@nextera.one/axis-server-sdk 1.9.0 → 2.1.0

package/dist/index.mjs

@@ -39,6 +39,106 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/decorators/chain.decorator.ts
+var chain_decorator_exports = {};
+__export(chain_decorator_exports, {
+  CHAIN_METADATA_KEY: () => CHAIN_METADATA_KEY,
+  Chain: () => Chain
+});
+import "reflect-metadata";
+function Chain(options = {}) {
+  return (target, propertyKey) => {
+    const value = {
+      enabled: true,
+      ...options
+    };
+    Reflect.defineMetadata(CHAIN_METADATA_KEY, value, target, propertyKey);
+  };
+}
+var CHAIN_METADATA_KEY;
+var init_chain_decorator = __esm({
+  "src/decorators/chain.decorator.ts"() {
+    CHAIN_METADATA_KEY = "axis:chain";
+  }
+});
+
+// src/decorators/capsule-policy.decorator.ts
+var capsule_policy_decorator_exports = {};
+__export(capsule_policy_decorator_exports, {
+  CAPSULE_POLICY_METADATA_KEY: () => CAPSULE_POLICY_METADATA_KEY,
+  CapsulePolicy: () => CapsulePolicy,
+  mergeCapsulePolicyOptions: () => mergeCapsulePolicyOptions,
+  normalizeCapsulePolicyOptions: () => normalizeCapsulePolicyOptions
+});
+import "reflect-metadata";
+function CapsulePolicy(options = {}) {
+  const normalized = normalizeCapsulePolicyOptions(options);
+  return ((target, propertyKey) => {
+    if (propertyKey !== void 0) {
+      Reflect.defineMetadata(
+        CAPSULE_POLICY_METADATA_KEY,
+        normalized,
+        target,
+        propertyKey
+      );
+      return;
+    }
+    Reflect.defineMetadata(
+      CAPSULE_POLICY_METADATA_KEY,
+      normalized,
+      target
+    );
+  });
+}
+function normalizeCapsulePolicyOptions(options = {}) {
+  return {
+    required: options.required ?? true,
+    scopes: normalizeScopeValue(options.scopes),
+    scopeMode: options.scopeMode ?? "all",
+    intentBound: options.intentBound ?? true,
+    allowCapsuleRef: options.allowCapsuleRef ?? false
+  };
+}
+function mergeCapsulePolicyOptions(base, override) {
+  if (!base && !override) {
+    return void 0;
+  }
+  const normalizedBase = base ? normalizeCapsulePolicyOptions(base) : void 0;
+  const normalizedOverride = override ? normalizeCapsulePolicyOptions(override) : void 0;
+  const scopes = [
+    ...toScopeList(normalizedBase?.scopes),
+    ...toScopeList(normalizedOverride?.scopes)
+  ];
+  return {
+    required: normalizedOverride?.required ?? normalizedBase?.required ?? true,
+    scopes: normalizeScopeValue(scopes),
+    scopeMode: normalizedOverride?.scopeMode ?? normalizedBase?.scopeMode ?? "all",
+    intentBound: normalizedOverride?.intentBound ?? normalizedBase?.intentBound ?? true,
+    allowCapsuleRef: normalizedOverride?.allowCapsuleRef ?? normalizedBase?.allowCapsuleRef ?? false
+  };
+}
+function normalizeScopeValue(value) {
+  const list = toScopeList(value);
+  if (list.length === 0) {
+    return void 0;
+  }
+  return list.length === 1 ? list[0] : list;
+}
+function toScopeList(value) {
+  if (!value) {
+    return [];
+  }
+  return Array.from(new Set(Array.isArray(value) ? value : [value])).filter(
+    (entry) => entry.trim().length > 0
+  );
+}
+var CAPSULE_POLICY_METADATA_KEY;
+var init_capsule_policy_decorator = __esm({
+  "src/decorators/capsule-policy.decorator.ts"() {
+    CAPSULE_POLICY_METADATA_KEY = "axis:capsule:policy";
+  }
+});
+
 // src/decorators/handler.decorator.ts
 var handler_decorator_exports = {};
 __export(handler_decorator_exports, {
@@ -82,6 +182,7 @@ function Intent(action, options) {
       absolute: options?.absolute,
       frame: options?.frame,
       kind: options?.kind,
+      chain: options?.chain,
       bodyProfile: options?.bodyProfile,
       tlv: options?.tlv,
       dto: options?.dto
@@ -135,6 +236,73 @@ var init_intent_sensors_decorator = __esm({
   }
 });
 
+// src/decorators/observer.decorator.ts
+var observer_decorator_exports = {};
+__export(observer_decorator_exports, {
+  OBSERVER_BINDINGS_KEY: () => OBSERVER_BINDINGS_KEY,
+  OBSERVER_METADATA_KEY: () => OBSERVER_METADATA_KEY,
+  Observer: () => Observer
+});
+import "reflect-metadata";
+import { Injectable as Injectable2 } from "@nestjs/common";
+function isBindingOptions(value) {
+  return !!value && typeof value === "object" && "use" in value;
+}
+function isDefinitionOptions(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && !isBindingOptions(value);
+}
+function toBinding(input) {
+  if (!input) return null;
+  if (isBindingOptions(input)) {
+    const refs = Array.isArray(input.use) ? input.use : [input.use];
+    return { refs, tags: input.tags, events: input.events };
+  }
+  if (Array.isArray(input)) {
+    return { refs: input };
+  }
+  if (typeof input === "function" || typeof input === "string") {
+    return { refs: [input] };
+  }
+  return null;
+}
+function Observer(input) {
+  return ((target, propertyKey) => {
+    const binding = toBinding(input);
+    if (binding) {
+      if (propertyKey !== void 0) {
+        const existing2 = Reflect.getMetadata(OBSERVER_BINDINGS_KEY, target, propertyKey) || [];
+        existing2.push(binding);
+        Reflect.defineMetadata(
+          OBSERVER_BINDINGS_KEY,
+          existing2,
+          target,
+          propertyKey
+        );
+        return;
+      }
+      const existing = Reflect.getMetadata(OBSERVER_BINDINGS_KEY, target) || [];
+      existing.push(binding);
+      Reflect.defineMetadata(OBSERVER_BINDINGS_KEY, existing, target);
+      return;
+    }
+    if (propertyKey !== void 0) {
+      throw new Error(
+        "@Observer method usage must reference one or more observer classes or names"
+      );
+    }
+    const definition = isDefinitionOptions(input) ? input : {};
+    Reflect.defineMetadata(OBSERVER_METADATA_KEY, definition, target);
+    Injectable2()(target);
+  });
+}
+var OBSERVER_METADATA_KEY, OBSERVER_BINDINGS_KEY;
+var init_observer_decorator = __esm({
+  "src/decorators/observer.decorator.ts"() {
+    OBSERVER_METADATA_KEY = "axis:observer";
+    OBSERVER_BINDINGS_KEY = "axis:observer:bindings";
+  }
+});
+
 // src/decorators/handler-sensors.decorator.ts
 var handler_sensors_decorator_exports = {};
 __export(handler_sensors_decorator_exports, {
@@ -473,113 +641,308 @@ var require_axis_response_dto = __commonJS({
   }
 });
 
-// src/sensor/axis-sensor.ts
-var axis_sensor_exports = {};
-__export(axis_sensor_exports, {
-  Decision: () => Decision,
-  SensorDecisions: () => SensorDecisions,
-  normalizeSensorDecision: () => normalizeSensorDecision
+// src/core/constants.ts
+var constants_exports = {};
+__export(constants_exports, {
+  AXIS_MAGIC: () => AXIS_MAGIC,
+  AXIS_VERSION: () => AXIS_VERSION,
+  BodyProfile: () => BodyProfile,
+  ERR_BAD_SIGNATURE: () => ERR_BAD_SIGNATURE,
+  ERR_CONTRACT_VIOLATION: () => ERR_CONTRACT_VIOLATION,
+  ERR_INVALID_PACKET: () => ERR_INVALID_PACKET,
+  ERR_REPLAY_DETECTED: () => ERR_REPLAY_DETECTED,
+  FLAG_BODY_TLV: () => FLAG_BODY_TLV,
+  FLAG_CHAIN_REQ: () => FLAG_CHAIN_REQ,
+  FLAG_HAS_WITNESS: () => FLAG_HAS_WITNESS,
+  MAX_BODY_LEN: () => MAX_BODY_LEN,
+  MAX_FRAME_LEN: () => MAX_FRAME_LEN,
+  MAX_HDR_LEN: () => MAX_HDR_LEN,
+  MAX_SIG_LEN: () => MAX_SIG_LEN,
+  NCERT_ALG: () => NCERT_ALG,
+  NCERT_EXP: () => NCERT_EXP,
+  NCERT_ISSUER_KID: () => NCERT_ISSUER_KID,
+  NCERT_KID: () => NCERT_KID,
+  NCERT_NBF: () => NCERT_NBF,
+  NCERT_NODE_ID: () => NCERT_NODE_ID,
+  NCERT_PAYLOAD: () => NCERT_PAYLOAD,
+  NCERT_PUB: () => NCERT_PUB,
+  NCERT_SCOPE: () => NCERT_SCOPE,
+  NCERT_SIG: () => NCERT_SIG,
+  PROOF_CAPSULE: () => PROOF_CAPSULE,
+  PROOF_JWT: () => PROOF_JWT,
+  PROOF_LOOM: () => PROOF_LOOM,
+  PROOF_MTLS: () => PROOF_MTLS,
+  PROOF_NONE: () => PROOF_NONE,
+  PROOF_WITNESS: () => PROOF_WITNESS,
+  ProofType: () => ProofType,
+  TLV_ACTOR_ID: () => TLV_ACTOR_ID,
+  TLV_AUD: () => TLV_AUD,
+  TLV_BODY_ARR: () => TLV_BODY_ARR,
+  TLV_BODY_OBJ: () => TLV_BODY_OBJ,
+  TLV_CAPSULE: () => TLV_CAPSULE,
+  TLV_EFFECT: () => TLV_EFFECT,
+  TLV_ERROR_CODE: () => TLV_ERROR_CODE,
+  TLV_ERROR_MSG: () => TLV_ERROR_MSG,
+  TLV_INDEX: () => TLV_INDEX,
+  TLV_INTENT: () => TLV_INTENT,
+  TLV_KID: () => TLV_KID,
+  TLV_LOOM_PRESENCE_ID: () => TLV_LOOM_PRESENCE_ID,
+  TLV_LOOM_THREAD_HASH: () => TLV_LOOM_THREAD_HASH,
+  TLV_LOOM_WRIT: () => TLV_LOOM_WRIT,
+  TLV_NODE: () => TLV_NODE,
+  TLV_NODE_CERT_HASH: () => TLV_NODE_CERT_HASH,
+  TLV_NODE_KID: () => TLV_NODE_KID,
+  TLV_NONCE: () => TLV_NONCE,
+  TLV_OFFSET: () => TLV_OFFSET,
+  TLV_OK: () => TLV_OK,
+  TLV_PID: () => TLV_PID,
+  TLV_PREV_HASH: () => TLV_PREV_HASH,
+  TLV_PROOF_REF: () => TLV_PROOF_REF,
+  TLV_PROOF_TYPE: () => TLV_PROOF_TYPE,
+  TLV_REALM: () => TLV_REALM,
+  TLV_RECEIPT_HASH: () => TLV_RECEIPT_HASH,
+  TLV_RID: () => TLV_RID,
+  TLV_SHA256_CHUNK: () => TLV_SHA256_CHUNK,
+  TLV_TRACE_ID: () => TLV_TRACE_ID,
+  TLV_TS: () => TLV_TS,
+  TLV_UPLOAD_ID: () => TLV_UPLOAD_ID
 });
-function normalizeSensorDecision(sensorDecision) {
-  if ("action" in sensorDecision) {
-    switch (sensorDecision.action) {
-      case "ALLOW":
-        return {
-          allow: true,
-          riskScore: 0,
-          reasons: [],
-          meta: sensorDecision.meta
-        };
-      case "DENY":
-        return {
-          allow: false,
-          riskScore: 100,
-          reasons: [sensorDecision.code, sensorDecision.reason].filter(
-            Boolean
-          ),
-          meta: sensorDecision.meta,
-          retryAfterMs: sensorDecision.retryAfterMs
-        };
-      case "THROTTLE":
-        return {
-          allow: false,
-          riskScore: 50,
-          reasons: ["RATE_LIMIT"],
-          retryAfterMs: sensorDecision.retryAfterMs,
-          meta: sensorDecision.meta
-        };
-      case "FLAG":
-        return {
-          allow: true,
-          riskScore: sensorDecision.scoreDelta,
-          reasons: sensorDecision.reasons,
-          meta: sensorDecision.meta
-        };
-    }
+import {
+  AXIS_MAGIC,
+  AXIS_VERSION,
+  MAX_HDR_LEN,
+  MAX_BODY_LEN,
+  MAX_SIG_LEN,
+  MAX_FRAME_LEN,
+  FLAG_BODY_TLV,
+  FLAG_CHAIN_REQ,
+  FLAG_HAS_WITNESS,
+  TLV_PID,
+  TLV_TS,
+  TLV_INTENT,
+  TLV_ACTOR_ID,
+  TLV_PROOF_TYPE,
+  TLV_PROOF_REF,
+  TLV_NONCE,
+  TLV_AUD,
+  TLV_REALM,
+  TLV_NODE,
+  TLV_TRACE_ID,
+  TLV_KID,
+  TLV_RID,
+  TLV_OK,
+  TLV_EFFECT,
+  TLV_ERROR_CODE,
+  TLV_ERROR_MSG,
+  TLV_PREV_HASH,
+  TLV_RECEIPT_HASH,
+  TLV_NODE_KID,
+  TLV_NODE_CERT_HASH,
+  TLV_LOOM_PRESENCE_ID,
+  TLV_LOOM_WRIT,
+  TLV_LOOM_THREAD_HASH,
+  TLV_UPLOAD_ID,
+  TLV_INDEX,
+  TLV_OFFSET,
+  TLV_SHA256_CHUNK,
+  TLV_CAPSULE,
+  TLV_BODY_OBJ,
+  TLV_BODY_ARR,
+  NCERT_NODE_ID,
+  NCERT_KID,
+  NCERT_ALG,
+  NCERT_PUB,
+  NCERT_NBF,
+  NCERT_EXP,
+  NCERT_SCOPE,
+  NCERT_ISSUER_KID,
+  NCERT_PAYLOAD,
+  NCERT_SIG,
+  PROOF_NONE,
+  PROOF_CAPSULE,
+  PROOF_JWT,
+  PROOF_MTLS,
+  PROOF_LOOM,
+  PROOF_WITNESS,
+  ProofType,
+  BodyProfile,
+  ERR_INVALID_PACKET,
+  ERR_BAD_SIGNATURE,
+  ERR_REPLAY_DETECTED,
+  ERR_CONTRACT_VIOLATION
+} from "@nextera.one/axis-protocol";
+var init_constants = __esm({
+  "src/core/constants.ts"() {
+  }
+});
+
+// src/engine/axis-execution-context.ts
+var axis_execution_context_exports = {};
+__export(axis_execution_context_exports, {
+  AXIS_EXECUTION_CONTEXT_KEY: () => AXIS_EXECUTION_CONTEXT_KEY,
+  getAxisExecutionContext: () => getAxisExecutionContext,
+  mergeAxisExecutionContext: () => mergeAxisExecutionContext,
+  withAxisExecutionContext: () => withAxisExecutionContext
+});
+function getAxisExecutionContext(frame) {
+  return frame?.[AXIS_EXECUTION_CONTEXT_KEY];
+}
+function withAxisExecutionContext(target, context) {
+  Object.defineProperty(target, AXIS_EXECUTION_CONTEXT_KEY, {
+    value: context,
+    writable: true,
+    configurable: true,
+    enumerable: false
+  });
+  return target;
+}
+function mergeAxisExecutionContext(base, override) {
+  if (!base && !override) {
+    return void 0;
   }
   return {
-    allow: sensorDecision.allow,
-    riskScore: sensorDecision.riskScore,
-    reasons: sensorDecision.reasons,
-    tags: sensorDecision.tags,
-    meta: sensorDecision.meta,
-    tighten: sensorDecision.tighten,
-    retryAfterMs: sensorDecision.retryAfterMs
+    ...base,
+    ...override,
+    capsuleRef: {
+      ...base?.capsuleRef || {},
+      ...override?.capsuleRef || {}
+    }
   };
 }
-var Decision, SensorDecisions;
-var init_axis_sensor = __esm({
-  "src/sensor/axis-sensor.ts"() {
-    Decision = /* @__PURE__ */ ((Decision2) => {
-      Decision2["ALLOW"] = "ALLOW";
-      Decision2["DENY"] = "DENY";
-      Decision2["THROTTLE"] = "THROTTLE";
-      Decision2["FLAG"] = "FLAG";
-      return Decision2;
-    })(Decision || {});
-    SensorDecisions = {
-      allow(meta, tags) {
-        return {
-          decision: "ALLOW" /* ALLOW */,
-          allow: true,
-          riskScore: 0,
-          reasons: [],
-          tags,
-          meta
-        };
-      },
-      deny(code, reason, meta) {
-        return {
-          decision: "DENY" /* DENY */,
-          allow: false,
-          riskScore: 100,
-          code,
-          reasons: [code, reason].filter(Boolean),
-          meta
-        };
-      },
-      throttle(retryAfterMs, meta) {
-        return {
-          decision: "THROTTLE" /* THROTTLE */,
-          allow: false,
-          riskScore: 50,
-          retryAfterMs,
-          code: "RATE_LIMIT",
-          reasons: ["RATE_LIMIT"],
-          meta
-        };
-      },
-      flag(scoreDelta, reasons, meta) {
-        return {
-          decision: "FLAG" /* FLAG */,
-          allow: true,
-          riskScore: scoreDelta,
-          scoreDelta,
-          reasons,
-          meta
+var AXIS_EXECUTION_CONTEXT_KEY;
+var init_axis_execution_context = __esm({
+  "src/engine/axis-execution-context.ts"() {
+    AXIS_EXECUTION_CONTEXT_KEY = /* @__PURE__ */ Symbol.for("axis.executionContext");
+  }
+});
+
+// src/engine/registry/observer.registry.ts
+var require_observer_registry = __commonJS({
+  "src/engine/registry/observer.registry.ts"(exports) {
+    "use strict";
+    var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
+      var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+      if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+      else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      return c > 3 && r && Object.defineProperty(target, key, r), r;
+    };
+    var ObserverRegistry_1;
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ObserverRegistry = void 0;
+    var common_1 = __require("@nestjs/common");
+    var ObserverRegistry2 = ObserverRegistry_1 = class ObserverRegistry {
+      constructor() {
+        this.logger = new common_1.Logger(ObserverRegistry_1.name);
+        this.byName = /* @__PURE__ */ new Map();
+        this.byType = /* @__PURE__ */ new Map();
+      }
+      register(instance, meta = {}) {
+        const name = meta.name || instance.name || instance.constructor.name;
+        const registration = {
+          name,
+          instance,
+          tags: meta.tags || [],
+          events: meta.events,
+          intents: meta.intents,
+          handlers: meta.handlers
         };
+        this.byName.set(name, registration);
+        this.byType.set(instance.constructor, registration);
+        this.logger.debug(`Registered observer: ${name}`);
+      }
+      resolve(ref) {
+        if (typeof ref === "string") {
+          return this.byName.get(ref);
+        }
+        return this.byType.get(ref) || this.byName.get(ref.name);
+      }
+      list() {
+        return Array.from(this.byName.values()).sort((left, right) => left.name.localeCompare(right.name));
+      }
+      clear() {
+        this.byName.clear();
+        this.byType.clear();
+      }
+    };
+    exports.ObserverRegistry = ObserverRegistry2;
+    exports.ObserverRegistry = ObserverRegistry2 = ObserverRegistry_1 = __decorate([
+      (0, common_1.Injectable)()
+    ], ObserverRegistry2);
+  }
+});
+
+// src/engine/observer-dispatcher.service.ts
+var require_observer_dispatcher_service = __commonJS({
+  "src/engine/observer-dispatcher.service.ts"(exports) {
+    "use strict";
+    var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
+      var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+      if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+      else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      return c > 3 && r && Object.defineProperty(target, key, r), r;
+    };
+    var __metadata = exports && exports.__metadata || function(k, v) {
+      if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+    };
+    var ObserverDispatcherService_1;
+    var _a;
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ObserverDispatcherService = void 0;
+    var common_1 = __require("@nestjs/common");
+    var observer_registry_1 = require_observer_registry();
+    function unique(values) {
+      return Array.from(new Set(values));
+    }
+    var ObserverDispatcherService2 = ObserverDispatcherService_1 = class ObserverDispatcherService {
+      constructor(registry) {
+        this.registry = registry;
+        this.logger = new common_1.Logger(ObserverDispatcherService_1.name);
+      }
+      async dispatch(bindings, context) {
+        if (!bindings || bindings.length === 0)
+          return;
+        const invoked = /* @__PURE__ */ new Set();
+        for (const binding of bindings) {
+          if (binding.events && binding.events.length > 0 && !binding.events.includes(context.event)) {
+            continue;
+          }
+          for (const ref of binding.refs) {
+            const registration = this.registry.resolve(ref);
+            if (!registration) {
+              this.logger.warn(`Observer ${String(ref)} could not be resolved`);
+              continue;
+            }
+            if (invoked.has(registration.name))
+              continue;
+            if (registration.events && registration.events.length > 0 && !registration.events.includes(context.event)) {
+              continue;
+            }
+            const observerContext = {
+              ...context,
+              observerTags: unique([
+                ...registration.tags || [],
+                ...binding.tags || [],
+                ...context.observerTags || []
+              ])
+            };
+            if (registration.instance.supports && !registration.instance.supports(observerContext)) {
+              continue;
+            }
+            try {
+              invoked.add(registration.name);
+              await registration.instance.observe(observerContext);
+            } catch (error) {
+              this.logger.warn(`Observer ${registration.name} failed during ${context.event}: ${error.message}`);
+            }
+          }
+        }
       }
     };
+    exports.ObserverDispatcherService = ObserverDispatcherService2;
+    exports.ObserverDispatcherService = ObserverDispatcherService2 = ObserverDispatcherService_1 = __decorate([
+      (0, common_1.Injectable)(),
+      __metadata("design:paramtypes", [typeof (_a = typeof observer_registry_1.ObserverRegistry !== "undefined" && observer_registry_1.ObserverRegistry) === "function" ? _a : Object])
+    ], ObserverDispatcherService2);
   }
 });
 
@@ -1057,6 +1420,116 @@ var init_cce_witness_observer = __esm({
   }
 });
 
+// src/sensor/axis-sensor.ts
+var axis_sensor_exports = {};
+__export(axis_sensor_exports, {
+  Decision: () => Decision,
+  SensorDecisions: () => SensorDecisions,
+  normalizeSensorDecision: () => normalizeSensorDecision
+});
+function normalizeSensorDecision(sensorDecision) {
+  if ("action" in sensorDecision) {
+    switch (sensorDecision.action) {
+      case "ALLOW":
+        return {
+          allow: true,
+          riskScore: 0,
+          reasons: [],
+          meta: sensorDecision.meta
+        };
+      case "DENY":
+        return {
+          allow: false,
+          riskScore: 100,
+          reasons: [sensorDecision.code, sensorDecision.reason].filter(
+            Boolean
+          ),
+          meta: sensorDecision.meta,
+          retryAfterMs: sensorDecision.retryAfterMs
+        };
+      case "THROTTLE":
+        return {
+          allow: false,
+          riskScore: 50,
+          reasons: ["RATE_LIMIT"],
+          retryAfterMs: sensorDecision.retryAfterMs,
+          meta: sensorDecision.meta
+        };
+      case "FLAG":
+        return {
+          allow: true,
+          riskScore: sensorDecision.scoreDelta,
+          reasons: sensorDecision.reasons,
+          meta: sensorDecision.meta
+        };
+    }
+  }
+  return {
+    allow: sensorDecision.allow,
+    riskScore: sensorDecision.riskScore,
+    reasons: sensorDecision.reasons,
+    tags: sensorDecision.tags,
+    meta: sensorDecision.meta,
+    tighten: sensorDecision.tighten,
+    retryAfterMs: sensorDecision.retryAfterMs
+  };
+}
+var Decision, SensorDecisions;
+var init_axis_sensor = __esm({
+  "src/sensor/axis-sensor.ts"() {
+    Decision = /* @__PURE__ */ ((Decision2) => {
+      Decision2["ALLOW"] = "ALLOW";
+      Decision2["DENY"] = "DENY";
+      Decision2["THROTTLE"] = "THROTTLE";
+      Decision2["FLAG"] = "FLAG";
+      return Decision2;
+    })(Decision || {});
+    SensorDecisions = {
+      allow(meta, tags) {
+        return {
+          decision: "ALLOW" /* ALLOW */,
+          allow: true,
+          riskScore: 0,
+          reasons: [],
+          tags,
+          meta
+        };
+      },
+      deny(code, reason, meta) {
+        return {
+          decision: "DENY" /* DENY */,
+          allow: false,
+          riskScore: 100,
+          code,
+          reasons: [code, reason].filter(Boolean),
+          meta
+        };
+      },
+      throttle(retryAfterMs, meta) {
+        return {
+          decision: "THROTTLE" /* THROTTLE */,
+          allow: false,
+          riskScore: 50,
+          retryAfterMs,
+          code: "RATE_LIMIT",
+          reasons: ["RATE_LIMIT"],
+          meta
+        };
+      },
+      flag(scoreDelta, reasons, meta) {
+        return {
+          decision: "FLAG" /* FLAG */,
+          allow: true,
+          riskScore: scoreDelta,
+          scoreDelta,
+          reasons,
+          meta
+        };
+      }
+    };
+  }
+});
+
 // src/cce/cce-pipeline.ts
 var cce_pipeline_exports = {};
 __export(cce_pipeline_exports, {
@@ -1289,50 +1762,330 @@ var init_cce_pipeline = __esm({
   }
 });
 
-// src/engine/intent.router.ts
-var require_intent_router = __commonJS({
-  "src/engine/intent.router.ts"(exports) {
-    "use strict";
-    var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
-      var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-      if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-      else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-      return c > 3 && r && Object.defineProperty(target, key, r), r;
-    };
-    var __metadata = exports && exports.__metadata || function(k, v) {
-      if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-    };
-    var __param = exports && exports.__param || function(paramIndex, decorator) {
-      return function(target, key) {
-        decorator(target, key, paramIndex);
-      };
-    };
-    var IntentRouter_1;
-    var _a;
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.IntentRouter = void 0;
-    var common_1 = __require("@nestjs/common");
-    var core_1 = __require("@nestjs/core");
-    var handler_sensors_decorator_1 = (init_handler_sensors_decorator(), __toCommonJS(handler_sensors_decorator_exports));
-    var intent_sensors_decorator_1 = (init_intent_sensors_decorator(), __toCommonJS(intent_sensors_decorator_exports));
-    var intent_body_decorator_1 = (init_intent_body_decorator(), __toCommonJS(intent_body_decorator_exports));
-    var handler_decorator_1 = (init_handler_decorator(), __toCommonJS(handler_decorator_exports));
-    var intent_decorator_1 = (init_intent_decorator(), __toCommonJS(intent_decorator_exports));
-    var dto_schema_util_1 = require_dto_schema_util();
-    var axis_sensor_1 = (init_axis_sensor(), __toCommonJS(axis_sensor_exports));
-    var cce_pipeline_1 = (init_cce_pipeline(), __toCommonJS(cce_pipeline_exports));
-    var IntentRouter2 = IntentRouter_1 = class IntentRouter {
-      constructor(moduleRef) {
-        this.moduleRef = moduleRef;
-        this.logger = new common_1.Logger(IntentRouter_1.name);
-        this.handlers = /* @__PURE__ */ new Map();
-        this.intentSensors = /* @__PURE__ */ new Map();
-        this.intentDecoders = /* @__PURE__ */ new Map();
-        this.intentSchemas = /* @__PURE__ */ new Map();
-        this.intentValidators = /* @__PURE__ */ new Map();
-        this.intentKinds = /* @__PURE__ */ new Map();
-        this.cceHandlers = /* @__PURE__ */ new Map();
-        this.ccePipelineConfig = null;
+// src/core/axis-error.ts
+var axis_error_exports = {};
+__export(axis_error_exports, {
+  AxisError: () => AxisError
+});
+var AxisError;
+var init_axis_error = __esm({
+  "src/core/axis-error.ts"() {
+    AxisError = class extends Error {
+      constructor(code, message, httpStatus = 400, details) {
+        super(message);
+        this.code = code;
+        this.httpStatus = httpStatus;
+        this.details = details;
+        this.name = "AxisError";
+      }
+    };
+  }
+});
+
+// src/security/scopes.ts
+function hasScope(scopes, required) {
+  if (!Array.isArray(scopes) || scopes.length === 0) {
+    return false;
+  }
+  if (scopes.includes(required)) {
+    return true;
+  }
+  const [resource, id] = required.split(":");
+  if (resource && id) {
+    const wildcard = `${resource}:*`;
+    if (scopes.includes(wildcard)) {
+      return true;
+    }
+  }
+  return false;
+}
+function parseScope(scope) {
+  const parts = scope.split(":");
+  if (parts.length !== 2) return null;
+  return { resource: parts[0], id: parts[1] };
+}
+function canAccessResource(scopes, resourceType, resourceId) {
+  const required = `${resourceType}:${resourceId}`;
+  return hasScope(scopes, required);
+}
+var init_scopes = __esm({
+  "src/security/scopes.ts"() {
+  }
+});
+
+// src/security/inline-capsule.ts
+var inline_capsule_exports = {};
+__export(inline_capsule_exports, {
+  inlineCapsuleAllowsIntent: () => inlineCapsuleAllowsIntent,
+  inlineCapsuleSatisfiesScopes: () => inlineCapsuleSatisfiesScopes,
+  isInlineCapsuleExpired: () => isInlineCapsuleExpired,
+  normalizeInlineCapsule: () => normalizeInlineCapsule,
+  resolvePolicyScopes: () => resolvePolicyScopes
+});
+function normalizeInlineCapsule(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return null;
+  }
+  const raw = input;
+  const scopes = normalizeStringList(raw.scopes ?? raw.scope);
+  return {
+    id: normalizeScalar(raw.id),
+    actorId: normalizeScalar(raw.actorId),
+    intents: normalizeStringList(raw.intents),
+    issuedAt: normalizeTimestamp(raw.issuedAt ?? raw.iat),
+    expiresAt: normalizeTimestamp(raw.expiresAt ?? raw.exp),
+    realm: normalizeScalar(raw.realm),
+    node: normalizeScalar(raw.node),
+    scopes,
+    raw
+  };
+}
+function inlineCapsuleAllowsIntent(capsule, intent) {
+  if (!capsule.intents || capsule.intents.length === 0) {
+    return false;
+  }
+  for (const pattern of capsule.intents) {
+    if (pattern === "*" || pattern === intent) {
+      return true;
+    }
+    if (pattern.endsWith(".*")) {
+      const prefix = pattern.slice(0, -1);
+      if (intent.startsWith(prefix)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function isInlineCapsuleExpired(capsule, clockSkewMs = 3e4) {
+  if (capsule.expiresAt === void 0) {
+    return false;
+  }
+  return BigInt(Date.now()) > capsule.expiresAt + BigInt(clockSkewMs);
+}
+function resolvePolicyScopes(scopes, context) {
+  return scopes.map(
+    (scope) => scope.replace(/\$\{([^}]+)\}/g, (_match, expression) => {
+      const resolved = resolveTemplateExpression(expression.trim(), context);
+      if (resolved === void 0 || resolved === null || resolved === "") {
+        throw new Error(`CAPSULE_SCOPE_TEMPLATE_UNRESOLVED:${expression}`);
+      }
+      return String(resolved);
+    })
+  );
+}
+function inlineCapsuleSatisfiesScopes(capsule, requiredScopes, mode = "all") {
+  if (!capsule.scopes || capsule.scopes.length === 0) {
+    return false;
+  }
+  if (mode === "any") {
+    return requiredScopes.some((scope) => hasScope(capsule.scopes, scope));
+  }
+  return requiredScopes.every((scope) => hasScope(capsule.scopes, scope));
+}
+function resolveTemplateExpression(expression, context) {
+  if (expression === "intent") {
+    return context.intent;
+  }
+  if (expression === "actorId") {
+    return context.actorId;
+  }
+  if (expression === "chainId") {
+    return context.chainId;
+  }
+  if (expression === "stepId") {
+    return context.stepId;
+  }
+  if (expression.startsWith("body.")) {
+    return getNestedValue(context.body, expression.slice(5));
+  }
+  return void 0;
+}
+function getNestedValue(value, path2) {
+  if (!value || typeof value !== "object") {
+    return void 0;
+  }
+  return path2.split(".").reduce((current, segment) => {
+    if (!current || typeof current !== "object") {
+      return void 0;
+    }
+    return current[segment];
+  }, value);
+}
+function normalizeScalar(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (value instanceof Uint8Array) {
+    return Buffer.from(value).toString("hex");
+  }
+  return void 0;
+}
+function normalizeStringList(value) {
+  if (!value) {
+    return void 0;
+  }
+  const list = Array.isArray(value) ? value : [value];
+  const normalized = list.map((entry) => typeof entry === "string" ? entry : void 0).filter((entry) => !!entry && entry.trim().length > 0);
+  return normalized.length > 0 ? Array.from(new Set(normalized)) : void 0;
+}
+function normalizeTimestamp(value) {
+  if (typeof value === "bigint") {
+    return value;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return BigInt(Math.trunc(value));
+  }
+  if (typeof value === "string" && value.trim().length > 0) {
+    try {
+      return BigInt(value);
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+var init_inline_capsule = __esm({
+  "src/security/inline-capsule.ts"() {
+    init_scopes();
+  }
+});
+
+// src/engine/intent.router.ts
+var require_intent_router = __commonJS({
+  "src/engine/intent.router.ts"(exports) {
+    "use strict";
+    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
+      var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+      if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+      else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      return c > 3 && r && Object.defineProperty(target, key, r), r;
+    };
+    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    var __metadata = exports && exports.__metadata || function(k, v) {
+      if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+    };
+    var __param = exports && exports.__param || function(paramIndex, decorator) {
+      return function(target, key) {
+        decorator(target, key, paramIndex);
+      };
+    };
+    var IntentRouter_1;
+    var _a;
+    var _b;
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.IntentRouter = void 0;
+    var common_1 = __require("@nestjs/common");
+    var core_1 = __require("@nestjs/core");
+    var axis_protocol_1 = __require("@nextera.one/axis-protocol");
+    var cce_pipeline_1 = (init_cce_pipeline(), __toCommonJS(cce_pipeline_exports));
+    var axis_error_1 = (init_axis_error(), __toCommonJS(axis_error_exports));
+    var constants_1 = (init_constants(), __toCommonJS(constants_exports));
+    var capsule_policy_decorator_1 = (init_capsule_policy_decorator(), __toCommonJS(capsule_policy_decorator_exports));
+    var chain_decorator_1 = (init_chain_decorator(), __toCommonJS(chain_decorator_exports));
+    var dto_schema_util_1 = require_dto_schema_util();
+    var handler_sensors_decorator_1 = (init_handler_sensors_decorator(), __toCommonJS(handler_sensors_decorator_exports));
+    var handler_decorator_1 = (init_handler_decorator(), __toCommonJS(handler_decorator_exports));
+    var intent_body_decorator_1 = (init_intent_body_decorator(), __toCommonJS(intent_body_decorator_exports));
+    var intent_sensors_decorator_1 = (init_intent_sensors_decorator(), __toCommonJS(intent_sensors_decorator_exports));
+    var intent_decorator_1 = (init_intent_decorator(), __toCommonJS(intent_decorator_exports));
+    var observer_decorator_1 = (init_observer_decorator(), __toCommonJS(observer_decorator_exports));
+    var inline_capsule_1 = (init_inline_capsule(), __toCommonJS(inline_capsule_exports));
+    var axis_sensor_1 = (init_axis_sensor(), __toCommonJS(axis_sensor_exports));
+    var axis_execution_context_1 = (init_axis_execution_context(), __toCommonJS(axis_execution_context_exports));
+    var observer_dispatcher_service_1 = require_observer_dispatcher_service();
+    function observerRefKey(ref) {
+      return typeof ref === "string" ? ref : ref.name;
+    }
+    function mergeObserverBindings(bindings) {
+      const merged = /* @__PURE__ */ new Map();
+      for (const binding of bindings) {
+        for (const ref of binding.refs) {
+          const key = observerRefKey(ref);
+          const existing = merged.get(key);
+          if (!existing) {
+            merged.set(key, {
+              refs: [ref],
+              tags: binding.tags ? [...new Set(binding.tags)] : void 0,
+              events: binding.events ? [...new Set(binding.events)] : void 0
+            });
+            continue;
+          }
+          existing.tags = Array.from(/* @__PURE__ */ new Set([...existing.tags || [], ...binding.tags || []]));
+          existing.events = existing.events === void 0 || binding.events === void 0 ? void 0 : Array.from(/* @__PURE__ */ new Set([...existing.events, ...binding.events]));
+        }
+      }
+      return Array.from(merged.values());
+    }
+    function normalizeChainConfig(decoratorConfig, intentConfig) {
+      if (decoratorConfig) {
+        return decoratorConfig;
+      }
+      if (!intentConfig) {
+        return void 0;
+      }
+      if (intentConfig === true) {
+        return { enabled: true };
+      }
+      return {
+        enabled: true,
+        ...intentConfig
+      };
+    }
+    var IntentRouter2 = IntentRouter_1 = class IntentRouter {
+      constructor(moduleRef, observerDispatcher) {
+        this.moduleRef = moduleRef;
+        this.observerDispatcher = observerDispatcher;
+        this.logger = new common_1.Logger(IntentRouter_1.name);
+        this.decoder = new TextDecoder();
+        this.encoder = new TextEncoder();
+        this.handlers = /* @__PURE__ */ new Map();
+        this.intentSensors = /* @__PURE__ */ new Map();
+        this.intentDecoders = /* @__PURE__ */ new Map();
+        this.intentSchemas = /* @__PURE__ */ new Map();
+        this.intentValidators = /* @__PURE__ */ new Map();
+        this.intentKinds = /* @__PURE__ */ new Map();
+        this.intentChains = /* @__PURE__ */ new Map();
+        this.intentObservers = /* @__PURE__ */ new Map();
+        this.intentCapsulePolicies = /* @__PURE__ */ new Map();
+        this.cceHandlers = /* @__PURE__ */ new Map();
+        this.ccePipelineConfig = null;
       }
       getSchema(intent) {
         return this.intentSchemas.get(intent);
@@ -1354,9 +2107,18 @@ var require_intent_router = __commonJS({
           validators: this.intentValidators.get(intent),
           hasSensors: this.intentSensors.has(intent),
           builtin: IntentRouter_1.BUILTIN_INTENTS.has(intent),
-          kind: this.intentKinds.get(intent)
+          kind: this.intentKinds.get(intent),
+          chain: this.intentChains.get(intent),
+          capsulePolicy: this.intentCapsulePolicies.get(intent),
+          observerCount: this.getObservers(intent).length
         };
       }
+      getChainConfig(intent) {
+        return this.intentChains.get(intent);
+      }
+      getObservers(intent) {
+        return this.intentObservers.get(intent) || [];
+      }
       register(intent, handler) {
         this.handlers.set(intent, handler);
       }
@@ -1364,7 +2126,10 @@ var require_intent_router = __commonJS({
         const handlerMeta = Reflect.getMetadata(handler_decorator_1.HANDLER_METADATA_KEY, instance.constructor);
         const prefix = handlerMeta?.intent || instance.name;
         const routes = Reflect.getMetadata(intent_decorator_1.INTENT_ROUTES_KEY, instance.constructor) || [];
+        const routedMethods = new Set(routes.map((route) => String(route.methodName)));
         const handlerSensors = Reflect.getMetadata(handler_sensors_decorator_1.HANDLER_SENSORS_KEY, instance.constructor) || [];
+        const handlerObservers = Reflect.getMetadata(observer_decorator_1.OBSERVER_BINDINGS_KEY, instance.constructor) || [];
+        const proto = Object.getPrototypeOf(instance);
         for (const route of routes) {
           const intentName = route.absolute ? route.action : `${prefix}.${route.action}`;
           const fn = instance[route.methodName].bind(instance);
@@ -1373,27 +2138,36 @@ var require_intent_router = __commonJS({
           } else {
             this.register(intentName, fn);
           }
-          this.registerIntentMeta(intentName, Object.getPrototypeOf(instance), String(route.methodName), handlerSensors);
+          this.registerIntentMeta(intentName, proto, String(route.methodName), handlerSensors, handlerObservers);
         }
-        const proto = Object.getPrototypeOf(instance);
         for (const key of Object.getOwnPropertyNames(proto)) {
+          if (routedMethods.has(key))
+            continue;
           const meta = Reflect.getMetadata(intent_decorator_1.INTENT_METADATA_KEY, proto, key);
           if (!meta?.intent)
             continue;
-          if (!this.handlers.has(meta.intent)) {
-            this.register(meta.intent, instance[key].bind(instance));
+          const intentName = meta.absolute ? meta.intent : `${prefix}.${meta.intent}`;
+          if (!this.handlers.has(intentName)) {
+            this.register(intentName, instance[key].bind(instance));
           }
-          this.registerIntentMeta(meta.intent, proto, key, handlerSensors);
+          this.registerIntentMeta(intentName, proto, key, handlerSensors, handlerObservers);
         }
       }
       async route(frame) {
         const start = process.hrtime();
         let intent = "unknown";
         try {
-          const intentBytes = frame.headers.get(3);
+          const intentBytes = frame.headers.get(constants_1.TLV_INTENT);
           if (!intentBytes)
             throw new Error("Missing intent");
-          intent = new TextDecoder().decode(intentBytes);
+          intent = this.decoder.decode(intentBytes);
+          const observerBindings = this.getObservers(intent);
+          await this.emitIntentObservers(observerBindings, {
+            event: "intent.received",
+            timestamp: Date.now(),
+            intent,
+            frame
+          });
           let effect;
           if (intent === "system.ping" || intent === "public.ping") {
             this.logger.debug("PING received");
@@ -1425,25 +2199,35 @@ var require_intent_router = __commonJS({
               effect: "echo",
               body: frame.body
             };
+          } else if (intent === "CHAIN.EXEC" || intent === "axis.chain.exec") {
+            const chainRequest = this.parseChainRequestBody(frame.body);
+            effect = await this.executeChainRequest(frame, chainRequest);
           } else if (intent === "INTENT.EXEC" || intent === "axis.intent.exec") {
-            try {
-              const bodyJSON = JSON.parse(new TextDecoder().decode(frame.body));
-              const innerIntent = bodyJSON.intent;
-              const innerArgs = bodyJSON.args || {};
-              if (!innerIntent) {
-                throw new Error("INTENT.EXEC missing inner intent");
-              }
-              this.logger.debug(`EXEC: routing to inner intent '${innerIntent}'`);
-              const innerFrame = {
-                ...frame,
-                headers: new Map(frame.headers),
-                body: new TextEncoder().encode(JSON.stringify(innerArgs))
-              };
-              innerFrame.headers.set(3, new TextEncoder().encode(innerIntent));
-              return await this.route(innerFrame);
-            } catch (e) {
-              throw new Error(`INTENT.EXEC unwrapping failed: ${e.message}`);
+            const execBody = this.parseIntentExecBody(frame.body);
+            const innerIntent = execBody.intent;
+            const innerArgs = execBody.args || {};
+            if (!innerIntent) {
+              throw new Error("INTENT.EXEC missing inner intent");
+            }
+            this.logger.debug(`EXEC: routing to inner intent '${innerIntent}'`);
+            const innerHeaders = new Map(frame.headers);
+            innerHeaders.set(constants_1.TLV_INTENT, this.encoder.encode(innerIntent));
+            const inlineCapsule = this.toInlineCapsuleRecord(execBody.capsule);
+            const capsuleId = this.extractInlineCapsuleId(inlineCapsule);
+            if (capsuleId) {
+              innerHeaders.set(constants_1.TLV_CAPSULE, this.encoder.encode(capsuleId));
+              innerHeaders.set(constants_1.TLV_PROOF_REF, this.encoder.encode(capsuleId));
             }
+            const innerFrame = (0, axis_execution_context_1.withAxisExecutionContext)({
+              ...frame,
+              headers: innerHeaders,
+              body: this.encodeJson(innerArgs)
+            }, (0, axis_execution_context_1.mergeAxisExecutionContext)((0, axis_execution_context_1.getAxisExecutionContext)(frame), {
+              metaIntent: "INTENT.EXEC",
+              actorId: this.getActorIdFromFrame(frame),
+              inlineCapsule
+            }) || {});
+            effect = await this.route(innerFrame);
           } else {
             const handler = this.handlers.get(intent);
             if (!handler) {
@@ -1462,6 +2246,7 @@ var require_intent_router = __commonJS({
                 throw new Error(`IntentBody decode failed for ${intent}: ${decodeErr.message}`);
               }
             }
+            this.enforceCapsulePolicy(intent, frame, decodedBody, this.getEffectiveCapsulePolicy(intent, frame));
             if (typeof handler === "function") {
               const resultBody = decoder ? await handler(decodedBody, frame.headers) : await handler(frame.body, frame.headers);
               effect = {
@@ -1484,9 +2269,24 @@ var require_intent_router = __commonJS({
               }
             }
           }
+          await this.emitIntentObservers(observerBindings, {
+            event: "intent.completed",
+            timestamp: Date.now(),
+            intent,
+            frame,
+            effect,
+            metadata: effect.metadata
+          });
           this.logIntent(intent, start, true);
           return effect;
         } catch (e) {
+          await this.emitIntentObservers(this.getObservers(intent), {
+            event: "intent.failed",
+            timestamp: Date.now(),
+            intent,
+            frame,
+            error: e.message
+          });
           this.logIntent(intent, start, false, e.message);
           throw e;
         }
@@ -1500,7 +2300,7 @@ var require_intent_router = __commonJS({
           this.logger.warn(`${intent} failed in ${ms}ms - ${error}`);
         }
       }
-      registerIntentMeta(intent, proto, methodName, handlerSensors) {
+      registerIntentMeta(intent, proto, methodName, handlerSensors, handlerObservers) {
         const decoder = Reflect.getMetadata(intent_body_decorator_1.INTENT_BODY_KEY, proto, methodName);
         if (decoder) {
           this.intentDecoders.set(intent, decoder);
@@ -1513,14 +2313,38 @@ var require_intent_router = __commonJS({
         if (combined.length > 0) {
           this.intentSensors.set(intent, combined);
         }
+        const methodObservers = Reflect.getMetadata(observer_decorator_1.OBSERVER_BINDINGS_KEY, proto, methodName) || [];
+        const observers = mergeObserverBindings([
+          ...handlerObservers || [],
+          ...methodObservers
+        ]);
+        if (observers.length > 0) {
+          this.intentObservers.set(intent, observers);
+        }
+        const handlerCapsulePolicy = Reflect.getMetadata(capsule_policy_decorator_1.CAPSULE_POLICY_METADATA_KEY, proto.constructor);
+        const methodCapsulePolicy = Reflect.getMetadata(capsule_policy_decorator_1.CAPSULE_POLICY_METADATA_KEY, proto, methodName);
+        const capsulePolicy = (0, capsule_policy_decorator_1.mergeCapsulePolicyOptions)(handlerCapsulePolicy, methodCapsulePolicy);
+        if (capsulePolicy) {
+          this.intentCapsulePolicies.set(intent, capsulePolicy);
+        }
         const meta = Reflect.getMetadata(intent_decorator_1.INTENT_METADATA_KEY, proto, methodName);
         if (meta) {
-          this.storeSchema(meta);
+          this.storeSchema({ ...meta, intent });
           if (meta.kind) {
             this.intentKinds.set(intent, meta.kind);
           }
+          const chainMeta = Reflect.getMetadata(chain_decorator_1.CHAIN_METADATA_KEY, proto, methodName);
+          const chainConfig = normalizeChainConfig(chainMeta, meta.chain);
+          if (chainConfig) {
+            this.intentChains.set(intent, chainConfig);
+          }
         }
       }
+      async emitIntentObservers(bindings, context) {
+        if (!this.observerDispatcher || bindings.length === 0)
+          return;
+        await this.observerDispatcher.dispatch(bindings, context);
+      }
       async runIntentSensors(sensorClasses, intent, frame) {
         if (!this.moduleRef)
           return;
@@ -1549,6 +2373,226 @@ var require_intent_router = __commonJS({
           }
         }
       }
+      getEffectiveCapsulePolicy(intent, frame) {
+        const registeredPolicy = this.intentCapsulePolicies.get(intent);
+        const chainConfig = this.intentChains.get(intent);
+        const executionContext = (0, axis_execution_context_1.getAxisExecutionContext)(frame);
+        const derivedScopes = Array.from(/* @__PURE__ */ new Set([
+          ...this.toScopeList(chainConfig?.capsuleScope),
+          ...this.toScopeList(executionContext?.capsuleRef?.scope),
+          ...this.toScopeList(executionContext?.chainStep?.capsuleScope)
+        ]));
+        const requiresCapsule = chainConfig?.proofRequired || executionContext?.capsuleRef?.proofRequired || executionContext?.chainStep?.proofRequired || executionContext?.chainEnvelope?.capsule?.proofRequired || derivedScopes.length > 0;
+        const derivedPolicy = requiresCapsule ? (0, capsule_policy_decorator_1.normalizeCapsulePolicyOptions)({
+          required: true,
+          scopes: derivedScopes.length > 0 ? derivedScopes : void 0
+        }) : void 0;
+        return (0, capsule_policy_decorator_1.mergeCapsulePolicyOptions)(registeredPolicy, derivedPolicy);
+      }
+      enforceCapsulePolicy(intent, frame, body, policy) {
+        const executionContext = (0, axis_execution_context_1.getAxisExecutionContext)(frame);
+        const inlineCapsuleRecord = this.toInlineCapsuleRecord(executionContext?.inlineCapsule);
+        const inlineCapsule = (0, inline_capsule_1.normalizeInlineCapsule)(inlineCapsuleRecord);
+        const normalizedPolicy = policy ? (0, capsule_policy_decorator_1.normalizeCapsulePolicyOptions)(policy) : void 0;
+        if (!inlineCapsule) {
+          if (normalizedPolicy?.required) {
+            if (normalizedPolicy.allowCapsuleRef && this.hasCapsuleReference(frame) && this.toScopeList(normalizedPolicy.scopes).length === 0 && normalizedPolicy.intentBound === false) {
+              return;
+            }
+            throw new axis_error_1.AxisError(this.hasCapsuleReference(frame) ? "CAPSULE_CLAIMS_REQUIRED" : "CAPSULE_REQUIRED", `Intent ${intent} requires an inline capsule for policy enforcement`, 403, { intent });
+          }
+          return;
+        }
+        if ((0, inline_capsule_1.isInlineCapsuleExpired)(inlineCapsule)) {
+          throw new axis_error_1.AxisError("CAPSULE_EXPIRED", `Capsule for ${intent} is expired`, 403, { intent, capsuleId: inlineCapsule.id });
+        }
+        const actorId = this.getActorIdFromFrame(frame) || executionContext?.actorId;
+        if (actorId && inlineCapsule.actorId && !this.identifiersMatch(actorId, inlineCapsule.actorId)) {
+          throw new axis_error_1.AxisError("CAPSULE_ACTOR_MISMATCH", `Capsule actor does not match request actor for ${intent}`, 403, {
+            intent,
+            actorId,
+            capsuleActorId: inlineCapsule.actorId
+          });
+        }
+        const proofRef = this.getProofRefFromFrame(frame);
+        if (proofRef && inlineCapsule.id && !this.identifiersMatch(proofRef, inlineCapsule.id)) {
+          throw new axis_error_1.AxisError("CAPSULE_REF_MISMATCH", `Capsule reference does not match request proof for ${intent}`, 403, {
+            intent,
+            proofRef,
+            capsuleId: inlineCapsule.id
+          });
+        }
+        const realm = this.getHeaderValue(frame, constants_1.TLV_REALM);
+        if (realm && inlineCapsule.realm && realm !== inlineCapsule.realm) {
+          throw new axis_error_1.AxisError("CAPSULE_REALM_MISMATCH", `Capsule realm does not match request realm for ${intent}`, 403, { intent, realm, capsuleRealm: inlineCapsule.realm });
+        }
+        const node = this.getHeaderValue(frame, constants_1.TLV_NODE);
+        if (node && inlineCapsule.node && node !== inlineCapsule.node) {
+          throw new axis_error_1.AxisError("CAPSULE_NODE_MISMATCH", `Capsule node does not match request node for ${intent}`, 403, { intent, node, capsuleNode: inlineCapsule.node });
+        }
+        const shouldCheckIntent = normalizedPolicy?.intentBound ?? true;
+        if (shouldCheckIntent && !(0, inline_capsule_1.inlineCapsuleAllowsIntent)(inlineCapsule, intent)) {
+          throw new axis_error_1.AxisError("CAPSULE_DENIED", `Capsule does not authorize ${intent}`, 403, {
+            intent,
+            capsuleId: inlineCapsule.id,
+            allowedIntents: inlineCapsule.intents
+          });
+        }
+        const requiredScopes = this.toScopeList(normalizedPolicy?.scopes);
+        if (requiredScopes.length === 0) {
+          return;
+        }
+        let resolvedScopes;
+        try {
+          resolvedScopes = (0, inline_capsule_1.resolvePolicyScopes)(requiredScopes, {
+            body,
+            intent,
+            actorId,
+            chainId: executionContext?.chainEnvelope?.chainId,
+            stepId: executionContext?.chainStep?.stepId
+          });
+        } catch (error) {
+          this.logger.error(`Scope template error for ${intent}: ${error.message}`);
+          throw new axis_error_1.AxisError("CAPSULE_SCOPE_TEMPLATE_UNRESOLVED", "Scope policy validation failed", 400, { intent });
+        }
+        if (!(0, inline_capsule_1.inlineCapsuleSatisfiesScopes)(inlineCapsule, resolvedScopes, normalizedPolicy?.scopeMode ?? "all")) {
+          throw new axis_error_1.AxisError("SCOPE_MISMATCH", `Capsule scopes do not satisfy ${intent}`, 403, {
+            intent,
+            requiredScopes: resolvedScopes,
+            availableScopes: inlineCapsule.scopes || []
+          });
+        }
+      }
+      async executeChainRequest(frame, request) {
+        const { AxisChainExecutor: AxisChainExecutor2 } = await Promise.resolve().then(() => __importStar(require_axis_chain_executor()));
+        const headerActorId = this.getActorIdFromFrame(frame);
+        if (request.actorId && headerActorId && !this.identifiersMatch(request.actorId, headerActorId)) {
+          throw new axis_error_1.AxisError("ACTOR_MISMATCH", "CHAIN.EXEC actorId conflicts with authenticated frame identity", 403);
+        }
+        const actorId = headerActorId || request.actorId;
+        const inlineCapsule = this.toInlineCapsuleRecord(request.capsule);
+        const capsuleId = this.extractInlineCapsuleId(inlineCapsule);
+        const headers = new Map(frame.headers);
+        if (capsuleId) {
+          headers.set(constants_1.TLV_CAPSULE, this.encoder.encode(capsuleId));
+          headers.set(constants_1.TLV_PROOF_REF, this.encoder.encode(capsuleId));
+        }
+        const baseFrame = (0, axis_execution_context_1.withAxisExecutionContext)({
+          ...frame,
+          headers
+        }, (0, axis_execution_context_1.mergeAxisExecutionContext)((0, axis_execution_context_1.getAxisExecutionContext)(frame), {
+          metaIntent: "CHAIN.EXEC",
+          actorId,
+          inlineCapsule,
+          capsuleRef: request.envelope.capsule,
+          chainEnvelope: request.envelope
+        }) || {});
+        const executor = new AxisChainExecutor2(this, this.observerDispatcher);
+        const result = await executor.execute(request.envelope, {
+          actorId,
+          baseFrame
+        });
+        return {
+          ok: result.status !== "FAILED",
+          effect: "chain.complete",
+          body: this.encodeJson(result),
+          metadata: {
+            chainId: result.chainId,
+            status: result.status
+          }
+        };
+      }
+      parseIntentExecBody(bytes2) {
+        try {
+          return JSON.parse(this.decoder.decode(bytes2));
+        } catch (error) {
+          throw new Error(`INTENT.EXEC unwrapping failed: ${error.message}`);
+        }
+      }
+      parseChainRequestBody(bytes2) {
+        let jsonError;
+        try {
+          const parsed = JSON.parse(this.decoder.decode(bytes2));
+          if (this.isChainRequestLike(parsed)) {
+            return {
+              envelope: parsed.envelope,
+              capsule: this.toInlineCapsuleRecord(parsed.capsule),
+              actorId: typeof parsed.actorId === "string" ? parsed.actorId : void 0
+            };
+          }
+          if (this.isChainEnvelopeLike(parsed)) {
+            return { envelope: parsed };
+          }
+        } catch (error) {
+          jsonError = error;
+        }
+        try {
+          const decoded = (0, axis_protocol_1.decodeChainRequest)(bytes2);
+          return {
+            envelope: decoded.envelope,
+            capsule: this.toInlineCapsuleRecord(decoded.capsule),
+            actorId: decoded.actorId
+          };
+        } catch (requestError) {
+          try {
+            return {
+              envelope: (0, axis_protocol_1.decodeChainEnvelope)(bytes2)
+            };
+          } catch (envelopeError) {
+            const reason = [jsonError?.message, requestError.message, envelopeError.message].filter(Boolean).join(" | ");
+            throw new Error(`CHAIN.EXEC decode failed: ${reason}`);
+          }
+        }
+      }
+      isChainRequestLike(value) {
+        return !!value && typeof value === "object" && "envelope" in value && this.isChainEnvelopeLike(value.envelope);
+      }
+      isChainEnvelopeLike(value) {
+        return !!value && typeof value === "object" && typeof value.chainId === "string" && Array.isArray(value.steps);
+      }
+      encodeJson(value) {
+        return this.encoder.encode(JSON.stringify(value));
+      }
+      getActorIdFromFrame(frame) {
+        return this.getHeaderValue(frame, constants_1.TLV_ACTOR_ID);
+      }
+      getProofRefFromFrame(frame) {
+        return this.getHeaderValue(frame, constants_1.TLV_PROOF_REF) || this.getHeaderValue(frame, constants_1.TLV_CAPSULE);
+      }
+      hasCapsuleReference(frame) {
+        return !!this.getProofRefFromFrame(frame);
+      }
+      getHeaderValue(frame, tag) {
+        const value = frame.headers.get(tag);
+        if (!value || value.length === 0) {
+          return void 0;
+        }
+        const decoded = this.decoder.decode(value);
+        if (/^[\x20-\x7e]+$/.test(decoded)) {
+          return decoded;
+        }
+        return Buffer.from(value).toString("hex");
+      }
+      identifiersMatch(left, right) {
+        const normalize2 = (value) => /^[0-9a-f]+$/i.test(value) ? value.toLowerCase() : value;
+        return normalize2(left) === normalize2(right);
+      }
+      extractInlineCapsuleId(capsule) {
+        const id = capsule?.id;
+        return typeof id === "string" && id.length > 0 ? id : void 0;
+      }
+      toInlineCapsuleRecord(value) {
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+          return void 0;
+        }
+        return value;
+      }
+      toScopeList(value) {
+        if (!value) {
+          return [];
+        }
+        return Array.isArray(value) ? value : [value];
+      }
       configureCce(config) {
         this.ccePipelineConfig = config;
         this.logger.log("CCE pipeline configured");
@@ -1622,23 +2666,460 @@ var require_intent_router = __commonJS({
             scope: f.scope
           }))
         };
-        this.intentSchemas.set(meta.intent, schema);
+        this.intentSchemas.set(meta.intent, schema);
+      }
+    };
+    exports.IntentRouter = IntentRouter2;
+    IntentRouter2.BUILTIN_INTENTS = /* @__PURE__ */ new Set([
+      "system.ping",
+      "public.ping",
+      "system.time",
+      "system.echo",
+      "CHAIN.EXEC",
+      "axis.chain.exec",
+      "INTENT.EXEC",
+      "axis.intent.exec"
+    ]);
+    exports.IntentRouter = IntentRouter2 = IntentRouter_1 = __decorate([
+      (0, common_1.Injectable)(),
+      __param(0, (0, common_1.Optional)()),
+      __param(1, (0, common_1.Optional)()),
+      __metadata("design:paramtypes", [typeof (_a = typeof core_1.ModuleRef !== "undefined" && core_1.ModuleRef) === "function" ? _a : Object, typeof (_b = typeof observer_dispatcher_service_1.ObserverDispatcherService !== "undefined" && observer_dispatcher_service_1.ObserverDispatcherService) === "function" ? _b : Object])
+    ], IntentRouter2);
+  }
+});
+
+// src/engine/axis-chain.executor.ts
+var require_axis_chain_executor = __commonJS({
+  "src/engine/axis-chain.executor.ts"(exports) {
+    "use strict";
+    var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
+      var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+      if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+      else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      return c > 3 && r && Object.defineProperty(target, key, r), r;
+    };
+    var __metadata = exports && exports.__metadata || function(k, v) {
+      if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+    };
+    var __param = exports && exports.__param || function(paramIndex, decorator) {
+      return function(target, key) {
+        decorator(target, key, paramIndex);
+      };
+    };
+    var AxisChainExecutor_1;
+    var _a;
+    var _b;
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.AxisChainExecutor = void 0;
+    var crypto_1 = __require("crypto");
+    var common_1 = __require("@nestjs/common");
+    var constants_1 = (init_constants(), __toCommonJS(constants_exports));
+    var axis_execution_context_1 = (init_axis_execution_context(), __toCommonJS(axis_execution_context_exports));
+    var observer_dispatcher_service_1 = require_observer_dispatcher_service();
+    var intent_router_1 = require_intent_router();
+    var AxisChainExecutor2 = AxisChainExecutor_1 = class AxisChainExecutor {
+      constructor(router, observerDispatcher) {
+        this.router = router;
+        this.observerDispatcher = observerDispatcher;
+        this.logger = new common_1.Logger(AxisChainExecutor_1.name);
+        this.encoder = new TextEncoder();
+        this.decoder = new TextDecoder();
+      }
+      async execute(envelope, options = {}) {
+        this.validateEnvelope(envelope);
+        const startedAt = Date.now();
+        const results = /* @__PURE__ */ new Map();
+        const bindings = this.collectChainBindings(envelope);
+        await this.dispatch(bindings, {
+          event: "chain.received",
+          timestamp: startedAt,
+          chainId: envelope.chainId,
+          envelope,
+          observerTags: envelope.observerTags,
+          capsule: envelope.capsule,
+          keyExchange: envelope.keyExchange
+        });
+        await this.dispatch(bindings, {
+          event: "chain.admitted",
+          timestamp: Date.now(),
+          chainId: envelope.chainId,
+          envelope,
+          observerTags: envelope.observerTags,
+          capsule: envelope.capsule,
+          keyExchange: envelope.keyExchange
+        });
+        const stepsById = new Map(envelope.steps.map((step) => [step.stepId, step]));
+        const pending = new Set(stepsById.keys());
+        while (pending.size > 0) {
+          const ready = Array.from(pending).map((stepId) => stepsById.get(stepId)).filter((step) => this.canRun(step, results));
+          if (ready.length === 0) {
+            this.markUnresolvedSteps(pending, stepsById, results, "BLOCKED", "UNRESOLVED_DEPENDENCIES");
+            break;
+          }
+          if (envelope.mode === "parallel") {
+            const waveResults = await Promise.all(ready.map((step) => this.executeStep(step, envelope, results, options)));
+            for (const result of waveResults) {
+              results.set(result.stepId, result);
+              pending.delete(result.stepId);
+            }
+          } else {
+            for (const step of ready) {
+              const result = await this.executeStep(step, envelope, results, options);
+              results.set(result.stepId, result);
+              pending.delete(result.stepId);
+              if (result.status === "FAILED" && (envelope.mode === "strict" || envelope.mode === "atomic")) {
+                this.markUnresolvedSteps(pending, stepsById, results, "SKIPPED", "CHAIN_HALTED");
+                pending.clear();
+                break;
+              }
+            }
+          }
+          this.blockStepsWithFailedDependencies(pending, stepsById, results);
+        }
+        const finishedAt = Date.now();
+        const orderedResults = envelope.steps.map((step) => results.get(step.stepId));
+        const summary = this.buildSummary(envelope.mode, orderedResults, startedAt, finishedAt, envelope.chainId);
+        await this.dispatch(bindings, {
+          event: summary.status === "SUCCEEDED" ? "chain.completed" : summary.status === "PARTIAL" ? "chain.partial" : "chain.failed",
+          timestamp: finishedAt,
+          chainId: envelope.chainId,
+          envelope,
+          result: summary,
+          observerTags: envelope.observerTags,
+          capsule: envelope.capsule,
+          keyExchange: envelope.keyExchange
+        });
+        return summary;
+      }
+      async executeStep(step, envelope, results, options) {
+        const stepBindings = this.router.getObservers(step.intent);
+        const startedAt = Date.now();
+        const input = this.resolveStepInput(step.input, results);
+        await this.dispatch(stepBindings, {
+          event: "step.started",
+          timestamp: startedAt,
+          chainId: envelope.chainId,
+          stepId: step.stepId,
+          intent: step.intent,
+          envelope,
+          step,
+          observerTags: [...envelope.observerTags || [], ...step.observerTags || []],
+          capsule: step.capsuleScope ? {
+            ...envelope.capsule,
+            scope: step.capsuleScope
+          } : envelope.capsule,
+          keyExchange: step.keyExchange || envelope.keyExchange
+        });
+        try {
+          const frame = this.buildFrame(step, envelope, input, options);
+          const effect = await this.router.route(frame);
+          const finishedAt = Date.now();
+          const output = this.decodeOutput(effect.body);
+          const proofHash = this.computeProofHash(envelope.chainId, step.stepId, effect, output);
+          const result = {
+            stepId: step.stepId,
+            intent: step.intent,
+            status: "SUCCEEDED",
+            effect: effect.effect,
+            output,
+            dependsOn: step.dependsOn,
+            startedAt,
+            finishedAt,
+            proofHash,
+            observerTags: [...envelope.observerTags || [], ...step.observerTags || []],
+            metadata: effect.metadata
+          };
+          await this.dispatch(stepBindings, {
+            event: "handler.completed",
+            timestamp: finishedAt,
+            chainId: envelope.chainId,
+            stepId: step.stepId,
+            intent: step.intent,
+            effect,
+            envelope,
+            step,
+            result,
+            observerTags: result.observerTags,
+            capsule: envelope.capsule,
+            keyExchange: step.keyExchange || envelope.keyExchange
+          });
+          await this.dispatch(stepBindings, {
+            event: "proof.recorded",
+            timestamp: finishedAt,
+            chainId: envelope.chainId,
+            stepId: step.stepId,
+            intent: step.intent,
+            envelope,
+            step,
+            result,
+            observerTags: result.observerTags,
+            capsule: envelope.capsule,
+            keyExchange: step.keyExchange || envelope.keyExchange,
+            metadata: { proofHash }
+          });
+          await this.dispatch(stepBindings, {
+            event: "step.completed",
+            timestamp: finishedAt,
+            chainId: envelope.chainId,
+            stepId: step.stepId,
+            intent: step.intent,
+            effect,
+            envelope,
+            step,
+            result,
+            observerTags: result.observerTags,
+            capsule: envelope.capsule,
+            keyExchange: step.keyExchange || envelope.keyExchange
+          });
+          return result;
+        } catch (error) {
+          const finishedAt = Date.now();
+          const result = {
+            stepId: step.stepId,
+            intent: step.intent,
+            status: "FAILED",
+            error: error.message,
+            dependsOn: step.dependsOn,
+            startedAt,
+            finishedAt,
+            observerTags: [...envelope.observerTags || [], ...step.observerTags || []]
+          };
+          this.logger.warn(`Chain ${envelope.chainId} step ${step.stepId} failed: ${error.message}`);
+          await this.dispatch(stepBindings, {
+            event: "step.failed",
+            timestamp: finishedAt,
+            chainId: envelope.chainId,
+            stepId: step.stepId,
+            intent: step.intent,
+            error: error.message,
+            envelope,
+            step,
+            result,
+            observerTags: result.observerTags,
+            capsule: envelope.capsule,
+            keyExchange: step.keyExchange || envelope.keyExchange
+          });
+          return result;
+        }
+      }
+      buildFrame(step, envelope, input, options) {
+        const baseContext = (0, axis_execution_context_1.getAxisExecutionContext)(options.baseFrame);
+        const baseHeaders = new Map(options.baseFrame?.headers || []);
+        baseHeaders.set(constants_1.TLV_INTENT, this.encoder.encode(step.intent));
+        baseHeaders.set(constants_1.TLV_TRACE_ID, this.encoder.encode(envelope.chainId));
+        const capsuleId = envelope.capsule?.capsuleId;
+        if (capsuleId) {
+          baseHeaders.set(constants_1.TLV_CAPSULE, this.encoder.encode(capsuleId));
+        }
+        if (options.actorId) {
+          baseHeaders.set(constants_1.TLV_ACTOR_ID, this.encoder.encode(options.actorId));
+        }
+        return (0, axis_execution_context_1.withAxisExecutionContext)({
+          flags: (options.baseFrame?.flags || 0) | constants_1.FLAG_CHAIN_REQ,
+          headers: baseHeaders,
+          body: this.serializeInput(input),
+          sig: options.baseFrame?.sig || new Uint8Array(0)
+        }, (0, axis_execution_context_1.mergeAxisExecutionContext)(baseContext, {
+          metaIntent: "CHAIN.EXEC",
+          actorId: options.actorId || baseContext?.actorId,
+          capsuleRef: step.capsuleScope ? {
+            ...envelope.capsule || {},
+            scope: step.capsuleScope
+          } : envelope.capsule,
+          chainEnvelope: envelope,
+          chainStep: step
+        }) || {});
+      }
+      validateEnvelope(envelope) {
+        if (!envelope.chainId) {
+          throw new Error("CHAIN_ID_REQUIRED");
+        }
+        if (!envelope.steps || envelope.steps.length === 0) {
+          throw new Error("CHAIN_STEPS_REQUIRED");
+        }
+        const seen = /* @__PURE__ */ new Set();
+        for (const step of envelope.steps) {
+          if (!step.stepId) {
+            throw new Error("CHAIN_STEP_ID_REQUIRED");
+          }
+          if (!step.intent) {
+            throw new Error(`CHAIN_STEP_INTENT_REQUIRED:${step.stepId}`);
+          }
+          if (seen.has(step.stepId)) {
+            throw new Error(`CHAIN_STEP_DUPLICATE:${step.stepId}`);
+          }
+          seen.add(step.stepId);
+        }
+        for (const step of envelope.steps) {
+          for (const dependency of step.dependsOn || []) {
+            if (!seen.has(dependency)) {
+              throw new Error(`CHAIN_STEP_DEPENDENCY_UNKNOWN:${step.stepId}:${dependency}`);
+            }
+          }
+        }
+      }
+      canRun(step, results) {
+        return (step.dependsOn || []).every((dependency) => results.has(dependency));
+      }
+      blockStepsWithFailedDependencies(pending, stepsById, results) {
+        for (const stepId of Array.from(pending)) {
+          const step = stepsById.get(stepId);
+          if (!step || !step.dependsOn || step.dependsOn.length === 0)
+            continue;
+          const dependencyResults = step.dependsOn.map((dependency) => results.get(dependency)).filter(Boolean);
+          if (dependencyResults.length !== step.dependsOn.length)
+            continue;
+          const hasFailure = dependencyResults.some((dependency) => dependency.status !== "SUCCEEDED");
+          if (!hasFailure)
+            continue;
+          results.set(step.stepId, {
+            stepId: step.stepId,
+            intent: step.intent,
+            status: "BLOCKED",
+            error: "DEPENDENCY_FAILED",
+            dependsOn: step.dependsOn,
+            startedAt: Date.now(),
+            finishedAt: Date.now(),
+            observerTags: step.observerTags
+          });
+          pending.delete(step.stepId);
+        }
+      }
+      markUnresolvedSteps(pending, stepsById, results, status, error) {
+        for (const stepId of pending) {
+          const step = stepsById.get(stepId);
+          if (!step)
+            continue;
+          results.set(stepId, {
+            stepId,
+            intent: step.intent,
+            status,
+            error,
+            dependsOn: step.dependsOn,
+            startedAt: Date.now(),
+            finishedAt: Date.now(),
+            observerTags: step.observerTags
+          });
+        }
+      }
+      buildSummary(mode, results, startedAt, finishedAt, chainId) {
+        const completedSteps = results.filter((result) => result.status === "SUCCEEDED").length;
+        const failedSteps = results.filter((result) => result.status === "FAILED").length;
+        const blockedSteps = results.filter((result) => result.status === "BLOCKED").length;
+        const skippedSteps = results.filter((result) => result.status === "SKIPPED").length;
+        let status = "SUCCEEDED";
+        if (failedSteps > 0 || blockedSteps > 0 || skippedSteps > 0) {
+          status = mode === "best_effort" || mode === "parallel" ? completedSteps > 0 ? "PARTIAL" : "FAILED" : "FAILED";
+        }
+        return {
+          chainId,
+          mode,
+          status,
+          completedSteps,
+          failedSteps,
+          blockedSteps,
+          skippedSteps,
+          startedAt,
+          finishedAt,
+          results,
+          rollback: mode === "atomic" ? {
+            supported: false,
+            attempted: false,
+            reason: "AXIS handlers do not expose rollback semantics yet"
+          } : void 0
+        };
+      }
+      resolveStepInput(value, results) {
+        if (typeof value === "string") {
+          if (!value.startsWith("$"))
+            return value;
+          return this.lookupReference(value.slice(1), results);
+        }
+        if (Array.isArray(value)) {
+          return value.map((entry) => this.resolveStepInput(entry, results));
+        }
+        if (value && typeof value === "object") {
+          return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            key,
+            this.resolveStepInput(entry, results)
+          ]));
+        }
+        return value;
+      }
+      lookupReference(path2, results) {
+        const [stepId, ...segments] = path2.split(".");
+        const result = results.get(stepId);
+        if (!result)
+          return void 0;
+        let current = result;
+        for (const segment of segments) {
+          if (current === void 0 || current === null)
+            return void 0;
+          if (typeof current !== "object")
+            return void 0;
+          current = current[segment];
+        }
+        return current;
+      }
+      serializeInput(input) {
+        if (input instanceof Uint8Array)
+          return input;
+        if (typeof input === "string")
+          return this.encoder.encode(input);
+        if (input === void 0)
+          return new Uint8Array(0);
+        return this.encoder.encode(JSON.stringify(input));
+      }
+      decodeOutput(body) {
+        if (!body || body.length === 0)
+          return void 0;
+        try {
+          const text = this.decoder.decode(body);
+          try {
+            return JSON.parse(text);
+          } catch {
+            return /^[\x20-\x7E\s]+$/.test(text) ? text : body;
+          }
+        } catch {
+          return body;
+        }
+      }
+      computeProofHash(chainId, stepId, effect, output) {
+        const hash = (0, crypto_1.createHash)("sha256");
+        hash.update(chainId);
+        hash.update(":");
+        hash.update(stepId);
+        hash.update(":");
+        hash.update(effect.effect);
+        hash.update(":");
+        hash.update(JSON.stringify(output ?? null));
+        return hash.digest("hex");
+      }
+      collectChainBindings(envelope) {
+        const uniqueBindings = /* @__PURE__ */ new Map();
+        for (const step of envelope.steps) {
+          for (const binding of this.router.getObservers(step.intent)) {
+            const key = binding.refs.map((ref) => String(ref)).sort().join("|");
+            if (!uniqueBindings.has(key)) {
+              uniqueBindings.set(key, binding);
+            }
+          }
+        }
+        return Array.from(uniqueBindings.values());
+      }
+      async dispatch(bindings, context) {
+        if (!this.observerDispatcher)
+          return;
+        await this.observerDispatcher.dispatch(bindings, context);
       }
     };
-    exports.IntentRouter = IntentRouter2;
-    IntentRouter2.BUILTIN_INTENTS = /* @__PURE__ */ new Set([
-      "system.ping",
-      "public.ping",
-      "system.time",
-      "system.echo",
-      "INTENT.EXEC",
-      "axis.intent.exec"
-    ]);
-    exports.IntentRouter = IntentRouter2 = IntentRouter_1 = __decorate([
+    exports.AxisChainExecutor = AxisChainExecutor2;
+    exports.AxisChainExecutor = AxisChainExecutor2 = AxisChainExecutor_1 = __decorate([
       (0, common_1.Injectable)(),
-      __param(0, (0, common_1.Optional)()),
-      __metadata("design:paramtypes", [typeof (_a = typeof core_1.ModuleRef !== "undefined" && core_1.ModuleRef) === "function" ? _a : Object])
-    ], IntentRouter2);
+      __param(1, (0, common_1.Optional)()),
+      __metadata("design:paramtypes", [typeof (_a = typeof intent_router_1.IntentRouter !== "undefined" && intent_router_1.IntentRouter) === "function" ? _a : Object, typeof (_b = typeof observer_dispatcher_service_1.ObserverDispatcherService !== "undefined" && observer_dispatcher_service_1.ObserverDispatcherService) === "function" ? _b : Object])
+    ], AxisChainExecutor2);
   }
 });
 
@@ -1841,141 +3322,6 @@ var init_observation_hash = __esm({
   }
 });
 
-// src/core/constants.ts
-var constants_exports = {};
-__export(constants_exports, {
-  AXIS_MAGIC: () => AXIS_MAGIC,
-  AXIS_VERSION: () => AXIS_VERSION,
-  BodyProfile: () => BodyProfile,
-  ERR_BAD_SIGNATURE: () => ERR_BAD_SIGNATURE,
-  ERR_CONTRACT_VIOLATION: () => ERR_CONTRACT_VIOLATION,
-  ERR_INVALID_PACKET: () => ERR_INVALID_PACKET,
-  ERR_REPLAY_DETECTED: () => ERR_REPLAY_DETECTED,
-  FLAG_BODY_TLV: () => FLAG_BODY_TLV,
-  FLAG_CHAIN_REQ: () => FLAG_CHAIN_REQ,
-  FLAG_HAS_WITNESS: () => FLAG_HAS_WITNESS,
-  MAX_BODY_LEN: () => MAX_BODY_LEN,
-  MAX_FRAME_LEN: () => MAX_FRAME_LEN,
-  MAX_HDR_LEN: () => MAX_HDR_LEN,
-  MAX_SIG_LEN: () => MAX_SIG_LEN,
-  NCERT_ALG: () => NCERT_ALG,
-  NCERT_EXP: () => NCERT_EXP,
-  NCERT_ISSUER_KID: () => NCERT_ISSUER_KID,
-  NCERT_KID: () => NCERT_KID,
-  NCERT_NBF: () => NCERT_NBF,
-  NCERT_NODE_ID: () => NCERT_NODE_ID,
-  NCERT_PAYLOAD: () => NCERT_PAYLOAD,
-  NCERT_PUB: () => NCERT_PUB,
-  NCERT_SCOPE: () => NCERT_SCOPE,
-  NCERT_SIG: () => NCERT_SIG,
-  PROOF_CAPSULE: () => PROOF_CAPSULE,
-  PROOF_JWT: () => PROOF_JWT,
-  PROOF_LOOM: () => PROOF_LOOM,
-  PROOF_MTLS: () => PROOF_MTLS,
-  PROOF_NONE: () => PROOF_NONE,
-  PROOF_WITNESS: () => PROOF_WITNESS,
-  ProofType: () => ProofType,
-  TLV_ACTOR_ID: () => TLV_ACTOR_ID,
-  TLV_AUD: () => TLV_AUD,
-  TLV_BODY_ARR: () => TLV_BODY_ARR,
-  TLV_BODY_OBJ: () => TLV_BODY_OBJ,
-  TLV_CAPSULE: () => TLV_CAPSULE,
-  TLV_EFFECT: () => TLV_EFFECT,
-  TLV_ERROR_CODE: () => TLV_ERROR_CODE,
-  TLV_ERROR_MSG: () => TLV_ERROR_MSG,
-  TLV_INDEX: () => TLV_INDEX,
-  TLV_INTENT: () => TLV_INTENT,
-  TLV_KID: () => TLV_KID,
-  TLV_LOOM_PRESENCE_ID: () => TLV_LOOM_PRESENCE_ID,
-  TLV_LOOM_THREAD_HASH: () => TLV_LOOM_THREAD_HASH,
-  TLV_LOOM_WRIT: () => TLV_LOOM_WRIT,
-  TLV_NODE: () => TLV_NODE,
-  TLV_NODE_CERT_HASH: () => TLV_NODE_CERT_HASH,
-  TLV_NODE_KID: () => TLV_NODE_KID,
-  TLV_NONCE: () => TLV_NONCE,
-  TLV_OFFSET: () => TLV_OFFSET,
-  TLV_OK: () => TLV_OK,
-  TLV_PID: () => TLV_PID,
-  TLV_PREV_HASH: () => TLV_PREV_HASH,
-  TLV_PROOF_REF: () => TLV_PROOF_REF,
-  TLV_PROOF_TYPE: () => TLV_PROOF_TYPE,
-  TLV_REALM: () => TLV_REALM,
-  TLV_RECEIPT_HASH: () => TLV_RECEIPT_HASH,
-  TLV_RID: () => TLV_RID,
-  TLV_SHA256_CHUNK: () => TLV_SHA256_CHUNK,
-  TLV_TRACE_ID: () => TLV_TRACE_ID,
-  TLV_TS: () => TLV_TS,
-  TLV_UPLOAD_ID: () => TLV_UPLOAD_ID
-});
-import {
-  AXIS_MAGIC,
-  AXIS_VERSION,
-  MAX_HDR_LEN,
-  MAX_BODY_LEN,
-  MAX_SIG_LEN,
-  MAX_FRAME_LEN,
-  FLAG_BODY_TLV,
-  FLAG_CHAIN_REQ,
-  FLAG_HAS_WITNESS,
-  TLV_PID,
-  TLV_TS,
-  TLV_INTENT,
-  TLV_ACTOR_ID,
-  TLV_PROOF_TYPE,
-  TLV_PROOF_REF,
-  TLV_NONCE,
-  TLV_AUD,
-  TLV_REALM,
-  TLV_NODE,
-  TLV_TRACE_ID,
-  TLV_KID,
-  TLV_RID,
-  TLV_OK,
-  TLV_EFFECT,
-  TLV_ERROR_CODE,
-  TLV_ERROR_MSG,
-  TLV_PREV_HASH,
-  TLV_RECEIPT_HASH,
-  TLV_NODE_KID,
-  TLV_NODE_CERT_HASH,
-  TLV_LOOM_PRESENCE_ID,
-  TLV_LOOM_WRIT,
-  TLV_LOOM_THREAD_HASH,
-  TLV_UPLOAD_ID,
-  TLV_INDEX,
-  TLV_OFFSET,
-  TLV_SHA256_CHUNK,
-  TLV_CAPSULE,
-  TLV_BODY_OBJ,
-  TLV_BODY_ARR,
-  NCERT_NODE_ID,
-  NCERT_KID,
-  NCERT_ALG,
-  NCERT_PUB,
-  NCERT_NBF,
-  NCERT_EXP,
-  NCERT_SCOPE,
-  NCERT_ISSUER_KID,
-  NCERT_PAYLOAD,
-  NCERT_SIG,
-  PROOF_NONE,
-  PROOF_CAPSULE,
-  PROOF_JWT,
-  PROOF_MTLS,
-  PROOF_LOOM,
-  PROOF_WITNESS,
-  ProofType,
-  BodyProfile,
-  ERR_INVALID_PACKET,
-  ERR_BAD_SIGNATURE,
-  ERR_REPLAY_DETECTED,
-  ERR_CONTRACT_VIOLATION
-} from "@nextera.one/axis-protocol";
-var init_constants = __esm({
-  "src/core/constants.ts"() {
-  }
-});
-
 // src/engine/observation/response-observer.ts
 function verifyResponse(ctx, response) {
   if (!response.effect || typeof response.effect !== "string") {
@@ -3494,37 +4840,6 @@ var init_packet = __esm({
   }
 });
 
-// src/security/scopes.ts
-function hasScope(scopes, required) {
-  if (!Array.isArray(scopes) || scopes.length === 0) {
-    return false;
-  }
-  if (scopes.includes(required)) {
-    return true;
-  }
-  const [resource, id] = required.split(":");
-  if (resource && id) {
-    const wildcard = `${resource}:*`;
-    if (scopes.includes(wildcard)) {
-      return true;
-    }
-  }
-  return false;
-}
-function parseScope(scope) {
-  const parts = scope.split(":");
-  if (parts.length !== 2) return null;
-  return { resource: parts[0], id: parts[1] };
-}
-function canAccessResource(scopes, resourceType, resourceId) {
-  const required = `${resourceType}:${resourceId}`;
-  return hasScope(scopes, required);
-}
-var init_scopes = __esm({
-  "src/security/scopes.ts"() {
-  }
-});
-
 // src/security/capabilities.ts
 var CAPABILITIES, PROOF_CAPABILITIES, INTENT_REQUIREMENTS;
 var init_capabilities = __esm({
@@ -4209,23 +5524,62 @@ var require_axis_request_decorator = __commonJS({
   }
 });
 
-// src/core/axis-error.ts
-var axis_error_exports = {};
-__export(axis_error_exports, {
-  AxisError: () => AxisError
-});
-var AxisError;
-var init_axis_error = __esm({
-  "src/core/axis-error.ts"() {
-    AxisError = class extends Error {
-      constructor(code, message, httpStatus = 400, details) {
-        super(message);
-        this.code = code;
-        this.httpStatus = httpStatus;
-        this.details = details;
-        this.name = "AxisError";
+// src/engine/observer-discovery.service.ts
+var require_observer_discovery_service = __commonJS({
+  "src/engine/observer-discovery.service.ts"(exports) {
+    "use strict";
+    var __decorate = exports && exports.__decorate || function(decorators, target, key, desc) {
+      var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+      if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+      else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+      return c > 3 && r && Object.defineProperty(target, key, r), r;
+    };
+    var __metadata = exports && exports.__metadata || function(k, v) {
+      if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+    };
+    var ObserverDiscoveryService_1;
+    var _a;
+    var _b;
+    var _c;
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ObserverDiscoveryService = void 0;
+    var common_1 = __require("@nestjs/common");
+    var core_1 = __require("@nestjs/core");
+    var observer_decorator_1 = (init_observer_decorator(), __toCommonJS(observer_decorator_exports));
+    var observer_registry_1 = require_observer_registry();
+    var ObserverDiscoveryService2 = ObserverDiscoveryService_1 = class ObserverDiscoveryService {
+      constructor(discovery, reflector, registry) {
+        this.discovery = discovery;
+        this.reflector = reflector;
+        this.registry = registry;
+        this.logger = new common_1.Logger(ObserverDiscoveryService_1.name);
+      }
+      onApplicationBootstrap() {
+        const providers = this.discovery.getProviders();
+        let count = 0;
+        for (const wrapper of providers) {
+          const { instance } = wrapper;
+          if (!instance || !instance.constructor)
+            continue;
+          const meta = this.reflector.get(observer_decorator_1.OBSERVER_METADATA_KEY, instance.constructor);
+          if (!meta)
+            continue;
+          const observer = instance;
+          if (typeof observer.observe !== "function") {
+            this.logger.warn(`@Observer on ${instance.constructor.name} is missing observe() and was skipped`);
+            continue;
+          }
+          this.registry.register(observer, meta);
+          count++;
+        }
+        this.logger.log(`Auto-registered ${count} observers via @Observer()`);
       }
     };
+    exports.ObserverDiscoveryService = ObserverDiscoveryService2;
+    exports.ObserverDiscoveryService = ObserverDiscoveryService2 = ObserverDiscoveryService_1 = __decorate([
+      (0, common_1.Injectable)(),
+      __metadata("design:paramtypes", [typeof (_a = typeof core_1.DiscoveryService !== "undefined" && core_1.DiscoveryService) === "function" ? _a : Object, typeof (_b = typeof core_1.Reflector !== "undefined" && core_1.Reflector) === "function" ? _b : Object, typeof (_c = typeof observer_registry_1.ObserverRegistry !== "undefined" && observer_registry_1.ObserverRegistry) === "function" ? _c : Object])
+    ], ObserverDiscoveryService2);
   }
 });
 
@@ -4250,6 +5604,7 @@ var require_handler_discovery_service = __commonJS({
     exports.HandlerDiscoveryService = void 0;
     var common_1 = __require("@nestjs/common");
     var core_1 = __require("@nestjs/core");
+    var observer_decorator_1 = (init_observer_decorator(), __toCommonJS(observer_decorator_exports));
     var handler_sensors_decorator_1 = (init_handler_sensors_decorator(), __toCommonJS(handler_sensors_decorator_exports));
     var handler_decorator_1 = (init_handler_decorator(), __toCommonJS(handler_decorator_exports));
     var intent_decorator_1 = (init_intent_decorator(), __toCommonJS(intent_decorator_exports));
@@ -4272,20 +5627,36 @@ var require_handler_discovery_service = __commonJS({
           if (!handlerMeta)
             continue;
           const handlerName = handlerMeta.intent || metatype.name;
+          const prefix = handlerMeta.intent || metatype.name;
           const proto = Object.getPrototypeOf(instance);
           const methods = this.scanner.getAllMethodNames(proto);
+          const routes = Reflect.getMetadata(intent_decorator_1.INTENT_ROUTES_KEY, metatype) || [];
+          const routedMethods = new Set(routes.map((route) => String(route.methodName)));
           let registered = 0;
           const handlerSensors = Reflect.getMetadata(handler_sensors_decorator_1.HANDLER_SENSORS_KEY, metatype) || [];
+          const handlerObservers = Reflect.getMetadata(observer_decorator_1.OBSERVER_BINDINGS_KEY, metatype) || [];
+          for (const route of routes) {
+            const intentName = route.absolute ? route.action : `${prefix}.${route.action}`;
+            if (!this.router.has(intentName)) {
+              this.router.register(intentName, instance[route.methodName].bind(instance));
+              registered++;
+              totalIntents++;
+            }
+            this.router.registerIntentMeta(intentName, proto, String(route.methodName), handlerSensors, handlerObservers);
+          }
           for (const methodName of methods) {
+            if (routedMethods.has(methodName))
+              continue;
             const meta = Reflect.getMetadata(intent_decorator_1.INTENT_METADATA_KEY, proto, methodName);
             if (!meta?.intent)
               continue;
-            if (!this.router.has(meta.intent)) {
-              this.router.register(meta.intent, instance[methodName].bind(instance));
+            const intentName = meta.absolute ? meta.intent : `${prefix}.${meta.intent}`;
+            if (!this.router.has(intentName)) {
+              this.router.register(intentName, instance[methodName].bind(instance));
               registered++;
               totalIntents++;
             }
-            this.router.registerIntentMeta(meta.intent, proto, methodName, handlerSensors);
+            this.router.registerIntentMeta(intentName, proto, methodName, handlerSensors, handlerObservers);
           }
           if (registered > 0) {
             this.logger.log(`Auto-registered ${registered} intents from ${handlerName}`);
@@ -5854,6 +7225,10 @@ var init_crypto = __esm({
 // src/decorators/index.ts
 var decorators_exports = {};
 __export(decorators_exports, {
+  CAPSULE_POLICY_METADATA_KEY: () => CAPSULE_POLICY_METADATA_KEY,
+  CHAIN_METADATA_KEY: () => CHAIN_METADATA_KEY,
+  CapsulePolicy: () => CapsulePolicy,
+  Chain: () => Chain,
   HANDLER_METADATA_KEY: () => HANDLER_METADATA_KEY,
   Handler: () => Handler,
   INTENT_BODY_KEY: () => INTENT_BODY_KEY,
@@ -5863,6 +7238,9 @@ __export(decorators_exports, {
   Intent: () => Intent,
   IntentBody: () => IntentBody,
   IntentSensors: () => IntentSensors,
+  OBSERVER_BINDINGS_KEY: () => OBSERVER_BINDINGS_KEY,
+  OBSERVER_METADATA_KEY: () => OBSERVER_METADATA_KEY,
+  Observer: () => Observer,
   SENSOR_METADATA_KEY: () => SENSOR_METADATA_KEY,
   Sensor: () => Sensor,
   TLV_FIELDS_KEY: () => TLV_FIELDS_KEY,
@@ -5872,16 +7250,21 @@ __export(decorators_exports, {
   TlvMinLen: () => TlvMinLen,
   TlvRange: () => TlvRange,
   TlvUtf8Pattern: () => TlvUtf8Pattern,
-  TlvValidate: () => TlvValidate
+  TlvValidate: () => TlvValidate,
+  mergeCapsulePolicyOptions: () => mergeCapsulePolicyOptions,
+  normalizeCapsulePolicyOptions: () => normalizeCapsulePolicyOptions
 });
 var init_decorators = __esm({
   "src/decorators/index.ts"() {
     __reExport(decorators_exports, __toESM(require_axis_request_decorator()));
+    init_capsule_policy_decorator();
+    init_chain_decorator();
     __reExport(decorators_exports, __toESM(require_dto_schema_util()));
     init_handler_decorator();
     init_intent_body_decorator();
     init_intent_sensors_decorator();
     init_intent_decorator();
+    init_observer_decorator();
     init_sensor_decorator();
     init_tlv_field_decorator();
   }
@@ -5893,6 +7276,18 @@ var init_axis_decoded = __esm({
   }
 });
 
+// src/engine/axis-chain.types.ts
+var init_axis_chain_types = __esm({
+  "src/engine/axis-chain.types.ts"() {
+  }
+});
+
+// src/engine/axis-observer.interface.ts
+var init_axis_observer_interface = __esm({
+  "src/engine/axis-observer.interface.ts"() {
+  }
+});
+
 // src/engine/observation/observation-queue.types.ts
 var init_observation_queue_types = __esm({
   "src/engine/observation/observation-queue.types.ts"() {
@@ -5927,6 +7322,7 @@ var init_observation = __esm({
 // src/engine/index.ts
 var engine_exports = {};
 __export(engine_exports, {
+  AXIS_EXECUTION_CONTEXT_KEY: () => AXIS_EXECUTION_CONTEXT_KEY,
   BAND: () => BAND,
   PRE_DECODE_BOUNDARY: () => PRE_DECODE_BOUNDARY,
   ResponseObserver: () => ResponseObserver,
@@ -5938,24 +7334,34 @@ __export(engine_exports, {
   encodeQueueMessage: () => encodeQueueMessage,
   endStage: () => endStage,
   finalizeObservation: () => finalizeObservation,
+  getAxisExecutionContext: () => getAxisExecutionContext,
   hashObservation: () => hashObservation,
+  mergeAxisExecutionContext: () => mergeAxisExecutionContext,
   observation: () => observation_exports,
   parseAutoClaimEntries: () => parseAutoClaimEntries,
   parseStreamEntries: () => parseStreamEntries,
   recordSensor: () => recordSensor,
   stableJsonStringify: () => stableJsonStringify,
   startStage: () => startStage,
-  verifyResponse: () => verifyResponse
+  verifyResponse: () => verifyResponse,
+  withAxisExecutionContext: () => withAxisExecutionContext
 });
 var init_engine = __esm({
   "src/engine/index.ts"() {
     init_axis_decoded();
+    __reExport(engine_exports, __toESM(require_axis_chain_executor()));
+    init_axis_chain_types();
+    init_axis_execution_context();
     init_axis_observation();
+    init_axis_observer_interface();
     __reExport(engine_exports, __toESM(require_handler_discovery_service()));
     __reExport(engine_exports, __toESM(require_intent_router()));
     init_observation();
+    __reExport(engine_exports, __toESM(require_observer_discovery_service()));
+    __reExport(engine_exports, __toESM(require_observer_dispatcher_service()));
     init_sensor_bands();
     __reExport(engine_exports, __toESM(require_sensor_discovery_service()));
+    __reExport(engine_exports, __toESM(require_observer_registry()));
     __reExport(engine_exports, __toESM(require_sensor_registry()));
     init_observation();
   }
@@ -7993,6 +9399,7 @@ var index_exports = {};
 __export(index_exports, {
   ATS1_HDR: () => ATS1_HDR,
   ATS1_SCHEMA: () => ATS1_SCHEMA,
+  AXIS_EXECUTION_CONTEXT_KEY: () => AXIS_EXECUTION_CONTEXT_KEY,
   AXIS_MAGIC: () => AXIS_MAGIC,
   AXIS_OPCODES: () => AXIS_OPCODES,
   AXIS_UPLOAD_FILE_STORE: () => AXIS_UPLOAD_FILE_STORE,
@@ -8000,6 +9407,7 @@ __export(index_exports, {
   AXIS_UPLOAD_SESSION_STORE: () => AXIS_UPLOAD_SESSION_STORE,
   AXIS_VERSION: () => AXIS_VERSION,
   Ats1Codec: () => ats1_exports,
+  AxisChainExecutor: () => import_axis_chain.AxisChainExecutor,
   AxisContext: () => import_axis_request.AxisContext,
   AxisDemoPubkey: () => import_axis_request.AxisDemoPubkey,
   AxisEffect: () => import_intent2.AxisEffect,
@@ -8018,9 +9426,13 @@ __export(index_exports, {
   BAND: () => BAND,
   BodyProfile: () => BodyProfile,
   CAPABILITIES: () => CAPABILITIES,
+  CAPSULE_POLICY_METADATA_KEY: () => CAPSULE_POLICY_METADATA_KEY,
   CCE_ERROR: () => CCE_ERROR,
   CCE_PROTOCOL_VERSION: () => CCE_PROTOCOL_VERSION,
+  CHAIN_METADATA_KEY: () => CHAIN_METADATA_KEY,
+  CapsulePolicy: () => CapsulePolicy,
   CceError: () => CceError,
+  Chain: () => Chain,
   ContractViolationError: () => ContractViolationError,
   DEFAULT_CONTRACTS: () => DEFAULT_CONTRACTS,
   DEFAULT_TIMEOUT: () => DEFAULT_TIMEOUT,
@@ -8066,6 +9478,12 @@ __export(index_exports, {
   NCERT_PUB: () => NCERT_PUB,
   NCERT_SCOPE: () => NCERT_SCOPE,
   NCERT_SIG: () => NCERT_SIG,
+  OBSERVER_BINDINGS_KEY: () => OBSERVER_BINDINGS_KEY,
+  OBSERVER_METADATA_KEY: () => OBSERVER_METADATA_KEY,
+  Observer: () => Observer,
+  ObserverDiscoveryService: () => import_observer_discovery.ObserverDiscoveryService,
+  ObserverDispatcherService: () => import_observer_dispatcher.ObserverDispatcherService,
+  ObserverRegistry: () => import_observer2.ObserverRegistry,
   PRE_DECODE_BOUNDARY: () => PRE_DECODE_BOUNDARY,
   PROOF_CAPABILITIES: () => PROOF_CAPABILITIES,
   PROOF_CAPSULE: () => PROOF_CAPSULE,
@@ -8183,6 +9601,7 @@ __export(index_exports, {
   extractDtoSchema: () => import_dto_schema.extractDtoSchema,
   finalizeObservation: () => finalizeObservation,
   generateEd25519KeyPair: () => generateEd25519KeyPair,
+  getAxisExecutionContext: () => getAxisExecutionContext,
   getSignTarget: () => getSignTarget,
   hasScope: () => hasScope,
   hashObservation: () => hashObservation,
@@ -8190,6 +9609,7 @@ __export(index_exports, {
   isKnownOpcode: () => isKnownOpcode,
   isTimestampValid: () => isTimestampValid,
   loom: () => loom_exports,
+  mergeAxisExecutionContext: () => mergeAxisExecutionContext,
   nonce16: () => nonce16,
   normalizeSensorDecision: () => normalizeSensorDecision,
   packPasskeyLoginOptionsReq: () => packPasskeyLoginOptionsReq,
@@ -8221,15 +9641,19 @@ __export(index_exports, {
   varintLength: () => varintLength,
   varintU: () => varintU,
   verifyFrameSignature: () => verifyFrameSignature,
-  verifyResponse: () => verifyResponse
+  verifyResponse: () => verifyResponse,
+  withAxisExecutionContext: () => withAxisExecutionContext
 });
-var import_dto_schema, import_axis_id, import_axis_response, import_intent2, import_axis_files, import_axis_request, import_handler_discovery, import_sensor_discovery, import_sensor2, import_axis_sensor_chain;
+var import_dto_schema, import_axis_id, import_axis_response, import_axis_chain, import_intent2, import_axis_files, import_axis_request, import_observer_discovery, import_observer_dispatcher, import_handler_discovery, import_sensor_discovery, import_observer2, import_sensor2, import_axis_sensor_chain;
 var init_index = __esm({
   "src/index.ts"() {
+    init_chain_decorator();
+    init_capsule_policy_decorator();
     init_handler_decorator();
     init_intent_decorator();
     init_intent_body_decorator();
     init_intent_sensors_decorator();
+    init_observer_decorator();
     init_handler_sensors_decorator();
     init_sensor_decorator();
     init_tlv_field_decorator();
@@ -8238,6 +9662,8 @@ var init_index = __esm({
     import_axis_id = __toESM(require_axis_id_dto());
     init_axis_partial_type();
     import_axis_response = __toESM(require_axis_response_dto());
+    import_axis_chain = __toESM(require_axis_chain_executor());
+    init_axis_execution_context();
     import_intent2 = __toESM(require_intent_router());
     init_sensor_bands();
     init_stable_json();
@@ -8275,8 +9701,11 @@ var init_index = __esm({
     init_disk_upload_file_store();
     import_axis_request = __toESM(require_axis_request_decorator());
     init_axis_error();
+    import_observer_discovery = __toESM(require_observer_discovery_service());
+    import_observer_dispatcher = __toESM(require_observer_dispatcher_service());
     import_handler_discovery = __toESM(require_handler_discovery_service());
     import_sensor_discovery = __toESM(require_sensor_discovery_service());
+    import_observer2 = __toESM(require_observer_registry());
     import_sensor2 = __toESM(require_sensor_registry());
     init_axis_observation();
     import_axis_sensor_chain = __toESM(require_axis_sensor_chain_service());
@@ -8297,6 +9726,7 @@ var init_index = __esm({
   }
 });
 init_index();
+var export_AxisChainExecutor = import_axis_chain.AxisChainExecutor;
 var export_AxisContext = import_axis_request.AxisContext;
 var export_AxisDemoPubkey = import_axis_request.AxisDemoPubkey;
 var export_AxisEffect = import_intent2.AxisEffect;
@@ -8309,6 +9739,9 @@ var export_AxisResponseDto = import_axis_response.AxisResponseDto;
 var export_AxisSensorChainService = import_axis_sensor_chain.AxisSensorChainService;
 var export_HandlerDiscoveryService = import_handler_discovery.HandlerDiscoveryService;
 var export_IntentRouter = import_intent2.IntentRouter;
+var export_ObserverDiscoveryService = import_observer_discovery.ObserverDiscoveryService;
+var export_ObserverDispatcherService = import_observer_dispatcher.ObserverDispatcherService;
+var export_ObserverRegistry = import_observer2.ObserverRegistry;
 var export_RESPONSE_TAG_CREATED_AT = import_axis_response.RESPONSE_TAG_CREATED_AT;
 var export_RESPONSE_TAG_CREATED_BY = import_axis_response.RESPONSE_TAG_CREATED_BY;
 var export_RESPONSE_TAG_ID = import_axis_response.RESPONSE_TAG_ID;
@@ -8321,6 +9754,7 @@ var export_extractDtoSchema = import_dto_schema.extractDtoSchema;
 export {
   ATS1_HDR,
   ATS1_SCHEMA,
+  AXIS_EXECUTION_CONTEXT_KEY,
   AXIS_MAGIC,
   AXIS_OPCODES,
   AXIS_UPLOAD_FILE_STORE,
@@ -8328,6 +9762,7 @@ export {
   AXIS_UPLOAD_SESSION_STORE,
   AXIS_VERSION,
   ats1_exports as Ats1Codec,
+  export_AxisChainExecutor as AxisChainExecutor,
   export_AxisContext as AxisContext,
   export_AxisDemoPubkey as AxisDemoPubkey,
   export_AxisEffect as AxisEffect,
@@ -8346,9 +9781,13 @@ export {
   BAND,
   BodyProfile,
   CAPABILITIES,
+  CAPSULE_POLICY_METADATA_KEY,
   CCE_ERROR,
   CCE_PROTOCOL_VERSION,
+  CHAIN_METADATA_KEY,
+  CapsulePolicy,
   CceError,
+  Chain,
   ContractViolationError,
   DEFAULT_CONTRACTS,
   DEFAULT_TIMEOUT,
@@ -8394,6 +9833,12 @@ export {
   NCERT_PUB,
   NCERT_SCOPE,
   NCERT_SIG,
+  OBSERVER_BINDINGS_KEY,
+  OBSERVER_METADATA_KEY,
+  Observer,
+  export_ObserverDiscoveryService as ObserverDiscoveryService,
+  export_ObserverDispatcherService as ObserverDispatcherService,
+  export_ObserverRegistry as ObserverRegistry,
   PRE_DECODE_BOUNDARY,
   PROOF_CAPABILITIES,
   PROOF_CAPSULE,
@@ -8511,6 +9956,7 @@ export {
   export_extractDtoSchema as extractDtoSchema,
   finalizeObservation,
   generateEd25519KeyPair,
+  getAxisExecutionContext,
   getSignTarget,
   hasScope,
   hashObservation,
@@ -8518,6 +9964,7 @@ export {
   isKnownOpcode,
   isTimestampValid,
   loom_exports as loom,
+  mergeAxisExecutionContext,
   nonce16,
   normalizeSensorDecision,
   packPasskeyLoginOptionsReq,
@@ -8549,6 +9996,7 @@ export {
   varintLength,
   varintU,
   verifyFrameSignature,
-  verifyResponse
+  verifyResponse,
+  withAxisExecutionContext
 };
 //# sourceMappingURL=index.mjs.map