@nifrajs/core 1.13.0 → 2.1.0

package/README.md

@@ -9,7 +9,7 @@ bun add @nifrajs/core
 ```
 
 ```ts
-import { server } from "@nifrajs/core"
+import { server } from "@nifrajs/core/server"
 
 const app = server()
   .get("/users/:id", (c) => ({ id: c.params.id }))
@@ -19,6 +19,15 @@ const app = server()
 export type App = typeof app // hand this to @nifrajs/client for end-to-end types
 ```
 
+`@nifrajs/core` and `@nifrajs/core/server` expose the same lean common runtime. Optional systems are
+available only from their explicit subpaths, so an ordinary HTTP server never evaluates them:
+
+```ts
+import { defineContract, implement } from "@nifrajs/core/contract"
+import { startCausality } from "@nifrajs/core/causality"
+import { defineAssurancePolicy } from "@nifrajs/core/assurance"
+```
+
 - **Inline or contract-first.** Write routes inline (types inferred from the
   builder), or `defineContract(...)` + `implement(...)` for a decoupled, versionable
   surface — handlers lift over unchanged.
@@ -39,6 +48,33 @@ export type App = typeof app // hand this to @nifrajs/client for end-to-end type
   IP-restriction, and security-header modules publish reflection-safe enforcement evidence.
   An ordered `AssurancePolicy` classifies every route and fails closed on missing or forbidden
   evidence without adding work to the request path.
+- **Owned effect execution.** `executeCapability()` correlates intent and terminal evidence with an
+  opaque `effectId`, records outcomes automatically, and forwards request cancellation. Add
+  order-scoped `aroundCapability()` policies for async approval/admission; they receive token-only
+  metadata, have bounded timeouts, and must call `next()` exactly once before the effect can run.
+- **Durable workflows (opt in).** `@nifrajs/core/durable-execution` provides tenant/principal-bound,
+  signed single-use approval resumes; a durable effect journal + reconciliation scanner; and a typed
+  saga state machine with reverse compensation, retry/backoff, and ambiguous-crash detection. Production
+  constructors reject stores that do not declare `durability: "durable"`. Operational scans use bounded
+  cursor pages through `reconcileEffectsPage()` / `reconcileSagasPage()`. Provider-confirmed manual
+  review uses effect-ID-bound `resolveAmbiguity()`, followed by `resume()` or `compensate()`.
+- **Production durable adapters.** `@nifrajs/core/durable-adapters` supplies
+  `PostgresDurableExecutionAdapter`, `SQLiteDurableExecutionAdapter`, and
+  `DurableObjectExecutionAdapter`. Each exposes compatible `effects`, `approvals`, `sagas`, and
+  `leases` stores. Run `runDurableExecutionAdapterConformance()` against the deployment backend.
+- **Bounded reconciliation workers.** `@nifrajs/core/reconciliation-worker` runs effect or saga
+  scans under an atomic lease with durable cursor checkpoints, a finite page budget, bounded handler
+  concurrency, filters, cancellation, and token-only metrics. A worker invocation always terminates.
+- **Rich wire values (opt in).** `@nifrajs/core/wire` round-trips dates, bigints, maps, sets, binary,
+  shared references, and cycles through JSON transports. Decoding validates every reachable shape,
+  preserves owned `__proto__` keys without prototype mutation, and enforces configurable node, depth,
+  collection-entry, and decoded-byte limits.
+- **Versioned transport codecs (opt in).** Add `.use(transportCodecs(registry))` from
+  `@nifrajs/core/transport-plugin` and configure the typed
+  client's `transport` option with the same registry. `@nifrajs/core/transport-codec` negotiates
+  bounded HTTP representations and supplies the same frame/loader adapters for WebSockets and
+  deferred data. Import `richWireCodec()` from `@nifrajs/core/transport-codec-rich`; the separate
+  subpath keeps rich-wire code out of plain JSON bundles.
 
 ```ts
 import { defineAssurancePolicy, evaluateRouteAssurance, NIFRA_ASSURANCE } from "@nifrajs/core/assurance"

package/dist/assurance.d.ts

@@ -5,12 +5,13 @@
 import { type CapabilityAssuranceReport, type CapabilityPolicy } from "./capabilities.js";
 import type { AssuranceDeclaration, AssuranceEvidence, AssuranceScope } from "./internal/route-assurance.js";
 import { withRouteAssurance } from "./internal/route-assurance.js";
-import type { InvariantExecutor } from "./invariants.js";
 import type { NifraManifestSigner } from "./manifest.js";
 import { type ReflectedRoute } from "./reflection.js";
 import type { Method } from "./router/router.js";
 export type { AssuranceDeclaration, AssuranceEvidence, AssuranceScope };
 export { withRouteAssurance };
+/** Isolated request executor used by adversarial contract verification. */
+export type InvariantExecutor = (request: Request) => Response | Promise<Response>;
 /** Canonical evidence ids emitted by Nifra's official middleware modules. */
 export declare const NIFRA_ASSURANCE: Readonly<{
     readonly AUTHENTICATED: "nifra.authenticated";
@@ -46,8 +47,16 @@ export interface AssurancePolicy {
     readonly unmatched?: "error" | "ignore";
     /** Default false: reject an empty reflected source so a wrong import cannot pass CI silently. */
     readonly allowEmpty?: boolean;
+    /**
+     * Default false. When true, a route matched by a **pure-classification** rule (no `require`, no `forbid`)
+     * that carries NO enforcement evidence is reported (`classified-no-evidence`). This surfaces the gap the
+     * feedback flagged: a classification-only policy silently degrades "proof" to a "label". Opt-in, because
+     * a genuinely public route legitimately carries no evidence; enable it once your guards emit evidence
+     * (inline `schema.assurance` or a `withRouteAssurance` middleware) to keep classification honest.
+     */
+    readonly flagClassifiedWithoutEvidence?: boolean;
 }
-export type AssuranceFindingCode = "no-routes" | "unclassified-route" | "missing-evidence" | "forbidden-evidence";
+export type AssuranceFindingCode = "no-routes" | "unclassified-route" | "missing-evidence" | "forbidden-evidence" | "classified-no-evidence";
 export interface AssuranceFinding {
     readonly code: AssuranceFindingCode;
     readonly method: string;

package/dist/assurance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assurance.d.ts","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EAEtB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAKL,kBAAkB,EACnB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AACxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,iBAAiB,CAAA;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAE7B,6EAA6E;AAC7E,eAAO,MAAM,eAAe;;;;;;;;;EAAsB,CAAA;AAElD,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,yCAAyC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACvC,iGAAiG;IACjG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,CAAA;AAExB,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAA;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAA;IACxC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,qCAAqC;QACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACtB,+EAA+E;QAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;KACzF,CAAA;IACD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;KACrC,CAAA;CACF;AAsBD,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CA2D9E;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CA4B9E;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,EACvD,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAOT;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,eAAe,GAC3B,eAAe,CAqEjB"}
+{"version":3,"file":"assurance.d.ts","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EAEtB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAKL,kBAAkB,EACnB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,iBAAiB,CAAA;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAEhD,YAAY,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAE7B,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAElF,6EAA6E;AAC7E,eAAO,MAAM,eAAe;;;;;;;;;EAAsB,CAAA;AAElD,MAAM,WAAW,sBAAsB;IACrC,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,kFAAkF;IAClF,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,yCAAyC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;IACxC,2DAA2D;IAC3D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAA;IACvC,iGAAiG;IACjG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,OAAO,CAAA;CACjD;AAED,MAAM,MAAM,oBAAoB,GAC5B,WAAW,GACX,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,wBAAwB,CAAA;AAE5B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;IACxC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,CAAC,EAAE,yBAAyB,CAAA;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAA;IACxC,mGAAmG;IACnG,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,qCAAqC;QACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;QACtB,+EAA+E;QAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;KACzF,CAAA;IACD,wFAAwF;IACxF,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;KACrC,CAAA;CACF;AAsBD,uDAAuD;AACvD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAkE9E;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CA4B9E;AAED,yEAAyE;AACzE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,EACvD,QAAQ,EAAE,sBAAsB,GAC/B,OAAO,CAOT;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,eAAe,GAC3B,eAAe,CAsFjB"}

package/dist/assurance.js

@@ -33,6 +33,10 @@ export function defineAssurancePolicy(policy) {
     if (policy.allowEmpty !== undefined && typeof policy.allowEmpty !== "boolean") {
         throw new Error(`route assurance: allowEmpty must be boolean`);
     }
+    if (policy.flagClassifiedWithoutEvidence !== undefined &&
+        typeof policy.flagClassifiedWithoutEvidence !== "boolean") {
+        throw new Error(`route assurance: flagClassifiedWithoutEvidence must be boolean`);
+    }
     const names = new Set();
     const rules = policy.rules.map((rule) => {
         if (typeof rule.name !== "string" || !nonEmpty(rule.name)) {
@@ -76,6 +80,7 @@ export function defineAssurancePolicy(policy) {
         rules: Object.freeze(rules),
         unmatched: policy.unmatched ?? "error",
         allowEmpty: policy.allowEmpty ?? false,
+        flagClassifiedWithoutEvidence: policy.flagClassifiedWithoutEvidence ?? false,
     });
 }
 /** Identity helper for a `nifra.assurance.ts` default export. */
@@ -171,6 +176,21 @@ export function evaluateRouteAssurance(source, policyInput) {
                 message: `${route.method} ${route.path} (${rule.name}) carries forbidden ${id}`,
             });
         }
+        // Opt-in visibility: a pure-classification rule (no require + no forbid) matching a route with zero
+        // evidence is a "label without proof". Surface it so the gap isn't silently green. A rule that expects
+        // or forbids evidence already speaks for itself via the loops above, so it's excluded here.
+        if (policy.flagClassifiedWithoutEvidence === true &&
+            evidence.length === 0 &&
+            (rule.require ?? []).length === 0 &&
+            (rule.forbid ?? []).length === 0) {
+            findings.push({
+                code: "classified-no-evidence",
+                method: route.method,
+                path: route.path,
+                rule: rule.name,
+                message: `${route.method} ${route.path} (${rule.name}) is classified but carries no enforcement evidence`,
+            });
+        }
         routes.push({
             method: route.method,
             path: route.path,

package/dist/assurance.js.map

@@ -1 +1 @@
-{"version":3,"file":"assurance.js","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,sBAAsB,GACvB,MAAM,mBAAmB,CAAA;AAM1B,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,WAAW,EACX,kBAAkB,GACnB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAuB,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIpE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAE7B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AA+ElD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;AAEhE,SAAS,oBAAoB,CAC3B,MAAqC,EACrC,KAAa;IAEb,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,MAAM,CAAC,SAAS,KAAK,OAAO;QAC5B,MAAM,CAAC,SAAS,KAAK,QAAQ,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAiB,EAAE;QACrD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iCAAiC,CAC/E,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QACzE,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACvF,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3C,SAAS,CAAC,IAAI,CAAC,CAAA;YACf,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/D,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CACrF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC;YACF,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO;QACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;KACvC,CAAC,CAAA;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,YAAY,EAAE,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;YAC/D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;YAC/B,CAAC,CAAC;gBACE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;oBACtB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7E,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE;YACzE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,KAAuD,EACvD,QAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAA;IAC1C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAgB,CAAC;QAAE,OAAO,KAAK,CAAA;IACpF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,KAAK,CAAA;IACd,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC7E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACpC,MAAe,EACf,WAA4B;IAE5B,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAEvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,oFAAoF;SAC9F,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAA;QACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,yCAAyC;iBAChF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;YAC7F,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,gBAAgB,EAAE,EAAE;aACzE,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,uBAAuB,EAAE,EAAE;aAChF,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACpC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"assurance.js","sourceRoot":"","sources":["../src/assurance.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,sBAAsB,GACvB,MAAM,mBAAmB,CAAA;AAM1B,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,WAAW,EACX,kBAAkB,GACnB,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAuB,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAIpE,OAAO,EAAE,kBAAkB,EAAE,CAAA;AAK7B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAA;AAwFlD,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;AAEhE,SAAS,oBAAoB,CAC3B,MAAqC,EACrC,KAAa;IAEb,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IACE,MAAM,CAAC,SAAS,KAAK,SAAS;QAC9B,MAAM,CAAC,SAAS,KAAK,OAAO;QAC5B,MAAM,CAAC,SAAS,KAAK,QAAQ,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAChE,CAAC;IACD,IACE,MAAM,CAAC,6BAA6B,KAAK,SAAS;QAClD,OAAO,MAAM,CAAC,6BAA6B,KAAK,SAAS,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAiB,EAAE;QACrD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACf,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iCAAiC,CAC/E,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;QACzE,KAAK,MAAM,MAAM,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;YACvF,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3C,SAAS,CAAC,IAAI,CAAC,CAAA;YACf,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC/D,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;QAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CACrF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvE,CAAC;YACF,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,OAAO;QACtC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,KAAK;QACtC,6BAA6B,EAAE,MAAM,CAAC,6BAA6B,IAAI,KAAK;KAC7E,CAAC,CAAA;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1F,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS;YACnC,CAAC,CAAC,EAAE,YAAY,EAAE,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE;YAC/D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS;YAC/B,CAAC,CAAC;gBACE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;oBACtB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7E,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpF,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,EAAE;YACzE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAA;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,wBAAwB,CACtC,KAAuD,EACvD,QAAgC;IAEhC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAA;IAC1C,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAgB,CAAC;QAAE,OAAO,KAAK,CAAA;IACpF,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,KAAK,CAAA;IACd,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC7E,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACpC,MAAe,EACf,WAA4B;IAE5B,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAuB,EAAE,CAAA;IACvC,MAAM,MAAM,GAAmB,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IAEvC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,oFAAoF;SAC9F,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAA;QACtC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,yCAAyC;iBAChF,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;YAC7F,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;QACzE,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,gBAAgB,EAAE,EAAE;aACzE,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,uBAAuB,EAAE,EAAE;aAChF,CAAC,CAAA;QACJ,CAAC;QACD,oGAAoG;QACpG,uGAAuG;QACvG,4FAA4F;QAC5F,IACE,MAAM,CAAC,6BAA6B,KAAK,IAAI;YAC7C,QAAQ,CAAC,MAAM,KAAK,CAAC;YACrB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YACjC,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAChC,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,qDAAqD;aAC1G,CAAC,CAAA;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAC/B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;SACpC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC"}

package/dist/capabilities.d.ts

@@ -3,9 +3,10 @@
  * are a fail-closed defence at owned effect seams. Static provenance remains the security anchor.
  */
 import type { DataClassification } from "./classification.js";
-import { type CapabilityUseEvent, validCapabilityId } from "./internal/capability-runtime.js";
+import { type EffectLifecycleObserver } from "./effect-lifecycle.js";
+import { type AroundCapabilityOptions, type CapabilityApprovalGate, type CapabilityApprovalInput, type CapabilityExecutionIdentity, type CapabilityExecutionJournal, type CapabilityInterceptor, type CapabilityInterceptorEvent, type CapabilityInterceptorNext, type CapabilityUseEvent, validCapabilityId } from "./internal/capability-runtime.js";
 import { type EffectCost, type EffectPhase } from "./ledger.js";
-export type { CapabilityUseEvent };
+export type { AroundCapabilityOptions, CapabilityApprovalGate, CapabilityApprovalInput, CapabilityExecutionIdentity, CapabilityExecutionJournal, CapabilityInterceptor, CapabilityInterceptorEvent, CapabilityInterceptorNext, CapabilityUseEvent, EffectLifecycleObserver, };
 export type CapabilityZone = "domain" | "operational";
 export type CapabilityAccess = "read" | "write";
 export type CapabilityIdempotency = "none" | "request" | "durable";
@@ -128,6 +129,51 @@ export interface CapabilityOutcomeOptions extends UseCapabilityOptions {
         readonly code: string;
     };
 }
+/** Durable controls consumed by `executeCapability`; none of these fields enter the effect ledger. */
+export interface CapabilityExecutionOptions extends UseCapabilityOptions {
+    readonly approval?: CapabilityApprovalInput & {
+        readonly gate: CapabilityApprovalGate;
+    };
+    readonly journal?: CapabilityExecutionJournal;
+}
+/** Context passed to the owned effect callback. Use the signal for cancellation-aware I/O. */
+export interface CapabilityExecutionContext {
+    readonly effectId: string;
+    readonly signal: AbortSignal;
+}
+export type CapabilityExecutor<T> = (execution: CapabilityExecutionContext) => T | PromiseLike<T>;
+/** A capability admission policy returned without calling `next()`. */
+export declare class CapabilityDeniedError extends Error {
+    readonly capability: string;
+    readonly effectId: string;
+    constructor(capability: string, effectId: string);
+}
+/** A capability admission policy exceeded its configured bound. */
+export declare class CapabilityInterceptorTimeoutError extends Error {
+    readonly capability: string;
+    readonly effectId: string;
+    readonly timeoutMs: number;
+    constructor(capability: string, effectId: string, timeoutMs: number);
+}
+/** The request was cancelled while capability admission was pending. */
+export declare class CapabilityAdmissionAbortedError extends Error {
+    readonly capability: string;
+    readonly effectId: string;
+    constructor(capability: string, effectId: string);
+}
+/** An interceptor called its one-shot `next()` continuation more than once. */
+export declare class CapabilityInterceptorProtocolError extends Error {
+    readonly capability: string;
+    readonly effectId: string;
+    constructor(capability: string, effectId: string);
+}
+/** The effect may have committed, but its durable terminal transition could not be recorded. */
+export declare class CapabilityJournalTransitionError extends Error {
+    readonly capability: string;
+    readonly effectId: string;
+    readonly transition: "committed";
+    constructor(capability: string, effectId: string, transition: "committed");
+}
 /**
  * Runtime effect beacon for owned adapters. It fails closed when the route omitted the capability or
  * when no route guard is present. Static provenance is still required: code can bypass a beacon.
@@ -136,6 +182,12 @@ export interface CapabilityOutcomeOptions extends UseCapabilityOptions {
 export declare function useCapability(context: object, capability: string, options?: UseCapabilityOptions): void;
 /** Record the terminal outcome of an already-admitted capability without debiting admission twice. */
 export declare function recordCapabilityOutcome(context: object, capability: string, options: CapabilityOutcomeOptions): void;
+/**
+ * Execute one owned effect behind a fail-closed capability boundary. The boundary assigns a stable
+ * effect id, records intent before execution, and records exactly one terminal outcome automatically.
+ * The callback result and errors never enter the token-only ledger.
+ */
+export declare function executeCapability<T>(context: object, capability: string, options: CapabilityExecutionOptions, executor: CapabilityExecutor<T>): Promise<T>;
 /**
  * Read the route's token-only declaration for admission plugins. This intentionally exposes neither
  * the request nor runtime evidence; it is the stable public seam for private entitlement policy.

package/dist/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAGL,KAAK,kBAAkB,EACvB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,WAAW,EAAkB,MAAM,aAAa,CAAA;AAG/E,YAAY,EAAE,kBAAkB,EAAE,CAAA;AAElC,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,aAAa,CAAA;AACrD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAA;AAC/C,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;AAElE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAA;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACjD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAC/D,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAA;IAC/C,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEzD,oGAAoG;AACpG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACpD;AAED,MAAM,MAAM,qBAAqB,GAC7B,oBAAoB,GACpB,sBAAsB,GACtB,gCAAgC,GAChC,0BAA0B,GAC1B,6BAA6B,GAC7B,6BAA6B,GAC7B,yBAAyB,CAAA;AAE7B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAChD,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAA;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAClD,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,uGAAuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAA;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACpD;AAID,OAAO,EAAE,iBAAiB,EAAE,CAAA;AA8B5B,0DAA0D;AAC1D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CA4EjF;AAUD,8FAA8F;AAC9F,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,qBAAqB,GACjC,yBAAyB,CA6H3B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC9C,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAsBD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,IAAI,CAON;AAED,sGAAsG;AACtG,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,wBAAwB,GAChC,IAAI,CAKN;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGvE;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,GAAG,kBAAkB,CAc1F"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7D,OAAO,EAAE,KAAK,uBAAuB,EAAuB,MAAM,uBAAuB,CAAA;AAEzF,OAAO,EACL,KAAK,uBAAuB,EAE5B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,0BAA0B,EAE/B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,yBAAyB,EAC9B,KAAK,kBAAkB,EAEvB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,WAAW,EAGjB,MAAM,aAAa,CAAA;AAGpB,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,GACxB,CAAA;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,aAAa,CAAA;AACrD,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAA;AAC/C,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;AAElE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAA;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACjD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAC/D,8FAA8F;IAC9F,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAA;CACzD;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAA;IAC/C,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEzD,oGAAoG;AACpG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACpD;AAED,MAAM,MAAM,qBAAqB,GAC7B,oBAAoB,GACpB,sBAAsB,GACtB,gCAAgC,GAChC,0BAA0B,GAC1B,6BAA6B,GAC7B,6BAA6B,GAC7B,yBAAyB,CAAA;AAE7B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAChD,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,iFAAiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAA;CAC7C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,sBAAsB,EAAE,CAAA;IAClD,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAA;CAChD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,uGAAuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAA;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,uBAAuB,EAAE,CAAA;CACpD;AAID,OAAO,EAAE,iBAAiB,EAAE,CAAA;AA8B5B,0DAA0D;AAC1D,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,CA4EjF;AAUD,8FAA8F;AAC9F,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,gBAAgB,EAC7B,WAAW,EAAE,qBAAqB,GACjC,yBAAyB,CA6H3B;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAA;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,yEAAyE;IACzE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;IAC9C,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC3C;AAED,sGAAsG;AACtG,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAA;KAAE,CAAA;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,0BAA0B,CAAA;CAC9C;AAED,8FAA8F;AAC9F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAC7B;AAED,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,0BAA0B,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;AAEjG,uEAAuE;AACvE,qBAAa,qBAAsB,SAAQ,KAAK;aAE5B,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,mEAAmE;AACnE,qBAAa,iCAAkC,SAAQ,KAAK;aAExC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,SAAS,EAAE,MAAM;gBAFjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM;CAKpC;AAED,wEAAwE;AACxE,qBAAa,+BAAgC,SAAQ,KAAK;aAEtC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,+EAA+E;AAC/E,qBAAa,kCAAmC,SAAQ,KAAK;aAEzC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;gBADhB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM;CAKnC;AAED,gGAAgG;AAChG,qBAAa,gCAAiC,SAAQ,KAAK;aAEvC,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,UAAU,EAAE,WAAW;gBAFvB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,WAAW;CAK1C;AA2GD;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,IAAI,CAQN;AAED,sGAAsG;AACtG,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,wBAAwB,GAChC,IAAI,CASN;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,0BAA0B,EACnC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAoGZ;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAGvE;AAED,iDAAiD;AACjD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,GAAG,kBAAkB,CAc1F"}

package/dist/capabilities.js

@@ -2,9 +2,12 @@
  * Route effect/capability assurance. Declarations are reflected at build/CI time; runtime beacons
  * are a fail-closed defence at owned effect seams. Static provenance remains the security anchor.
  */
+import { effectTraceParentOf } from "./effect-lifecycle.js";
+import { createEffectScope } from "./effect-scope.js";
 import { CAPABILITY_GUARD, validCapabilityId, } from "./internal/capability-runtime.js";
+import { effectScopeForContext } from "./internal/effect-execution.js";
 import { NIFRA_ASSURANCE_IDS } from "./internal/route-assurance.js";
-import { effectLedgerOf } from "./ledger.js";
+import { effectLedgerOf, normalizeEffectMetadata, } from "./ledger.js";
 import { reflectRoutes } from "./reflection.js";
 const SAFE_METHODS = new Set(["GET", "HEAD"]);
 export { validCapabilityId };
@@ -224,6 +227,132 @@ export function evaluateCapabilityAssurance(source, policyInput, evidenceSet) {
         findings: Object.freeze(findings),
     });
 }
+/** A capability admission policy returned without calling `next()`. */
+export class CapabilityDeniedError extends Error {
+    capability;
+    effectId;
+    constructor(capability, effectId) {
+        super(`capability assurance: ${capability} was denied by an async interceptor`);
+        this.capability = capability;
+        this.effectId = effectId;
+        this.name = "CapabilityDeniedError";
+    }
+}
+/** A capability admission policy exceeded its configured bound. */
+export class CapabilityInterceptorTimeoutError extends Error {
+    capability;
+    effectId;
+    timeoutMs;
+    constructor(capability, effectId, timeoutMs) {
+        super(`capability assurance: ${capability} admission timed out after ${timeoutMs}ms`);
+        this.capability = capability;
+        this.effectId = effectId;
+        this.timeoutMs = timeoutMs;
+        this.name = "CapabilityInterceptorTimeoutError";
+    }
+}
+/** The request was cancelled while capability admission was pending. */
+export class CapabilityAdmissionAbortedError extends Error {
+    capability;
+    effectId;
+    constructor(capability, effectId) {
+        super(`capability assurance: ${capability} admission was aborted`);
+        this.capability = capability;
+        this.effectId = effectId;
+        this.name = "CapabilityAdmissionAbortedError";
+    }
+}
+/** An interceptor called its one-shot `next()` continuation more than once. */
+export class CapabilityInterceptorProtocolError extends Error {
+    capability;
+    effectId;
+    constructor(capability, effectId) {
+        super(`capability assurance: ${capability} interceptor called next() more than once`);
+        this.capability = capability;
+        this.effectId = effectId;
+        this.name = "CapabilityInterceptorProtocolError";
+    }
+}
+/** The effect may have committed, but its durable terminal transition could not be recorded. */
+export class CapabilityJournalTransitionError extends Error {
+    capability;
+    effectId;
+    transition;
+    constructor(capability, effectId, transition) {
+        super(`capability assurance: ${capability} durable ${transition} transition failed`);
+        this.capability = capability;
+        this.effectId = effectId;
+        this.transition = transition;
+        this.name = "CapabilityJournalTransitionError";
+    }
+}
+let unboundedCapabilitySignal;
+function signalFor(context) {
+    const signal = context.signal;
+    if (signal !== undefined)
+        return signal;
+    unboundedCapabilitySignal ??= new AbortController().signal;
+    return unboundedCapabilitySignal;
+}
+function admissionErrorCode(error) {
+    if (error instanceof CapabilityDeniedError)
+        return "admission_denied";
+    if (error instanceof CapabilityInterceptorTimeoutError)
+        return "admission_timeout";
+    if (error instanceof CapabilityAdmissionAbortedError)
+        return "admission_aborted";
+    if (error instanceof CapabilityInterceptorProtocolError)
+        return "admission_protocol";
+    return "admission_failed";
+}
+async function withInterceptorBound(registration, parentSignal, capability, effectId, run) {
+    if (parentSignal.aborted)
+        throw new CapabilityAdmissionAbortedError(capability, effectId);
+    const controller = new AbortController();
+    let timeout;
+    let rejectGate;
+    const gate = new Promise((_resolve, reject) => {
+        rejectGate = reject;
+    });
+    const abort = () => {
+        const error = new CapabilityAdmissionAbortedError(capability, effectId);
+        controller.abort(error);
+        rejectGate?.(error);
+    };
+    parentSignal.addEventListener("abort", abort, { once: true });
+    timeout = setTimeout(() => {
+        const error = new CapabilityInterceptorTimeoutError(capability, effectId, registration.timeoutMs);
+        controller.abort(error);
+        rejectGate?.(error);
+    }, registration.timeoutMs);
+    try {
+        await Promise.race([run(controller.signal), gate]);
+    }
+    finally {
+        clearTimeout(timeout);
+        parentSignal.removeEventListener("abort", abort);
+    }
+}
+async function runCapabilityInterceptors(registrations, baseEvent, parentSignal, index = 0) {
+    const registration = registrations[index];
+    if (registration === undefined)
+        return;
+    let nextPromise;
+    await withInterceptorBound(registration, parentSignal, baseEvent.capability, baseEvent.effectId, async (signal) => {
+        const event = Object.freeze({ ...baseEvent, signal });
+        await registration.interceptor(event, () => {
+            if (nextPromise !== undefined) {
+                throw new CapabilityInterceptorProtocolError(baseEvent.capability, baseEvent.effectId);
+            }
+            nextPromise = runCapabilityInterceptors(registrations, baseEvent, signal, index + 1);
+            return nextPromise;
+        });
+    });
+    if (nextPromise === undefined) {
+        throw new CapabilityDeniedError(baseEvent.capability, baseEvent.effectId);
+    }
+    await nextPromise;
+}
 function guardFor(context, capability) {
     if (!validCapabilityId(capability)) {
         throw new Error(`capability assurance: invalid runtime capability ${JSON.stringify(capability)}`);
@@ -248,15 +377,121 @@ export function useCapability(context, capability, options) {
     // Validate/append the intent before private admission hooks debit budgets. Overflow or malformed
     // evidence therefore cannot consume quota and then fail the request.
     ledger?.append({ capability, ...options, phase: "intent" });
+    guard.trackEffect?.(context, false);
     guard.onUse?.({ capability, method: guard.method, path: guard.path });
 }
 /** Record the terminal outcome of an already-admitted capability without debiting admission twice. */
 export function recordCapabilityOutcome(context, capability, options) {
-    guardFor(context, capability);
+    const guard = guardFor(context, capability);
     const ledger = effectLedgerOf(context);
-    if (ledger === undefined)
-        return;
-    ledger.append({ capability, ...options });
+    ledger?.append({ capability, ...options });
+    if (options.phase === "committed" || options.phase === "compensated") {
+        guard.trackEffect?.(context, true);
+    }
+    else {
+        guard.trackEffect?.(context, false);
+    }
+}
+/**
+ * Execute one owned effect behind a fail-closed capability boundary. The boundary assigns a stable
+ * effect id, records intent before execution, and records exactly one terminal outcome automatically.
+ * The callback result and errors never enter the token-only ledger.
+ */
+export async function executeCapability(context, capability, options, executor) {
+    if (typeof executor !== "function") {
+        throw new TypeError("capability assurance: executeCapability executor must be a function");
+    }
+    const guard = guardFor(context, capability);
+    const ledger = effectLedgerOf(context);
+    const effectId = crypto.randomUUID();
+    const metadata = normalizeEffectMetadata(options);
+    const trace = effectTraceParentOf(context);
+    const identity = options.approval;
+    const requestEvidence = effectScopeForContext(context);
+    const scope = createEffectScope({}, requestEvidence);
+    const result = await scope.run({
+        effectId,
+        capability,
+        ...metadata,
+        signal: signalFor(context),
+        observers: guard.observers,
+        ...(trace === undefined ? {} : { trace }),
+        errorCode: (error, began) => (began ? "execution_failed" : admissionErrorCode(error)),
+        async admit(execution) {
+            if (identity !== undefined) {
+                await identity.gate.authorize({
+                    effectId: execution.effectId,
+                    capability,
+                    ...(metadata.target === undefined ? {} : { target: metadata.target }),
+                    ...(metadata.digest === undefined ? {} : { digest: metadata.digest }),
+                    identity: { tenantId: identity.tenantId, principalId: identity.principalId },
+                    ...(identity.resumeToken === undefined ? {} : { resumeToken: identity.resumeToken }),
+                    signal: execution.signal,
+                });
+            }
+            guard.onUse?.({ capability, method: guard.method, path: guard.path });
+            if (guard.interceptors.length > 0) {
+                await runCapabilityInterceptors(guard.interceptors, Object.freeze({
+                    capability,
+                    method: guard.method,
+                    path: guard.path,
+                    effectId: execution.effectId,
+                    ...metadata,
+                }), execution.signal);
+            }
+        },
+        transitions: {
+            async intent(execution) {
+                ledger?.append({ capability, effectId: execution.effectId, ...metadata, phase: "intent" });
+                await options.journal?.intent({
+                    effectId: execution.effectId,
+                    capability,
+                    ...(metadata.target === undefined ? {} : { target: metadata.target }),
+                    ...(metadata.digest === undefined ? {} : { digest: metadata.digest }),
+                    ...(identity === undefined
+                        ? {}
+                        : { identity: { tenantId: identity.tenantId, principalId: identity.principalId } }),
+                });
+            },
+            async executing(execution) {
+                await options.journal?.executing(execution.effectId);
+            },
+            async committed(execution) {
+                try {
+                    await options.journal?.committed(execution.effectId);
+                }
+                catch {
+                    throw new CapabilityJournalTransitionError(capability, execution.effectId, "committed");
+                }
+            },
+            async failed(execution, failure) {
+                try {
+                    await options.journal?.failed(execution.effectId, {
+                        began: failure.began,
+                        errorCode: failure.errorCode,
+                    });
+                }
+                finally {
+                    try {
+                        ledger?.append({
+                            capability,
+                            effectId: execution.effectId,
+                            ...metadata,
+                            phase: "failed",
+                            error: { code: failure.errorCode },
+                        });
+                    }
+                    catch {
+                        // Preserve the original effect failure when terminal evidence overflows.
+                    }
+                }
+            },
+        },
+    }, (execution) => executor(Object.freeze({ effectId: execution.effectId, signal: execution.signal })));
+    // Durable commit and success telemetry are already final. A ledger overflow here must not rewrite
+    // the effect to failed/unknown or erase the request scope's proven committed evidence.
+    ledger?.append({ capability, effectId, ...metadata, phase: "committed" });
+    return result;
 }
 /**
  * Read the route's token-only declaration for admission plugins. This intentionally exposes neither