@nextera.one/axis-server-sdk 1.4.0 → 1.6.0

package/dist/index.d.mts

@@ -1,11 +1,11 @@
 import { ModuleRef, DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
-import { A as AxisFrame$2 } from './index-B5xzROld.mjs';
-export { a as AxisBinaryFrame, b as AxisFrameZ, c as computeReceiptHash, d as computeSignaturePayload, i as core, e as decodeFrame, f as encodeFrame, g as generateEd25519KeyPair, h as getSignTarget, s as sha256, j as signFrame, v as verifyFrameSignature } from './index-B5xzROld.mjs';
+import { A as AxisFrame$2 } from './index-1uEwnW-w.mjs';
+export { a as AxisBinaryFrame, b as AxisError, c as AxisFrameZ, d as computeReceiptHash, e as computeSignaturePayload, i as core, f as decodeFrame, g as encodeFrame, h as generateEd25519KeyPair, j as getSignTarget, s as sha256, k as signFrame, v as verifyFrameSignature } from './index-1uEwnW-w.mjs';
 import { PROOF_LOOM, TLV_LOOM_PRESENCE_ID, TLV_LOOM_THREAD_HASH, TLV_LOOM_WRIT } from '@nextera.one/axis-protocol';
 export { AXIS_MAGIC, AXIS_VERSION, TLV as AxisTlvType, BodyProfile, ERR_BAD_SIGNATURE, ERR_CONTRACT_VIOLATION, ERR_INVALID_PACKET, ERR_REPLAY_DETECTED, FLAG_BODY_TLV, FLAG_CHAIN_REQ, FLAG_HAS_WITNESS, MAX_BODY_LEN, MAX_FRAME_LEN, MAX_HDR_LEN, MAX_SIG_LEN, NCERT_ALG, NCERT_EXP, NCERT_ISSUER_KID, NCERT_KID, NCERT_NBF, NCERT_NODE_ID, NCERT_PAYLOAD, NCERT_PUB, NCERT_SCOPE, NCERT_SIG, PROOF_CAPSULE, PROOF_JWT, PROOF_LOOM, PROOF_MTLS, PROOF_NONE, PROOF_WITNESS, ProofType, TLV, TLV_ACTOR_ID, TLV_AUD, TLV_BODY_ARR, TLV_BODY_OBJ, TLV_CAPSULE, TLV_EFFECT, TLV_ERROR_CODE, TLV_ERROR_MSG, TLV_INDEX, TLV_INTENT, TLV_KID, TLV_LOOM_PRESENCE_ID, TLV_LOOM_THREAD_HASH, TLV_LOOM_WRIT, TLV_NODE, TLV_NODE_CERT_HASH, TLV_NODE_KID, TLV_NONCE, TLV_OFFSET, TLV_OK, TLV_PID, TLV_PREV_HASH, TLV_PROOF_REF, TLV_PROOF_TYPE, TLV_REALM, TLV_RECEIPT_HASH, TLV_RID, TLV_SHA256_CHUNK, TLV_TRACE_ID, TLV_TS, TLV_UPLOAD_ID, decodeArray, decodeObject, decodeTLVs, decodeTLVsList, decodeVarint, encodeTLVs, encodeVarint, varintLength } from '@nextera.one/axis-protocol';
-import * as z from 'zod';
 import { OnModuleInit, OnApplicationBootstrap } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
+import * as z from 'zod';
 
 declare const HANDLER_METADATA_KEY = "axis:handler";
 declare function Handler(intent?: string): ClassDecorator;
@@ -48,6 +48,16 @@ declare function IntentBody(decoder: (buf: Buffer) => any): MethodDecorator;
 declare const INTENT_SENSORS_KEY = "axis:intent:sensors";
 declare function IntentSensors(sensors: Function[]): MethodDecorator;
 
+declare const HANDLER_SENSORS_KEY = "axis:handler:sensors";
+declare function HandlerSensors(sensors: Function[]): ClassDecorator;
+
+declare const SENSOR_METADATA_KEY = "axis:sensor";
+type SensorPhase = 'PRE_DECODE' | 'POST_DECODE';
+interface SensorOptions {
+    phase?: SensorPhase;
+}
+declare function Sensor(options?: SensorOptions): ClassDecorator;
+
 declare const TLV_FIELDS_KEY = "axis:tlv:fields";
 declare const TLV_VALIDATORS_KEY = "axis:tlv:validators";
 type TlvFieldKind = 'utf8' | 'u64' | 'bytes' | 'bytes16' | 'bool' | 'obj' | 'arr';
@@ -92,31 +102,608 @@ declare class AxisIdDto extends AxisTlvDto {
 
 declare function AxisPartialType<T extends new (...args: any[]) => AxisTlvDto>(BaseDto: T): new (...args: any[]) => Partial<InstanceType<T>> & AxisTlvDto;
 
-declare const RESPONSE_TAG_ID = 1;
-declare const RESPONSE_TAG_CREATED_AT = 2;
-declare const RESPONSE_TAG_UPDATED_AT = 3;
-declare const RESPONSE_TAG_CREATED_BY = 4;
-declare const RESPONSE_TAG_UPDATED_BY = 5;
-declare abstract class AxisResponseDto extends AxisTlvDto {
-    id?: string;
-    created_at?: bigint;
-    updated_at?: bigint;
-    created_by?: string;
-    updated_by?: string;
-}
+declare const RESPONSE_TAG_ID = 1;
+declare const RESPONSE_TAG_CREATED_AT = 2;
+declare const RESPONSE_TAG_UPDATED_AT = 3;
+declare const RESPONSE_TAG_CREATED_BY = 4;
+declare const RESPONSE_TAG_UPDATED_BY = 5;
+declare abstract class AxisResponseDto extends AxisTlvDto {
+    id?: string;
+    created_at?: bigint;
+    updated_at?: bigint;
+    created_by?: string;
+    updated_by?: string;
+}
+
+declare const CCE_PROTOCOL_VERSION: "cce-v1";
+declare const CCE_DERIVATION: {
+    readonly REQUEST: "axis:cce:req:v1";
+    readonly RESPONSE: "axis:cce:resp:v1";
+    readonly WITNESS: "axis:cce:witness:v1";
+};
+type CceAlgorithm = "AES-256-GCM";
+type CceKemAlgorithm = "X25519" | "RSA-OAEP-256";
+type CceKdfAlgorithm = "HKDF-SHA256";
+declare const CCE_AES_KEY_BYTES = 32;
+declare const CCE_IV_BYTES = 12;
+declare const CCE_TAG_BYTES = 16;
+declare const CCE_NONCE_BYTES = 32;
+interface CceCapsuleClaims {
+    capsule_id: string;
+    ver: typeof CCE_PROTOCOL_VERSION;
+    sub: string;
+    kid: string;
+    intent: string;
+    aud: string;
+    tps_from: number;
+    tps_to: number;
+    capsule_nonce: string;
+    challenge_id: string;
+    policy_hash?: string;
+    iat: number;
+    exp: number;
+    mode: "SINGLE_USE" | "SESSION";
+    scope?: string[];
+    constraints?: CceConstraints;
+    issuer_sig: CceSignature;
+}
+interface CceConstraints {
+    max_payload_bytes?: number;
+    ip_allow?: string[];
+    device_allow?: string[];
+    country_allow?: string[];
+}
+interface CceSignature {
+    alg: "EdDSA" | "ES256";
+    kid: string;
+    value: string;
+}
+interface CceRequestEnvelope {
+    ver: typeof CCE_PROTOCOL_VERSION;
+    request_id: string;
+    correlation_id: string;
+    client_kid: string;
+    capsule: CceCapsuleClaims;
+    encrypted_key: CceEncryptedKey;
+    encrypted_payload: CceEncryptedPayload;
+    request_nonce: string;
+    client_sig: CceSignature;
+    content_type: string;
+    algorithms: CceAlgorithmDescriptor;
+    aad_descriptor?: string;
+}
+interface CceEncryptedKey {
+    alg: CceKemAlgorithm;
+    axis_kid: string;
+    ciphertext: string;
+    ephemeral_pk?: string;
+}
+interface CceEncryptedPayload {
+    alg: CceAlgorithm;
+    iv: string;
+    ciphertext: string;
+    tag: string;
+}
+interface CceAlgorithmDescriptor {
+    kem: CceKemAlgorithm;
+    enc: CceAlgorithm;
+    kdf: CceKdfAlgorithm;
+    sig: "EdDSA" | "ES256";
+}
+interface CceResponseEnvelope {
+    ver: typeof CCE_PROTOCOL_VERSION;
+    response_id: string;
+    request_id: string;
+    correlation_id: string;
+    encrypted_key: CceEncryptedKey;
+    encrypted_payload: CceEncryptedPayload;
+    response_nonce: string;
+    axis_sig: CceSignature;
+    witness_ref?: string;
+    algorithms: CceAlgorithmDescriptor;
+    status: CceResponseStatus;
+}
+type CceResponseStatus = "SUCCESS" | "DENIED" | "PARTIAL" | "FAILED" | "ERROR";
+interface CceExecutionContext {
+    execution_key_hash: string;
+    request_id: string;
+    capsule_id: string;
+    sub: string;
+    kid: string;
+    intent: string;
+    aud: string;
+    tps_from: number;
+    tps_to: number;
+    policy_hash?: string;
+    derived_at: number;
+    valid: boolean;
+}
+interface CceWitnessRecord {
+    witness_id: string;
+    request_id: string;
+    capsule_id: string;
+    sub: string;
+    intent: string;
+    aud: string;
+    tps_from: number;
+    tps_to: number;
+    timestamp: number;
+    verification: {
+        client_sig: boolean;
+        capsule_sig: boolean;
+        tps_valid: boolean;
+        audience_match: boolean;
+        intent_match: boolean;
+        replay_clean: boolean;
+        nonce_unique: boolean;
+        decryption_ok: boolean;
+    };
+    execution: {
+        status: CceResponseStatus;
+        handler_duration_ms: number;
+        effect?: string;
+    };
+    response_encrypted: boolean;
+    execution_context_hash: string;
+    request_payload_hash?: string;
+    response_payload_hash?: string;
+}
+declare const CCE_ERROR: {
+    readonly INVALID_ENVELOPE: "CCE_INVALID_ENVELOPE";
+    readonly UNSUPPORTED_VERSION: "CCE_UNSUPPORTED_VERSION";
+    readonly MISSING_CAPSULE: "CCE_MISSING_CAPSULE";
+    readonly MISSING_ENCRYPTED_KEY: "CCE_MISSING_ENCRYPTED_KEY";
+    readonly CLIENT_SIG_INVALID: "CCE_CLIENT_SIG_INVALID";
+    readonly CLIENT_KEY_NOT_FOUND: "CCE_CLIENT_KEY_NOT_FOUND";
+    readonly CAPSULE_SIG_INVALID: "CCE_CAPSULE_SIG_INVALID";
+    readonly CAPSULE_EXPIRED: "CCE_CAPSULE_EXPIRED";
+    readonly CAPSULE_NOT_YET_VALID: "CCE_CAPSULE_NOT_YET_VALID";
+    readonly CAPSULE_REVOKED: "CCE_CAPSULE_REVOKED";
+    readonly CAPSULE_CONSUMED: "CCE_CAPSULE_CONSUMED";
+    readonly AUDIENCE_MISMATCH: "CCE_AUDIENCE_MISMATCH";
+    readonly INTENT_MISMATCH: "CCE_INTENT_MISMATCH";
+    readonly TPS_WINDOW_EXPIRED: "CCE_TPS_WINDOW_EXPIRED";
+    readonly TPS_WINDOW_FUTURE: "CCE_TPS_WINDOW_FUTURE";
+    readonly REPLAY_DETECTED: "CCE_REPLAY_DETECTED";
+    readonly NONCE_REUSED: "CCE_NONCE_REUSED";
+    readonly DECRYPTION_FAILED: "CCE_DECRYPTION_FAILED";
+    readonly KEY_UNWRAP_FAILED: "CCE_KEY_UNWRAP_FAILED";
+    readonly AEAD_TAG_MISMATCH: "CCE_AEAD_TAG_MISMATCH";
+    readonly PAYLOAD_TOO_LARGE: "CCE_PAYLOAD_TOO_LARGE";
+    readonly PAYLOAD_SCHEMA_INVALID: "CCE_PAYLOAD_SCHEMA_INVALID";
+    readonly INTENT_SCHEMA_MISMATCH: "CCE_INTENT_SCHEMA_MISMATCH";
+    readonly POLICY_DENIED: "CCE_POLICY_DENIED";
+    readonly CONSTRAINT_VIOLATED: "CCE_CONSTRAINT_VIOLATED";
+    readonly HANDLER_NOT_FOUND: "CCE_HANDLER_NOT_FOUND";
+    readonly HANDLER_EXECUTION_FAILED: "CCE_HANDLER_EXECUTION_FAILED";
+    readonly HANDLER_TIMEOUT: "CCE_HANDLER_TIMEOUT";
+    readonly RESPONSE_ENCRYPTION_FAILED: "CCE_RESPONSE_ENCRYPTION_FAILED";
+};
+type CceErrorCode = (typeof CCE_ERROR)[keyof typeof CCE_ERROR];
+declare class CceError extends Error {
+    readonly code: CceErrorCode;
+    readonly metadata?: Record<string, unknown> | undefined;
+    constructor(code: CceErrorCode, message: string, metadata?: Record<string, unknown> | undefined);
+    get clientSafe(): boolean;
+    toClientError(): {
+        code: CceErrorCode;
+        message: string;
+    };
+}
+
+interface CceClientKeyEncryptor {
+    wrapKey(aesKey: Uint8Array, clientKid: string, clientPublicKeyHex: string): Promise<CceEncryptedKey>;
+}
+interface CceAxisSigner {
+    sign(payload: Uint8Array): Promise<CceSignature>;
+}
+interface CceResponseOptions {
+    request: CceRequestEnvelope;
+    capsule: CceCapsuleClaims;
+    status: CceResponseStatus;
+    body: Uint8Array;
+    clientPublicKeyHex: string;
+    witnessRef?: string;
+}
+declare function buildCceResponse(options: CceResponseOptions, clientKeyEncryptor: CceClientKeyEncryptor, axisSigner: CceAxisSigner): Promise<{
+    envelope: CceResponseEnvelope;
+    responsePayloadHash: string;
+}>;
+declare function buildCceErrorResponse(requestId: string, correlationId: string, status: CceResponseStatus, errorCode: string, message: string): {
+    ver: string;
+    request_id: string;
+    correlation_id: string;
+    status: CceResponseStatus;
+    error: {
+        code: string;
+        message: string;
+    };
+};
+
+interface CceWitnessStore {
+    record(witness: CceWitnessRecord): Promise<void>;
+}
+declare class InMemoryCceWitnessStore implements CceWitnessStore {
+    readonly records: CceWitnessRecord[];
+    record(witness: CceWitnessRecord): Promise<void>;
+    getByRequestId(requestId: string): CceWitnessRecord | undefined;
+    getByCapsuleId(capsuleId: string): CceWitnessRecord[];
+}
+interface CceVerificationState {
+    clientSigVerified: boolean;
+    capsuleSigVerified: boolean;
+    tpsValid: boolean;
+    audienceMatch: boolean;
+    intentMatch: boolean;
+    replayClean: boolean;
+    nonceUnique: boolean;
+    decryptionOk: boolean;
+}
+declare function buildWitnessRecord(envelope: CceRequestEnvelope, capsule: CceCapsuleClaims, verification: CceVerificationState, execution: {
+    status: CceResponseStatus;
+    handlerDurationMs: number;
+    effect?: string;
+}, options: {
+    axisLocalSecret: string;
+    requestPayload?: Uint8Array;
+    responsePayload?: Uint8Array;
+    responseEncrypted: boolean;
+}): CceWitnessRecord;
+declare function extractVerificationState(metadata: Record<string, any>): CceVerificationState;
+
+type AxisAlg$1 = 'EdDSA' | 'ES256' | 'RS256';
+type CapsuleStatus = 'ACTIVE' | 'CONSUMED' | 'REVOKED' | 'EXPIRED';
+type CapsuleMode = 'SINGLE_USE' | 'MULTI_USE';
+type KeyStatus = 'ACTIVE' | 'GRACE' | 'REVOKED' | 'RETIRED';
+interface AxisSig$1 {
+    alg: AxisAlg$1;
+    kid: string;
+    value: string;
+}
+interface AxisPacket$1<T = any> {
+    v: 1;
+    pid: string;
+    nonce: string;
+    ts: number;
+    actorId: string;
+    opcode: string;
+    body: T;
+    sig: AxisSig$1;
+}
+interface AxisCapsuleConstraints {
+    maxAmount?: number;
+    maxCount?: number;
+    ttlSeconds?: number;
+    ipCidrAllow?: string[];
+    countryAllow?: string[];
+    deviceIdAllow?: string[];
+    sessionIdLock?: string;
+    nonceRequired?: boolean;
+}
+interface TickWindow {
+    start: number;
+    end: number;
+}
+interface AxisCapsulePayload {
+    v: 1;
+    capsuleId: string;
+    actorId: string;
+    issuer: string;
+    audience: string;
+    subject?: string;
+    intent: string;
+    scopes: string[];
+    actions?: string[];
+    iat: number;
+    nbf?: number;
+    exp: number;
+    tickWindow?: TickWindow;
+    mode: CapsuleMode;
+    maxUses: number;
+    nonceSeed?: string;
+    policyRefs?: string[];
+    riskScore?: number;
+    constraints?: AxisCapsuleConstraints;
+    meta?: Record<string, unknown>;
+}
+interface AxisCapsule {
+    payload: AxisCapsulePayload;
+    sig: AxisSig$1;
+}
+interface CapsuleIssueBody {
+    intent: string;
+    audience: string;
+    scopes: string[];
+    subject?: string;
+    mode: CapsuleMode;
+    maxUses?: number;
+    expSeconds?: number;
+    constraints?: AxisCapsuleConstraints;
+    hints?: {
+        ip?: string;
+        ua?: string;
+        deviceId?: string;
+        geo?: string;
+    };
+}
+interface CapsuleBatchBody extends Omit<CapsuleIssueBody, 'mode' | 'maxUses'> {
+    count: number;
+    mode: 'SINGLE_USE';
+}
+interface IntentExecBody {
+    intent: string;
+    capsule: AxisCapsule;
+    execNonce?: string;
+    args: Record<string, any>;
+}
+interface CapsuleRevokeBody {
+    capsuleId: string;
+    reason: string;
+}
+interface AxisResponse$1<T = any> {
+    ok: boolean;
+    pid: string;
+    decisionId: string;
+    code: string;
+    message?: string;
+    data?: T;
+    meta?: Record<string, unknown>;
+}
+interface CapsuleIssueResult {
+    capsule: AxisCapsule;
+}
+interface CapsuleBatchResult {
+    capsules: AxisCapsule[];
+}
+interface ActorKeyRecord {
+    id: Buffer;
+    actor_id: string;
+    key_id: string;
+    algorithm: string;
+    public_key: Buffer;
+    purpose: string;
+    status: KeyStatus;
+    is_primary: boolean;
+    not_before: Date | null;
+    expires_at: Date | null;
+    rotated_from_key_id: string | null;
+    revoked_at: Date | null;
+    revocation_reason: string | null;
+    metadata: any;
+    created_at: Date;
+    updated_at: Date;
+}
+interface IssuerKeyRecord {
+    id: Buffer;
+    kid: string;
+    issuer_id: string;
+    alg: string;
+    public_key_pem: string;
+    status: KeyStatus;
+    not_before: Date | null;
+    not_after: Date | null;
+    fingerprint: string | null;
+    metadata: any;
+    created_at: Date;
+    updated_at: Date;
+}
+interface CapsuleRecord {
+    id: Buffer;
+    capsule_id: string;
+    actor_id: string;
+    intent: string;
+    audience: string;
+    issuer: string;
+    subject: string | null;
+    status: CapsuleStatus;
+    mode: CapsuleMode;
+    max_uses: number;
+    used_count: number;
+    iat: Date;
+    nbf: Date | null;
+    exp: Date;
+    scopes_json: any;
+    constraints_json: any;
+    policy_refs_json: any;
+    risk_score: number | null;
+    payload_hash: Buffer;
+    sig_alg: string;
+    sig_kid: string;
+    sig_value: Buffer;
+    created_at: Date;
+    updated_at: Date;
+    last_used_at: Date | null;
+}
+
+type AxisAlg = Extract<AxisAlg$1, 'EdDSA'>;
+type AxisSig = AxisSig$1 & {
+    alg: AxisAlg;
+};
+interface AxisFrame$1<T = any> {
+    v: 1;
+    pid: string;
+    nonce: string;
+    ts: number;
+    actorId: string;
+    aud?: string;
+    opcode: string;
+    headers: Map<number, Uint8Array>;
+    body: T;
+    sig: AxisSig;
+}
+type AxisResponse<T = any> = AxisResponse$1<T> & {
+    policyRefs?: string[];
+    riskScore?: number;
+};
+interface AxisObservedContext {
+    ip?: string;
+    ua?: string;
+    geo?: string;
+}
+interface AxisRequestContext {
+    observed: AxisObservedContext;
+    actorKeyKid?: string;
+    issuerKeyKid?: string;
+    decisionId: string;
+    actorId: string;
+    aud?: string;
+    opcode: string;
+    deviceId?: string;
+    sessionId?: string;
+}
+
+interface SensorPhaseMetadata {
+    phase: 'PRE_DECODE' | 'POST_DECODE';
+    dependencies?: string[];
+    asyncOk?: boolean;
+    cryptoOk?: boolean;
+    description?: string;
+}
+interface AxisSensor {
+    readonly name: string;
+    readonly order?: number;
+    phase?: SensorPhaseMetadata | 'PRE_DECODE' | 'POST_DECODE';
+    supports?(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+interface AxisSensorInit extends AxisSensor {
+    onModuleInit?(): void | Promise<void>;
+}
+interface AxisPreSensor extends AxisSensor {
+    phase: 'PRE_DECODE';
+}
+interface AxisPostSensor extends AxisSensor {
+    phase: 'POST_DECODE';
+}
+interface SensorInput {
+    rawBytes?: Buffer | Uint8Array;
+    intent?: string;
+    ip?: string;
+    path?: string;
+    contentLength?: number;
+    peek?: Uint8Array;
+    country?: string;
+    clientId?: string;
+    isWs?: boolean;
+    metadata?: Record<string, any>;
+    actorId?: string;
+    opcode?: string;
+    aud?: string;
+    observed?: AxisObservedContext;
+    frameBody?: any;
+    deviceId?: string;
+    sessionId?: string;
+    packet?: Record<string, any>;
+    [key: string]: any;
+}
+declare enum Decision {
+    ALLOW = "ALLOW",
+    DENY = "DENY",
+    THROTTLE = "THROTTLE",
+    FLAG = "FLAG"
+}
+type SensorDecision = {
+    decision?: Decision;
+    allow: boolean;
+    riskScore: number;
+    reasons: string[];
+    code?: string;
+    retryAfterMs?: number;
+    scoreDelta?: number;
+    tags?: Record<string, any>;
+    meta?: any;
+    tighten?: {
+        expSecondsMax?: number;
+        constraintsPatch?: Record<string, any>;
+    };
+} | {
+    action: 'ALLOW';
+    meta?: any;
+} | {
+    action: 'DENY';
+    code: string;
+    reason?: string;
+    retryAfterMs?: number;
+    meta?: any;
+} | {
+    action: 'THROTTLE';
+    retryAfterMs: number;
+    meta?: any;
+} | {
+    action: 'FLAG';
+    scoreDelta: number;
+    reasons: string[];
+    meta?: any;
+};
+type SensorMinifiedDecision = {
+    allow: boolean;
+    riskScore: number;
+    reasons: string[];
+    tags?: Record<string, any>;
+    meta?: any;
+    tighten?: {
+        expSecondsMax?: number;
+        constraintsPatch?: Record<string, any>;
+    };
+    retryAfterMs?: number;
+};
+declare function normalizeSensorDecision(sensorDecision: SensorDecision): SensorMinifiedDecision;
+declare const SensorDecisions: {
+    allow(meta?: any, tags?: Record<string, any>): SensorDecision;
+    deny(code: string, reason?: string, meta?: any): SensorDecision;
+    throttle(retryAfterMs: number, meta?: any): SensorDecision;
+    flag(scoreDelta: number, reasons: string[], meta?: any): SensorDecision;
+};
+
+type CceHandler = (payload: Uint8Array, context: CceHandlerContext) => Promise<CceHandlerResult>;
+interface CceHandlerContext {
+    capsule: CceCapsuleClaims;
+    executionContext: CceExecutionContext;
+    envelope: CceRequestEnvelope;
+    clientPublicKeyHex: string;
+    intent: string;
+    sub: string;
+}
+interface CceHandlerResult {
+    status: CceResponseStatus;
+    body: Uint8Array;
+    effect?: string;
+}
+interface CcePipelineConfig {
+    axisLocalSecret: string;
+    axisAudience: string;
+    sensors: AxisSensor[];
+    handlers: Map<string, CceHandler>;
+    witnessStore: CceWitnessStore;
+    clientKeyEncryptor: CceClientKeyEncryptor;
+    axisSigner: CceAxisSigner;
+}
+type CcePipelineResult = {
+    ok: true;
+    response: CceResponseEnvelope;
+    witnessId: string;
+} | {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+    };
+    status: CceResponseStatus;
+};
+declare function executeCcePipeline(envelope: CceRequestEnvelope, config: CcePipelineConfig): Promise<CcePipelineResult>;
 
 interface IntentSchema$1 {
     intent: string;
     version: number;
-    bodyProfile: 'TLV_MAP' | 'RAW' | 'TLV_OBJ' | 'TLV_ARR';
+    bodyProfile: "TLV_MAP" | "RAW" | "TLV_OBJ" | "TLV_ARR";
     fields: Array<{
         name: string;
         tlv: number;
-        kind: IntentTlvField['kind'];
+        kind: IntentTlvField["kind"];
         required?: boolean;
         maxLen?: number;
         max?: string;
-        scope?: 'header' | 'body';
+        scope?: "header" | "body";
     }>;
 }
 interface AxisEffect {
@@ -136,6 +723,8 @@ declare class IntentRouter {
     private intentSchemas;
     private intentValidators;
     private intentKinds;
+    private cceHandlers;
+    private ccePipelineConfig;
     constructor(moduleRef?: ModuleRef | undefined);
     getSchema(intent: string): IntentSchema$1 | undefined;
     getValidators(intent: string): Map<number, TlvValidatorFn[]> | undefined;
@@ -152,11 +741,26 @@ declare class IntentRouter {
     registerHandler(instance: any): void;
     route(frame: AxisFrame$2): Promise<AxisEffect>;
     private logIntent;
-    registerIntentMeta(intent: string, proto: object, methodName: string): void;
+    registerIntentMeta(intent: string, proto: object, methodName: string, handlerSensors?: Function[]): void;
     private runIntentSensors;
+    configureCce(config: Omit<CcePipelineConfig, "handlers">): void;
+    registerCceHandler(intent: string, handler: CceHandler): void;
+    hasCceHandler(intent: string): boolean;
+    routeCce(envelope: CceRequestEnvelope): Promise<CcePipelineResult>;
     private storeSchema;
 }
 
+declare const BAND: {
+    readonly WIRE: 0;
+    readonly IDENTITY: 40;
+    readonly POLICY: 90;
+    readonly CONTENT: 140;
+    readonly BUSINESS: 200;
+    readonly AUDIT: 900;
+};
+type SensorBand = keyof typeof BAND;
+declare const PRE_DECODE_BOUNDARY = 40;
+
 declare function stableJsonStringify(value: unknown): string;
 
 interface ObservationStage {
@@ -498,216 +1102,52 @@ declare function packPasskeyLoginOptionsRes(params: {
         type: string;
         transports?: string[];
     }[];
-}): Buffer;
-declare const Schema2012_PasskeyLoginVerifyRes: Ats1SchemaDescriptor;
-declare function packPasskeyLoginVerifyRes(params: {
-    actorId: string;
-    keyId: string;
-    capsule: Buffer;
-    expiresAt: bigint;
-}): Buffer;
-
-type Axis1FrameToEncode = {
-    ver: number;
-    flags: number;
-    hdr: Buffer;
-    body: Buffer;
-    sig: Buffer;
-};
-declare function encodeAxis1Frame(f: Axis1FrameToEncode): Buffer;
-
-declare function axis1SigningBytes(params: {
-    ver: number;
-    flags: number;
-    hdr: Buffer;
-    body: Buffer;
-}): Buffer;
-
-declare function encVarint(x: bigint): Buffer;
-declare function varintU(x: number | bigint): Buffer;
-declare function u64be(x: bigint): Buffer;
-declare function utf8(s: string): Buffer;
-declare function bytes(b: Uint8Array | Buffer): Buffer;
-declare function nonce16(): Buffer;
-declare function tlv(type: number, value: Buffer): Buffer;
-declare function buildTLVs(items: {
-    type: number;
-    value: Buffer;
-}[], opts?: {
-    allowDupTypes?: Set<number>;
-}): Buffer;
-
-declare function b64urlEncode(buf: Buffer): string;
-declare function b64urlDecode(str: string): Buffer;
-declare function b64urlEncodeString(str: string, encoding?: BufferEncoding): string;
-declare function b64urlDecodeString(str: string, encoding?: BufferEncoding): string;
-
-declare function canonicalJson(value: any): string;
-declare function canonicalJsonExcluding(obj: Record<string, any>, exclude: string[]): string;
-
-type AxisAlg$1 = 'EdDSA' | 'ES256' | 'RS256';
-type CapsuleStatus = 'ACTIVE' | 'CONSUMED' | 'REVOKED' | 'EXPIRED';
-type CapsuleMode = 'SINGLE_USE' | 'MULTI_USE';
-type KeyStatus = 'ACTIVE' | 'GRACE' | 'REVOKED' | 'RETIRED';
-interface AxisSig$1 {
-    alg: AxisAlg$1;
-    kid: string;
-    value: string;
-}
-interface AxisPacket$1<T = any> {
-    v: 1;
-    pid: string;
-    nonce: string;
-    ts: number;
-    actorId: string;
-    opcode: string;
-    body: T;
-    sig: AxisSig$1;
-}
-interface AxisCapsuleConstraints {
-    maxAmount?: number;
-    maxCount?: number;
-    ttlSeconds?: number;
-    ipCidrAllow?: string[];
-    countryAllow?: string[];
-    deviceIdAllow?: string[];
-    sessionIdLock?: string;
-    nonceRequired?: boolean;
-}
-interface TickWindow {
-    start: number;
-    end: number;
-}
-interface AxisCapsulePayload {
-    v: 1;
-    capsuleId: string;
-    actorId: string;
-    issuer: string;
-    audience: string;
-    subject?: string;
-    intent: string;
-    scopes: string[];
-    actions?: string[];
-    iat: number;
-    nbf?: number;
-    exp: number;
-    tickWindow?: TickWindow;
-    mode: CapsuleMode;
-    maxUses: number;
-    nonceSeed?: string;
-    policyRefs?: string[];
-    riskScore?: number;
-    constraints?: AxisCapsuleConstraints;
-    meta?: Record<string, unknown>;
-}
-interface AxisCapsule {
-    payload: AxisCapsulePayload;
-    sig: AxisSig$1;
-}
-interface CapsuleIssueBody {
-    intent: string;
-    audience: string;
-    scopes: string[];
-    subject?: string;
-    mode: CapsuleMode;
-    maxUses?: number;
-    expSeconds?: number;
-    constraints?: AxisCapsuleConstraints;
-    hints?: {
-        ip?: string;
-        ua?: string;
-        deviceId?: string;
-        geo?: string;
-    };
-}
-interface CapsuleBatchBody extends Omit<CapsuleIssueBody, 'mode' | 'maxUses'> {
-    count: number;
-    mode: 'SINGLE_USE';
-}
-interface IntentExecBody {
-    intent: string;
-    capsule: AxisCapsule;
-    execNonce?: string;
-    args: Record<string, any>;
-}
-interface CapsuleRevokeBody {
-    capsuleId: string;
-    reason: string;
-}
-interface AxisResponse$1<T = any> {
-    ok: boolean;
-    pid: string;
-    decisionId: string;
-    code: string;
-    message?: string;
-    data?: T;
-    meta?: Record<string, unknown>;
-}
-interface CapsuleIssueResult {
-    capsule: AxisCapsule;
-}
-interface CapsuleBatchResult {
-    capsules: AxisCapsule[];
-}
-interface ActorKeyRecord {
-    id: Buffer;
-    actor_id: string;
-    key_id: string;
-    algorithm: string;
-    public_key: Buffer;
-    purpose: string;
-    status: KeyStatus;
-    is_primary: boolean;
-    not_before: Date | null;
-    expires_at: Date | null;
-    rotated_from_key_id: string | null;
-    revoked_at: Date | null;
-    revocation_reason: string | null;
-    metadata: any;
-    created_at: Date;
-    updated_at: Date;
-}
-interface IssuerKeyRecord {
-    id: Buffer;
-    kid: string;
-    issuer_id: string;
-    alg: string;
-    public_key_pem: string;
-    status: KeyStatus;
-    not_before: Date | null;
-    not_after: Date | null;
-    fingerprint: string | null;
-    metadata: any;
-    created_at: Date;
-    updated_at: Date;
-}
-interface CapsuleRecord {
-    id: Buffer;
-    capsule_id: string;
-    actor_id: string;
-    intent: string;
-    audience: string;
-    issuer: string;
-    subject: string | null;
-    status: CapsuleStatus;
-    mode: CapsuleMode;
-    max_uses: number;
-    used_count: number;
-    iat: Date;
-    nbf: Date | null;
-    exp: Date;
-    scopes_json: any;
-    constraints_json: any;
-    policy_refs_json: any;
-    risk_score: number | null;
-    payload_hash: Buffer;
-    sig_alg: string;
-    sig_kid: string;
-    sig_value: Buffer;
-    created_at: Date;
-    updated_at: Date;
-    last_used_at: Date | null;
-}
+}): Buffer;
+declare const Schema2012_PasskeyLoginVerifyRes: Ats1SchemaDescriptor;
+declare function packPasskeyLoginVerifyRes(params: {
+    actorId: string;
+    keyId: string;
+    capsule: Buffer;
+    expiresAt: bigint;
+}): Buffer;
+
+type Axis1FrameToEncode = {
+    ver: number;
+    flags: number;
+    hdr: Buffer;
+    body: Buffer;
+    sig: Buffer;
+};
+declare function encodeAxis1Frame(f: Axis1FrameToEncode): Buffer;
+
+declare function axis1SigningBytes(params: {
+    ver: number;
+    flags: number;
+    hdr: Buffer;
+    body: Buffer;
+}): Buffer;
+
+declare function encVarint(x: bigint): Buffer;
+declare function varintU(x: number | bigint): Buffer;
+declare function u64be(x: bigint): Buffer;
+declare function utf8(s: string): Buffer;
+declare function bytes(b: Uint8Array | Buffer): Buffer;
+declare function nonce16(): Buffer;
+declare function tlv(type: number, value: Buffer): Buffer;
+declare function buildTLVs(items: {
+    type: number;
+    value: Buffer;
+}[], opts?: {
+    allowDupTypes?: Set<number>;
+}): Buffer;
+
+declare function b64urlEncode(buf: Buffer): string;
+declare function b64urlDecode(str: string): Buffer;
+declare function b64urlEncodeString(str: string, encoding?: BufferEncoding): string;
+declare function b64urlDecodeString(str: string, encoding?: BufferEncoding): string;
+
+declare function canonicalJson(value: any): string;
+declare function canonicalJsonExcluding(obj: Record<string, any>, exclude: string[]): string;
 
 declare class ContractViolationError extends Error {
     code: string;
@@ -784,146 +1224,6 @@ type AxisPacket = {
 };
 declare function buildPacket(hdr: Buffer, body: Buffer, sig: Buffer, flags?: number): AxisPacket;
 
-type AxisAlg = Extract<AxisAlg$1, 'EdDSA'>;
-type AxisSig = AxisSig$1 & {
-    alg: AxisAlg;
-};
-interface AxisFrame$1<T = any> {
-    v: 1;
-    pid: string;
-    nonce: string;
-    ts: number;
-    actorId: string;
-    aud?: string;
-    opcode: string;
-    headers: Map<number, Uint8Array>;
-    body: T;
-    sig: AxisSig;
-}
-type AxisResponse<T = any> = AxisResponse$1<T> & {
-    policyRefs?: string[];
-    riskScore?: number;
-};
-interface AxisObservedContext {
-    ip?: string;
-    ua?: string;
-    geo?: string;
-}
-interface AxisRequestContext {
-    observed: AxisObservedContext;
-    actorKeyKid?: string;
-    issuerKeyKid?: string;
-    decisionId: string;
-    actorId: string;
-    aud?: string;
-    opcode: string;
-    deviceId?: string;
-    sessionId?: string;
-}
-
-interface SensorPhaseMetadata {
-    phase: 'PRE_DECODE' | 'POST_DECODE';
-    dependencies?: string[];
-    asyncOk?: boolean;
-    cryptoOk?: boolean;
-    description?: string;
-}
-interface AxisSensor {
-    readonly name: string;
-    readonly order?: number;
-    phase?: SensorPhaseMetadata | 'PRE_DECODE' | 'POST_DECODE';
-    supports?(input: SensorInput): boolean;
-    run(input: SensorInput): Promise<SensorDecision>;
-}
-interface AxisSensorInit extends AxisSensor {
-    onModuleInit?(): void | Promise<void>;
-}
-interface AxisPreSensor extends AxisSensor {
-    phase: 'PRE_DECODE';
-}
-interface AxisPostSensor extends AxisSensor {
-    phase: 'POST_DECODE';
-}
-interface SensorInput {
-    rawBytes?: Buffer | Uint8Array;
-    intent?: string;
-    ip?: string;
-    path?: string;
-    contentLength?: number;
-    peek?: Uint8Array;
-    country?: string;
-    clientId?: string;
-    isWs?: boolean;
-    metadata?: Record<string, any>;
-    actorId?: string;
-    opcode?: string;
-    aud?: string;
-    observed?: AxisObservedContext;
-    frameBody?: any;
-    deviceId?: string;
-    sessionId?: string;
-    packet?: Record<string, any>;
-    [key: string]: any;
-}
-declare enum Decision {
-    ALLOW = "ALLOW",
-    DENY = "DENY",
-    THROTTLE = "THROTTLE",
-    FLAG = "FLAG"
-}
-type SensorDecision = {
-    decision?: Decision;
-    allow: boolean;
-    riskScore: number;
-    reasons: string[];
-    code?: string;
-    retryAfterMs?: number;
-    scoreDelta?: number;
-    tags?: Record<string, any>;
-    meta?: any;
-    tighten?: {
-        expSecondsMax?: number;
-        constraintsPatch?: Record<string, any>;
-    };
-} | {
-    action: 'ALLOW';
-    meta?: any;
-} | {
-    action: 'DENY';
-    code: string;
-    reason?: string;
-    retryAfterMs?: number;
-    meta?: any;
-} | {
-    action: 'THROTTLE';
-    retryAfterMs: number;
-    meta?: any;
-} | {
-    action: 'FLAG';
-    scoreDelta: number;
-    reasons: string[];
-    meta?: any;
-};
-type SensorMinifiedDecision = {
-    allow: boolean;
-    riskScore: number;
-    reasons: string[];
-    tags?: Record<string, any>;
-    meta?: any;
-    tighten?: {
-        expSecondsMax?: number;
-        constraintsPatch?: Record<string, any>;
-    };
-    retryAfterMs?: number;
-};
-declare function normalizeSensorDecision(sensorDecision: SensorDecision): SensorMinifiedDecision;
-declare const SensorDecisions: {
-    allow(meta?: any, tags?: Record<string, any>): SensorDecision;
-    deny(code: string, reason?: string, meta?: any): SensorDecision;
-    throttle(retryAfterMs: number, meta?: any): SensorDecision;
-    flag(scoreDelta: number, reasons: string[], meta?: any): SensorDecision;
-};
-
 interface AxisHandler {
     readonly name: string;
     readonly open?: boolean;
@@ -1097,79 +1397,7 @@ declare class DiskUploadFileStore implements UploadFileStore {
     readFinalRange(fileId: string, filename: string | undefined, start: number, length: number): Promise<Buffer>;
     hasTemp(fileId: string): Promise<boolean>;
     moveTempToFinal(fileId: string, filename?: string): Promise<string>;
-    createTempReadStream(fileId: string): NodeJS.ReadableStream;
-}
-
-type ProofType$1 = 1 | 2 | 3 | 4;
-interface ProofVerificationResult {
-    valid: boolean;
-    actorId?: string;
-    error?: string;
-    metadata?: Record<string, any>;
-}
-interface MTLSContext {
-    clientCertPem?: string;
-    clientCertFingerprint?: string;
-    clientCertSubject?: string;
-    clientCertIssuer?: string;
-    verified?: boolean;
-}
-interface DeviceSEContext {
-    deviceId: string;
-    signature: Uint8Array;
-    publicKey: Uint8Array;
-    challenge?: Uint8Array;
-}
-declare class ProofVerificationService {
-    private readonly logger;
-    private readonly deviceKeys;
-    private readonly trustedCerts;
-    verifyProof(proofType: ProofType$1, proofRef: Uint8Array, context: {
-        signTarget?: Uint8Array;
-        signature?: Uint8Array;
-        mtls?: MTLSContext;
-        deviceSE?: DeviceSEContext;
-    }): Promise<ProofVerificationResult>;
-    private verifyCapsuleProof;
-    private verifyJWTProof;
-    private verifyMTLSProof;
-    private verifyDeviceSEProof;
-    registerDeviceKey(deviceId: string, publicKey: Uint8Array): void;
-    unregisterDevice(deviceId: string): boolean;
-    registerMTLSCert(fingerprint: string, actorId: string): void;
-    revokeMTLSCert(fingerprint: string): boolean;
-    static calculateFingerprint(certPem: string): string;
-}
-
-type index$8_ActorKeyRecord = ActorKeyRecord;
-type index$8_AxisCapsule = AxisCapsule;
-type index$8_AxisCapsuleConstraints = AxisCapsuleConstraints;
-type index$8_AxisCapsulePayload = AxisCapsulePayload;
-type index$8_CapsuleBatchBody = CapsuleBatchBody;
-type index$8_CapsuleBatchResult = CapsuleBatchResult;
-type index$8_CapsuleIssueBody = CapsuleIssueBody;
-type index$8_CapsuleIssueResult = CapsuleIssueResult;
-type index$8_CapsuleMode = CapsuleMode;
-type index$8_CapsuleRecord = CapsuleRecord;
-type index$8_CapsuleRevokeBody = CapsuleRevokeBody;
-type index$8_CapsuleStatus = CapsuleStatus;
-type index$8_DeviceSEContext = DeviceSEContext;
-type index$8_IntentExecBody = IntentExecBody;
-type index$8_IssuerKeyRecord = IssuerKeyRecord;
-type index$8_KeyStatus = KeyStatus;
-type index$8_MTLSContext = MTLSContext;
-type index$8_ProofVerificationResult = ProofVerificationResult;
-type index$8_ProofVerificationService = ProofVerificationService;
-declare const index$8_ProofVerificationService: typeof ProofVerificationService;
-type index$8_TickWindow = TickWindow;
-declare const index$8_b64urlDecode: typeof b64urlDecode;
-declare const index$8_b64urlDecodeString: typeof b64urlDecodeString;
-declare const index$8_b64urlEncode: typeof b64urlEncode;
-declare const index$8_b64urlEncodeString: typeof b64urlEncodeString;
-declare const index$8_canonicalJson: typeof canonicalJson;
-declare const index$8_canonicalJsonExcluding: typeof canonicalJsonExcluding;
-declare namespace index$8 {
-  export { type index$8_ActorKeyRecord as ActorKeyRecord, type AxisAlg$1 as AxisAlg, type index$8_AxisCapsule as AxisCapsule, type index$8_AxisCapsuleConstraints as AxisCapsuleConstraints, type index$8_AxisCapsulePayload as AxisCapsulePayload, type AxisPacket$1 as AxisPacket, type AxisResponse$1 as AxisResponse, type AxisSig$1 as AxisSig, type index$8_CapsuleBatchBody as CapsuleBatchBody, type index$8_CapsuleBatchResult as CapsuleBatchResult, type index$8_CapsuleIssueBody as CapsuleIssueBody, type index$8_CapsuleIssueResult as CapsuleIssueResult, type index$8_CapsuleMode as CapsuleMode, type index$8_CapsuleRecord as CapsuleRecord, type index$8_CapsuleRevokeBody as CapsuleRevokeBody, type index$8_CapsuleStatus as CapsuleStatus, type index$8_DeviceSEContext as DeviceSEContext, type index$8_IntentExecBody as IntentExecBody, type index$8_IssuerKeyRecord as IssuerKeyRecord, type index$8_KeyStatus as KeyStatus, type index$8_MTLSContext as MTLSContext, type ProofType$1 as ProofType, type index$8_ProofVerificationResult as ProofVerificationResult, index$8_ProofVerificationService as ProofVerificationService, type index$8_TickWindow as TickWindow, index$8_b64urlDecode as b64urlDecode, index$8_b64urlDecodeString as b64urlDecodeString, index$8_b64urlEncode as b64urlEncode, index$8_b64urlEncodeString as b64urlEncodeString, index$8_canonicalJson as canonicalJson, index$8_canonicalJsonExcluding as canonicalJsonExcluding };
+    createTempReadStream(fileId: string): NodeJS.ReadableStream;
 }
 
 interface AxisRequestData {
@@ -1184,53 +1412,40 @@ declare const AxisContext$1: (...dataOrPipes: unknown[]) => ParameterDecorator;
 declare const AxisDemoPubkey: (...dataOrPipes: unknown[]) => ParameterDecorator;
 declare const AxisFrame: (...dataOrPipes: unknown[]) => ParameterDecorator;
 
-declare const SENSOR_METADATA_KEY = "axis:sensor";
-type SensorPhase = 'PRE_DECODE' | 'POST_DECODE';
-interface SensorOptions {
-    phase?: SensorPhase;
+declare class HandlerDiscoveryService implements OnModuleInit {
+    private readonly discovery;
+    private readonly scanner;
+    private readonly router;
+    private readonly logger;
+    constructor(discovery: DiscoveryService, scanner: MetadataScanner, router: IntentRouter);
+    onModuleInit(): void;
 }
-declare function Sensor(options?: SensorOptions): ClassDecorator;
 
-declare const index$7_AxisDemoPubkey: typeof AxisDemoPubkey;
-declare const index$7_AxisFrame: typeof AxisFrame;
-declare const index$7_AxisIp: typeof AxisIp;
-declare const index$7_AxisRaw: typeof AxisRaw;
-type index$7_AxisRequestData = AxisRequestData;
-type index$7_DtoSchema = DtoSchema;
-declare const index$7_HANDLER_METADATA_KEY: typeof HANDLER_METADATA_KEY;
-declare const index$7_Handler: typeof Handler;
-declare const index$7_INTENT_BODY_KEY: typeof INTENT_BODY_KEY;
-declare const index$7_INTENT_METADATA_KEY: typeof INTENT_METADATA_KEY;
-declare const index$7_INTENT_ROUTES_KEY: typeof INTENT_ROUTES_KEY;
-declare const index$7_INTENT_SENSORS_KEY: typeof INTENT_SENSORS_KEY;
-declare const index$7_Intent: typeof Intent;
-declare const index$7_IntentBody: typeof IntentBody;
-type index$7_IntentKind = IntentKind;
-type index$7_IntentOptions = IntentOptions;
-type index$7_IntentRoute = IntentRoute;
-declare const index$7_IntentSensors: typeof IntentSensors;
-type index$7_IntentTlvField = IntentTlvField;
-declare const index$7_SENSOR_METADATA_KEY: typeof SENSOR_METADATA_KEY;
-declare const index$7_Sensor: typeof Sensor;
-type index$7_SensorOptions = SensorOptions;
-type index$7_SensorPhase = SensorPhase;
-declare const index$7_TLV_FIELDS_KEY: typeof TLV_FIELDS_KEY;
-declare const index$7_TLV_VALIDATORS_KEY: typeof TLV_VALIDATORS_KEY;
-declare const index$7_TlvEnum: typeof TlvEnum;
-declare const index$7_TlvField: typeof TlvField;
-type index$7_TlvFieldKind = TlvFieldKind;
-type index$7_TlvFieldMeta = TlvFieldMeta;
-type index$7_TlvFieldOptions = TlvFieldOptions;
-declare const index$7_TlvMinLen: typeof TlvMinLen;
-declare const index$7_TlvRange: typeof TlvRange;
-declare const index$7_TlvUtf8Pattern: typeof TlvUtf8Pattern;
-declare const index$7_TlvValidate: typeof TlvValidate;
-type index$7_TlvValidatorFn = TlvValidatorFn;
-type index$7_TlvValidatorMeta = TlvValidatorMeta;
-declare const index$7_buildDtoDecoder: typeof buildDtoDecoder;
-declare const index$7_extractDtoSchema: typeof extractDtoSchema;
-declare namespace index$7 {
-  export { AxisContext$1 as AxisContext, index$7_AxisDemoPubkey as AxisDemoPubkey, index$7_AxisFrame as AxisFrame, index$7_AxisIp as AxisIp, index$7_AxisRaw as AxisRaw, type index$7_AxisRequestData as AxisRequestData, type index$7_DtoSchema as DtoSchema, index$7_HANDLER_METADATA_KEY as HANDLER_METADATA_KEY, index$7_Handler as Handler, index$7_INTENT_BODY_KEY as INTENT_BODY_KEY, index$7_INTENT_METADATA_KEY as INTENT_METADATA_KEY, index$7_INTENT_ROUTES_KEY as INTENT_ROUTES_KEY, index$7_INTENT_SENSORS_KEY as INTENT_SENSORS_KEY, index$7_Intent as Intent, index$7_IntentBody as IntentBody, type index$7_IntentKind as IntentKind, type index$7_IntentOptions as IntentOptions, type index$7_IntentRoute as IntentRoute, index$7_IntentSensors as IntentSensors, type index$7_IntentTlvField as IntentTlvField, index$7_SENSOR_METADATA_KEY as SENSOR_METADATA_KEY, index$7_Sensor as Sensor, type index$7_SensorOptions as SensorOptions, type index$7_SensorPhase as SensorPhase, index$7_TLV_FIELDS_KEY as TLV_FIELDS_KEY, index$7_TLV_VALIDATORS_KEY as TLV_VALIDATORS_KEY, index$7_TlvEnum as TlvEnum, index$7_TlvField as TlvField, type index$7_TlvFieldKind as TlvFieldKind, type index$7_TlvFieldMeta as TlvFieldMeta, type index$7_TlvFieldOptions as TlvFieldOptions, index$7_TlvMinLen as TlvMinLen, index$7_TlvRange as TlvRange, index$7_TlvUtf8Pattern as TlvUtf8Pattern, index$7_TlvValidate as TlvValidate, type index$7_TlvValidatorFn as TlvValidatorFn, type index$7_TlvValidatorMeta as TlvValidatorMeta, index$7_buildDtoDecoder as buildDtoDecoder, index$7_extractDtoSchema as extractDtoSchema };
+declare class SensorRegistry {
+    private readonly configService;
+    private sensors;
+    private readonly logger;
+    constructor(configService: ConfigService);
+    register(sensor: AxisSensor): void;
+    list(): AxisSensor[];
+    getPreDecodeSensors(): AxisPreSensor[];
+    getPostDecodeSensors(): AxisPostSensor[];
+    private isPreDecodeSensor;
+    private isPostDecodeSensor;
+    getSensorCountByPhase(): {
+        preDecodeCount: number;
+        postDecodeCount: number;
+    };
+    clear(): void;
+}
+
+declare class SensorDiscoveryService implements OnApplicationBootstrap {
+    private readonly discovery;
+    private readonly reflector;
+    private readonly registry;
+    private readonly logger;
+    constructor(discovery: DiscoveryService, reflector: Reflector, registry: SensorRegistry);
+    onApplicationBootstrap(): void;
 }
 
 declare const SensorDecisionZ: z.ZodUnion<readonly [z.ZodObject<{
@@ -1680,7 +1895,7 @@ declare const ChunkHashInputZ: z.ZodObject<{
     intent: z.ZodString;
 }, z.core.$strip>;
 type ChunkHashInput = z.infer<typeof ChunkHashInputZ>;
-declare enum ProofType {
+declare enum ProofType$1 {
     CAPSULE = 1,
     JWT = 2,
     MTLS_ID = 3,
@@ -1692,7 +1907,7 @@ declare const AxisContextZ: z.ZodObject<{
     ts: z.ZodBigInt;
     intent: z.ZodString;
     actorId: z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>;
-    proofType: z.ZodEnum<typeof ProofType>;
+    proofType: z.ZodEnum<typeof ProofType$1>;
     proofRef: z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>;
     nonce: z.ZodCustom<Buffer<ArrayBufferLike>, Buffer<ArrayBufferLike>>;
     ip: z.ZodString;
@@ -1751,51 +1966,364 @@ interface AxisDecoded {
     observation: AxisObservation;
 }
 
-declare class HandlerDiscoveryService implements OnModuleInit {
-    private readonly discovery;
-    private readonly scanner;
-    private readonly router;
-    private readonly logger;
-    constructor(discovery: DiscoveryService, scanner: MetadataScanner, router: IntentRouter);
-    onModuleInit(): void;
+interface ChainResult {
+    allowed: boolean;
+    scoreDelta: number;
+    statusCode: number;
+    body?: string | Buffer | Uint8Array;
+    headers?: Map<number, Uint8Array>;
+}
+declare class AxisSensorChainService {
+    private readonly registry;
+    constructor(registry: SensorRegistry);
+    evaluate(input: SensorInput, phase?: 'PRE_DECODE' | 'POST_DECODE' | 'BOTH', baseDecision?: SensorDecision): Promise<SensorDecision>;
+    evaluatePre(input: SensorInput): Promise<SensorDecision>;
+    evaluatePost(input: SensorInput, baseDecision?: SensorDecision): Promise<SensorDecision>;
+    private evaluateSensors;
+}
+
+interface CceDerivationInput {
+    axisLocalSecret: string;
+    capsule: CceCapsuleClaims;
+    requestNonce: string;
+    responseNonce?: string;
+}
+declare function deriveRequestExecutionKey(input: CceDerivationInput): Uint8Array;
+declare function deriveResponseExecutionKey(input: CceDerivationInput & {
+    responseNonce: string;
+}): Uint8Array;
+declare function deriveWitnessKey(input: CceDerivationInput): Uint8Array;
+declare function buildExecutionContext(input: CceDerivationInput, requestId: string): CceExecutionContext;
+declare function generateCceNonce(): string;
+
+interface CceAxisKeyProvider {
+    unwrapKey(encryptedKeyB64: string, algorithm: string, axisKid: string, ephemeralPkB64?: string): Promise<Uint8Array | null>;
+}
+interface CceAesGcmProvider {
+    decrypt(key: Uint8Array, iv: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Promise<Uint8Array | null>;
+}
+declare class CcePayloadDecryptionSensor implements AxisSensor {
+    private readonly keyProvider;
+    private readonly aesProvider;
+    private readonly maxPayloadBytes;
+    readonly name = "cce.payload.decryption";
+    readonly order = 145;
+    readonly phase: "POST_DECODE";
+    constructor(keyProvider: CceAxisKeyProvider, aesProvider: CceAesGcmProvider, maxPayloadBytes?: number);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
 }
 
-declare const BAND: {
-    readonly WIRE: 0;
-    readonly IDENTITY: 40;
-    readonly POLICY: 90;
-    readonly CONTENT: 140;
-    readonly BUSINESS: 200;
-    readonly AUDIT: 900;
+declare function aesGcmEncrypt(key: Uint8Array, plaintext: Uint8Array, aad?: Uint8Array): {
+    iv: Uint8Array;
+    ciphertext: Uint8Array;
+    tag: Uint8Array;
 };
-type SensorBand = keyof typeof BAND;
-declare const PRE_DECODE_BOUNDARY = 40;
+declare function aesGcmDecrypt(key: Uint8Array, iv: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array, aad?: Uint8Array): Uint8Array | null;
+declare function generateAesKey(): Uint8Array;
+declare function generateIv(): Uint8Array;
+declare function base64UrlEncode(bytes: Uint8Array): string;
+declare function base64UrlDecode(input: string): Uint8Array;
+declare function hashPayload(payload: Uint8Array): string;
+
+declare const nodeAesGcmProvider: CceAesGcmProvider;
+
+declare class CceEnvelopeValidationSensor implements AxisSensor {
+    readonly name = "cce.envelope.validation";
+    readonly order = 5;
+    readonly phase: "PRE_DECODE";
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
 
-declare class SensorRegistry {
-    private readonly configService;
-    private sensors;
-    private readonly logger;
-    constructor(configService: ConfigService);
-    register(sensor: AxisSensor): void;
-    list(): AxisSensor[];
-    getPreDecodeSensors(): AxisPreSensor[];
-    getPostDecodeSensors(): AxisPostSensor[];
-    private isPreDecodeSensor;
-    private isPostDecodeSensor;
-    getSensorCountByPhase(): {
-        preDecodeCount: number;
-        postDecodeCount: number;
-    };
-    clear(): void;
+interface CceClientKeyResolver {
+    resolve(kid: string): Promise<{
+        publicKeyHex: string;
+        alg: string;
+    } | null>;
+}
+interface CceSignatureVerifier {
+    verify(message: Uint8Array, signatureHex: string, publicKeyHex: string, alg: string): Promise<boolean>;
+}
+declare class CceClientSignatureSensor implements AxisSensor {
+    private readonly keyResolver;
+    private readonly signatureVerifier;
+    readonly name = "cce.client.signature";
+    readonly order = 45;
+    readonly phase: "POST_DECODE";
+    constructor(keyResolver: CceClientKeyResolver, signatureVerifier: CceSignatureVerifier);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
 }
 
-declare class SensorDiscoveryService implements OnApplicationBootstrap {
-    private readonly discovery;
-    private readonly reflector;
-    private readonly registry;
+interface CceIssuerKeyResolver {
+    resolve(kid: string): Promise<{
+        publicKeyHex: string;
+    } | null>;
+}
+interface CceCapsuleSignatureVerifier {
+    verify(claims: Omit<CceCapsuleClaims, "issuer_sig">, signature: {
+        alg: string;
+        kid: string;
+        value: string;
+    }, publicKeyHex: string): Promise<boolean>;
+}
+declare class CceCapsuleVerificationSensor implements AxisSensor {
+    private readonly issuerKeyResolver;
+    private readonly capsuleVerifier;
+    readonly name = "cce.capsule.verification";
+    readonly order = 50;
+    readonly phase: "POST_DECODE";
+    constructor(issuerKeyResolver: CceIssuerKeyResolver, capsuleVerifier: CceCapsuleSignatureVerifier);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+declare class CceTpsWindowSensor implements AxisSensor {
+    private readonly skewMs;
+    readonly name = "cce.tps.window";
+    readonly order = 92;
+    readonly phase: "POST_DECODE";
+    constructor(skewMs?: number);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+declare class CceAudienceIntentBindingSensor implements AxisSensor {
+    private readonly axisAudience;
+    readonly name = "cce.audience.intent.binding";
+    readonly order = 95;
+    readonly phase: "POST_DECODE";
+    constructor(axisAudience: string);
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+interface CceReplayStore {
+    checkAndMark(key: string, ttlMs: number): Promise<boolean>;
+    isCapsuleConsumed(capsuleId: string): Promise<boolean>;
+    markCapsuleConsumed(capsuleId: string, ttlMs: number): Promise<void>;
+    isCapsuleRevoked(capsuleId: string): Promise<boolean>;
+}
+declare class InMemoryCceReplayStore implements CceReplayStore {
+    private nonces;
+    private consumed;
+    private revoked;
+    checkAndMark(key: string, ttlMs: number): Promise<boolean>;
+    isCapsuleConsumed(capsuleId: string): Promise<boolean>;
+    markCapsuleConsumed(capsuleId: string, _ttlMs: number): Promise<void>;
+    isCapsuleRevoked(capsuleId: string): Promise<boolean>;
+    revoke(capsuleId: string): void;
+    private cleanup;
+}
+declare class CceReplayProtectionSensor implements AxisSensor {
+    private readonly replayStore;
+    readonly name = "cce.replay.protection";
+    readonly order = 98;
+    readonly phase: "POST_DECODE";
+    private readonly nonceTtlMs;
+    constructor(replayStore: CceReplayStore, options?: {
+        nonceTtlMs?: number;
+    });
+    supports(input: SensorInput): boolean;
+    run(input: SensorInput): Promise<SensorDecision>;
+}
+
+declare const index$9_CCE_AES_KEY_BYTES: typeof CCE_AES_KEY_BYTES;
+declare const index$9_CCE_DERIVATION: typeof CCE_DERIVATION;
+declare const index$9_CCE_ERROR: typeof CCE_ERROR;
+declare const index$9_CCE_IV_BYTES: typeof CCE_IV_BYTES;
+declare const index$9_CCE_NONCE_BYTES: typeof CCE_NONCE_BYTES;
+declare const index$9_CCE_PROTOCOL_VERSION: typeof CCE_PROTOCOL_VERSION;
+declare const index$9_CCE_TAG_BYTES: typeof CCE_TAG_BYTES;
+type index$9_CceAesGcmProvider = CceAesGcmProvider;
+type index$9_CceAlgorithm = CceAlgorithm;
+type index$9_CceAlgorithmDescriptor = CceAlgorithmDescriptor;
+type index$9_CceAudienceIntentBindingSensor = CceAudienceIntentBindingSensor;
+declare const index$9_CceAudienceIntentBindingSensor: typeof CceAudienceIntentBindingSensor;
+type index$9_CceAxisKeyProvider = CceAxisKeyProvider;
+type index$9_CceAxisSigner = CceAxisSigner;
+type index$9_CceCapsuleClaims = CceCapsuleClaims;
+type index$9_CceCapsuleSignatureVerifier = CceCapsuleSignatureVerifier;
+type index$9_CceCapsuleVerificationSensor = CceCapsuleVerificationSensor;
+declare const index$9_CceCapsuleVerificationSensor: typeof CceCapsuleVerificationSensor;
+type index$9_CceClientKeyEncryptor = CceClientKeyEncryptor;
+type index$9_CceClientKeyResolver = CceClientKeyResolver;
+type index$9_CceClientSignatureSensor = CceClientSignatureSensor;
+declare const index$9_CceClientSignatureSensor: typeof CceClientSignatureSensor;
+type index$9_CceConstraints = CceConstraints;
+type index$9_CceDerivationInput = CceDerivationInput;
+type index$9_CceEncryptedKey = CceEncryptedKey;
+type index$9_CceEncryptedPayload = CceEncryptedPayload;
+type index$9_CceEnvelopeValidationSensor = CceEnvelopeValidationSensor;
+declare const index$9_CceEnvelopeValidationSensor: typeof CceEnvelopeValidationSensor;
+type index$9_CceError = CceError;
+declare const index$9_CceError: typeof CceError;
+type index$9_CceErrorCode = CceErrorCode;
+type index$9_CceExecutionContext = CceExecutionContext;
+type index$9_CceHandler = CceHandler;
+type index$9_CceHandlerContext = CceHandlerContext;
+type index$9_CceHandlerResult = CceHandlerResult;
+type index$9_CceIssuerKeyResolver = CceIssuerKeyResolver;
+type index$9_CceKdfAlgorithm = CceKdfAlgorithm;
+type index$9_CceKemAlgorithm = CceKemAlgorithm;
+type index$9_CcePayloadDecryptionSensor = CcePayloadDecryptionSensor;
+declare const index$9_CcePayloadDecryptionSensor: typeof CcePayloadDecryptionSensor;
+type index$9_CcePipelineConfig = CcePipelineConfig;
+type index$9_CcePipelineResult = CcePipelineResult;
+type index$9_CceReplayProtectionSensor = CceReplayProtectionSensor;
+declare const index$9_CceReplayProtectionSensor: typeof CceReplayProtectionSensor;
+type index$9_CceReplayStore = CceReplayStore;
+type index$9_CceRequestEnvelope = CceRequestEnvelope;
+type index$9_CceResponseEnvelope = CceResponseEnvelope;
+type index$9_CceResponseOptions = CceResponseOptions;
+type index$9_CceResponseStatus = CceResponseStatus;
+type index$9_CceSignature = CceSignature;
+type index$9_CceSignatureVerifier = CceSignatureVerifier;
+type index$9_CceTpsWindowSensor = CceTpsWindowSensor;
+declare const index$9_CceTpsWindowSensor: typeof CceTpsWindowSensor;
+type index$9_CceVerificationState = CceVerificationState;
+type index$9_CceWitnessRecord = CceWitnessRecord;
+type index$9_CceWitnessStore = CceWitnessStore;
+type index$9_InMemoryCceReplayStore = InMemoryCceReplayStore;
+declare const index$9_InMemoryCceReplayStore: typeof InMemoryCceReplayStore;
+type index$9_InMemoryCceWitnessStore = InMemoryCceWitnessStore;
+declare const index$9_InMemoryCceWitnessStore: typeof InMemoryCceWitnessStore;
+declare const index$9_aesGcmDecrypt: typeof aesGcmDecrypt;
+declare const index$9_aesGcmEncrypt: typeof aesGcmEncrypt;
+declare const index$9_base64UrlDecode: typeof base64UrlDecode;
+declare const index$9_base64UrlEncode: typeof base64UrlEncode;
+declare const index$9_buildCceErrorResponse: typeof buildCceErrorResponse;
+declare const index$9_buildCceResponse: typeof buildCceResponse;
+declare const index$9_buildExecutionContext: typeof buildExecutionContext;
+declare const index$9_buildWitnessRecord: typeof buildWitnessRecord;
+declare const index$9_deriveRequestExecutionKey: typeof deriveRequestExecutionKey;
+declare const index$9_deriveResponseExecutionKey: typeof deriveResponseExecutionKey;
+declare const index$9_deriveWitnessKey: typeof deriveWitnessKey;
+declare const index$9_executeCcePipeline: typeof executeCcePipeline;
+declare const index$9_extractVerificationState: typeof extractVerificationState;
+declare const index$9_generateAesKey: typeof generateAesKey;
+declare const index$9_generateCceNonce: typeof generateCceNonce;
+declare const index$9_generateIv: typeof generateIv;
+declare const index$9_hashPayload: typeof hashPayload;
+declare const index$9_nodeAesGcmProvider: typeof nodeAesGcmProvider;
+declare namespace index$9 {
+  export { index$9_CCE_AES_KEY_BYTES as CCE_AES_KEY_BYTES, index$9_CCE_DERIVATION as CCE_DERIVATION, index$9_CCE_ERROR as CCE_ERROR, index$9_CCE_IV_BYTES as CCE_IV_BYTES, index$9_CCE_NONCE_BYTES as CCE_NONCE_BYTES, index$9_CCE_PROTOCOL_VERSION as CCE_PROTOCOL_VERSION, index$9_CCE_TAG_BYTES as CCE_TAG_BYTES, type index$9_CceAesGcmProvider as CceAesGcmProvider, type index$9_CceAlgorithm as CceAlgorithm, type index$9_CceAlgorithmDescriptor as CceAlgorithmDescriptor, index$9_CceAudienceIntentBindingSensor as CceAudienceIntentBindingSensor, type index$9_CceAxisKeyProvider as CceAxisKeyProvider, type index$9_CceAxisSigner as CceAxisSigner, type index$9_CceCapsuleClaims as CceCapsuleClaims, type index$9_CceCapsuleSignatureVerifier as CceCapsuleSignatureVerifier, index$9_CceCapsuleVerificationSensor as CceCapsuleVerificationSensor, type index$9_CceClientKeyEncryptor as CceClientKeyEncryptor, type index$9_CceClientKeyResolver as CceClientKeyResolver, index$9_CceClientSignatureSensor as CceClientSignatureSensor, type index$9_CceConstraints as CceConstraints, type index$9_CceDerivationInput as CceDerivationInput, type index$9_CceEncryptedKey as CceEncryptedKey, type index$9_CceEncryptedPayload as CceEncryptedPayload, index$9_CceEnvelopeValidationSensor as CceEnvelopeValidationSensor, index$9_CceError as CceError, type index$9_CceErrorCode as CceErrorCode, type index$9_CceExecutionContext as CceExecutionContext, type index$9_CceHandler as CceHandler, type index$9_CceHandlerContext as CceHandlerContext, type index$9_CceHandlerResult as CceHandlerResult, type index$9_CceIssuerKeyResolver as CceIssuerKeyResolver, type index$9_CceKdfAlgorithm as CceKdfAlgorithm, type index$9_CceKemAlgorithm as CceKemAlgorithm, index$9_CcePayloadDecryptionSensor as CcePayloadDecryptionSensor, type index$9_CcePipelineConfig as CcePipelineConfig, type index$9_CcePipelineResult as CcePipelineResult, index$9_CceReplayProtectionSensor as CceReplayProtectionSensor, type index$9_CceReplayStore as CceReplayStore, type index$9_CceRequestEnvelope as CceRequestEnvelope, type index$9_CceResponseEnvelope as CceResponseEnvelope, type index$9_CceResponseOptions as CceResponseOptions, type index$9_CceResponseStatus as CceResponseStatus, type index$9_CceSignature as CceSignature, type index$9_CceSignatureVerifier as CceSignatureVerifier, index$9_CceTpsWindowSensor as CceTpsWindowSensor, type index$9_CceVerificationState as CceVerificationState, type index$9_CceWitnessRecord as CceWitnessRecord, type index$9_CceWitnessStore as CceWitnessStore, index$9_InMemoryCceReplayStore as InMemoryCceReplayStore, index$9_InMemoryCceWitnessStore as InMemoryCceWitnessStore, index$9_aesGcmDecrypt as aesGcmDecrypt, index$9_aesGcmEncrypt as aesGcmEncrypt, index$9_base64UrlDecode as base64UrlDecode, index$9_base64UrlEncode as base64UrlEncode, index$9_buildCceErrorResponse as buildCceErrorResponse, index$9_buildCceResponse as buildCceResponse, index$9_buildExecutionContext as buildExecutionContext, index$9_buildWitnessRecord as buildWitnessRecord, index$9_deriveRequestExecutionKey as deriveRequestExecutionKey, index$9_deriveResponseExecutionKey as deriveResponseExecutionKey, index$9_deriveWitnessKey as deriveWitnessKey, index$9_executeCcePipeline as executeCcePipeline, index$9_extractVerificationState as extractVerificationState, index$9_generateAesKey as generateAesKey, index$9_generateCceNonce as generateCceNonce, index$9_generateIv as generateIv, index$9_hashPayload as hashPayload, index$9_nodeAesGcmProvider as nodeAesGcmProvider };
+}
+
+type ProofType = 1 | 2 | 3 | 4;
+interface ProofVerificationResult {
+    valid: boolean;
+    actorId?: string;
+    error?: string;
+    metadata?: Record<string, any>;
+}
+interface MTLSContext {
+    clientCertPem?: string;
+    clientCertFingerprint?: string;
+    clientCertSubject?: string;
+    clientCertIssuer?: string;
+    verified?: boolean;
+}
+interface DeviceSEContext {
+    deviceId: string;
+    signature: Uint8Array;
+    publicKey: Uint8Array;
+    challenge?: Uint8Array;
+}
+declare class ProofVerificationService {
     private readonly logger;
-    constructor(discovery: DiscoveryService, reflector: Reflector, registry: SensorRegistry);
-    onApplicationBootstrap(): void;
+    private readonly deviceKeys;
+    private readonly trustedCerts;
+    verifyProof(proofType: ProofType, proofRef: Uint8Array, context: {
+        signTarget?: Uint8Array;
+        signature?: Uint8Array;
+        mtls?: MTLSContext;
+        deviceSE?: DeviceSEContext;
+    }): Promise<ProofVerificationResult>;
+    private verifyCapsuleProof;
+    private verifyJWTProof;
+    private verifyMTLSProof;
+    private verifyDeviceSEProof;
+    registerDeviceKey(deviceId: string, publicKey: Uint8Array): void;
+    unregisterDevice(deviceId: string): boolean;
+    registerMTLSCert(fingerprint: string, actorId: string): void;
+    revokeMTLSCert(fingerprint: string): boolean;
+    static calculateFingerprint(certPem: string): string;
+}
+
+type index$8_ActorKeyRecord = ActorKeyRecord;
+type index$8_AxisCapsule = AxisCapsule;
+type index$8_AxisCapsuleConstraints = AxisCapsuleConstraints;
+type index$8_AxisCapsulePayload = AxisCapsulePayload;
+type index$8_CapsuleBatchBody = CapsuleBatchBody;
+type index$8_CapsuleBatchResult = CapsuleBatchResult;
+type index$8_CapsuleIssueBody = CapsuleIssueBody;
+type index$8_CapsuleIssueResult = CapsuleIssueResult;
+type index$8_CapsuleMode = CapsuleMode;
+type index$8_CapsuleRecord = CapsuleRecord;
+type index$8_CapsuleRevokeBody = CapsuleRevokeBody;
+type index$8_CapsuleStatus = CapsuleStatus;
+type index$8_DeviceSEContext = DeviceSEContext;
+type index$8_IntentExecBody = IntentExecBody;
+type index$8_IssuerKeyRecord = IssuerKeyRecord;
+type index$8_KeyStatus = KeyStatus;
+type index$8_MTLSContext = MTLSContext;
+type index$8_ProofType = ProofType;
+type index$8_ProofVerificationResult = ProofVerificationResult;
+type index$8_ProofVerificationService = ProofVerificationService;
+declare const index$8_ProofVerificationService: typeof ProofVerificationService;
+type index$8_TickWindow = TickWindow;
+declare const index$8_b64urlDecode: typeof b64urlDecode;
+declare const index$8_b64urlDecodeString: typeof b64urlDecodeString;
+declare const index$8_b64urlEncode: typeof b64urlEncode;
+declare const index$8_b64urlEncodeString: typeof b64urlEncodeString;
+declare const index$8_canonicalJson: typeof canonicalJson;
+declare const index$8_canonicalJsonExcluding: typeof canonicalJsonExcluding;
+declare namespace index$8 {
+  export { type index$8_ActorKeyRecord as ActorKeyRecord, type AxisAlg$1 as AxisAlg, type index$8_AxisCapsule as AxisCapsule, type index$8_AxisCapsuleConstraints as AxisCapsuleConstraints, type index$8_AxisCapsulePayload as AxisCapsulePayload, type AxisPacket$1 as AxisPacket, type AxisResponse$1 as AxisResponse, type AxisSig$1 as AxisSig, type index$8_CapsuleBatchBody as CapsuleBatchBody, type index$8_CapsuleBatchResult as CapsuleBatchResult, type index$8_CapsuleIssueBody as CapsuleIssueBody, type index$8_CapsuleIssueResult as CapsuleIssueResult, type index$8_CapsuleMode as CapsuleMode, type index$8_CapsuleRecord as CapsuleRecord, type index$8_CapsuleRevokeBody as CapsuleRevokeBody, type index$8_CapsuleStatus as CapsuleStatus, type index$8_DeviceSEContext as DeviceSEContext, type index$8_IntentExecBody as IntentExecBody, type index$8_IssuerKeyRecord as IssuerKeyRecord, type index$8_KeyStatus as KeyStatus, type index$8_MTLSContext as MTLSContext, type index$8_ProofType as ProofType, type index$8_ProofVerificationResult as ProofVerificationResult, index$8_ProofVerificationService as ProofVerificationService, type index$8_TickWindow as TickWindow, index$8_b64urlDecode as b64urlDecode, index$8_b64urlDecodeString as b64urlDecodeString, index$8_b64urlEncode as b64urlEncode, index$8_b64urlEncodeString as b64urlEncodeString, index$8_canonicalJson as canonicalJson, index$8_canonicalJsonExcluding as canonicalJsonExcluding };
+}
+
+declare const index$7_AxisDemoPubkey: typeof AxisDemoPubkey;
+declare const index$7_AxisFrame: typeof AxisFrame;
+declare const index$7_AxisIp: typeof AxisIp;
+declare const index$7_AxisRaw: typeof AxisRaw;
+type index$7_AxisRequestData = AxisRequestData;
+type index$7_DtoSchema = DtoSchema;
+declare const index$7_HANDLER_METADATA_KEY: typeof HANDLER_METADATA_KEY;
+declare const index$7_Handler: typeof Handler;
+declare const index$7_INTENT_BODY_KEY: typeof INTENT_BODY_KEY;
+declare const index$7_INTENT_METADATA_KEY: typeof INTENT_METADATA_KEY;
+declare const index$7_INTENT_ROUTES_KEY: typeof INTENT_ROUTES_KEY;
+declare const index$7_INTENT_SENSORS_KEY: typeof INTENT_SENSORS_KEY;
+declare const index$7_Intent: typeof Intent;
+declare const index$7_IntentBody: typeof IntentBody;
+type index$7_IntentKind = IntentKind;
+type index$7_IntentOptions = IntentOptions;
+type index$7_IntentRoute = IntentRoute;
+declare const index$7_IntentSensors: typeof IntentSensors;
+type index$7_IntentTlvField = IntentTlvField;
+declare const index$7_SENSOR_METADATA_KEY: typeof SENSOR_METADATA_KEY;
+declare const index$7_Sensor: typeof Sensor;
+type index$7_SensorOptions = SensorOptions;
+type index$7_SensorPhase = SensorPhase;
+declare const index$7_TLV_FIELDS_KEY: typeof TLV_FIELDS_KEY;
+declare const index$7_TLV_VALIDATORS_KEY: typeof TLV_VALIDATORS_KEY;
+declare const index$7_TlvEnum: typeof TlvEnum;
+declare const index$7_TlvField: typeof TlvField;
+type index$7_TlvFieldKind = TlvFieldKind;
+type index$7_TlvFieldMeta = TlvFieldMeta;
+type index$7_TlvFieldOptions = TlvFieldOptions;
+declare const index$7_TlvMinLen: typeof TlvMinLen;
+declare const index$7_TlvRange: typeof TlvRange;
+declare const index$7_TlvUtf8Pattern: typeof TlvUtf8Pattern;
+declare const index$7_TlvValidate: typeof TlvValidate;
+type index$7_TlvValidatorFn = TlvValidatorFn;
+type index$7_TlvValidatorMeta = TlvValidatorMeta;
+declare const index$7_buildDtoDecoder: typeof buildDtoDecoder;
+declare const index$7_extractDtoSchema: typeof extractDtoSchema;
+declare namespace index$7 {
+  export { AxisContext$1 as AxisContext, index$7_AxisDemoPubkey as AxisDemoPubkey, index$7_AxisFrame as AxisFrame, index$7_AxisIp as AxisIp, index$7_AxisRaw as AxisRaw, type index$7_AxisRequestData as AxisRequestData, type index$7_DtoSchema as DtoSchema, index$7_HANDLER_METADATA_KEY as HANDLER_METADATA_KEY, index$7_Handler as Handler, index$7_INTENT_BODY_KEY as INTENT_BODY_KEY, index$7_INTENT_METADATA_KEY as INTENT_METADATA_KEY, index$7_INTENT_ROUTES_KEY as INTENT_ROUTES_KEY, index$7_INTENT_SENSORS_KEY as INTENT_SENSORS_KEY, index$7_Intent as Intent, index$7_IntentBody as IntentBody, type index$7_IntentKind as IntentKind, type index$7_IntentOptions as IntentOptions, type index$7_IntentRoute as IntentRoute, index$7_IntentSensors as IntentSensors, type index$7_IntentTlvField as IntentTlvField, index$7_SENSOR_METADATA_KEY as SENSOR_METADATA_KEY, index$7_Sensor as Sensor, type index$7_SensorOptions as SensorOptions, type index$7_SensorPhase as SensorPhase, index$7_TLV_FIELDS_KEY as TLV_FIELDS_KEY, index$7_TLV_VALIDATORS_KEY as TLV_VALIDATORS_KEY, index$7_TlvEnum as TlvEnum, index$7_TlvField as TlvField, type index$7_TlvFieldKind as TlvFieldKind, type index$7_TlvFieldMeta as TlvFieldMeta, type index$7_TlvFieldOptions as TlvFieldOptions, index$7_TlvMinLen as TlvMinLen, index$7_TlvRange as TlvRange, index$7_TlvUtf8Pattern as TlvUtf8Pattern, index$7_TlvValidate as TlvValidate, type index$7_TlvValidatorFn as TlvValidatorFn, type index$7_TlvValidatorMeta as TlvValidatorMeta, index$7_buildDtoDecoder as buildDtoDecoder, index$7_extractDtoSchema as extractDtoSchema };
 }
 
 type index$6_ObservationQueueConfig = ObservationQueueConfig;
@@ -2084,8 +2612,6 @@ type index$3_ProofKind = ProofKind;
 declare const index$3_ProofKindZ: typeof ProofKindZ;
 type index$3_ProofPresenceInput = ProofPresenceInput;
 declare const index$3_ProofPresenceInputZ: typeof ProofPresenceInputZ;
-type index$3_ProofType = ProofType;
-declare const index$3_ProofType: typeof ProofType;
 type index$3_ProtocolStrictInput = ProtocolStrictInput;
 declare const index$3_ProtocolStrictInputZ: typeof ProtocolStrictInputZ;
 type index$3_RateLimitConfig = RateLimitConfig;
@@ -2121,18 +2647,23 @@ declare const index$3_WsHandshakeDecisionZ: typeof WsHandshakeDecisionZ;
 type index$3_WsHandshakeInput = WsHandshakeInput;
 declare const index$3_WsHandshakeInputZ: typeof WsHandshakeInputZ;
 declare namespace index$3 {
-  export { type index$3_AccessProfile as AccessProfile, index$3_AccessProfileZ as AccessProfileZ, type index$3_AxisContext as AxisContext, index$3_AxisContextZ as AxisContextZ, type index$3_AxisError as AxisError, index$3_AxisErrorZ as AxisErrorZ, type index$3_BodyBudgetInput as BodyBudgetInput, index$3_BodyBudgetInputZ as BodyBudgetInputZ, type index$3_BodyBudgetPolicy as BodyBudgetPolicy, index$3_BodyBudgetPolicyZ as BodyBudgetPolicyZ, index$3_BodyProfile as BodyProfile, type index$3_BodyProfileValidation as BodyProfileValidation, index$3_BodyProfileValidator as BodyProfileValidator, index$3_BodyProfileZ as BodyProfileZ, type index$3_Capsule as Capsule, type index$3_CapsuleClaims as CapsuleClaims, index$3_CapsuleClaimsZ as CapsuleClaimsZ, type index$3_CapsuleValidationResult as CapsuleValidationResult, index$3_CapsuleValidationResultZ as CapsuleValidationResultZ, type index$3_CapsuleVerifyResult as CapsuleVerifyResult, index$3_CapsuleVerifyResultZ as CapsuleVerifyResultZ, type index$3_CapsuleVerifySensorInput as CapsuleVerifySensorInput, index$3_CapsuleVerifySensorInputZ as CapsuleVerifySensorInputZ, index$3_CapsuleZ as CapsuleZ, type index$3_ChunkHashInput as ChunkHashInput, index$3_ChunkHashInputZ as ChunkHashInputZ, type index$3_CountryBlockDecision as CountryBlockDecision, index$3_CountryBlockDecisionZ as CountryBlockDecisionZ, type index$3_CountryBlockSensorInput as CountryBlockSensorInput, index$3_CountryBlockSensorInputZ as CountryBlockSensorInputZ, type index$3_EntropySensorInput as EntropySensorInput, index$3_EntropySensorInputZ as EntropySensorInputZ, index$3_ExecutionMetricsZ as ExecutionMetricsZ, type index$3_IPReputation as IPReputation, type index$3_IPReputationInput as IPReputationInput, index$3_IPReputationInputZ as IPReputationInputZ, index$3_IPReputationZ as IPReputationZ, type index$3_IntentPolicy as IntentPolicy, type index$3_IntentPolicyDecision as IntentPolicyDecision, index$3_IntentPolicyDecisionZ as IntentPolicyDecisionZ, type index$3_IntentPolicySensorInput as IntentPolicySensorInput, index$3_IntentPolicySensorInputZ as IntentPolicySensorInputZ, index$3_IntentPolicyZ as IntentPolicyZ, type index$3_IntentSchema as IntentSchema, index$3_IntentSchemaZ as IntentSchemaZ, type index$3_Passport as Passport, index$3_PassportZ as PassportZ, type index$3_ProofKind as ProofKind, index$3_ProofKindZ as ProofKindZ, type index$3_ProofPresenceInput as ProofPresenceInput, index$3_ProofPresenceInputZ as ProofPresenceInputZ, index$3_ProofType as ProofType, type index$3_ProtocolStrictInput as ProtocolStrictInput, index$3_ProtocolStrictInputZ as ProtocolStrictInputZ, type index$3_RateLimitConfig as RateLimitConfig, index$3_RateLimitConfigZ as RateLimitConfigZ, type index$3_RateLimitInput as RateLimitInput, index$3_RateLimitInputZ as RateLimitInputZ, type index$3_RateLimitProfile as RateLimitProfile, index$3_RateLimitProfileZ as RateLimitProfileZ, type index$3_ScanBurstDecision as ScanBurstDecision, index$3_ScanBurstDecisionZ as ScanBurstDecisionZ, type index$3_ScanBurstSensorInput as ScanBurstSensorInput, index$3_ScanBurstSensorInputZ as ScanBurstSensorInputZ, type index$3_SchemaField as SchemaField, type index$3_SchemaFieldKind as SchemaFieldKind, index$3_SchemaFieldKindZ as SchemaFieldKindZ, index$3_SchemaFieldZ as SchemaFieldZ, type index$3_Scope as Scope, index$3_ScopeZ as ScopeZ, type index$3_SensitivityLevel as SensitivityLevel, index$3_SensitivityLevelZ as SensitivityLevelZ, type index$3_SensorChainInput as SensorChainInput, index$3_SensorChainInputZ as SensorChainInputZ, index$3_SensorDecisionWithMetadataZ as SensorDecisionWithMetadataZ, index$3_SensorDecisionZ as SensorDecisionZ, type index$3_SensorResult as SensorResult, index$3_SensorResultZ as SensorResultZ, type index$3_UploadSession as UploadSession, index$3_UploadSessionZ as UploadSessionZ, type index$3_UploadStatus as UploadStatus, index$3_UploadStatusZ as UploadStatusZ, type index$3_WsHandshakeDecision as WsHandshakeDecision, index$3_WsHandshakeDecisionZ as WsHandshakeDecisionZ, type index$3_WsHandshakeInput as WsHandshakeInput, index$3_WsHandshakeInputZ as WsHandshakeInputZ };
+  export { type index$3_AccessProfile as AccessProfile, index$3_AccessProfileZ as AccessProfileZ, type index$3_AxisContext as AxisContext, index$3_AxisContextZ as AxisContextZ, type index$3_AxisError as AxisError, index$3_AxisErrorZ as AxisErrorZ, type index$3_BodyBudgetInput as BodyBudgetInput, index$3_BodyBudgetInputZ as BodyBudgetInputZ, type index$3_BodyBudgetPolicy as BodyBudgetPolicy, index$3_BodyBudgetPolicyZ as BodyBudgetPolicyZ, index$3_BodyProfile as BodyProfile, type index$3_BodyProfileValidation as BodyProfileValidation, index$3_BodyProfileValidator as BodyProfileValidator, index$3_BodyProfileZ as BodyProfileZ, type index$3_Capsule as Capsule, type index$3_CapsuleClaims as CapsuleClaims, index$3_CapsuleClaimsZ as CapsuleClaimsZ, type index$3_CapsuleValidationResult as CapsuleValidationResult, index$3_CapsuleValidationResultZ as CapsuleValidationResultZ, type index$3_CapsuleVerifyResult as CapsuleVerifyResult, index$3_CapsuleVerifyResultZ as CapsuleVerifyResultZ, type index$3_CapsuleVerifySensorInput as CapsuleVerifySensorInput, index$3_CapsuleVerifySensorInputZ as CapsuleVerifySensorInputZ, index$3_CapsuleZ as CapsuleZ, type index$3_ChunkHashInput as ChunkHashInput, index$3_ChunkHashInputZ as ChunkHashInputZ, type index$3_CountryBlockDecision as CountryBlockDecision, index$3_CountryBlockDecisionZ as CountryBlockDecisionZ, type index$3_CountryBlockSensorInput as CountryBlockSensorInput, index$3_CountryBlockSensorInputZ as CountryBlockSensorInputZ, type index$3_EntropySensorInput as EntropySensorInput, index$3_EntropySensorInputZ as EntropySensorInputZ, index$3_ExecutionMetricsZ as ExecutionMetricsZ, type index$3_IPReputation as IPReputation, type index$3_IPReputationInput as IPReputationInput, index$3_IPReputationInputZ as IPReputationInputZ, index$3_IPReputationZ as IPReputationZ, type index$3_IntentPolicy as IntentPolicy, type index$3_IntentPolicyDecision as IntentPolicyDecision, index$3_IntentPolicyDecisionZ as IntentPolicyDecisionZ, type index$3_IntentPolicySensorInput as IntentPolicySensorInput, index$3_IntentPolicySensorInputZ as IntentPolicySensorInputZ, index$3_IntentPolicyZ as IntentPolicyZ, type index$3_IntentSchema as IntentSchema, index$3_IntentSchemaZ as IntentSchemaZ, type index$3_Passport as Passport, index$3_PassportZ as PassportZ, type index$3_ProofKind as ProofKind, index$3_ProofKindZ as ProofKindZ, type index$3_ProofPresenceInput as ProofPresenceInput, index$3_ProofPresenceInputZ as ProofPresenceInputZ, ProofType$1 as ProofType, type index$3_ProtocolStrictInput as ProtocolStrictInput, index$3_ProtocolStrictInputZ as ProtocolStrictInputZ, type index$3_RateLimitConfig as RateLimitConfig, index$3_RateLimitConfigZ as RateLimitConfigZ, type index$3_RateLimitInput as RateLimitInput, index$3_RateLimitInputZ as RateLimitInputZ, type index$3_RateLimitProfile as RateLimitProfile, index$3_RateLimitProfileZ as RateLimitProfileZ, type index$3_ScanBurstDecision as ScanBurstDecision, index$3_ScanBurstDecisionZ as ScanBurstDecisionZ, type index$3_ScanBurstSensorInput as ScanBurstSensorInput, index$3_ScanBurstSensorInputZ as ScanBurstSensorInputZ, type index$3_SchemaField as SchemaField, type index$3_SchemaFieldKind as SchemaFieldKind, index$3_SchemaFieldKindZ as SchemaFieldKindZ, index$3_SchemaFieldZ as SchemaFieldZ, type index$3_Scope as Scope, index$3_ScopeZ as ScopeZ, type index$3_SensitivityLevel as SensitivityLevel, index$3_SensitivityLevelZ as SensitivityLevelZ, type index$3_SensorChainInput as SensorChainInput, index$3_SensorChainInputZ as SensorChainInputZ, index$3_SensorDecisionWithMetadataZ as SensorDecisionWithMetadataZ, index$3_SensorDecisionZ as SensorDecisionZ, type index$3_SensorResult as SensorResult, index$3_SensorResultZ as SensorResultZ, type index$3_UploadSession as UploadSession, index$3_UploadSessionZ as UploadSessionZ, type index$3_UploadStatus as UploadStatus, index$3_UploadStatusZ as UploadStatusZ, type index$3_WsHandshakeDecision as WsHandshakeDecision, index$3_WsHandshakeDecisionZ as WsHandshakeDecisionZ, type index$3_WsHandshakeInput as WsHandshakeInput, index$3_WsHandshakeInputZ as WsHandshakeInputZ };
 }
 
+type index$2_AxisSensorChainService = AxisSensorChainService;
+declare const index$2_AxisSensorChainService: typeof AxisSensorChainService;
 declare const index$2_CAPABILITIES: typeof CAPABILITIES;
 type index$2_Capability = Capability;
+type index$2_ChainResult = ChainResult;
 declare const index$2_INTENT_REQUIREMENTS: typeof INTENT_REQUIREMENTS;
 declare const index$2_PROOF_CAPABILITIES: typeof PROOF_CAPABILITIES;
+type index$2_SensorDecision = SensorDecision;
+type index$2_SensorInput = SensorInput;
 declare const index$2_canAccessResource: typeof canAccessResource;
 declare const index$2_hasScope: typeof hasScope;
 declare const index$2_parseScope: typeof parseScope;
 declare namespace index$2 {
-  export { index$2_CAPABILITIES as CAPABILITIES, type index$2_Capability as Capability, index$2_INTENT_REQUIREMENTS as INTENT_REQUIREMENTS, index$2_PROOF_CAPABILITIES as PROOF_CAPABILITIES, index$2_canAccessResource as canAccessResource, index$2_hasScope as hasScope, index$2_parseScope as parseScope };
+  export { index$2_AxisSensorChainService as AxisSensorChainService, index$2_CAPABILITIES as CAPABILITIES, type index$2_Capability as Capability, type index$2_ChainResult as ChainResult, index$2_INTENT_REQUIREMENTS as INTENT_REQUIREMENTS, index$2_PROOF_CAPABILITIES as PROOF_CAPABILITIES, type index$2_SensorDecision as SensorDecision, type index$2_SensorInput as SensorInput, index$2_canAccessResource as canAccessResource, index$2_hasScope as hasScope, index$2_parseScope as parseScope };
 }
 
 declare class AccessProfileResolverSensor implements AxisSensor {
@@ -2353,4 +2884,4 @@ declare namespace index {
   export { index_encodeAxisTlvDto as encodeAxisTlvDto };
 }
 
-export { ATS1_HDR, ATS1_SCHEMA, AXIS_OPCODES, AXIS_UPLOAD_FILE_STORE, AXIS_UPLOAD_RECEIPT_SIGNER, AXIS_UPLOAD_SESSION_STORE, ats1 as Ats1Codec, type Axis1DecodedFrame, type Axis1FrameToEncode, type AxisAlg$1 as AxisAlg, type AxisPacket as AxisBinaryPacket, type AxisCapsule, type AxisCapsuleConstraints, type AxisCapsulePayload, type AxisCrudHandler, type AxisEffect, AxisFilesDownloadHandler, AxisFilesFinalizeHandler, AxisFrame$2 as AxisFrame, type AxisHandler, type AxisHandlerInit, AxisIdDto, type AxisAlg as AxisJsonAlg, type AxisFrame$1 as AxisJsonFrame, type AxisResponse as AxisJsonResponse, type AxisSig as AxisJsonSig, type AxisObservedContext, type AxisPacket$1 as AxisPacket, T as AxisPacketTags, AxisPartialType, type AxisPostSensor, type AxisPreSensor, type AxisRequestContext, AxisResponseDto, type AxisSensor, type AxisSensorInit, type AxisSig$1 as AxisSig, AxisTlvDto, CAPABILITIES, type Capability, type CapsuleMode, ContractViolationError, DEFAULT_CONTRACTS, DEFAULT_TIMEOUT, Decision, DiskUploadFileStore, type DtoSchema, type ExecutionContract, ExecutionMeter, type ExecutionMetrics, FALLBACK_CONTRACT, HANDLER_METADATA_KEY, Handler, INTENT_BODY_KEY, INTENT_METADATA_KEY, INTENT_REQUIREMENTS, INTENT_ROUTES_KEY, INTENT_SENSITIVITY_MAP, INTENT_SENSORS_KEY, INTENT_TIMEOUTS, Intent, IntentBody, type IntentDefinition, type IntentKind, type IntentOptions, type IntentRoute, IntentRouter, IntentSensitivity, IntentSensors, type IntentTlvField, type KeyStatus, type ObservationQueueConfig, type ObservationQueueMessage, type ObservationStreamEntry, type ObservationWitnessSummary, type ObserverVerdict, PROOF_CAPABILITIES, RESPONSE_TAG_CREATED_AT, RESPONSE_TAG_CREATED_BY, RESPONSE_TAG_ID, RESPONSE_TAG_UPDATED_AT, RESPONSE_TAG_UPDATED_BY, type ReceiptEffect, type ResponseContract, type ResponseObserverContext, RiskDecision, type RiskEvaluation, type RiskSignal, Schema2002_PasskeyLoginOptionsRes, Schema2011_PasskeyLoginVerifyReq, Schema2012_PasskeyLoginVerifyRes, Schema2021_PasskeyRegisterOptionsReq, type SensorDecision, SensorDecisions, type SensorInput, type SensorMinifiedDecision, type SensorPhaseMetadata, TLV_FIELDS_KEY, TLV_VALIDATORS_KEY, TlvEnum, TlvField, type TlvFieldKind, type TlvFieldMeta, type TlvFieldOptions, TlvMinLen, TlvRange, TlvUtf8Pattern, TlvValidate, type TlvValidatorFn, type TlvValidatorMeta, type UnsignedObservationWitness, type UploadFileStat, type UploadFileStore, type UploadReceiptSigner, type UploadSessionRecord, type UploadSessionStatus, type UploadSessionStore, axis1SigningBytes, b64urlDecode, b64urlDecodeString, b64urlEncode, b64urlEncodeString, buildAts1Hdr, buildDtoDecoder, buildPacket, buildQueueMessage, buildReceiptHash, buildTLVs, buildUnsignedWitness, bytes, canAccessResource, canonicalJson, canonicalJsonExcluding, canonicalizeObservation, classifyIntent, index$8 as crypto, decodeAxis1Frame, decodeQueueMessage, index$7 as decorators, encVarint, encodeAxis1Frame, encodeQueueMessage, index$5 as engine, extractDtoSchema, hasScope, hashObservation, isAdminOpcode, isKnownOpcode, isTimestampValid, index$4 as loom, nonce16, normalizeSensorDecision, packPasskeyLoginOptionsReq, packPasskeyLoginOptionsRes, packPasskeyLoginVerifyReq, packPasskeyLoginVerifyRes, packPasskeyRegisterOptionsReq, parseAutoClaimEntries, parseScope, parseStreamEntries, resolveTimeout, index$3 as schemas, index$2 as security, sensitivityName, index$1 as sensors, stableJsonStringify, tlv, u64be, unpackPasskeyLoginOptionsReq, unpackPasskeyLoginVerifyReq, unpackPasskeyRegisterOptionsReq, utf8, index as utils, validateFrameShape, varintU, verifyResponse };
+export { ATS1_HDR, ATS1_SCHEMA, AXIS_OPCODES, AXIS_UPLOAD_FILE_STORE, AXIS_UPLOAD_RECEIPT_SIGNER, AXIS_UPLOAD_SESSION_STORE, ats1 as Ats1Codec, type Axis1DecodedFrame, type Axis1FrameToEncode, type AxisAlg$1 as AxisAlg, type AxisPacket as AxisBinaryPacket, type AxisCapsule, type AxisCapsuleConstraints, type AxisCapsulePayload, AxisContext$1 as AxisContext, type AxisCrudHandler, type AxisDecoded, AxisDemoPubkey, type AxisEffect, AxisFilesDownloadHandler, AxisFilesFinalizeHandler, AxisFrame$2 as AxisFrame, type AxisHandler, type AxisHandlerInit, AxisIdDto, AxisIp, type AxisAlg as AxisJsonAlg, type AxisFrame$1 as AxisJsonFrame, type AxisResponse as AxisJsonResponse, type AxisSig as AxisJsonSig, type AxisObservation, type AxisObservedContext, type AxisPacket$1 as AxisPacket, T as AxisPacketTags, AxisPartialType, type AxisPostSensor, type AxisPreSensor, AxisRaw, type AxisRequestContext, type AxisRequestData, AxisResponseDto, type AxisSensor, AxisSensorChainService, type AxisSensorInit, type AxisSig$1 as AxisSig, AxisTlvDto, BAND, CAPABILITIES, CCE_ERROR, CCE_PROTOCOL_VERSION, type Capability, type CapsuleMode, type CceCapsuleClaims as CceCapsuleClaimsType, CceError, type CceExecutionContext as CceExecutionContextType, type CceHandler, type CceHandlerContext, type CceHandlerResult, type CcePipelineConfig, type CcePipelineResult, type CceRequestEnvelope as CceRequestEnvelopeType, type CceResponseEnvelope as CceResponseEnvelopeType, type CceWitnessRecord as CceWitnessRecordType, type ChainResult, ContractViolationError, DEFAULT_CONTRACTS, DEFAULT_TIMEOUT, Decision, DiskUploadFileStore, type DtoSchema, type ExecutionContract, ExecutionMeter, type ExecutionMetrics, FALLBACK_CONTRACT, HANDLER_METADATA_KEY, HANDLER_SENSORS_KEY, Handler, HandlerDiscoveryService, HandlerSensors, INTENT_BODY_KEY, INTENT_METADATA_KEY, INTENT_REQUIREMENTS, INTENT_ROUTES_KEY, INTENT_SENSITIVITY_MAP, INTENT_SENSORS_KEY, INTENT_TIMEOUTS, Intent, IntentBody, type IntentDefinition, type IntentKind, type IntentOptions, type IntentRoute, IntentRouter, IntentSensitivity, IntentSensors, type IntentTlvField, type KeyStatus, type ObservationQueueConfig, type ObservationQueueMessage, type ObservationSensor, type ObservationStage, type ObservationStreamEntry, type ObservationWitnessSummary, type ObserverVerdict, PRE_DECODE_BOUNDARY, PROOF_CAPABILITIES, RESPONSE_TAG_CREATED_AT, RESPONSE_TAG_CREATED_BY, RESPONSE_TAG_ID, RESPONSE_TAG_UPDATED_AT, RESPONSE_TAG_UPDATED_BY, type ReceiptEffect, type ResponseContract, type ResponseObserverContext, RiskDecision, type RiskEvaluation, type RiskSignal, SENSOR_METADATA_KEY, Schema2002_PasskeyLoginOptionsRes, Schema2011_PasskeyLoginVerifyReq, Schema2012_PasskeyLoginVerifyRes, Schema2021_PasskeyRegisterOptionsReq, Sensor, type SensorBand, type SensorDecision, SensorDecisions, SensorDiscoveryService, type SensorInput, type SensorMinifiedDecision, type SensorOptions, type SensorPhase, type SensorPhaseMetadata, SensorRegistry, TLV_FIELDS_KEY, TLV_VALIDATORS_KEY, TlvEnum, TlvField, type TlvFieldKind, type TlvFieldMeta, type TlvFieldOptions, TlvMinLen, TlvRange, TlvUtf8Pattern, TlvValidate, type TlvValidatorFn, type TlvValidatorMeta, type UnsignedObservationWitness, type UploadFileStat, type UploadFileStore, type UploadReceiptSigner, type UploadSessionRecord, type UploadSessionStatus, type UploadSessionStore, axis1SigningBytes, b64urlDecode, b64urlDecodeString, b64urlEncode, b64urlEncodeString, buildAts1Hdr, buildDtoDecoder, buildPacket, buildQueueMessage, buildReceiptHash, buildTLVs, buildUnsignedWitness, bytes, canAccessResource, canonicalJson, canonicalJsonExcluding, canonicalizeObservation, index$9 as cce, classifyIntent, createObservation, index$8 as crypto, decodeAxis1Frame, decodeQueueMessage, index$7 as decorators, encVarint, encodeAxis1Frame, encodeQueueMessage, endStage, index$5 as engine, executeCcePipeline, extractDtoSchema, finalizeObservation, hasScope, hashObservation, isAdminOpcode, isKnownOpcode, isTimestampValid, index$4 as loom, nonce16, normalizeSensorDecision, packPasskeyLoginOptionsReq, packPasskeyLoginOptionsRes, packPasskeyLoginVerifyReq, packPasskeyLoginVerifyRes, packPasskeyRegisterOptionsReq, parseAutoClaimEntries, parseScope, parseStreamEntries, recordSensor, resolveTimeout, index$3 as schemas, index$2 as security, sensitivityName, index$1 as sensors, stableJsonStringify, startStage, tlv, u64be, unpackPasskeyLoginOptionsReq, unpackPasskeyLoginVerifyReq, unpackPasskeyRegisterOptionsReq, utf8, index as utils, validateFrameShape, varintU, verifyResponse };