@nextera.one/axis-server-sdk 2.2.1 → 2.2.3

package/dist/cce/index.js

@@ -0,0 +1,1502 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cce/index.ts
+var cce_exports = {};
+__export(cce_exports, {
+  CCE_AES_KEY_BYTES: () => CCE_AES_KEY_BYTES,
+  CCE_DERIVATION: () => CCE_DERIVATION,
+  CCE_ERROR: () => CCE_ERROR,
+  CCE_IV_BYTES: () => CCE_IV_BYTES,
+  CCE_NONCE_BYTES: () => CCE_NONCE_BYTES,
+  CCE_PROTOCOL_VERSION: () => CCE_PROTOCOL_VERSION,
+  CCE_TAG_BYTES: () => CCE_TAG_BYTES,
+  CceAudienceIntentBindingSensor: () => CceAudienceIntentBindingSensor,
+  CceCapsuleVerificationSensor: () => CceCapsuleVerificationSensor,
+  CceClientSignatureSensor: () => CceClientSignatureSensor,
+  CceEnvelopeValidationSensor: () => CceEnvelopeValidationSensor,
+  CceError: () => CceError,
+  CcePayloadDecryptionSensor: () => CcePayloadDecryptionSensor,
+  CceReplayProtectionSensor: () => CceReplayProtectionSensor,
+  CceTpsWindowSensor: () => CceTpsWindowSensor,
+  InMemoryCceReplayStore: () => InMemoryCceReplayStore,
+  InMemoryCceWitnessStore: () => InMemoryCceWitnessStore,
+  aesGcmDecrypt: () => aesGcmDecrypt,
+  aesGcmEncrypt: () => aesGcmEncrypt,
+  base64UrlDecode: () => base64UrlDecode,
+  base64UrlEncode: () => base64UrlEncode,
+  buildCceErrorResponse: () => buildCceErrorResponse,
+  buildCceResponse: () => buildCceResponse,
+  buildExecutionContext: () => buildExecutionContext,
+  buildWitnessRecord: () => buildWitnessRecord,
+  deriveRequestExecutionKey: () => deriveRequestExecutionKey,
+  deriveResponseExecutionKey: () => deriveResponseExecutionKey,
+  deriveWitnessKey: () => deriveWitnessKey,
+  executeCcePipeline: () => executeCcePipeline,
+  extractVerificationState: () => extractVerificationState,
+  generateAesKey: () => generateAesKey,
+  generateCceNonce: () => generateCceNonce,
+  generateIv: () => generateIv,
+  hashPayload: () => hashPayload,
+  nodeAesGcmProvider: () => nodeAesGcmProvider
+});
+module.exports = __toCommonJS(cce_exports);
+
+// src/cce/cce.types.ts
+var CCE_PROTOCOL_VERSION = "cce-v1";
+var CCE_DERIVATION = {
+  /** Request execution context */
+  REQUEST: "axis:cce:req:v1",
+  /** Response execution context */
+  RESPONSE: "axis:cce:resp:v1",
+  /** Witness binding context */
+  WITNESS: "axis:cce:witness:v1"
+};
+var CCE_AES_KEY_BYTES = 32;
+var CCE_IV_BYTES = 12;
+var CCE_TAG_BYTES = 16;
+var CCE_NONCE_BYTES = 32;
+var CCE_ERROR = {
+  // Envelope errors
+  INVALID_ENVELOPE: "CCE_INVALID_ENVELOPE",
+  UNSUPPORTED_VERSION: "CCE_UNSUPPORTED_VERSION",
+  MISSING_CAPSULE: "CCE_MISSING_CAPSULE",
+  MISSING_ENCRYPTED_KEY: "CCE_MISSING_ENCRYPTED_KEY",
+  // Signature errors
+  CLIENT_SIG_INVALID: "CCE_CLIENT_SIG_INVALID",
+  CLIENT_KEY_NOT_FOUND: "CCE_CLIENT_KEY_NOT_FOUND",
+  // Capsule errors
+  CAPSULE_SIG_INVALID: "CCE_CAPSULE_SIG_INVALID",
+  CAPSULE_EXPIRED: "CCE_CAPSULE_EXPIRED",
+  CAPSULE_NOT_YET_VALID: "CCE_CAPSULE_NOT_YET_VALID",
+  CAPSULE_REVOKED: "CCE_CAPSULE_REVOKED",
+  CAPSULE_CONSUMED: "CCE_CAPSULE_CONSUMED",
+  // Binding errors
+  AUDIENCE_MISMATCH: "CCE_AUDIENCE_MISMATCH",
+  INTENT_MISMATCH: "CCE_INTENT_MISMATCH",
+  TPS_WINDOW_EXPIRED: "CCE_TPS_WINDOW_EXPIRED",
+  TPS_WINDOW_FUTURE: "CCE_TPS_WINDOW_FUTURE",
+  // Replay / nonce errors
+  REPLAY_DETECTED: "CCE_REPLAY_DETECTED",
+  NONCE_REUSED: "CCE_NONCE_REUSED",
+  // Decryption errors
+  DECRYPTION_FAILED: "CCE_DECRYPTION_FAILED",
+  KEY_UNWRAP_FAILED: "CCE_KEY_UNWRAP_FAILED",
+  AEAD_TAG_MISMATCH: "CCE_AEAD_TAG_MISMATCH",
+  PAYLOAD_TOO_LARGE: "CCE_PAYLOAD_TOO_LARGE",
+  // Schema / validation errors
+  PAYLOAD_SCHEMA_INVALID: "CCE_PAYLOAD_SCHEMA_INVALID",
+  INTENT_SCHEMA_MISMATCH: "CCE_INTENT_SCHEMA_MISMATCH",
+  // Policy errors
+  POLICY_DENIED: "CCE_POLICY_DENIED",
+  CONSTRAINT_VIOLATED: "CCE_CONSTRAINT_VIOLATED",
+  // Handler errors
+  HANDLER_NOT_FOUND: "CCE_HANDLER_NOT_FOUND",
+  HANDLER_EXECUTION_FAILED: "CCE_HANDLER_EXECUTION_FAILED",
+  HANDLER_TIMEOUT: "CCE_HANDLER_TIMEOUT",
+  // Response errors
+  RESPONSE_ENCRYPTION_FAILED: "CCE_RESPONSE_ENCRYPTION_FAILED"
+};
+var CceError = class extends Error {
+  constructor(code, message, metadata) {
+    super(`[${code}] ${message}`);
+    this.code = code;
+    this.metadata = metadata;
+    this.name = "CceError";
+  }
+  /** Whether this error is safe to expose to the client */
+  get clientSafe() {
+    const internal = [
+      CCE_ERROR.DECRYPTION_FAILED,
+      CCE_ERROR.KEY_UNWRAP_FAILED,
+      CCE_ERROR.AEAD_TAG_MISMATCH,
+      CCE_ERROR.HANDLER_EXECUTION_FAILED,
+      CCE_ERROR.RESPONSE_ENCRYPTION_FAILED
+    ];
+    return !internal.includes(this.code);
+  }
+  /** Get client-safe representation */
+  toClientError() {
+    if (this.clientSafe) {
+      return { code: this.code, message: this.message };
+    }
+    return {
+      code: CCE_ERROR.DECRYPTION_FAILED,
+      message: "Request processing failed"
+    };
+  }
+};
+
+// src/cce/cce-derivation.service.ts
+var import_utils = require("@noble/hashes/utils.js");
+var import_hkdf = require("@noble/hashes/hkdf.js");
+var import_sha2 = require("@noble/hashes/sha2.js");
+function buildSalt(capsuleId, capsuleNonce, requestNonce) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(
+    capsuleId + "|" + capsuleNonce + "|" + requestNonce
+  );
+  return (0, import_sha2.sha256)(data);
+}
+function buildInfo(contextPrefix, capsule, extraNonce) {
+  const encoder = new TextEncoder();
+  const parts = [
+    contextPrefix,
+    capsule.sub,
+    capsule.kid,
+    capsule.intent,
+    capsule.aud,
+    String(capsule.tps_from),
+    String(capsule.tps_to),
+    capsule.policy_hash ?? "",
+    capsule.ver
+  ];
+  if (extraNonce) {
+    parts.push(extraNonce);
+  }
+  return encoder.encode(parts.join("|"));
+}
+function deriveRequestExecutionKey(input) {
+  const ikm = (0, import_utils.hexToBytes)(input.axisLocalSecret);
+  const salt = buildSalt(
+    input.capsule.capsule_id,
+    input.capsule.capsule_nonce,
+    input.requestNonce
+  );
+  const info = buildInfo(CCE_DERIVATION.REQUEST, input.capsule);
+  return (0, import_hkdf.hkdf)(import_sha2.sha256, ikm, salt, info, CCE_AES_KEY_BYTES);
+}
+function deriveResponseExecutionKey(input) {
+  const ikm = (0, import_utils.hexToBytes)(input.axisLocalSecret);
+  const encoder = new TextEncoder();
+  const saltData = encoder.encode(
+    input.capsule.capsule_id + "|" + input.capsule.capsule_nonce + "|" + input.requestNonce + "|" + input.responseNonce
+  );
+  const salt = (0, import_sha2.sha256)(saltData);
+  const info = buildInfo(
+    CCE_DERIVATION.RESPONSE,
+    input.capsule,
+    input.responseNonce
+  );
+  return (0, import_hkdf.hkdf)(import_sha2.sha256, ikm, salt, info, CCE_AES_KEY_BYTES);
+}
+function deriveWitnessKey(input) {
+  const ikm = (0, import_utils.hexToBytes)(input.axisLocalSecret);
+  const salt = buildSalt(
+    input.capsule.capsule_id,
+    input.capsule.capsule_nonce,
+    input.requestNonce
+  );
+  const info = buildInfo(CCE_DERIVATION.WITNESS, input.capsule);
+  return (0, import_hkdf.hkdf)(import_sha2.sha256, ikm, salt, info, CCE_AES_KEY_BYTES);
+}
+function buildExecutionContext(input, requestId) {
+  const executionKey = deriveRequestExecutionKey(input);
+  const keyHash = (0, import_utils.bytesToHex)((0, import_sha2.sha256)(executionKey));
+  executionKey.fill(0);
+  return {
+    execution_key_hash: keyHash,
+    request_id: requestId,
+    capsule_id: input.capsule.capsule_id,
+    sub: input.capsule.sub,
+    kid: input.capsule.kid,
+    intent: input.capsule.intent,
+    aud: input.capsule.aud,
+    tps_from: input.capsule.tps_from,
+    tps_to: input.capsule.tps_to,
+    policy_hash: input.capsule.policy_hash,
+    derived_at: Math.floor(Date.now() / 1e3),
+    valid: true
+  };
+}
+function generateCceNonce() {
+  const bytes = new Uint8Array(CCE_NONCE_BYTES);
+  crypto.getRandomValues(bytes);
+  return (0, import_utils.bytesToHex)(bytes);
+}
+
+// src/cce/cce-crypto.ts
+var import_utils2 = require("@noble/hashes/utils.js");
+var import_sha22 = require("@noble/hashes/sha2.js");
+var import_crypto = require("crypto");
+function aesGcmEncrypt(key, plaintext, aad) {
+  if (key.length !== CCE_AES_KEY_BYTES) {
+    throw new Error(`AES key must be ${CCE_AES_KEY_BYTES} bytes`);
+  }
+  const iv = (0, import_crypto.randomBytes)(CCE_IV_BYTES);
+  const cipher = (0, import_crypto.createCipheriv)("aes-256-gcm", key, iv);
+  if (aad) {
+    cipher.setAAD(aad);
+  }
+  const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    iv: new Uint8Array(iv),
+    ciphertext: new Uint8Array(encrypted),
+    tag: new Uint8Array(tag)
+  };
+}
+function aesGcmDecrypt(key, iv, ciphertext, tag, aad) {
+  if (key.length !== CCE_AES_KEY_BYTES) {
+    throw new Error(`AES key must be ${CCE_AES_KEY_BYTES} bytes`);
+  }
+  if (iv.length !== CCE_IV_BYTES) {
+    throw new Error(`IV must be ${CCE_IV_BYTES} bytes`);
+  }
+  if (tag.length !== CCE_TAG_BYTES) {
+    throw new Error(`Tag must be ${CCE_TAG_BYTES} bytes`);
+  }
+  try {
+    const decipher = (0, import_crypto.createDecipheriv)("aes-256-gcm", key, iv);
+    decipher.setAuthTag(tag);
+    if (aad) {
+      decipher.setAAD(aad);
+    }
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final()
+    ]);
+    return new Uint8Array(decrypted);
+  } catch {
+    return null;
+  }
+}
+function generateAesKey() {
+  return new Uint8Array((0, import_crypto.randomBytes)(CCE_AES_KEY_BYTES));
+}
+function generateIv() {
+  return new Uint8Array((0, import_crypto.randomBytes)(CCE_IV_BYTES));
+}
+function base64UrlEncode(bytes) {
+  return Buffer.from(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = "=".repeat((4 - base64.length % 4) % 4);
+  return new Uint8Array(Buffer.from(base64 + padding, "base64"));
+}
+function hashPayload(payload) {
+  return (0, import_utils2.bytesToHex)((0, import_sha22.sha256)(payload));
+}
+var nodeAesGcmProvider = {
+  async decrypt(key, iv, ciphertext, tag, aad) {
+    return aesGcmDecrypt(key, iv, ciphertext, tag, aad);
+  }
+};
+
+// src/cce/cce-response.service.ts
+var import_utils3 = require("@noble/hashes/utils.js");
+var import_crypto2 = require("crypto");
+async function buildCceResponse(options, clientKeyEncryptor, axisSigner) {
+  const { request, capsule, status, body, clientPublicKeyHex, witnessRef } = options;
+  const responseNonce = (0, import_utils3.bytesToHex)(
+    new Uint8Array((0, import_crypto2.randomBytes)(CCE_NONCE_BYTES))
+  );
+  const responseId = generateResponseId();
+  const aesKey = generateAesKey();
+  const aad = buildResponseAad(
+    request.request_id,
+    responseId,
+    request.correlation_id,
+    capsule.capsule_id,
+    responseNonce
+  );
+  const { iv, ciphertext, tag } = aesGcmEncrypt(aesKey, body, aad);
+  const encryptedKey = await clientKeyEncryptor.wrapKey(
+    aesKey,
+    request.client_kid,
+    clientPublicKeyHex
+  );
+  aesKey.fill(0);
+  const encryptedPayload = {
+    alg: "AES-256-GCM",
+    iv: base64UrlEncode(iv),
+    ciphertext: base64UrlEncode(ciphertext),
+    tag: base64UrlEncode(tag)
+  };
+  const algorithms = {
+    kem: encryptedKey.alg,
+    enc: "AES-256-GCM",
+    kdf: "HKDF-SHA256",
+    sig: "EdDSA"
+  };
+  const unsignedResponse = {
+    ver: CCE_PROTOCOL_VERSION,
+    response_id: responseId,
+    request_id: request.request_id,
+    correlation_id: request.correlation_id,
+    capsule_id: capsule.capsule_id,
+    encrypted_key: encryptedKey,
+    encrypted_payload: encryptedPayload,
+    response_nonce: responseNonce,
+    algorithms,
+    status,
+    ...witnessRef ? { witness_ref: witnessRef } : {}
+  };
+  const signPayload = new TextEncoder().encode(canonicalize(unsignedResponse));
+  const axisSig = await axisSigner.sign(signPayload);
+  const envelope = {
+    ...unsignedResponse,
+    axis_sig: axisSig
+  };
+  return {
+    envelope,
+    responsePayloadHash: hashPayload(body)
+  };
+}
+function buildCceErrorResponse(requestId, correlationId, status, errorCode, message) {
+  return {
+    ver: CCE_PROTOCOL_VERSION,
+    request_id: requestId,
+    correlation_id: correlationId,
+    status,
+    error: { code: errorCode, message }
+  };
+}
+function generateResponseId() {
+  const bytes = (0, import_crypto2.randomBytes)(16);
+  return "resp_" + (0, import_utils3.bytesToHex)(new Uint8Array(bytes)).slice(0, 24);
+}
+function buildResponseAad(requestId, responseId, correlationId, capsuleId, responseNonce) {
+  const parts = [
+    requestId,
+    responseId,
+    correlationId,
+    capsuleId,
+    responseNonce
+  ];
+  return new TextEncoder().encode(parts.join("|"));
+}
+function canonicalize(obj) {
+  if (Array.isArray(obj)) {
+    return "[" + obj.map(canonicalize).join(",") + "]";
+  }
+  if (obj !== null && typeof obj === "object") {
+    const sorted = Object.keys(obj).sort().map(
+      (k) => JSON.stringify(k) + ":" + canonicalize(obj[k])
+    );
+    return "{" + sorted.join(",") + "}";
+  }
+  return JSON.stringify(obj);
+}
+
+// src/cce/cce-witness.observer.ts
+var import_utils4 = require("@noble/hashes/utils.js");
+var import_hkdf2 = require("@noble/hashes/hkdf.js");
+var import_sha23 = require("@noble/hashes/sha2.js");
+var InMemoryCceWitnessStore = class {
+  constructor() {
+    this.records = [];
+  }
+  async record(witness) {
+    this.records.push(witness);
+  }
+  getByRequestId(requestId) {
+    return this.records.find((w) => w.request_id === requestId);
+  }
+  getByCapsuleId(capsuleId) {
+    return this.records.filter((w) => w.capsule_id === capsuleId);
+  }
+};
+function buildWitnessRecord(envelope, capsule, verification, execution, options) {
+  const witnessId = generateWitnessId(envelope.request_id, capsule.capsule_id);
+  const executionContextHash = computeExecutionContextHash(
+    options.axisLocalSecret,
+    capsule,
+    envelope.request_nonce
+  );
+  return {
+    witness_id: witnessId,
+    request_id: envelope.request_id,
+    capsule_id: capsule.capsule_id,
+    sub: capsule.sub,
+    intent: capsule.intent,
+    aud: capsule.aud,
+    tps_from: capsule.tps_from,
+    tps_to: capsule.tps_to,
+    timestamp: Math.floor(Date.now() / 1e3),
+    verification: {
+      client_sig: verification.clientSigVerified,
+      capsule_sig: verification.capsuleSigVerified,
+      tps_valid: verification.tpsValid,
+      audience_match: verification.audienceMatch,
+      intent_match: verification.intentMatch,
+      replay_clean: verification.replayClean,
+      nonce_unique: verification.nonceUnique,
+      decryption_ok: verification.decryptionOk
+    },
+    execution: {
+      status: execution.status,
+      handler_duration_ms: execution.handlerDurationMs,
+      ...execution.effect ? { effect: execution.effect } : {}
+    },
+    response_encrypted: options.responseEncrypted,
+    execution_context_hash: executionContextHash,
+    ...options.requestPayload ? { request_payload_hash: hashPayload(options.requestPayload) } : {},
+    ...options.responsePayload ? { response_payload_hash: hashPayload(options.responsePayload) } : {}
+  };
+}
+function extractVerificationState(metadata) {
+  return {
+    clientSigVerified: metadata.cceClientSigVerified === true,
+    capsuleSigVerified: metadata.cceCapsuleVerified === true,
+    tpsValid: metadata.cceTpsValid === true,
+    audienceMatch: metadata.cceBindingVerified === true,
+    intentMatch: metadata.cceBindingVerified === true,
+    replayClean: metadata.cceReplayClean === true,
+    nonceUnique: metadata.cceReplayClean === true,
+    decryptionOk: metadata.cceDecryptionOk === true
+  };
+}
+function generateWitnessId(requestId, capsuleId) {
+  const input = `witness:${requestId}:${capsuleId}:${Date.now()}`;
+  const hash = (0, import_sha23.sha256)(new TextEncoder().encode(input));
+  return "wit_" + (0, import_utils4.bytesToHex)(hash).slice(0, 24);
+}
+function computeExecutionContextHash(axisLocalSecret, capsule, requestNonce) {
+  const encoder = new TextEncoder();
+  const ikm = hexToBytes2(axisLocalSecret);
+  const salt = (0, import_sha23.sha256)(
+    encoder.encode(
+      capsule.capsule_id + "|" + capsule.capsule_nonce + "|" + requestNonce
+    )
+  );
+  const info = encoder.encode(
+    [
+      CCE_DERIVATION.WITNESS,
+      capsule.sub,
+      capsule.kid,
+      capsule.intent,
+      capsule.aud,
+      String(capsule.tps_from),
+      String(capsule.tps_to),
+      capsule.policy_hash ?? "",
+      capsule.ver
+    ].join("|")
+  );
+  const witnessKey = (0, import_hkdf2.hkdf)(import_sha23.sha256, ikm, salt, info, 32);
+  const hash = (0, import_utils4.bytesToHex)((0, import_sha23.sha256)(witnessKey));
+  witnessKey.fill(0);
+  return hash;
+}
+function hexToBytes2(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+// src/sensor/axis-sensor.ts
+function normalizeSensorDecision(sensorDecision) {
+  if ("action" in sensorDecision) {
+    switch (sensorDecision.action) {
+      case "ALLOW":
+        return {
+          allow: true,
+          riskScore: 0,
+          reasons: [],
+          meta: sensorDecision.meta
+        };
+      case "DENY":
+        return {
+          allow: false,
+          riskScore: 100,
+          reasons: [sensorDecision.code, sensorDecision.reason].filter(
+            Boolean
+          ),
+          meta: sensorDecision.meta,
+          retryAfterMs: sensorDecision.retryAfterMs
+        };
+      case "THROTTLE":
+        return {
+          allow: false,
+          riskScore: 50,
+          reasons: ["RATE_LIMIT"],
+          retryAfterMs: sensorDecision.retryAfterMs,
+          meta: sensorDecision.meta
+        };
+      case "FLAG":
+        return {
+          allow: true,
+          riskScore: sensorDecision.scoreDelta,
+          reasons: sensorDecision.reasons,
+          meta: sensorDecision.meta
+        };
+    }
+  }
+  return {
+    allow: sensorDecision.allow,
+    riskScore: sensorDecision.riskScore,
+    reasons: sensorDecision.reasons,
+    tags: sensorDecision.tags,
+    meta: sensorDecision.meta,
+    tighten: sensorDecision.tighten,
+    retryAfterMs: sensorDecision.retryAfterMs
+  };
+}
+
+// src/cce/cce-pipeline.ts
+async function executeCcePipeline(envelope, config) {
+  const startTime = Date.now();
+  if (envelope.ver !== CCE_PROTOCOL_VERSION) {
+    return {
+      ok: false,
+      error: {
+        code: CCE_ERROR.UNSUPPORTED_VERSION,
+        message: `Unsupported version: ${envelope.ver}`
+      },
+      status: "ERROR"
+    };
+  }
+  const sensorInput = {
+    intent: envelope.capsule.intent,
+    metadata: {
+      cce: true,
+      cceEnvelope: envelope,
+      contentType: "application/axis-cce"
+    }
+  };
+  const sortedSensors = [...config.sensors].sort(
+    (a, b) => (a.order ?? 999) - (b.order ?? 999)
+  );
+  for (const sensor of sortedSensors) {
+    if (sensor.supports && !sensor.supports(sensorInput)) {
+      continue;
+    }
+    let decision;
+    try {
+      decision = await sensor.run(sensorInput);
+    } catch (err) {
+      return {
+        ok: false,
+        error: {
+          code: CCE_ERROR.DECRYPTION_FAILED,
+          message: `Sensor ${sensor.name} failed`
+        },
+        status: "ERROR"
+      };
+    }
+    const normalized = normalizeSensorDecision(decision);
+    if (!normalized.allow) {
+      const code = normalized.reasons[0]?.split(":")[0] ?? CCE_ERROR.DECRYPTION_FAILED;
+      return {
+        ok: false,
+        error: { code, message: normalized.reasons.join("; ") },
+        status: "DENIED"
+      };
+    }
+  }
+  const capsule = sensorInput.metadata?.cceCapsule;
+  const decryptedPayload = sensorInput.metadata?.cceDecryptedPayload;
+  const clientKey = sensorInput.metadata?.cceClientKey;
+  if (!capsule || !decryptedPayload || !clientKey) {
+    return {
+      ok: false,
+      error: {
+        code: CCE_ERROR.DECRYPTION_FAILED,
+        message: "Sensor chain did not produce required outputs"
+      },
+      status: "ERROR"
+    };
+  }
+  const derivationInput = {
+    axisLocalSecret: config.axisLocalSecret,
+    capsule,
+    requestNonce: envelope.request_nonce
+  };
+  const executionContext = buildExecutionContext(
+    derivationInput,
+    envelope.request_id
+  );
+  if (config.policyEvaluator) {
+    try {
+      const policyDecision = await config.policyEvaluator.evaluate({
+        envelope,
+        capsule,
+        executionContext,
+        decryptedPayload,
+        clientPublicKeyHex: clientKey.publicKeyHex
+      });
+      if (!policyDecision.allow) {
+        const verification2 = extractVerificationState(sensorInput.metadata ?? {});
+        const witness2 = buildWitnessRecord(
+          envelope,
+          capsule,
+          verification2,
+          {
+            status: "DENIED",
+            handlerDurationMs: 0,
+            effect: "policy_denied"
+          },
+          {
+            axisLocalSecret: config.axisLocalSecret,
+            requestPayload: decryptedPayload,
+            responseEncrypted: false
+          }
+        );
+        await config.witnessStore.record(witness2);
+        return {
+          ok: false,
+          error: {
+            code: policyDecision.code ?? CCE_ERROR.POLICY_DENIED,
+            message: policyDecision.message ?? "Request denied by policy evaluator"
+          },
+          status: "DENIED"
+        };
+      }
+    } catch (err) {
+      return {
+        ok: false,
+        error: {
+          code: CCE_ERROR.POLICY_DENIED,
+          message: "Policy evaluator failed"
+        },
+        status: "ERROR"
+      };
+    }
+  }
+  const handler = config.handlers.get(capsule.intent);
+  if (!handler) {
+    return {
+      ok: false,
+      error: {
+        code: CCE_ERROR.HANDLER_NOT_FOUND,
+        message: `No handler for intent: ${capsule.intent}`
+      },
+      status: "ERROR"
+    };
+  }
+  const handlerContext = {
+    capsule,
+    executionContext,
+    envelope,
+    clientPublicKeyHex: clientKey.publicKeyHex,
+    intent: capsule.intent,
+    sub: capsule.sub
+  };
+  let result;
+  const handlerStart = Date.now();
+  try {
+    result = await handler(decryptedPayload, handlerContext);
+  } catch (err) {
+    const handlerDuration2 = Date.now() - handlerStart;
+    const verification2 = extractVerificationState(sensorInput.metadata ?? {});
+    const witness2 = buildWitnessRecord(
+      envelope,
+      capsule,
+      verification2,
+      { status: "FAILED", handlerDurationMs: handlerDuration2 },
+      {
+        axisLocalSecret: config.axisLocalSecret,
+        requestPayload: decryptedPayload,
+        responseEncrypted: false
+      }
+    );
+    await config.witnessStore.record(witness2);
+    return {
+      ok: false,
+      error: {
+        code: CCE_ERROR.HANDLER_EXECUTION_FAILED,
+        message: "Handler execution failed"
+      },
+      status: "FAILED"
+    };
+  }
+  const handlerDuration = Date.now() - handlerStart;
+  let responseEnvelope;
+  let responsePayloadHash;
+  try {
+    const responseResult = await buildCceResponse(
+      {
+        request: envelope,
+        capsule,
+        status: result.status,
+        body: result.body,
+        clientPublicKeyHex: clientKey.publicKeyHex
+      },
+      config.clientKeyEncryptor,
+      config.axisSigner
+    );
+    responseEnvelope = responseResult.envelope;
+    responsePayloadHash = responseResult.responsePayloadHash;
+  } catch (err) {
+    return {
+      ok: false,
+      error: {
+        code: CCE_ERROR.RESPONSE_ENCRYPTION_FAILED,
+        message: "Response encryption failed"
+      },
+      status: "ERROR"
+    };
+  }
+  const verification = extractVerificationState(sensorInput.metadata ?? {});
+  const witness = buildWitnessRecord(
+    envelope,
+    capsule,
+    verification,
+    {
+      status: result.status,
+      handlerDurationMs: handlerDuration,
+      effect: result.effect
+    },
+    {
+      axisLocalSecret: config.axisLocalSecret,
+      requestPayload: decryptedPayload,
+      responsePayload: result.body,
+      responseEncrypted: true
+    }
+  );
+  await config.witnessStore.record(witness);
+  return {
+    ok: true,
+    response: responseEnvelope,
+    witnessId: witness.witness_id
+  };
+}
+
+// src/cce/sensors/cce-envelope-validation.sensor.ts
+var REQUIRED_FIELDS = [
+  "ver",
+  "request_id",
+  "correlation_id",
+  "client_kid",
+  "capsule",
+  "encrypted_key",
+  "encrypted_payload",
+  "request_nonce",
+  "client_sig",
+  "content_type",
+  "algorithms"
+];
+var CceEnvelopeValidationSensor = class {
+  constructor() {
+    this.name = "cce.envelope.validation";
+    this.order = 5;
+    this.phase = "PRE_DECODE";
+  }
+  supports(input) {
+    return input.metadata?.cce === true || input.metadata?.contentType === "application/axis-cce";
+  }
+  async run(input) {
+    const envelope = input.metadata?.cceEnvelope;
+    if (!envelope) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.INVALID_ENVELOPE],
+        code: CCE_ERROR.INVALID_ENVELOPE
+      };
+    }
+    for (const field of REQUIRED_FIELDS) {
+      if (envelope[field] === void 0 || envelope[field] === null) {
+        return {
+          allow: false,
+          riskScore: 100,
+          reasons: [`${CCE_ERROR.INVALID_ENVELOPE}: missing ${field}`],
+          code: CCE_ERROR.INVALID_ENVELOPE
+        };
+      }
+    }
+    if (envelope.ver !== CCE_PROTOCOL_VERSION) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.UNSUPPORTED_VERSION}: ${envelope.ver}`],
+        code: CCE_ERROR.UNSUPPORTED_VERSION
+      };
+    }
+    if (!/^[0-9a-f]+$/i.test(envelope.request_nonce)) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.INVALID_ENVELOPE}: invalid request_nonce format`
+        ],
+        code: CCE_ERROR.INVALID_ENVELOPE
+      };
+    }
+    if (envelope.request_nonce.length !== CCE_NONCE_BYTES * 2) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.INVALID_ENVELOPE}: request_nonce wrong length`],
+        code: CCE_ERROR.INVALID_ENVELOPE
+      };
+    }
+    const capsule = envelope.capsule;
+    if (!capsule.capsule_id || !capsule.ver || !capsule.sub || !capsule.kid || !capsule.intent || !capsule.aud || !capsule.issuer_sig) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.MISSING_CAPSULE}: incomplete capsule claims`],
+        code: CCE_ERROR.MISSING_CAPSULE
+      };
+    }
+    if (!envelope.encrypted_key.ciphertext || !envelope.encrypted_key.alg) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.MISSING_ENCRYPTED_KEY}: incomplete encrypted_key`
+        ],
+        code: CCE_ERROR.MISSING_ENCRYPTED_KEY
+      };
+    }
+    input.metadata = input.metadata ?? {};
+    input.metadata.cceEnvelopeValid = true;
+    return {
+      decision: "ALLOW" /* ALLOW */,
+      allow: true,
+      riskScore: 0,
+      reasons: []
+    };
+  }
+};
+
+// src/cce/sensors/cce-client-signature.sensor.ts
+var CceClientSignatureSensor = class {
+  constructor(keyResolver, signatureVerifier) {
+    this.keyResolver = keyResolver;
+    this.signatureVerifier = signatureVerifier;
+    this.name = "cce.client.signature";
+    this.order = 45;
+    this.phase = "POST_DECODE";
+  }
+  supports(input) {
+    return input.metadata?.cceEnvelopeValid === true;
+  }
+  async run(input) {
+    const envelope = input.metadata?.cceEnvelope;
+    if (!envelope) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.INVALID_ENVELOPE],
+        code: CCE_ERROR.INVALID_ENVELOPE
+      };
+    }
+    const keyRecord = await this.keyResolver.resolve(envelope.client_kid);
+    if (!keyRecord) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.CLIENT_KEY_NOT_FOUND}: kid=${envelope.client_kid}`
+        ],
+        code: CCE_ERROR.CLIENT_KEY_NOT_FOUND
+      };
+    }
+    const { client_sig, ...signable } = envelope;
+    const canonical = canonicalize2(signable);
+    const message = new TextEncoder().encode(canonical);
+    const valid = await this.signatureVerifier.verify(
+      message,
+      client_sig.value,
+      keyRecord.publicKeyHex,
+      keyRecord.alg
+    );
+    if (!valid) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.CLIENT_SIG_INVALID],
+        code: CCE_ERROR.CLIENT_SIG_INVALID
+      };
+    }
+    input.metadata = input.metadata ?? {};
+    input.metadata.cceClientKey = keyRecord;
+    input.metadata.cceClientSigVerified = true;
+    return {
+      decision: "ALLOW" /* ALLOW */,
+      allow: true,
+      riskScore: 0,
+      reasons: [],
+      meta: { kid: envelope.client_kid }
+    };
+  }
+};
+function canonicalize2(obj) {
+  if (Array.isArray(obj)) {
+    return "[" + obj.map(canonicalize2).join(",") + "]";
+  }
+  if (obj !== null && typeof obj === "object") {
+    const sorted = Object.keys(obj).sort().map(
+      (k) => JSON.stringify(k) + ":" + canonicalize2(obj[k])
+    );
+    return "{" + sorted.join(",") + "}";
+  }
+  return JSON.stringify(obj);
+}
+
+// src/cce/sensors/cce-capsule-verification.sensor.ts
+var import_blake3 = require("@noble/hashes/blake3.js");
+var import_utils5 = require("@noble/hashes/utils.js");
+var CceCapsuleVerificationSensor = class {
+  constructor(issuerKeyResolver, capsuleVerifier) {
+    this.issuerKeyResolver = issuerKeyResolver;
+    this.capsuleVerifier = capsuleVerifier;
+    this.name = "cce.capsule.verification";
+    this.order = 50;
+    this.phase = "POST_DECODE";
+  }
+  supports(input) {
+    return input.metadata?.cceEnvelopeValid === true;
+  }
+  async run(input) {
+    const capsule = input.metadata?.cceEnvelope?.capsule;
+    if (!capsule) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.MISSING_CAPSULE],
+        code: CCE_ERROR.MISSING_CAPSULE
+      };
+    }
+    if (capsule.ver !== CCE_PROTOCOL_VERSION) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.CAPSULE_SIG_INVALID}: wrong version ${capsule.ver}`
+        ],
+        code: CCE_ERROR.CAPSULE_SIG_INVALID
+      };
+    }
+    const { capsule_id, issuer_sig, ...claimsBody } = capsule;
+    const expectedId = computeCceCapsuleId(claimsBody);
+    if (capsule_id !== expectedId) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.CAPSULE_SIG_INVALID}: content hash mismatch`],
+        code: CCE_ERROR.CAPSULE_SIG_INVALID
+      };
+    }
+    const issuerKey = await this.issuerKeyResolver.resolve(
+      capsule.issuer_sig.kid
+    );
+    if (!issuerKey) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.CAPSULE_SIG_INVALID}: issuer key not found`],
+        code: CCE_ERROR.CAPSULE_SIG_INVALID
+      };
+    }
+    const { issuer_sig: sig, ...rest } = capsule;
+    const sigValid = await this.capsuleVerifier.verify(
+      rest,
+      sig,
+      issuerKey.publicKeyHex
+    );
+    if (!sigValid) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.CAPSULE_SIG_INVALID],
+        code: CCE_ERROR.CAPSULE_SIG_INVALID
+      };
+    }
+    const nowSeconds = Math.floor(Date.now() / 1e3);
+    if (capsule.exp < nowSeconds) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.CAPSULE_EXPIRED}: exp=${capsule.exp}`],
+        code: CCE_ERROR.CAPSULE_EXPIRED
+      };
+    }
+    if (capsule.iat > nowSeconds + 5) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.CAPSULE_NOT_YET_VALID}: iat=${capsule.iat}`],
+        code: CCE_ERROR.CAPSULE_NOT_YET_VALID
+      };
+    }
+    input.metadata = input.metadata ?? {};
+    input.metadata.cceCapsuleVerified = true;
+    input.metadata.cceCapsule = capsule;
+    return {
+      decision: "ALLOW" /* ALLOW */,
+      allow: true,
+      riskScore: 0,
+      reasons: [],
+      meta: { capsule_id: capsule.capsule_id }
+    };
+  }
+};
+function canonicalize3(obj) {
+  if (Array.isArray(obj)) {
+    return "[" + obj.map(canonicalize3).join(",") + "]";
+  }
+  if (obj !== null && typeof obj === "object") {
+    const sorted = Object.keys(obj).sort().map(
+      (k) => JSON.stringify(k) + ":" + canonicalize3(obj[k])
+    );
+    return "{" + sorted.join(",") + "}";
+  }
+  return JSON.stringify(obj);
+}
+function computeCceCapsuleId(claims) {
+  const canonical = canonicalize3(claims);
+  const hash = (0, import_blake3.blake3)(new TextEncoder().encode(canonical));
+  return "cce_b3_" + (0, import_utils5.bytesToHex)(hash).slice(0, 32);
+}
+
+// src/cce/sensors/cce-tps-window.sensor.ts
+var DEFAULT_SKEW_MS = 5e3;
+var CceTpsWindowSensor = class {
+  constructor(skewMs = DEFAULT_SKEW_MS) {
+    this.skewMs = skewMs;
+    this.name = "cce.tps.window";
+    this.order = 92;
+    this.phase = "POST_DECODE";
+  }
+  supports(input) {
+    return input.metadata?.cceCapsuleVerified === true;
+  }
+  async run(input) {
+    const capsule = input.metadata?.cceCapsule;
+    if (!capsule) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.MISSING_CAPSULE],
+        code: CCE_ERROR.MISSING_CAPSULE
+      };
+    }
+    const nowMs = Date.now();
+    if (nowMs > capsule.tps_to + this.skewMs) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.TPS_WINDOW_EXPIRED}: window ended at ${capsule.tps_to}, now=${nowMs}`
+        ],
+        code: CCE_ERROR.TPS_WINDOW_EXPIRED
+      };
+    }
+    if (nowMs < capsule.tps_from - this.skewMs) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.TPS_WINDOW_FUTURE}: window starts at ${capsule.tps_from}, now=${nowMs}`
+        ],
+        code: CCE_ERROR.TPS_WINDOW_FUTURE
+      };
+    }
+    input.metadata = input.metadata ?? {};
+    input.metadata.cceTpsValid = true;
+    return {
+      decision: "ALLOW" /* ALLOW */,
+      allow: true,
+      riskScore: 0,
+      reasons: []
+    };
+  }
+};
+
+// src/cce/sensors/cce-audience-intent-binding.sensor.ts
+var CceAudienceIntentBindingSensor = class {
+  constructor(axisAudience) {
+    this.axisAudience = axisAudience;
+    this.name = "cce.audience.intent.binding";
+    this.order = 95;
+    this.phase = "POST_DECODE";
+  }
+  supports(input) {
+    return input.metadata?.cceCapsuleVerified === true;
+  }
+  async run(input) {
+    const capsule = input.metadata?.cceCapsule;
+    const envelope = input.metadata?.cceEnvelope;
+    if (!capsule || !envelope) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.MISSING_CAPSULE],
+        code: CCE_ERROR.MISSING_CAPSULE
+      };
+    }
+    if (capsule.aud !== this.axisAudience) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.AUDIENCE_MISMATCH}: capsule.aud=${capsule.aud}, expected=${this.axisAudience}`
+        ],
+        code: CCE_ERROR.AUDIENCE_MISMATCH
+      };
+    }
+    const requestIntent = input.intent ?? input.metadata?.cceRequestIntent;
+    if (requestIntent && capsule.intent !== requestIntent) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.INTENT_MISMATCH}: capsule.intent=${capsule.intent}, request=${requestIntent}`
+        ],
+        code: CCE_ERROR.INTENT_MISMATCH
+      };
+    }
+    if (envelope.client_kid !== capsule.kid) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.INTENT_MISMATCH}: envelope.kid=${envelope.client_kid}, capsule.kid=${capsule.kid}`
+        ],
+        code: CCE_ERROR.INTENT_MISMATCH
+      };
+    }
+    input.metadata = input.metadata ?? {};
+    input.metadata.cceBindingVerified = true;
+    return {
+      decision: "ALLOW" /* ALLOW */,
+      allow: true,
+      riskScore: 0,
+      reasons: []
+    };
+  }
+};
+
+// src/cce/sensors/cce-replay-protection.sensor.ts
+var InMemoryCceReplayStore = class {
+  constructor() {
+    this.nonces = /* @__PURE__ */ new Map();
+    this.consumed = /* @__PURE__ */ new Set();
+    this.revoked = /* @__PURE__ */ new Set();
+  }
+  async checkAndMark(key, ttlMs) {
+    this.cleanup();
+    if (this.nonces.has(key)) return false;
+    this.nonces.set(key, Date.now() + ttlMs);
+    return true;
+  }
+  async isCapsuleConsumed(capsuleId) {
+    return this.consumed.has(capsuleId);
+  }
+  async markCapsuleConsumed(capsuleId, _ttlMs) {
+    this.consumed.add(capsuleId);
+  }
+  async isCapsuleRevoked(capsuleId) {
+    return this.revoked.has(capsuleId);
+  }
+  /** Revoke a capsule (for testing/admin) */
+  revoke(capsuleId) {
+    this.revoked.add(capsuleId);
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [key, expiresAt] of this.nonces) {
+      if (expiresAt < now) this.nonces.delete(key);
+    }
+  }
+};
+var CceReplayProtectionSensor = class {
+  constructor(replayStore, options) {
+    this.replayStore = replayStore;
+    this.name = "cce.replay.protection";
+    this.order = 98;
+    this.phase = "POST_DECODE";
+    this.nonceTtlMs = options?.nonceTtlMs ?? 5 * 60 * 1e3;
+  }
+  supports(input) {
+    return input.metadata?.cceCapsuleVerified === true;
+  }
+  async run(input) {
+    const capsule = input.metadata?.cceCapsule;
+    const envelope = input.metadata?.cceEnvelope;
+    if (!capsule || !envelope) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.MISSING_CAPSULE],
+        code: CCE_ERROR.MISSING_CAPSULE
+      };
+    }
+    const revoked = await this.replayStore.isCapsuleRevoked(capsule.capsule_id);
+    if (revoked) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.CAPSULE_REVOKED}: ${capsule.capsule_id}`],
+        code: CCE_ERROR.CAPSULE_REVOKED
+      };
+    }
+    if (capsule.mode === "SINGLE_USE") {
+      const consumed = await this.replayStore.isCapsuleConsumed(
+        capsule.capsule_id
+      );
+      if (consumed) {
+        return {
+          allow: false,
+          riskScore: 100,
+          reasons: [`${CCE_ERROR.CAPSULE_CONSUMED}: ${capsule.capsule_id}`],
+          code: CCE_ERROR.CAPSULE_CONSUMED
+        };
+      }
+    }
+    const nonceKey = `cce:nonce:${capsule.sub}:${capsule.aud}:${capsule.intent}:${envelope.request_nonce}`;
+    const nonceValid = await this.replayStore.checkAndMark(
+      nonceKey,
+      this.nonceTtlMs
+    );
+    if (!nonceValid) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.NONCE_REUSED}: ${envelope.request_nonce.slice(0, 16)}...`
+        ],
+        code: CCE_ERROR.NONCE_REUSED
+      };
+    }
+    if (capsule.mode === "SINGLE_USE") {
+      const capsuleTtl = (capsule.exp - capsule.iat) * 1e3 + 6e4;
+      await this.replayStore.markCapsuleConsumed(
+        capsule.capsule_id,
+        capsuleTtl
+      );
+    }
+    input.metadata = input.metadata ?? {};
+    input.metadata.cceReplayClean = true;
+    return {
+      decision: "ALLOW" /* ALLOW */,
+      allow: true,
+      riskScore: 0,
+      reasons: []
+    };
+  }
+};
+
+// src/cce/sensors/cce-payload-decryption.sensor.ts
+var CcePayloadDecryptionSensor = class {
+  constructor(keyProvider, aesProvider, maxPayloadBytes = 64 * 1024, payloadValidator) {
+    this.keyProvider = keyProvider;
+    this.aesProvider = aesProvider;
+    this.maxPayloadBytes = maxPayloadBytes;
+    this.payloadValidator = payloadValidator;
+    this.name = "cce.payload.decryption";
+    this.order = 145;
+    this.phase = "POST_DECODE";
+  }
+  supports(input) {
+    return input.metadata?.cceEnvelopeValid === true && input.metadata?.cceClientSigVerified === true && input.metadata?.cceCapsuleVerified === true && input.metadata?.cceReplayClean === true;
+  }
+  async run(input) {
+    const envelope = input.metadata?.cceEnvelope;
+    if (!envelope) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.INVALID_ENVELOPE],
+        code: CCE_ERROR.INVALID_ENVELOPE
+      };
+    }
+    let aesKey;
+    try {
+      aesKey = await this.keyProvider.unwrapKey(
+        envelope.encrypted_key.ciphertext,
+        envelope.encrypted_key.alg,
+        envelope.encrypted_key.axis_kid,
+        envelope.encrypted_key.ephemeral_pk
+      );
+    } catch {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.KEY_UNWRAP_FAILED],
+        code: CCE_ERROR.KEY_UNWRAP_FAILED
+      };
+    }
+    if (!aesKey) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.KEY_UNWRAP_FAILED],
+        code: CCE_ERROR.KEY_UNWRAP_FAILED
+      };
+    }
+    let iv;
+    let ciphertext;
+    let tag;
+    try {
+      iv = base64UrlDecode2(envelope.encrypted_payload.iv);
+      ciphertext = base64UrlDecode2(envelope.encrypted_payload.ciphertext);
+      tag = base64UrlDecode2(envelope.encrypted_payload.tag);
+    } catch {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [`${CCE_ERROR.DECRYPTION_FAILED}: invalid base64url encoding`],
+        code: CCE_ERROR.DECRYPTION_FAILED
+      };
+    }
+    if (ciphertext.length > this.maxPayloadBytes) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [
+          `${CCE_ERROR.PAYLOAD_TOO_LARGE}: ${ciphertext.length} > ${this.maxPayloadBytes}`
+        ],
+        code: CCE_ERROR.PAYLOAD_TOO_LARGE
+      };
+    }
+    const aad = buildAad(envelope);
+    let plaintext;
+    try {
+      plaintext = await this.aesProvider.decrypt(
+        aesKey,
+        iv,
+        ciphertext,
+        tag,
+        aad
+      );
+    } catch {
+      plaintext = null;
+    } finally {
+      aesKey.fill(0);
+    }
+    if (!plaintext) {
+      return {
+        allow: false,
+        riskScore: 100,
+        reasons: [CCE_ERROR.AEAD_TAG_MISMATCH],
+        code: CCE_ERROR.AEAD_TAG_MISMATCH
+      };
+    }
+    const capsule = input.metadata?.cceCapsule;
+    if (capsule && isJsonContentType(envelope.content_type)) {
+      const parsed = tryParseJsonObject(plaintext);
+      if (parsed && typeof parsed.intent === "string") {
+        if (parsed.intent !== capsule.intent) {
+          return {
+            allow: false,
+            riskScore: 100,
+            reasons: [
+              `${CCE_ERROR.INTENT_SCHEMA_MISMATCH}: payload.intent=${parsed.intent}, capsule.intent=${capsule.intent}`
+            ],
+            code: CCE_ERROR.INTENT_SCHEMA_MISMATCH
+          };
+        }
+        input.metadata = input.metadata ?? {};
+        input.metadata.cceRequestIntent = parsed.intent;
+      }
+    }
+    if (this.payloadValidator) {
+      const verdict = await this.payloadValidator.validate(plaintext, envelope);
+      if (!verdict.ok) {
+        const code = verdict.code ?? CCE_ERROR.PAYLOAD_SCHEMA_INVALID;
+        return {
+          allow: false,
+          riskScore: 100,
+          reasons: [verdict.reason ?? code],
+          code
+        };
+      }
+      if (verdict.intent) {
+        input.metadata = input.metadata ?? {};
+        input.metadata.cceRequestIntent = verdict.intent;
+      }
+    }
+    input.metadata = input.metadata ?? {};
+    input.metadata.cceDecryptedPayload = plaintext;
+    input.metadata.cceDecryptionOk = true;
+    return {
+      decision: "ALLOW" /* ALLOW */,
+      allow: true,
+      riskScore: 0,
+      reasons: []
+    };
+  }
+};
+function buildAad(envelope) {
+  const parts = [
+    envelope.ver,
+    envelope.request_id,
+    envelope.correlation_id,
+    envelope.client_kid,
+    envelope.capsule.capsule_id,
+    envelope.capsule.intent,
+    envelope.capsule.aud,
+    envelope.request_nonce
+  ];
+  return new TextEncoder().encode(parts.join("|"));
+}
+function isJsonContentType(contentType) {
+  return typeof contentType === "string" && contentType.toLowerCase().includes("application/json");
+}
+function tryParseJsonObject(payload) {
+  try {
+    const parsed = JSON.parse(new TextDecoder().decode(payload));
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function base64UrlDecode2(input) {
+  const base64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padding = "=".repeat((4 - base64.length % 4) % 4);
+  return new Uint8Array(Buffer.from(base64 + padding, "base64"));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CCE_AES_KEY_BYTES,
+  CCE_DERIVATION,
+  CCE_ERROR,
+  CCE_IV_BYTES,
+  CCE_NONCE_BYTES,
+  CCE_PROTOCOL_VERSION,
+  CCE_TAG_BYTES,
+  CceAudienceIntentBindingSensor,
+  CceCapsuleVerificationSensor,
+  CceClientSignatureSensor,
+  CceEnvelopeValidationSensor,
+  CceError,
+  CcePayloadDecryptionSensor,
+  CceReplayProtectionSensor,
+  CceTpsWindowSensor,
+  InMemoryCceReplayStore,
+  InMemoryCceWitnessStore,
+  aesGcmDecrypt,
+  aesGcmEncrypt,
+  base64UrlDecode,
+  base64UrlEncode,
+  buildCceErrorResponse,
+  buildCceResponse,
+  buildExecutionContext,
+  buildWitnessRecord,
+  deriveRequestExecutionKey,
+  deriveResponseExecutionKey,
+  deriveWitnessKey,
+  executeCcePipeline,
+  extractVerificationState,
+  generateAesKey,
+  generateCceNonce,
+  generateIv,
+  hashPayload,
+  nodeAesGcmProvider
+});
+//# sourceMappingURL=index.js.map