.startMs,
+    endMs: obs.endMs,
+    transport: obs.transport,
+    ip: obs.ip,
+    intent: obs.intent,
+    actorId: obs.actorId,
+    capsuleId: obs.capsuleId,
+    decision: obs.decision,
+    resultCode: obs.resultCode,
+    statusCode: obs.statusCode,
+    durationMs: obs.durationMs,
+    stages: obs.stages.map((s) => ({
+      name: s.name,
+      status: s.status,
+      startMs: s.startMs,
+      endMs: s.endMs,
+      durationMs: s.durationMs,
+      reason: s.reason,
+      code: s.code
+    })),
+    sensors: obs.sensors.map((s) => ({
+      name: s.name,
+      allowed: s.allowed,
+      riskScore: s.riskScore,
+      durationMs: s.durationMs,
+      reasons: s.reasons,
+      code: s.code
+    }))
+  };
+  return stableJsonStringify(obj);
+}
+function hashObservation(obs) {
+  const canonical = canonicalizeObservation(obs);
+  return (0, import_crypto.createHash)("sha256").update(canonical).digest("hex");
+}
+function buildUnsignedWitness(obs) {
+  if (!obs.decision || !obs.endMs) {
+    return null;
+  }
+  return {
+    v: 1,
+    observationId: obs.id,
+    payloadHash: hashObservation(obs),
+    sealedAt: Date.now(),
+    summary: {
+      intent: obs.intent,
+      actorId: obs.actorId,
+      decision: obs.decision,
+      statusCode: obs.statusCode,
+      durationMs: obs.durationMs,
+      sensorCount: obs.sensors.length,
+      stageCount: obs.stages.length
+    }
+  };
+}
+
 // src/core/constants.ts
 var import_axis_protocol2 = require("@nextera.one/axis-protocol");
 
+// src/engine/observation/response-observer.ts
+var SENSITIVE_RESPONSE_TAGS = [4, 5, 6];
+function verifyResponse(ctx, response) {
+  if (!response.effect || typeof response.effect !== "string") {
+    return {
+      passed: false,
+      code: "OBSERVER_INVALID_EFFECT",
+      reason: "Response effect is missing or invalid"
+    };
+  }
+  if (response.ok && (!response.body || response.body.length === 0)) {
+    return {
+      passed: false,
+      code: "OBSERVER_EMPTY_BODY",
+      reason: "Successful response must contain a body"
+    };
+  }
+  if (response.body && response.body.length > import_axis_protocol2.MAX_BODY_LEN) {
+    return {
+      passed: false,
+      code: "OBSERVER_BODY_OVERFLOW",
+      reason: `Response body exceeds ${import_axis_protocol2.MAX_BODY_LEN} bytes`
+    };
+  }
+  if (response.headers) {
+    for (const tag of SENSITIVE_RESPONSE_TAGS) {
+      if (response.headers.has(tag)) {
+        return {
+          passed: false,
+          code: "OBSERVER_DATA_LEAK",
+          reason: `Response must not contain sensitive TLV tag ${tag}`
+        };
+      }
+    }
+  }
+  if (response.effect.includes("Error:") || response.effect.includes("stack") || response.effect.includes("at /")) {
+    return {
+      passed: false,
+      code: "OBSERVER_INFO_LEAK",
+      reason: "Response effect may contain internal error details"
+    };
+  }
+  return { passed: true };
+}
+
 // src/core/varint.ts
 var import_axis_protocol3 = require("@nextera.one/axis-protocol");
 
@@ -1197,7 +1478,7 @@ __export(ats1_exports, {
   tlvsToMap: () => tlvsToMap,
   validateTLVsAgainstSchema: () => validateTLVsAgainstSchema
 });
-var import_crypto = require("crypto");
+var import_crypto2 = require("crypto");
 var DEFAULT_LIMITS = {
   maxVarintBytes: 10,
   maxTlvCount: 512,
@@ -1247,7 +1528,7 @@ function decodeU64BE(buf) {
   return buf.readBigUInt64BE(0);
 }
 function sha2562(data) {
-  return (0, import_crypto.createHash)("sha256").update(data).digest();
+  return (0, import_crypto2.createHash)("sha256").update(data).digest();
 }
 function encodeTLV(tag, value) {
   if (!Number.isInteger(tag) || tag <= 0)
@@ -1836,7 +2117,7 @@ function packPasskeyLoginVerifyRes(params) {
 }
 
 // src/codec/tlv.encode.ts
-var import_crypto2 = require("crypto");
+var import_crypto3 = require("crypto");
 function encVarint(x) {
   if (x < 0n) throw new Error("VARINT_NEG");
   const out = [];
@@ -1864,7 +2145,7 @@ function bytes(b) {
   return Buffer.isBuffer(b) ? b : Buffer.from(b);
 }
 function nonce16() {
-  return (0, import_crypto2.randomBytes)(16);
+  return (0, import_crypto3.randomBytes)(16);
 }
 function tlv(type, value) {
   if (!Number.isSafeInteger(type) || type < 0) throw new Error("TLV_BAD_TYPE");
@@ -2410,9 +2691,9 @@ function isAdminOpcode(op) {
 }
 
 // src/core/receipt.ts
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 function buildReceiptHash(prevHash, pid, actorId, intent, effect, ts) {
-  const h = (0, import_crypto3.createHash)("sha256");
+  const h = (0, import_crypto4.createHash)("sha256");
   if (prevHash) h.update(prevHash);
   h.update(pid);
   h.update(Buffer.from(actorId, "utf8"));
@@ -2591,7 +2872,7 @@ function isTimestampValid(ts, skewSeconds = 120) {
 }
 
 // src/upload/axis-files.handlers.ts
-var import_common3 = require("@nestjs/common");
+var import_common4 = require("@nestjs/common");
 var crypto2 = __toESM(require("crypto"));
 
 // src/upload/upload.tokens.ts
@@ -2604,7 +2885,7 @@ var AxisFilesDownloadHandler = class {
   constructor(sessions, files) {
     this.sessions = sessions;
     this.files = files;
-    this.logger = new import_common3.Logger(AxisFilesDownloadHandler.name);
+    this.logger = new import_common4.Logger(AxisFilesDownloadHandler.name);
     this.name = "axis.files.download";
     this.open = true;
     this.description = "File download handler";
@@ -2669,16 +2950,16 @@ __decorateClass([
 ], AxisFilesDownloadHandler.prototype, "execute", 1);
 AxisFilesDownloadHandler = __decorateClass([
   Handler("axis.files.download"),
-  (0, import_common3.Injectable)(),
-  __decorateParam(0, (0, import_common3.Inject)(AXIS_UPLOAD_SESSION_STORE)),
-  __decorateParam(1, (0, import_common3.Inject)(AXIS_UPLOAD_FILE_STORE))
+  (0, import_common4.Injectable)(),
+  __decorateParam(0, (0, import_common4.Inject)(AXIS_UPLOAD_SESSION_STORE)),
+  __decorateParam(1, (0, import_common4.Inject)(AXIS_UPLOAD_FILE_STORE))
 ], AxisFilesDownloadHandler);
 var AxisFilesFinalizeHandler = class {
   constructor(sessions, files, keyring) {
     this.sessions = sessions;
     this.files = files;
     this.keyring = keyring;
-    this.logger = new import_common3.Logger(AxisFilesFinalizeHandler.name);
+    this.logger = new import_common4.Logger(AxisFilesFinalizeHandler.name);
     this.name = "axis.files.finalize";
     this.open = false;
     this.description = "File upload finalization handler";
@@ -2754,11 +3035,11 @@ __decorateClass([
 ], AxisFilesFinalizeHandler.prototype, "execute", 1);
 AxisFilesFinalizeHandler = __decorateClass([
   Handler("axis.files.finalize"),
-  (0, import_common3.Injectable)(),
-  __decorateParam(0, (0, import_common3.Inject)(AXIS_UPLOAD_SESSION_STORE)),
-  __decorateParam(1, (0, import_common3.Inject)(AXIS_UPLOAD_FILE_STORE)),
-  __decorateParam(2, (0, import_common3.Optional)()),
-  __decorateParam(2, (0, import_common3.Inject)(AXIS_UPLOAD_RECEIPT_SIGNER))
+  (0, import_common4.Injectable)(),
+  __decorateParam(0, (0, import_common4.Inject)(AXIS_UPLOAD_SESSION_STORE)),
+  __decorateParam(1, (0, import_common4.Inject)(AXIS_UPLOAD_FILE_STORE)),
+  __decorateParam(2, (0, import_common4.Optional)()),
+  __decorateParam(2, (0, import_common4.Inject)(AXIS_UPLOAD_RECEIPT_SIGNER))
 ], AxisFilesFinalizeHandler);
 
 // src/upload/disk-upload-file.store.ts
@@ -2817,377 +3098,15 @@ var DiskUploadFileStore = class {
   }
 };
 
-// src/core/index.ts
-var core_exports = {};
-__export(core_exports, {
-  AXIS_MAGIC: () => import_axis_protocol2.AXIS_MAGIC,
-  AXIS_VERSION: () => import_axis_protocol2.AXIS_VERSION,
-  AxisError: () => AxisError,
-  AxisFrameZ: () => AxisFrameZ,
-  BodyProfile: () => import_axis_protocol2.BodyProfile,
-  ERR_BAD_SIGNATURE: () => import_axis_protocol2.ERR_BAD_SIGNATURE,
-  ERR_CONTRACT_VIOLATION: () => import_axis_protocol2.ERR_CONTRACT_VIOLATION,
-  ERR_INVALID_PACKET: () => import_axis_protocol2.ERR_INVALID_PACKET,
-  ERR_REPLAY_DETECTED: () => import_axis_protocol2.ERR_REPLAY_DETECTED,
-  FLAG_BODY_TLV: () => import_axis_protocol2.FLAG_BODY_TLV,
-  FLAG_CHAIN_REQ: () => import_axis_protocol2.FLAG_CHAIN_REQ,
-  FLAG_HAS_WITNESS: () => import_axis_protocol2.FLAG_HAS_WITNESS,
-  MAX_BODY_LEN: () => import_axis_protocol2.MAX_BODY_LEN,
-  MAX_FRAME_LEN: () => import_axis_protocol2.MAX_FRAME_LEN,
-  MAX_HDR_LEN: () => import_axis_protocol2.MAX_HDR_LEN,
-  MAX_SIG_LEN: () => import_axis_protocol2.MAX_SIG_LEN,
-  NCERT_ALG: () => import_axis_protocol2.NCERT_ALG,
-  NCERT_EXP: () => import_axis_protocol2.NCERT_EXP,
-  NCERT_ISSUER_KID: () => import_axis_protocol2.NCERT_ISSUER_KID,
-  NCERT_KID: () => import_axis_protocol2.NCERT_KID,
-  NCERT_NBF: () => import_axis_protocol2.NCERT_NBF,
-  NCERT_NODE_ID: () => import_axis_protocol2.NCERT_NODE_ID,
-  NCERT_PAYLOAD: () => import_axis_protocol2.NCERT_PAYLOAD,
-  NCERT_PUB: () => import_axis_protocol2.NCERT_PUB,
-  NCERT_SCOPE: () => import_axis_protocol2.NCERT_SCOPE,
-  NCERT_SIG: () => import_axis_protocol2.NCERT_SIG,
-  PROOF_CAPSULE: () => import_axis_protocol2.PROOF_CAPSULE,
-  PROOF_JWT: () => import_axis_protocol2.PROOF_JWT,
-  PROOF_LOOM: () => import_axis_protocol2.PROOF_LOOM,
-  PROOF_MTLS: () => import_axis_protocol2.PROOF_MTLS,
-  PROOF_NONE: () => import_axis_protocol2.PROOF_NONE,
-  PROOF_WITNESS: () => import_axis_protocol2.PROOF_WITNESS,
-  ProofType: () => import_axis_protocol2.ProofType,
-  TLV: () => import_axis_protocol.TLV,
-  TLV_ACTOR_ID: () => import_axis_protocol2.TLV_ACTOR_ID,
-  TLV_AUD: () => import_axis_protocol2.TLV_AUD,
-  TLV_BODY_ARR: () => import_axis_protocol2.TLV_BODY_ARR,
-  TLV_BODY_OBJ: () => import_axis_protocol2.TLV_BODY_OBJ,
-  TLV_CAPSULE: () => import_axis_protocol2.TLV_CAPSULE,
-  TLV_EFFECT: () => import_axis_protocol2.TLV_EFFECT,
-  TLV_ERROR_CODE: () => import_axis_protocol2.TLV_ERROR_CODE,
-  TLV_ERROR_MSG: () => import_axis_protocol2.TLV_ERROR_MSG,
-  TLV_INDEX: () => import_axis_protocol2.TLV_INDEX,
-  TLV_INTENT: () => import_axis_protocol2.TLV_INTENT,
-  TLV_KID: () => import_axis_protocol2.TLV_KID,
-  TLV_LOOM_PRESENCE_ID: () => import_axis_protocol2.TLV_LOOM_PRESENCE_ID,
-  TLV_LOOM_THREAD_HASH: () => import_axis_protocol2.TLV_LOOM_THREAD_HASH,
-  TLV_LOOM_WRIT: () => import_axis_protocol2.TLV_LOOM_WRIT,
-  TLV_NODE: () => import_axis_protocol2.TLV_NODE,
-  TLV_NODE_CERT_HASH: () => import_axis_protocol2.TLV_NODE_CERT_HASH,
-  TLV_NODE_KID: () => import_axis_protocol2.TLV_NODE_KID,
-  TLV_NONCE: () => import_axis_protocol2.TLV_NONCE,
-  TLV_OFFSET: () => import_axis_protocol2.TLV_OFFSET,
-  TLV_OK: () => import_axis_protocol2.TLV_OK,
-  TLV_PID: () => import_axis_protocol2.TLV_PID,
-  TLV_PREV_HASH: () => import_axis_protocol2.TLV_PREV_HASH,
-  TLV_PROOF_REF: () => import_axis_protocol2.TLV_PROOF_REF,
-  TLV_PROOF_TYPE: () => import_axis_protocol2.TLV_PROOF_TYPE,
-  TLV_REALM: () => import_axis_protocol2.TLV_REALM,
-  TLV_RECEIPT_HASH: () => import_axis_protocol2.TLV_RECEIPT_HASH,
-  TLV_RID: () => import_axis_protocol2.TLV_RID,
-  TLV_SHA256_CHUNK: () => import_axis_protocol2.TLV_SHA256_CHUNK,
-  TLV_TRACE_ID: () => import_axis_protocol2.TLV_TRACE_ID,
-  TLV_TS: () => import_axis_protocol2.TLV_TS,
-  TLV_UPLOAD_ID: () => import_axis_protocol2.TLV_UPLOAD_ID,
-  computeReceiptHash: () => computeReceiptHash,
-  computeSignaturePayload: () => computeSignaturePayload,
-  decodeArray: () => import_axis_protocol.decodeArray,
-  decodeFrame: () => decodeFrame,
-  decodeObject: () => import_axis_protocol.decodeObject,
-  decodeTLVs: () => import_axis_protocol.decodeTLVs,
-  decodeTLVsList: () => import_axis_protocol.decodeTLVsList,
-  decodeVarint: () => import_axis_protocol3.decodeVarint,
-  encodeFrame: () => encodeFrame,
-  encodeTLVs: () => import_axis_protocol.encodeTLVs,
-  encodeVarint: () => import_axis_protocol3.encodeVarint,
-  generateEd25519KeyPair: () => generateEd25519KeyPair,
-  getSignTarget: () => getSignTarget,
-  sha256: () => sha256,
-  signFrame: () => signFrame,
-  varintLength: () => import_axis_protocol3.varintLength,
-  verifyFrameSignature: () => verifyFrameSignature
-});
-
-// src/core/axis-error.ts
-var AxisError = class extends Error {
-  constructor(code, message, httpStatus = 400, details) {
-    super(message);
-    this.code = code;
-    this.httpStatus = httpStatus;
-    this.details = details;
-    this.name = "AxisError";
-  }
-};
-
-// src/crypto/index.ts
-var crypto_exports = {};
-__export(crypto_exports, {
-  ProofVerificationService: () => ProofVerificationService,
-  b64urlDecode: () => b64urlDecode,
-  b64urlDecodeString: () => b64urlDecodeString,
-  b64urlEncode: () => b64urlEncode,
-  b64urlEncodeString: () => b64urlEncodeString,
-  canonicalJson: () => canonicalJson,
-  canonicalJsonExcluding: () => canonicalJsonExcluding
-});
-
-// src/crypto/proof-verification.service.ts
-var import_common4 = require("@nestjs/common");
-var crypto3 = __toESM(require("crypto"));
-var nacl = __toESM(require("tweetnacl"));
-var ProofVerificationService = class {
-  constructor() {
-    this.logger = new import_common4.Logger(ProofVerificationService.name);
-    // Cache of registered device public keys (deviceId -> pubKey)
-    this.deviceKeys = /* @__PURE__ */ new Map();
-    // Cache of trusted mTLS certificate fingerprints
-    this.trustedCerts = /* @__PURE__ */ new Map();
-  }
-  /**
-   * Verifies an authentication proof based on its type.
-   *
-   * **Supported Types:**
-   * - 1 (CAPSULE): Delegated to `verifyCapsuleProof`
-   * - 2 (JWT): Verified by `verifyJWTProof`
-   * - 3 (MTLS_ID): Verified by `verifyMTLSProof`
-   * - 4 (DEVICE_SE): Verified by `verifyDeviceSEProof`
-   *
-   * @param {ProofType} proofType - The numeric AXIS proof type
-   * @param {Uint8Array} proofRef - The binary reference or token for the proof
-   * @param {Object} context - Additional metadata required for specific proof types
-   * @param {Uint8Array} [context.signTarget] - The canonical bytes that were signed (for Ed25519)
-   * @param {Uint8Array} [context.signature] - The signature to verify (for Ed25519)
-   * @param {MTLSContext} [context.mtls] - mTLS certificate data
-   * @param {DeviceSEContext} [context.deviceSE] - Device Secure Element information
-   * @returns {Promise<ProofVerificationResult>} The outcome of the verification
-   */
-  async verifyProof(proofType, proofRef, context) {
-    switch (proofType) {
-      case 1:
-        return this.verifyCapsuleProof(proofRef);
-      case 2:
-        return this.verifyJWTProof(proofRef);
-      case 3:
-        return this.verifyMTLSProof(context.mtls);
-      case 4:
-        return this.verifyDeviceSEProof(
-          context.signTarget,
-          context.signature,
-          context.deviceSE
-        );
-      default:
-        return { valid: false, error: `Unknown proof type: ${proofType}` };
-    }
-  }
-  /**
-   * Verify CAPSULE proof (delegated to CapsuleService)
-   */
-  async verifyCapsuleProof(proofRef) {
-    const capsuleId = new TextDecoder().decode(proofRef);
-    return {
-      valid: true,
-      metadata: { capsuleId, requiresCapsuleValidation: true }
-    };
-  }
-  /**
-   * Verifies a JSON Web Token (JWT) proof.
-   *
-   * **Validation Logic:**
-   * 1. Decodes the token string.
-   * 2. Checks for valid 3-part JWT structure.
-   * 3. Validates `exp` (expiration) and `nbf` (not before) claims.
-   * 4. Extracts `actor_id` or `sub` as the identity.
-   *
-   * @param {Uint8Array} proofRef - Binary representation of the JWT string
-   * @returns {Promise<ProofVerificationResult>} Result including the actor identifier
-   */
-  async verifyJWTProof(proofRef) {
-    try {
-      const token = new TextDecoder().decode(proofRef);
-      const parts = token.split(".");
-      if (parts.length !== 3) {
-        return { valid: false, error: "Invalid JWT format" };
-      }
-      const header = JSON.parse(Buffer.from(parts[0], "base64url").toString());
-      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-      if (payload.exp && Date.now() / 1e3 > payload.exp) {
-        return { valid: false, error: "JWT expired" };
-      }
-      if (payload.nbf && Date.now() / 1e3 < payload.nbf) {
-        return { valid: false, error: "JWT not yet valid" };
-      }
-      return {
-        valid: true,
-        actorId: payload.sub || payload.actor_id,
-        metadata: { iss: payload.iss, scope: payload.scope }
-      };
-    } catch (e) {
-      const message = e instanceof Error ? e.message : "Unknown error";
-      return { valid: false, error: `JWT parse error: ${message}` };
-    }
-  }
-  /**
-   * Verify mTLS client certificate proof
-   */
-  async verifyMTLSProof(mtls) {
-    if (!mtls) {
-      return { valid: false, error: "No mTLS context provided" };
-    }
-    if (!mtls.verified) {
-      return { valid: false, error: "mTLS not verified by TLS terminator" };
-    }
-    if (mtls.clientCertFingerprint) {
-      const trusted = this.trustedCerts.get(mtls.clientCertFingerprint);
-      if (trusted) {
-        return {
-          valid: true,
-          actorId: trusted.actorId,
-          metadata: {
-            fingerprint: mtls.clientCertFingerprint,
-            subject: mtls.clientCertSubject
-          }
-        };
-      }
-    }
-    if (mtls.clientCertSubject) {
-      const cnMatch = mtls.clientCertSubject.match(/CN=([^,]+)/);
-      if (cnMatch) {
-        return {
-          valid: true,
-          actorId: cnMatch[1],
-          metadata: {
-            subject: mtls.clientCertSubject,
-            issuer: mtls.clientCertIssuer
-          }
-        };
-      }
-    }
-    return { valid: false, error: "Could not extract actor from certificate" };
-  }
-  /**
-   * Verify Device Secure Element signature
-   */
-  async verifyDeviceSEProof(signTarget, signature, deviceSE) {
-    if (!deviceSE || !signTarget || !signature) {
-      return { valid: false, error: "Missing Device SE context" };
-    }
-    let publicKey = deviceSE.publicKey;
-    const registeredKey = this.deviceKeys.get(deviceSE.deviceId);
-    if (registeredKey) {
-      publicKey = registeredKey;
-    }
-    if (!publicKey || publicKey.length !== 32) {
-      return {
-        valid: false,
-        error: "Invalid or unregistered device public key"
-      };
-    }
-    try {
-      const valid = nacl.sign.detached.verify(signTarget, signature, publicKey);
-      if (!valid) {
-        return { valid: false, error: "Device signature verification failed" };
-      }
-      return {
-        valid: true,
-        actorId: deviceSE.deviceId,
-        metadata: { deviceId: deviceSE.deviceId, proofType: "DEVICE_SE" }
-      };
-    } catch (e) {
-      const message = e instanceof Error ? e.message : "Unknown error";
-      return {
-        valid: false,
-        error: `Signature verification error: ${message}`
-      };
-    }
-  }
-  /**
-   * Registers a public key for a trusted device.
-   * This key will be used for future `DEVICE_SE` proof verifications.
-   *
-   * @param {string} deviceId - Unique identifier for the device
-   * @param {Uint8Array} publicKey - 32-byte Ed25519 public key
-   * @throws {Error} If the public key is not 32 bytes
-   */
-  registerDeviceKey(deviceId, publicKey) {
-    if (publicKey.length !== 32) {
-      throw new Error("Device public key must be 32 bytes (Ed25519)");
-    }
-    this.deviceKeys.set(deviceId, publicKey);
-    this.logger.log(`Registered device key for ${deviceId}`);
-  }
-  /**
-   * Unregister a device
-   */
-  unregisterDevice(deviceId) {
-    return this.deviceKeys.delete(deviceId);
-  }
-  /**
-   * Registers a trusted mTLS certificate fingerprint and associates it with an actor.
-   *
-   * @param {string} fingerprint - SHA-256 fingerprint of the client certificate
-   * @param {string} actorId - The actor to associate with this certificate
-   */
-  registerMTLSCert(fingerprint, actorId) {
-    this.trustedCerts.set(fingerprint, { actorId, issuedAt: Date.now() });
-    this.logger.log(`Registered mTLS cert ${fingerprint} for actor ${actorId}`);
-  }
-  /**
-   * Revoke an mTLS certificate
-   */
-  revokeMTLSCert(fingerprint) {
-    return this.trustedCerts.delete(fingerprint);
-  }
-  /**
-   * Calculate certificate fingerprint (SHA-256)
-   */
-  static calculateFingerprint(certPem) {
-    const der = Buffer.from(
-      certPem.replace(/-----BEGIN CERTIFICATE-----/, "").replace(/-----END CERTIFICATE-----/, "").replace(/\s/g, ""),
-      "base64"
-    );
-    return crypto3.createHash("sha256").update(der).digest("hex");
-  }
-};
-ProofVerificationService = __decorateClass([
-  (0, import_common4.Injectable)()
-], ProofVerificationService);
-
-// src/decorators/index.ts
-var decorators_exports = {};
-__export(decorators_exports, {
-  AxisContext: () => AxisContext,
-  AxisDemoPubkey: () => AxisDemoPubkey,
-  AxisFrame: () => AxisFrame3,
-  AxisIp: () => AxisIp,
-  AxisRaw: () => AxisRaw,
-  HANDLER_METADATA_KEY: () => HANDLER_METADATA_KEY,
-  Handler: () => Handler,
-  INTENT_BODY_KEY: () => INTENT_BODY_KEY,
-  INTENT_METADATA_KEY: () => INTENT_METADATA_KEY,
-  INTENT_ROUTES_KEY: () => INTENT_ROUTES_KEY,
-  INTENT_SENSORS_KEY: () => INTENT_SENSORS_KEY,
-  Intent: () => Intent,
-  IntentBody: () => IntentBody,
-  IntentSensors: () => IntentSensors,
-  SENSOR_METADATA_KEY: () => SENSOR_METADATA_KEY,
-  Sensor: () => Sensor,
-  TLV_FIELDS_KEY: () => TLV_FIELDS_KEY,
-  TLV_VALIDATORS_KEY: () => TLV_VALIDATORS_KEY,
-  TlvEnum: () => TlvEnum,
-  TlvField: () => TlvField,
-  TlvMinLen: () => TlvMinLen,
-  TlvRange: () => TlvRange,
-  TlvUtf8Pattern: () => TlvUtf8Pattern,
-  TlvValidate: () => TlvValidate,
-  buildDtoDecoder: () => buildDtoDecoder,
-  extractDtoSchema: () => extractDtoSchema
-});
-
-// src/decorators/axis-request.decorator.ts
-var import_common5 = require("@nestjs/common");
-function resolveIp(req) {
-  return req.headers["x-forwarded-for"]?.split(",")[0]?.trim() || req.headers["x-real-ip"] || req.socket.remoteAddress || void 0;
-}
-var AxisRaw = (0, import_common5.createParamDecorator)(
-  (_data, ctx) => {
-    const req = ctx.switchToHttp().getRequest();
-    return req.body;
+// src/decorators/axis-request.decorator.ts
+var import_common5 = require("@nestjs/common");
+function resolveIp(req) {
+  return req.headers["x-forwarded-for"]?.split(",")[0]?.trim() || req.headers["x-real-ip"] || req.socket.remoteAddress || void 0;
+}
+var AxisRaw = (0, import_common5.createParamDecorator)(
+  (_data, ctx) => {
+    const req = ctx.switchToHttp().getRequest();
+    return req.body;
   }
 );
 var AxisIp = (0, import_common5.createParamDecorator)(
@@ -3228,73 +3147,25 @@ var AxisFrame3 = (0, import_common5.createParamDecorator)(
   }
 );
 
-// src/decorators/sensor.decorator.ts
-var import_common6 = require("@nestjs/common");
-var SENSOR_METADATA_KEY = "axis:sensor";
-function Sensor(options) {
-  return (0, import_common6.SetMetadata)(SENSOR_METADATA_KEY, options ?? true);
-}
-
-// src/engine/index.ts
-var engine_exports = {};
-__export(engine_exports, {
-  BAND: () => BAND,
-  HandlerDiscoveryService: () => HandlerDiscoveryService,
-  IntentRouter: () => IntentRouter,
-  PRE_DECODE_BOUNDARY: () => PRE_DECODE_BOUNDARY,
-  SensorDiscoveryService: () => SensorDiscoveryService,
-  SensorRegistry: () => SensorRegistry,
-  createObservation: () => createObservation,
-  endStage: () => endStage,
-  finalizeObservation: () => finalizeObservation,
-  recordSensor: () => recordSensor,
-  startStage: () => startStage
-});
-
-// src/engine/axis-observation.ts
-var import_crypto4 = require("crypto");
-function createObservation(transport, ip) {
-  return {
-    id: (0, import_crypto4.randomBytes)(16).toString("hex"),
-    startMs: Date.now(),
-    transport,
-    ip,
-    stages: [],
-    sensors: [],
-    facts: {}
-  };
-}
-function startStage(obs, name) {
-  const stage = { name, status: "ok", startMs: Date.now() };
-  obs.stages.push(stage);
-  return stage;
-}
-function endStage(stage, status = "ok", reason, code) {
-  stage.endMs = Date.now();
-  stage.durationMs = stage.endMs - stage.startMs;
-  stage.status = status;
-  if (reason) stage.reason = reason;
-  if (code) stage.code = code;
-}
-function recordSensor(obs, name, allowed, riskScore, durationMs, reasons, code) {
-  obs.sensors.push({ name, allowed, riskScore, durationMs, reasons, code });
-}
-function finalizeObservation(obs, decision, statusCode, resultCode) {
-  obs.endMs = Date.now();
-  obs.durationMs = obs.endMs - obs.startMs;
-  obs.decision = decision;
-  obs.statusCode = statusCode;
-  if (resultCode) obs.resultCode = resultCode;
-}
+// src/core/axis-error.ts
+var AxisError = class extends Error {
+  constructor(code, message, httpStatus = 400, details) {
+    super(message);
+    this.code = code;
+    this.httpStatus = httpStatus;
+    this.details = details;
+    this.name = "AxisError";
+  }
+};
 
 // src/engine/handler-discovery.service.ts
-var import_common7 = require("@nestjs/common");
+var import_common6 = require("@nestjs/common");
 var HandlerDiscoveryService = class {
   constructor(discovery, scanner, router) {
     this.discovery = discovery;
     this.scanner = scanner;
     this.router = router;
-    this.logger = new import_common7.Logger(HandlerDiscoveryService.name);
+    this.logger = new import_common6.Logger(HandlerDiscoveryService.name);
   }
   onModuleInit() {
     const providers = this.discovery.getProviders();
@@ -3308,6 +3179,7 @@ var HandlerDiscoveryService = class {
       const proto = Object.getPrototypeOf(instance);
       const methods = this.scanner.getAllMethodNames(proto);
       let registered = 0;
+      const handlerSensors = Reflect.getMetadata(HANDLER_SENSORS_KEY, metatype) || [];
       for (const methodName of methods) {
         const meta = Reflect.getMetadata(
           INTENT_METADATA_KEY,
@@ -3323,7 +3195,12 @@ var HandlerDiscoveryService = class {
           registered++;
           totalIntents++;
         }
-        this.router.registerIntentMeta(meta.intent, proto, methodName);
+        this.router.registerIntentMeta(
+          meta.intent,
+          proto,
+          methodName,
+          handlerSensors
+        );
       }
       if (registered > 0) {
         this.logger.log(
@@ -3337,34 +3214,17 @@ var HandlerDiscoveryService = class {
   }
 };
 HandlerDiscoveryService = __decorateClass([
-  (0, import_common7.Injectable)()
+  (0, import_common6.Injectable)()
 ], HandlerDiscoveryService);
 
-// src/engine/sensor-bands.ts
-var BAND = {
-  /** Pre-decode: raw byte validation, geo, budget, magic */
-  WIRE: 0,
-  /** Post-decode: identity resolution, capsule, proof */
-  IDENTITY: 40,
-  /** Post-decode: authorization, signature, rate limiting */
-  POLICY: 90,
-  /** Post-decode: content validation, TLV, schema, files */
-  CONTENT: 140,
-  /** Post-decode: business logic sensors, streams, WS */
-  BUSINESS: 200,
-  /** Post-decode: audit, logging (always last) */
-  AUDIT: 900
-};
-var PRE_DECODE_BOUNDARY = 40;
-
 // src/engine/sensor-discovery.service.ts
-var import_common8 = require("@nestjs/common");
+var import_common7 = require("@nestjs/common");
 var SensorDiscoveryService = class {
   constructor(discovery, reflector, registry) {
     this.discovery = discovery;
     this.reflector = reflector;
     this.registry = registry;
-    this.logger = new import_common8.Logger(SensorDiscoveryService.name);
+    this.logger = new import_common7.Logger(SensorDiscoveryService.name);
   }
   onApplicationBootstrap() {
     const providers = this.discovery.getProviders();
@@ -3395,16 +3255,16 @@ var SensorDiscoveryService = class {
   }
 };
 SensorDiscoveryService = __decorateClass([
-  (0, import_common8.Injectable)()
+  (0, import_common7.Injectable)()
 ], SensorDiscoveryService);
 
 // src/engine/registry/sensor.registry.ts
-var import_common9 = require("@nestjs/common");
+var import_common8 = require("@nestjs/common");
 var SensorRegistry = class {
   constructor(configService) {
     this.configService = configService;
     this.sensors = [];
-    this.logger = new import_common9.Logger(SensorRegistry.name);
+    this.logger = new import_common8.Logger(SensorRegistry.name);
   }
   /**
    * Registers a new sensor in the registry.
@@ -3449,89 +3309,634 @@ var SensorRegistry = class {
         `AxisSensor "${sensor.name}" is marked as POST_DECODE but has order ${sensor.order} (should be >= 40)`
       );
     }
-    this.sensors.push(sensor);
-    const phaseLabel = typeof sensor.phase === "string" ? sensor.phase : sensor.phase?.phase || "UNKNOWN";
-    this.logger.debug(
-      `Registered sensor: ${sensor.name} (order: ${sensor.order}, phase: ${phaseLabel})`
-    );
-  }
-  /**
-   * Returns all registered sensors, sorted by their execution order.
-   *
-   * @returns {AxisSensor[]} A sorted array of sensors
-   */
-  list() {
-    return [...this.sensors].sort(
-      (a, b) => (a.order ?? 999) - (b.order ?? 999)
-    );
+    this.sensors.push(sensor);
+    const phaseLabel = typeof sensor.phase === "string" ? sensor.phase : sensor.phase?.phase || "UNKNOWN";
+    this.logger.debug(
+      `Registered sensor: ${sensor.name} (order: ${sensor.order}, phase: ${phaseLabel})`
+    );
+  }
+  /**
+   * Returns all registered sensors, sorted by their execution order.
+   *
+   * @returns {AxisSensor[]} A sorted array of sensors
+   */
+  list() {
+    return [...this.sensors].sort(
+      (a, b) => (a.order ?? 999) - (b.order ?? 999)
+    );
+  }
+  /**
+   * Returns only pre-decode sensors (order < 40).
+   * These sensors run in middleware on raw bytes before frame decoding.
+   *
+   * @returns {AxisPreSensor[]} Pre-decode sensors sorted by order
+   */
+  getPreDecodeSensors() {
+    return this.list().filter((s) => (s.order ?? 999) < 40);
+  }
+  /**
+   * Returns only post-decode sensors (order >= 40).
+   * These sensors run in the controller on fully decoded frames.
+   *
+   * @returns {AxisPostSensor[]} Post-decode sensors sorted by order
+   */
+  getPostDecodeSensors() {
+    return this.list().filter(
+      (s) => (s.order ?? 999) >= 40
+    );
+  }
+  /**
+   * Helper: Check if a sensor is a pre-decode sensor.
+   *
+   * @private
+   * @param {AxisSensor} sensor - The sensor to check
+   * @returns {boolean} True if sensor is pre-decode
+   */
+  isPreDecodeSensor(sensor) {
+    const phase = typeof sensor.phase === "string" ? sensor.phase : sensor.phase?.phase;
+    return phase === "PRE_DECODE" || (sensor.order ?? 999) < 40;
+  }
+  /**
+   * Helper: Check if a sensor is a post-decode sensor.
+   *
+   * @private
+   * @param {AxisSensor} sensor - The sensor to check
+   * @returns {boolean} True if sensor is post-decode
+   */
+  isPostDecodeSensor(sensor) {
+    const phase = typeof sensor.phase === "string" ? sensor.phase : sensor.phase?.phase;
+    return phase === "POST_DECODE" || (sensor.order ?? 999) >= 40;
+  }
+  /**
+   * Returns sensor count by phase.
+   * Useful for diagnostics and monitoring.
+   *
+   * @returns {{preDecodeCount: number, postDecodeCount: number}}
+   */
+  getSensorCountByPhase() {
+    return {
+      preDecodeCount: this.getPreDecodeSensors().length,
+      postDecodeCount: this.getPostDecodeSensors().length
+    };
+  }
+  /**
+   * Clears all registered sensors.
+   * Useful for testing.
+   *
+   * @internal
+   */
+  clear() {
+    this.sensors = [];
+  }
+};
+SensorRegistry = __decorateClass([
+  (0, import_common8.Injectable)()
+], SensorRegistry);
+
+// src/engine/axis-observation.ts
+var import_crypto5 = require("crypto");
+function createObservation(transport, ip) {
+  return {
+    id: (0, import_crypto5.randomBytes)(16).toString("hex"),
+    startMs: Date.now(),
+    transport,
+    ip,
+    stages: [],
+    sensors: [],
+    facts: {}
+  };
+}
+function startStage(obs, name) {
+  const stage = { name, status: "ok", startMs: Date.now() };
+  obs.stages.push(stage);
+  return stage;
+}
+function endStage(stage, status = "ok", reason, code) {
+  stage.endMs = Date.now();
+  stage.durationMs = stage.endMs - stage.startMs;
+  stage.status = status;
+  if (reason) stage.reason = reason;
+  if (code) stage.code = code;
+}
+function recordSensor(obs, name, allowed, riskScore, durationMs, reasons, code) {
+  obs.sensors.push({ name, allowed, riskScore, durationMs, reasons, code });
+}
+function finalizeObservation(obs, decision, statusCode, resultCode) {
+  obs.endMs = Date.now();
+  obs.durationMs = obs.endMs - obs.startMs;
+  obs.decision = decision;
+  obs.statusCode = statusCode;
+  if (resultCode) obs.resultCode = resultCode;
+}
+
+// src/security/axis-sensor-chain.service.ts
+var import_common9 = require("@nestjs/common");
+var AxisSensorChainService = class {
+  constructor(registry) {
+    this.registry = registry;
+  }
+  /**
+   * Evaluate all applicable sensors based on phase.
+   */
+  async evaluate(input, phase = "POST_DECODE", baseDecision) {
+    if (phase === "PRE_DECODE") {
+      return this.evaluateSensors(this.registry.getPreDecodeSensors(), input);
+    }
+    if (phase === "BOTH") {
+      const rawPreResult = await this.evaluateSensors(
+        this.registry.getPreDecodeSensors(),
+        input
+      );
+      const preResult = normalizeSensorDecision(rawPreResult);
+      if (!preResult.allow) return rawPreResult;
+      return this.evaluateSensors(
+        this.registry.getPostDecodeSensors(),
+        input,
+        rawPreResult
+      );
+    }
+    return this.evaluateSensors(
+      this.registry.getPostDecodeSensors(),
+      input,
+      baseDecision
+    );
+  }
+  /** Run only pre-decode sensors. */
+  async evaluatePre(input) {
+    return this.evaluateSensors(this.registry.getPreDecodeSensors(), input);
+  }
+  /** Run only post-decode sensors. */
+  async evaluatePost(input, baseDecision) {
+    return this.evaluateSensors(
+      this.registry.getPostDecodeSensors(),
+      input,
+      baseDecision
+    );
+  }
+  async evaluateSensors(sensors, input, baseDecision) {
+    const relevantSensors = sensors.filter(
+      (s) => !s.supports || s.supports(input)
+    );
+    const normalizedBase = baseDecision ? normalizeSensorDecision(baseDecision) : void 0;
+    let riskScore = normalizedBase?.riskScore ?? 0;
+    const reasons = normalizedBase?.reasons ? [...normalizedBase.reasons] : [];
+    const tags = normalizedBase?.tags ? { ...normalizedBase.tags } : {};
+    let expSecondsMax = normalizedBase?.tighten?.expSecondsMax;
+    let constraintsPatch = normalizedBase?.tighten?.constraintsPatch ? { ...normalizedBase.tighten.constraintsPatch } : {};
+    for (const sensor of relevantSensors) {
+      try {
+        const t0 = Date.now();
+        const rawDecision = await sensor.run(input);
+        const elapsed = Date.now() - t0;
+        const decision = normalizeSensorDecision(rawDecision);
+        const obs = input.metadata?.observation;
+        if (obs) {
+          recordSensor(
+            obs,
+            sensor.name,
+            decision.allow,
+            decision.riskScore,
+            elapsed,
+            decision.reasons,
+            decision.allow ? void 0 : decision.code
+          );
+        }
+        if (!decision.allow) {
+          return {
+            allow: false,
+            riskScore: Math.min(100, riskScore + decision.riskScore),
+            reasons: [...reasons, ...decision.reasons],
+            tags
+          };
+        }
+        riskScore = Math.min(100, riskScore + decision.riskScore);
+        reasons.push(...decision.reasons);
+        if (decision.tags) {
+          Object.assign(tags, decision.tags);
+        }
+        if (decision.tighten?.expSecondsMax !== void 0) {
+          expSecondsMax = expSecondsMax === void 0 ? decision.tighten.expSecondsMax : Math.min(expSecondsMax, decision.tighten.expSecondsMax);
+        }
+        if (decision.tighten?.constraintsPatch) {
+          constraintsPatch = {
+            ...constraintsPatch,
+            ...decision.tighten.constraintsPatch
+          };
+        }
+      } catch (error) {
+        console.error(`[AXIS][SENSOR] ${sensor.name} failed:`, error);
+        const obs = input.metadata?.observation;
+        if (obs) {
+          recordSensor(obs, sensor.name, false, 100, 0, [
+            `sensor_error:${sensor.name}`
+          ]);
+        }
+        return {
+          allow: false,
+          riskScore: 100,
+          reasons: [`sensor_error:${sensor.name}`]
+        };
+      }
+    }
+    const tightenPatch = Object.keys(constraintsPatch).length > 0 ? constraintsPatch : void 0;
+    return {
+      allow: true,
+      riskScore,
+      reasons,
+      tags,
+      tighten: expSecondsMax !== void 0 || tightenPatch ? {
+        expSecondsMax,
+        constraintsPatch: tightenPatch
+      } : void 0
+    };
+  }
+};
+AxisSensorChainService = __decorateClass([
+  (0, import_common9.Injectable)()
+], AxisSensorChainService);
+
+// src/core/index.ts
+var core_exports = {};
+__export(core_exports, {
+  AXIS_MAGIC: () => import_axis_protocol2.AXIS_MAGIC,
+  AXIS_VERSION: () => import_axis_protocol2.AXIS_VERSION,
+  AxisError: () => AxisError,
+  AxisFrameZ: () => AxisFrameZ,
+  BodyProfile: () => import_axis_protocol2.BodyProfile,
+  ERR_BAD_SIGNATURE: () => import_axis_protocol2.ERR_BAD_SIGNATURE,
+  ERR_CONTRACT_VIOLATION: () => import_axis_protocol2.ERR_CONTRACT_VIOLATION,
+  ERR_INVALID_PACKET: () => import_axis_protocol2.ERR_INVALID_PACKET,
+  ERR_REPLAY_DETECTED: () => import_axis_protocol2.ERR_REPLAY_DETECTED,
+  FLAG_BODY_TLV: () => import_axis_protocol2.FLAG_BODY_TLV,
+  FLAG_CHAIN_REQ: () => import_axis_protocol2.FLAG_CHAIN_REQ,
+  FLAG_HAS_WITNESS: () => import_axis_protocol2.FLAG_HAS_WITNESS,
+  MAX_BODY_LEN: () => import_axis_protocol2.MAX_BODY_LEN,
+  MAX_FRAME_LEN: () => import_axis_protocol2.MAX_FRAME_LEN,
+  MAX_HDR_LEN: () => import_axis_protocol2.MAX_HDR_LEN,
+  MAX_SIG_LEN: () => import_axis_protocol2.MAX_SIG_LEN,
+  NCERT_ALG: () => import_axis_protocol2.NCERT_ALG,
+  NCERT_EXP: () => import_axis_protocol2.NCERT_EXP,
+  NCERT_ISSUER_KID: () => import_axis_protocol2.NCERT_ISSUER_KID,
+  NCERT_KID: () => import_axis_protocol2.NCERT_KID,
+  NCERT_NBF: () => import_axis_protocol2.NCERT_NBF,
+  NCERT_NODE_ID: () => import_axis_protocol2.NCERT_NODE_ID,
+  NCERT_PAYLOAD: () => import_axis_protocol2.NCERT_PAYLOAD,
+  NCERT_PUB: () => import_axis_protocol2.NCERT_PUB,
+  NCERT_SCOPE: () => import_axis_protocol2.NCERT_SCOPE,
+  NCERT_SIG: () => import_axis_protocol2.NCERT_SIG,
+  PROOF_CAPSULE: () => import_axis_protocol2.PROOF_CAPSULE,
+  PROOF_JWT: () => import_axis_protocol2.PROOF_JWT,
+  PROOF_LOOM: () => import_axis_protocol2.PROOF_LOOM,
+  PROOF_MTLS: () => import_axis_protocol2.PROOF_MTLS,
+  PROOF_NONE: () => import_axis_protocol2.PROOF_NONE,
+  PROOF_WITNESS: () => import_axis_protocol2.PROOF_WITNESS,
+  ProofType: () => import_axis_protocol2.ProofType,
+  TLV: () => import_axis_protocol.TLV,
+  TLV_ACTOR_ID: () => import_axis_protocol2.TLV_ACTOR_ID,
+  TLV_AUD: () => import_axis_protocol2.TLV_AUD,
+  TLV_BODY_ARR: () => import_axis_protocol2.TLV_BODY_ARR,
+  TLV_BODY_OBJ: () => import_axis_protocol2.TLV_BODY_OBJ,
+  TLV_CAPSULE: () => import_axis_protocol2.TLV_CAPSULE,
+  TLV_EFFECT: () => import_axis_protocol2.TLV_EFFECT,
+  TLV_ERROR_CODE: () => import_axis_protocol2.TLV_ERROR_CODE,
+  TLV_ERROR_MSG: () => import_axis_protocol2.TLV_ERROR_MSG,
+  TLV_INDEX: () => import_axis_protocol2.TLV_INDEX,
+  TLV_INTENT: () => import_axis_protocol2.TLV_INTENT,
+  TLV_KID: () => import_axis_protocol2.TLV_KID,
+  TLV_LOOM_PRESENCE_ID: () => import_axis_protocol2.TLV_LOOM_PRESENCE_ID,
+  TLV_LOOM_THREAD_HASH: () => import_axis_protocol2.TLV_LOOM_THREAD_HASH,
+  TLV_LOOM_WRIT: () => import_axis_protocol2.TLV_LOOM_WRIT,
+  TLV_NODE: () => import_axis_protocol2.TLV_NODE,
+  TLV_NODE_CERT_HASH: () => import_axis_protocol2.TLV_NODE_CERT_HASH,
+  TLV_NODE_KID: () => import_axis_protocol2.TLV_NODE_KID,
+  TLV_NONCE: () => import_axis_protocol2.TLV_NONCE,
+  TLV_OFFSET: () => import_axis_protocol2.TLV_OFFSET,
+  TLV_OK: () => import_axis_protocol2.TLV_OK,
+  TLV_PID: () => import_axis_protocol2.TLV_PID,
+  TLV_PREV_HASH: () => import_axis_protocol2.TLV_PREV_HASH,
+  TLV_PROOF_REF: () => import_axis_protocol2.TLV_PROOF_REF,
+  TLV_PROOF_TYPE: () => import_axis_protocol2.TLV_PROOF_TYPE,
+  TLV_REALM: () => import_axis_protocol2.TLV_REALM,
+  TLV_RECEIPT_HASH: () => import_axis_protocol2.TLV_RECEIPT_HASH,
+  TLV_RID: () => import_axis_protocol2.TLV_RID,
+  TLV_SHA256_CHUNK: () => import_axis_protocol2.TLV_SHA256_CHUNK,
+  TLV_TRACE_ID: () => import_axis_protocol2.TLV_TRACE_ID,
+  TLV_TS: () => import_axis_protocol2.TLV_TS,
+  TLV_UPLOAD_ID: () => import_axis_protocol2.TLV_UPLOAD_ID,
+  computeReceiptHash: () => computeReceiptHash,
+  computeSignaturePayload: () => computeSignaturePayload,
+  decodeArray: () => import_axis_protocol.decodeArray,
+  decodeFrame: () => decodeFrame,
+  decodeObject: () => import_axis_protocol.decodeObject,
+  decodeTLVs: () => import_axis_protocol.decodeTLVs,
+  decodeTLVsList: () => import_axis_protocol.decodeTLVsList,
+  decodeVarint: () => import_axis_protocol3.decodeVarint,
+  encodeFrame: () => encodeFrame,
+  encodeTLVs: () => import_axis_protocol.encodeTLVs,
+  encodeVarint: () => import_axis_protocol3.encodeVarint,
+  generateEd25519KeyPair: () => generateEd25519KeyPair,
+  getSignTarget: () => getSignTarget,
+  sha256: () => sha256,
+  signFrame: () => signFrame,
+  varintLength: () => import_axis_protocol3.varintLength,
+  verifyFrameSignature: () => verifyFrameSignature
+});
+
+// src/crypto/index.ts
+var crypto_exports = {};
+__export(crypto_exports, {
+  ProofVerificationService: () => ProofVerificationService,
+  b64urlDecode: () => b64urlDecode,
+  b64urlDecodeString: () => b64urlDecodeString,
+  b64urlEncode: () => b64urlEncode,
+  b64urlEncodeString: () => b64urlEncodeString,
+  canonicalJson: () => canonicalJson,
+  canonicalJsonExcluding: () => canonicalJsonExcluding
+});
+
+// src/crypto/proof-verification.service.ts
+var import_common10 = require("@nestjs/common");
+var crypto3 = __toESM(require("crypto"));
+var nacl = __toESM(require("tweetnacl"));
+var ProofVerificationService = class {
+  constructor() {
+    this.logger = new import_common10.Logger(ProofVerificationService.name);
+    // Cache of registered device public keys (deviceId -> pubKey)
+    this.deviceKeys = /* @__PURE__ */ new Map();
+    // Cache of trusted mTLS certificate fingerprints
+    this.trustedCerts = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Verifies an authentication proof based on its type.
+   *
+   * **Supported Types:**
+   * - 1 (CAPSULE): Delegated to `verifyCapsuleProof`
+   * - 2 (JWT): Verified by `verifyJWTProof`
+   * - 3 (MTLS_ID): Verified by `verifyMTLSProof`
+   * - 4 (DEVICE_SE): Verified by `verifyDeviceSEProof`
+   *
+   * @param {ProofType} proofType - The numeric AXIS proof type
+   * @param {Uint8Array} proofRef - The binary reference or token for the proof
+   * @param {Object} context - Additional metadata required for specific proof types
+   * @param {Uint8Array} [context.signTarget] - The canonical bytes that were signed (for Ed25519)
+   * @param {Uint8Array} [context.signature] - The signature to verify (for Ed25519)
+   * @param {MTLSContext} [context.mtls] - mTLS certificate data
+   * @param {DeviceSEContext} [context.deviceSE] - Device Secure Element information
+   * @returns {Promise<ProofVerificationResult>} The outcome of the verification
+   */
+  async verifyProof(proofType, proofRef, context) {
+    switch (proofType) {
+      case 1:
+        return this.verifyCapsuleProof(proofRef);
+      case 2:
+        return this.verifyJWTProof(proofRef);
+      case 3:
+        return this.verifyMTLSProof(context.mtls);
+      case 4:
+        return this.verifyDeviceSEProof(
+          context.signTarget,
+          context.signature,
+          context.deviceSE
+        );
+      default:
+        return { valid: false, error: `Unknown proof type: ${proofType}` };
+    }
+  }
+  /**
+   * Verify CAPSULE proof (delegated to CapsuleService)
+   */
+  async verifyCapsuleProof(proofRef) {
+    const capsuleId = new TextDecoder().decode(proofRef);
+    return {
+      valid: true,
+      metadata: { capsuleId, requiresCapsuleValidation: true }
+    };
+  }
+  /**
+   * Verifies a JSON Web Token (JWT) proof.
+   *
+   * **Validation Logic:**
+   * 1. Decodes the token string.
+   * 2. Checks for valid 3-part JWT structure.
+   * 3. Validates `exp` (expiration) and `nbf` (not before) claims.
+   * 4. Extracts `actor_id` or `sub` as the identity.
+   *
+   * @param {Uint8Array} proofRef - Binary representation of the JWT string
+   * @returns {Promise<ProofVerificationResult>} Result including the actor identifier
+   */
+  async verifyJWTProof(proofRef) {
+    try {
+      const token = new TextDecoder().decode(proofRef);
+      const parts = token.split(".");
+      if (parts.length !== 3) {
+        return { valid: false, error: "Invalid JWT format" };
+      }
+      const header = JSON.parse(Buffer.from(parts[0], "base64url").toString());
+      const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+      if (payload.exp && Date.now() / 1e3 > payload.exp) {
+        return { valid: false, error: "JWT expired" };
+      }
+      if (payload.nbf && Date.now() / 1e3 < payload.nbf) {
+        return { valid: false, error: "JWT not yet valid" };
+      }
+      return {
+        valid: true,
+        actorId: payload.sub || payload.actor_id,
+        metadata: { iss: payload.iss, scope: payload.scope }
+      };
+    } catch (e) {
+      const message = e instanceof Error ? e.message : "Unknown error";
+      return { valid: false, error: `JWT parse error: ${message}` };
+    }
+  }
+  /**
+   * Verify mTLS client certificate proof
+   */
+  async verifyMTLSProof(mtls) {
+    if (!mtls) {
+      return { valid: false, error: "No mTLS context provided" };
+    }
+    if (!mtls.verified) {
+      return { valid: false, error: "mTLS not verified by TLS terminator" };
+    }
+    if (mtls.clientCertFingerprint) {
+      const trusted = this.trustedCerts.get(mtls.clientCertFingerprint);
+      if (trusted) {
+        return {
+          valid: true,
+          actorId: trusted.actorId,
+          metadata: {
+            fingerprint: mtls.clientCertFingerprint,
+            subject: mtls.clientCertSubject
+          }
+        };
+      }
+    }
+    if (mtls.clientCertSubject) {
+      const cnMatch = mtls.clientCertSubject.match(/CN=([^,]+)/);
+      if (cnMatch) {
+        return {
+          valid: true,
+          actorId: cnMatch[1],
+          metadata: {
+            subject: mtls.clientCertSubject,
+            issuer: mtls.clientCertIssuer
+          }
+        };
+      }
+    }
+    return { valid: false, error: "Could not extract actor from certificate" };
   }
   /**
-   * Returns only pre-decode sensors (order < 40).
-   * These sensors run in middleware on raw bytes before frame decoding.
-   *
-   * @returns {AxisPreSensor[]} Pre-decode sensors sorted by order
+   * Verify Device Secure Element signature
    */
-  getPreDecodeSensors() {
-    return this.list().filter((s) => (s.order ?? 999) < 40);
+  async verifyDeviceSEProof(signTarget, signature, deviceSE) {
+    if (!deviceSE || !signTarget || !signature) {
+      return { valid: false, error: "Missing Device SE context" };
+    }
+    let publicKey = deviceSE.publicKey;
+    const registeredKey = this.deviceKeys.get(deviceSE.deviceId);
+    if (registeredKey) {
+      publicKey = registeredKey;
+    }
+    if (!publicKey || publicKey.length !== 32) {
+      return {
+        valid: false,
+        error: "Invalid or unregistered device public key"
+      };
+    }
+    try {
+      const valid = nacl.sign.detached.verify(signTarget, signature, publicKey);
+      if (!valid) {
+        return { valid: false, error: "Device signature verification failed" };
+      }
+      return {
+        valid: true,
+        actorId: deviceSE.deviceId,
+        metadata: { deviceId: deviceSE.deviceId, proofType: "DEVICE_SE" }
+      };
+    } catch (e) {
+      const message = e instanceof Error ? e.message : "Unknown error";
+      return {
+        valid: false,
+        error: `Signature verification error: ${message}`
+      };
+    }
   }
   /**
-   * Returns only post-decode sensors (order >= 40).
-   * These sensors run in the controller on fully decoded frames.
+   * Registers a public key for a trusted device.
+   * This key will be used for future `DEVICE_SE` proof verifications.
    *
-   * @returns {AxisPostSensor[]} Post-decode sensors sorted by order
+   * @param {string} deviceId - Unique identifier for the device
+   * @param {Uint8Array} publicKey - 32-byte Ed25519 public key
+   * @throws {Error} If the public key is not 32 bytes
    */
-  getPostDecodeSensors() {
-    return this.list().filter(
-      (s) => (s.order ?? 999) >= 40
-    );
+  registerDeviceKey(deviceId, publicKey) {
+    if (publicKey.length !== 32) {
+      throw new Error("Device public key must be 32 bytes (Ed25519)");
+    }
+    this.deviceKeys.set(deviceId, publicKey);
+    this.logger.log(`Registered device key for ${deviceId}`);
   }
   /**
-   * Helper: Check if a sensor is a pre-decode sensor.
-   *
-   * @private
-   * @param {AxisSensor} sensor - The sensor to check
-   * @returns {boolean} True if sensor is pre-decode
+   * Unregister a device
    */
-  isPreDecodeSensor(sensor) {
-    const phase = typeof sensor.phase === "string" ? sensor.phase : sensor.phase?.phase;
-    return phase === "PRE_DECODE" || (sensor.order ?? 999) < 40;
+  unregisterDevice(deviceId) {
+    return this.deviceKeys.delete(deviceId);
   }
   /**
-   * Helper: Check if a sensor is a post-decode sensor.
+   * Registers a trusted mTLS certificate fingerprint and associates it with an actor.
    *
-   * @private
-   * @param {AxisSensor} sensor - The sensor to check
-   * @returns {boolean} True if sensor is post-decode
+   * @param {string} fingerprint - SHA-256 fingerprint of the client certificate
+   * @param {string} actorId - The actor to associate with this certificate
    */
-  isPostDecodeSensor(sensor) {
-    const phase = typeof sensor.phase === "string" ? sensor.phase : sensor.phase?.phase;
-    return phase === "POST_DECODE" || (sensor.order ?? 999) >= 40;
+  registerMTLSCert(fingerprint, actorId) {
+    this.trustedCerts.set(fingerprint, { actorId, issuedAt: Date.now() });
+    this.logger.log(`Registered mTLS cert ${fingerprint} for actor ${actorId}`);
   }
   /**
-   * Returns sensor count by phase.
-   * Useful for diagnostics and monitoring.
-   *
-   * @returns {{preDecodeCount: number, postDecodeCount: number}}
+   * Revoke an mTLS certificate
    */
-  getSensorCountByPhase() {
-    return {
-      preDecodeCount: this.getPreDecodeSensors().length,
-      postDecodeCount: this.getPostDecodeSensors().length
-    };
+  revokeMTLSCert(fingerprint) {
+    return this.trustedCerts.delete(fingerprint);
   }
   /**
-   * Clears all registered sensors.
-   * Useful for testing.
-   *
-   * @internal
+   * Calculate certificate fingerprint (SHA-256)
    */
-  clear() {
-    this.sensors = [];
+  static calculateFingerprint(certPem) {
+    const der = Buffer.from(
+      certPem.replace(/-----BEGIN CERTIFICATE-----/, "").replace(/-----END CERTIFICATE-----/, "").replace(/\s/g, ""),
+      "base64"
+    );
+    return crypto3.createHash("sha256").update(der).digest("hex");
   }
 };
-SensorRegistry = __decorateClass([
-  (0, import_common9.Injectable)()
-], SensorRegistry);
+ProofVerificationService = __decorateClass([
+  (0, import_common10.Injectable)()
+], ProofVerificationService);
+
+// src/decorators/index.ts
+var decorators_exports = {};
+__export(decorators_exports, {
+  AxisContext: () => AxisContext,
+  AxisDemoPubkey: () => AxisDemoPubkey,
+  AxisFrame: () => AxisFrame3,
+  AxisIp: () => AxisIp,
+  AxisRaw: () => AxisRaw,
+  HANDLER_METADATA_KEY: () => HANDLER_METADATA_KEY,
+  Handler: () => Handler,
+  INTENT_BODY_KEY: () => INTENT_BODY_KEY,
+  INTENT_METADATA_KEY: () => INTENT_METADATA_KEY,
+  INTENT_ROUTES_KEY: () => INTENT_ROUTES_KEY,
+  INTENT_SENSORS_KEY: () => INTENT_SENSORS_KEY,
+  Intent: () => Intent,
+  IntentBody: () => IntentBody,
+  IntentSensors: () => IntentSensors,
+  SENSOR_METADATA_KEY: () => SENSOR_METADATA_KEY,
+  Sensor: () => Sensor,
+  TLV_FIELDS_KEY: () => TLV_FIELDS_KEY,
+  TLV_VALIDATORS_KEY: () => TLV_VALIDATORS_KEY,
+  TlvEnum: () => TlvEnum,
+  TlvField: () => TlvField,
+  TlvMinLen: () => TlvMinLen,
+  TlvRange: () => TlvRange,
+  TlvUtf8Pattern: () => TlvUtf8Pattern,
+  TlvValidate: () => TlvValidate,
+  buildDtoDecoder: () => buildDtoDecoder,
+  extractDtoSchema: () => extractDtoSchema
+});
+
+// src/engine/index.ts
+var engine_exports = {};
+__export(engine_exports, {
+  BAND: () => BAND,
+  HandlerDiscoveryService: () => HandlerDiscoveryService,
+  IntentRouter: () => IntentRouter,
+  PRE_DECODE_BOUNDARY: () => PRE_DECODE_BOUNDARY,
+  SensorDiscoveryService: () => SensorDiscoveryService,
+  SensorRegistry: () => SensorRegistry,
+  createObservation: () => createObservation,
+  endStage: () => endStage,
+  finalizeObservation: () => finalizeObservation,
+  observation: () => observation_exports,
+  recordSensor: () => recordSensor,
+  startStage: () => startStage
+});
+
+// src/engine/observation/index.ts
+var observation_exports = {};
+__export(observation_exports, {
+  buildQueueMessage: () => buildQueueMessage,
+  buildUnsignedWitness: () => buildUnsignedWitness,
+  canonicalizeObservation: () => canonicalizeObservation,
+  decodeQueueMessage: () => decodeQueueMessage,
+  encodeQueueMessage: () => encodeQueueMessage,
+  hashObservation: () => hashObservation,
+  parseAutoClaimEntries: () => parseAutoClaimEntries,
+  parseStreamEntries: () => parseStreamEntries,
+  stableJsonStringify: () => stableJsonStringify,
+  verifyResponse: () => verifyResponse
+});
 
 // src/loom/index.ts
 var loom_exports = {};
@@ -3901,7 +4306,7 @@ var AxisErrorZ = z2.object({
 });
 
 // src/schemas/body-profile.validator.ts
-var import_common10 = require("@nestjs/common");
+var import_common11 = require("@nestjs/common");
 var BodyProfile2 = /* @__PURE__ */ ((BodyProfile3) => {
   BodyProfile3[BodyProfile3["RAW"] = 0] = "RAW";
   BodyProfile3[BodyProfile3["TLV_MAP"] = 1] = "TLV_MAP";
@@ -3911,7 +4316,7 @@ var BodyProfile2 = /* @__PURE__ */ ((BodyProfile3) => {
 })(BodyProfile2 || {});
 var BodyProfileValidator = class {
   constructor() {
-    this.logger = new import_common10.Logger(BodyProfileValidator.name);
+    this.logger = new import_common11.Logger(BodyProfileValidator.name);
   }
   /**
    * Validate body matches declared profile
@@ -4027,12 +4432,13 @@ var BodyProfileValidator = class {
   }
 };
 BodyProfileValidator = __decorateClass([
-  (0, import_common10.Injectable)()
+  (0, import_common11.Injectable)()
 ], BodyProfileValidator);
 
 // src/security/index.ts
 var security_exports = {};
 __export(security_exports, {
+  AxisSensorChainService: () => AxisSensorChainService,
   CAPABILITIES: () => CAPABILITIES,
   INTENT_REQUIREMENTS: () => INTENT_REQUIREMENTS,
   PROOF_CAPABILITIES: () => PROOF_CAPABILITIES,
@@ -4065,7 +4471,7 @@ __export(sensors_exports, {
 });
 
 // src/sensors/access-profile-resolver.sensor.ts
-var import_common11 = require("@nestjs/common");
+var import_common12 = require("@nestjs/common");
 var AccessProfileResolverSensor = class {
   constructor() {
     /** AxisSensor identifier */
@@ -4091,11 +4497,11 @@ var AccessProfileResolverSensor = class {
 };
 AccessProfileResolverSensor = __decorateClass([
   Sensor(),
-  (0, import_common11.Injectable)()
+  (0, import_common12.Injectable)()
 ], AccessProfileResolverSensor);
 
 // src/sensors/body-budget.sensor.ts
-var import_common12 = require("@nestjs/common");
+var import_common13 = require("@nestjs/common");
 var BodyBudgetSensor = class {
   constructor() {
     /** AxisSensor identifier */
@@ -4169,14 +4575,14 @@ var BodyBudgetSensor = class {
 };
 BodyBudgetSensor = __decorateClass([
   Sensor(),
-  (0, import_common12.Injectable)()
+  (0, import_common13.Injectable)()
 ], BodyBudgetSensor);
 
 // src/sensors/capability-enforcement.sensor.ts
-var import_common13 = require("@nestjs/common");
+var import_common14 = require("@nestjs/common");
 var CapabilityEnforcementSensor = class {
   constructor() {
-    this.logger = new import_common13.Logger(CapabilityEnforcementSensor.name);
+    this.logger = new import_common14.Logger(CapabilityEnforcementSensor.name);
     /** AxisSensor identifier for logging and registry */
     this.name = "CapabilityEnforcementSensor";
     /**
@@ -4270,12 +4676,12 @@ var CapabilityEnforcementSensor = class {
 };
 CapabilityEnforcementSensor = __decorateClass([
   Sensor(),
-  (0, import_common13.Injectable)()
+  (0, import_common14.Injectable)()
 ], CapabilityEnforcementSensor);
 
 // src/sensors/chunk-hash.sensor.ts
-var import_common14 = require("@nestjs/common");
-var import_crypto5 = require("crypto");
+var import_common15 = require("@nestjs/common");
+var import_crypto6 = require("crypto");
 var ChunkHashSensor = class {
   constructor() {
     /** Sensor identifier */
@@ -4334,7 +4740,7 @@ var ChunkHashSensor = class {
         reason: "Missing sha256Chunk TLV in header"
       };
     }
-    const actual = (0, import_crypto5.createHash)("sha256").update(bodyBytes).digest();
+    const actual = (0, import_crypto6.createHash)("sha256").update(bodyBytes).digest();
     if (!Buffer.from(actual).equals(Buffer.from(expected))) {
       return {
         action: "DENY",
@@ -4347,15 +4753,15 @@ var ChunkHashSensor = class {
 };
 ChunkHashSensor = __decorateClass([
   Sensor(),
-  (0, import_common14.Injectable)()
+  (0, import_common15.Injectable)()
 ], ChunkHashSensor);
 
 // src/sensors/entropy.sensor.ts
-var import_common15 = require("@nestjs/common");
+var import_common16 = require("@nestjs/common");
 var crypto4 = __toESM(require("crypto"));
 var EntropySensor = class {
   constructor() {
-    this.logger = new import_common15.Logger(EntropySensor.name);
+    this.logger = new import_common16.Logger(EntropySensor.name);
     /**
      * Minimum acceptable entropy in bits per byte.
      *
@@ -4525,14 +4931,14 @@ var EntropySensor = class {
 };
 EntropySensor = __decorateClass([
   Sensor(),
-  (0, import_common15.Injectable)()
+  (0, import_common16.Injectable)()
 ], EntropySensor);
 
 // src/sensors/execution-timeout.sensor.ts
-var import_common16 = require("@nestjs/common");
+var import_common17 = require("@nestjs/common");
 var ExecutionTimeoutSensor = class {
   constructor() {
-    this.logger = new import_common16.Logger(ExecutionTimeoutSensor.name);
+    this.logger = new import_common17.Logger(ExecutionTimeoutSensor.name);
     /** AxisSensor identifier */
     this.name = "ExecutionTimeoutSensor";
     /**
@@ -4610,11 +5016,11 @@ var ExecutionTimeoutSensor = class {
 };
 ExecutionTimeoutSensor = __decorateClass([
   Sensor(),
-  (0, import_common16.Injectable)()
+  (0, import_common17.Injectable)()
 ], ExecutionTimeoutSensor);
 
 // src/sensors/frame-budget.sensor.ts
-var import_common17 = require("@nestjs/common");
+var import_common18 = require("@nestjs/common");
 var FrameBudgetSensor = class {
   constructor(config) {
     this.config = config;
@@ -4673,11 +5079,11 @@ var FrameBudgetSensor = class {
 };
 FrameBudgetSensor = __decorateClass([
   Sensor({ phase: "PRE_DECODE" }),
-  (0, import_common17.Injectable)()
+  (0, import_common18.Injectable)()
 ], FrameBudgetSensor);
 
 // src/sensors/frame-header-sanity.sensor.ts
-var import_common18 = require("@nestjs/common");
+var import_common19 = require("@nestjs/common");
 var FrameHeaderSanitySensor = class {
   constructor() {
     this.name = "FrameHeaderSanitySensor";
@@ -4721,12 +5127,12 @@ var FrameHeaderSanitySensor = class {
   }
 };
 FrameHeaderSanitySensor = __decorateClass([
-  (0, import_common18.Injectable)(),
+  (0, import_common19.Injectable)(),
   Sensor({ phase: "PRE_DECODE" })
 ], FrameHeaderSanitySensor);
 
 // src/sensors/header-tlv-limit.sensor.ts
-var import_common19 = require("@nestjs/common");
+var import_common20 = require("@nestjs/common");
 var HeaderTLVLimitSensor = class {
   constructor() {
     this.name = "HeaderTLVLimitSensor";
@@ -4758,12 +5164,12 @@ var HeaderTLVLimitSensor = class {
   }
 };
 HeaderTLVLimitSensor = __decorateClass([
-  (0, import_common19.Injectable)(),
+  (0, import_common20.Injectable)(),
   Sensor()
 ], HeaderTLVLimitSensor);
 
 // src/sensors/intent-allowlist.sensor.ts
-var import_common20 = require("@nestjs/common");
+var import_common21 = require("@nestjs/common");
 var PUBLIC_INTENT_ALLOWLIST = [
   "public.",
   "schema.",
@@ -4798,12 +5204,12 @@ var IntentAllowlistSensor = class {
   }
 };
 IntentAllowlistSensor = __decorateClass([
-  (0, import_common20.Injectable)(),
+  (0, import_common21.Injectable)(),
   Sensor()
 ], IntentAllowlistSensor);
 
 // src/sensors/intent-registry.sensor.ts
-var import_common21 = require("@nestjs/common");
+var import_common22 = require("@nestjs/common");
 var IntentRegistrySensor = class {
   constructor(router) {
     this.router = router;
@@ -4826,12 +5232,12 @@ var IntentRegistrySensor = class {
   }
 };
 IntentRegistrySensor = __decorateClass([
-  (0, import_common21.Injectable)(),
+  (0, import_common22.Injectable)(),
   Sensor({ phase: "POST_DECODE" })
 ], IntentRegistrySensor);
 
 // src/sensors/proof-presence.sensor.ts
-var import_common22 = require("@nestjs/common");
+var import_common23 = require("@nestjs/common");
 var ProofPresenceSensor = class {
   constructor() {
     this.name = "ProofPresenceSensor";
@@ -4879,11 +5285,11 @@ var ProofPresenceSensor = class {
 };
 ProofPresenceSensor = __decorateClass([
   Sensor(),
-  (0, import_common22.Injectable)()
+  (0, import_common23.Injectable)()
 ], ProofPresenceSensor);
 
 // src/sensors/protocol-strict.sensor.ts
-var import_common23 = require("@nestjs/common");
+var import_common24 = require("@nestjs/common");
 var VALID_FLAGS = [
   0,
   // No flags
@@ -4901,7 +5307,7 @@ var VALID_FLAGS = [
 var ProtocolStrictSensor = class {
   constructor(config) {
     this.config = config;
-    this.logger = new import_common23.Logger(ProtocolStrictSensor.name);
+    this.logger = new import_common24.Logger(ProtocolStrictSensor.name);
     /** Sensor identifier for logging and registry */
     this.name = "ProtocolStrictSensor";
     /**
@@ -5154,11 +5560,11 @@ var ProtocolStrictSensor = class {
 };
 ProtocolStrictSensor = __decorateClass([
   Sensor({ phase: "PRE_DECODE" }),
-  (0, import_common23.Injectable)()
+  (0, import_common24.Injectable)()
 ], ProtocolStrictSensor);
 
 // src/sensors/receipt-policy.sensor.ts
-var import_common24 = require("@nestjs/common");
+var import_common25 = require("@nestjs/common");
 var ReceiptPolicySensor = class {
   constructor() {
     this.name = "ReceiptPolicySensor";
@@ -5172,12 +5578,12 @@ var ReceiptPolicySensor = class {
   }
 };
 ReceiptPolicySensor = __decorateClass([
-  (0, import_common24.Injectable)(),
+  (0, import_common25.Injectable)(),
   Sensor()
 ], ReceiptPolicySensor);
 
 // src/sensors/schema-validation.sensor.ts
-var import_common25 = require("@nestjs/common");
+var import_common26 = require("@nestjs/common");
 function readU64be(b) {
   if (b.length !== 8)
     throw new AxisError("SCHEMA_TYPE_MISMATCH", "u64 must be 8 bytes", 400);
@@ -5352,11 +5758,11 @@ var SchemaValidationSensor = class {
 };
 SchemaValidationSensor = __decorateClass([
   Sensor(),
-  (0, import_common25.Injectable)()
+  (0, import_common26.Injectable)()
 ], SchemaValidationSensor);
 
 // src/sensors/stream-scope.sensor.ts
-var import_common26 = require("@nestjs/common");
+var import_common27 = require("@nestjs/common");
 var StreamScopeSensor = class {
   constructor() {
     /** Sensor identifier */
@@ -5402,11 +5808,11 @@ var StreamScopeSensor = class {
 };
 StreamScopeSensor = __decorateClass([
   Sensor(),
-  (0, import_common26.Injectable)()
+  (0, import_common27.Injectable)()
 ], StreamScopeSensor);
 
 // src/sensors/tlv-parse.sensor.ts
-var import_common27 = require("@nestjs/common");
+var import_common28 = require("@nestjs/common");
 var TLVParseSensor = class {
   constructor() {
     this.name = "TLVParseSensor";
@@ -5508,11 +5914,11 @@ var TLVParseSensor = class {
 };
 TLVParseSensor = __decorateClass([
   Sensor(),
-  (0, import_common27.Injectable)()
+  (0, import_common28.Injectable)()
 ], TLVParseSensor);
 
 // src/sensors/varint-hardening.sensor.ts
-var import_common28 = require("@nestjs/common");
+var import_common29 = require("@nestjs/common");
 var VarintHardeningSensor = class {
   constructor() {
     /** Sensor identifier */
@@ -5575,7 +5981,7 @@ var VarintHardeningSensor = class {
 };
 VarintHardeningSensor = __decorateClass([
   Sensor({ phase: "PRE_DECODE" }),
-  (0, import_common28.Injectable)()
+  (0, import_common29.Injectable)()
 ], VarintHardeningSensor);
 
 // src/utils/index.ts
@@ -5647,14 +6053,21 @@ function toBuffer(value) {
   AXIS_UPLOAD_SESSION_STORE,
   AXIS_VERSION,
   Ats1Codec,
+  AxisContext,
+  AxisDemoPubkey,
+  AxisError,
   AxisFilesDownloadHandler,
   AxisFilesFinalizeHandler,
   AxisFrameZ,
   AxisIdDto,
+  AxisIp,
   AxisPacketTags,
   AxisPartialType,
+  AxisRaw,
   AxisResponseDto,
+  AxisSensorChainService,
   AxisTlvDto,
+  BAND,
   BodyProfile,
   CAPABILITIES,
   ContractViolationError,
@@ -5672,7 +6085,10 @@ function toBuffer(value) {
   FLAG_CHAIN_REQ,
   FLAG_HAS_WITNESS,
   HANDLER_METADATA_KEY,
+  HANDLER_SENSORS_KEY,
   Handler,
+  HandlerDiscoveryService,
+  HandlerSensors,
   INTENT_BODY_KEY,
   INTENT_METADATA_KEY,
   INTENT_REQUIREMENTS,
@@ -5699,6 +6115,7 @@ function toBuffer(value) {
   NCERT_PUB,
   NCERT_SCOPE,
   NCERT_SIG,
+  PRE_DECODE_BOUNDARY,
   PROOF_CAPABILITIES,
   PROOF_CAPSULE,
   PROOF_JWT,
@@ -5713,11 +6130,15 @@ function toBuffer(value) {
   RESPONSE_TAG_UPDATED_AT,
   RESPONSE_TAG_UPDATED_BY,
   RiskDecision,
+  SENSOR_METADATA_KEY,
   Schema2002_PasskeyLoginOptionsRes,
   Schema2011_PasskeyLoginVerifyReq,
   Schema2012_PasskeyLoginVerifyRes,
   Schema2021_PasskeyRegisterOptionsReq,
+  Sensor,
   SensorDecisions,
+  SensorDiscoveryService,
+  SensorRegistry,
   TLV,
   TLV_ACTOR_ID,
   TLV_AUD,
@@ -5766,21 +6187,26 @@ function toBuffer(value) {
   buildAts1Hdr,
   buildDtoDecoder,
   buildPacket,
+  buildQueueMessage,
   buildReceiptHash,
   buildTLVs,
+  buildUnsignedWitness,
   bytes,
   canAccessResource,
   canonicalJson,
   canonicalJsonExcluding,
+  canonicalizeObservation,
   classifyIntent,
   computeReceiptHash,
   computeSignaturePayload,
   core,
+  createObservation,
   crypto,
   decodeArray,
   decodeAxis1Frame,
   decodeFrame,
   decodeObject,
+  decodeQueueMessage,
   decodeTLVs,
   decodeTLVsList,
   decodeVarint,
@@ -5788,13 +6214,17 @@ function toBuffer(value) {
   encVarint,
   encodeAxis1Frame,
   encodeFrame,
+  encodeQueueMessage,
   encodeTLVs,
   encodeVarint,
+  endStage,
   engine,
   extractDtoSchema,
+  finalizeObservation,
   generateEd25519KeyPair,
   getSignTarget,
   hasScope,
+  hashObservation,
   isAdminOpcode,
   isKnownOpcode,
   isTimestampValid,
@@ -5806,7 +6236,10 @@ function toBuffer(value) {
   packPasskeyLoginVerifyReq,
   packPasskeyLoginVerifyRes,
   packPasskeyRegisterOptionsReq,
+  parseAutoClaimEntries,
   parseScope,
+  parseStreamEntries,
+  recordSensor,
   resolveTimeout,
   schemas,
   security,
@@ -5814,6 +6247,8 @@ function toBuffer(value) {
   sensors,
   sha256,
   signFrame,
+  stableJsonStringify,
+  startStage,
   tlv,
   u64be,
   unpackPasskeyLoginOptionsReq,
@@ -5824,6 +6259,7 @@ function toBuffer(value) {
   validateFrameShape,
   varintLength,
   varintU,
-  verifyFrameSignature
+  verifyFrameSignature,
+  verifyResponse
 });
 //# sourceMappingURL=index.js.map