@nifrajs/core 1.9.0 → 1.10.0

package/dist/capabilities.js

@@ -0,0 +1,257 @@
+/**
+ * Route effect/capability assurance. Declarations are reflected at build/CI time; runtime beacons
+ * are a fail-closed defence at owned effect seams. Static provenance remains the security anchor.
+ */
+import { CAPABILITY_GUARD, validCapabilityId, } from "./internal/capability-runtime.js";
+import { NIFRA_ASSURANCE_IDS } from "./internal/route-assurance.js";
+import { reflectRoutes } from "./reflection.js";
+const SAFE_METHODS = new Set(["GET", "HEAD"]);
+export { validCapabilityId };
+function normalizedIds(values, label) {
+    if (!Array.isArray(values))
+        throw new TypeError(`${label} must be an array`);
+    const out = [];
+    const seen = new Set();
+    for (const value of values) {
+        if (typeof value !== "string" || !validCapabilityId(value)) {
+            throw new Error(`capability assurance: invalid ${label} id ${JSON.stringify(value)}`);
+        }
+        if (!seen.has(value)) {
+            seen.add(value);
+            out.push(value);
+        }
+    }
+    return Object.freeze(out);
+}
+function validSpecifier(value) {
+    return value.trim() === value && value !== "" && !hasControlCharacter(value);
+}
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code <= 31 || code === 127)
+            return true;
+    }
+    return false;
+}
+/** Validate and freeze a capability/provenance policy. */
+export function defineCapabilityPolicy(policy) {
+    if (policy.provenance === undefined || policy.provenance === null) {
+        throw new Error("capability assurance: provenance policy is required");
+    }
+    const ids = new Set();
+    const definitions = policy.definitions.map((definition) => {
+        if (!validCapabilityId(definition.id)) {
+            throw new Error(`capability assurance: invalid capability id ${JSON.stringify(definition.id)}`);
+        }
+        if (ids.has(definition.id)) {
+            throw new Error(`capability assurance: duplicate capability ${JSON.stringify(definition.id)}`);
+        }
+        ids.add(definition.id);
+        if (definition.zone !== "domain" && definition.zone !== "operational") {
+            throw new Error(`capability assurance: invalid zone for ${definition.id}`);
+        }
+        if (definition.access !== "read" && definition.access !== "write") {
+            throw new Error(`capability assurance: invalid access for ${definition.id}`);
+        }
+        const idempotency = definition.idempotency ?? "none";
+        if (idempotency !== "none" && idempotency !== "request" && idempotency !== "durable") {
+            throw new Error(`capability assurance: invalid idempotency for ${definition.id}`);
+        }
+        if (definition.access === "read" && idempotency !== "none") {
+            throw new Error(`capability assurance: read capability ${definition.id} cannot require idempotency`);
+        }
+        return Object.freeze({ ...definition, idempotency });
+    });
+    const imports = policy.provenance.imports.map((rule) => {
+        if (!validSpecifier(rule.specifier))
+            throw new Error("capability assurance: invalid import specifier");
+        const capabilities = normalizedIds(rule.capabilities, "import capability");
+        for (const id of capabilities) {
+            if (!ids.has(id))
+                throw new Error(`capability assurance: import references unknown ${id}`);
+        }
+        return Object.freeze({ specifier: rule.specifier, capabilities });
+    });
+    const forbiddenImports = policy.provenance.forbiddenImports.map((rule) => {
+        if (!validSpecifier(rule.specifier) || rule.reason.trim() === "") {
+            throw new Error("capability assurance: forbidden import needs a specifier and reason");
+        }
+        return Object.freeze({ specifier: rule.specifier, reason: rule.reason.trim() });
+    });
+    const routeModules = policy.provenance.routeModules?.map((rule) => {
+        if (!Array.isArray(rule.modules) || rule.modules.length === 0) {
+            throw new Error("capability assurance: routeModules entry needs at least one module");
+        }
+        const modules = rule.modules.map((module) => {
+            if (!validSpecifier(module))
+                throw new Error("capability assurance: invalid route module");
+            return module.replace(/^\.\//, "");
+        });
+        return Object.freeze({
+            match: Object.freeze({
+                ...(rule.match.methods !== undefined
+                    ? { methods: Object.freeze(rule.match.methods.map((method) => method.toUpperCase())) }
+                    : {}),
+                ...(rule.match.paths !== undefined ? { paths: Object.freeze([...rule.match.paths]) } : {}),
+            }),
+            modules: Object.freeze(modules),
+        });
+    });
+    return Object.freeze({
+        definitions: Object.freeze(definitions),
+        provenance: Object.freeze({
+            imports: Object.freeze(imports),
+            forbiddenImports: Object.freeze(forbiddenImports),
+            ...(routeModules !== undefined ? { routeModules: Object.freeze(routeModules) } : {}),
+        }),
+        lockfile: policy.lockfile ?? "capabilities.lock.json",
+    });
+}
+function evidenceSourceValid(source) {
+    return source.length > 0 && source.length <= 256 && !hasControlCharacter(source);
+}
+function routeKey(method, path) {
+    return `${method.toUpperCase()}\n${path}`;
+}
+/** Compare declared route capabilities against coverage-qualified static/runtime evidence. */
+export function evaluateCapabilityAssurance(source, policyInput, evidenceSet) {
+    const policy = defineCapabilityPolicy(policyInput);
+    const definitions = new Map(policy.definitions.map((definition) => [definition.id, definition]));
+    const evidenceByRoute = new Map(evidenceSet.routes.map((route) => [routeKey(route.method, route.path), route]));
+    const findings = [];
+    const routes = [];
+    for (const route of reflectRoutes(source)) {
+        const declared = route.capabilities ?? [];
+        const supplied = evidenceByRoute.get(routeKey(route.method, route.path));
+        const covered = supplied?.covered === true;
+        const evidence = [];
+        const evidenceIds = new Set();
+        for (const item of supplied?.evidence ?? []) {
+            if (!validCapabilityId(item.id) ||
+                (item.kind !== "static" && item.kind !== "runtime") ||
+                !evidenceSourceValid(item.source)) {
+                continue;
+            }
+            const key = `${item.id}\n${item.kind}\n${item.source}`;
+            if (evidence.some((candidate) => `${candidate.id}\n${candidate.kind}\n${candidate.source}` === key))
+                continue;
+            evidence.push(Object.freeze({ id: item.id, kind: item.kind, source: item.source }));
+            evidenceIds.add(item.id);
+        }
+        for (const id of declared) {
+            if (!definitions.has(id)) {
+                findings.push({
+                    code: "unknown-capability",
+                    method: route.method,
+                    path: route.path,
+                    capability: id,
+                    message: `${route.method} ${route.path} declares unknown capability ${id}`,
+                });
+            }
+        }
+        if (!covered) {
+            findings.push({
+                code: "provenance-uncovered",
+                method: route.method,
+                path: route.path,
+                message: `${route.method} ${route.path} has no static provenance coverage`,
+            });
+        }
+        for (const id of evidenceIds) {
+            if (!declared.includes(id)) {
+                findings.push({
+                    code: "undeclared-capability-evidence",
+                    method: route.method,
+                    path: route.path,
+                    capability: id,
+                    message: `${route.method} ${route.path} evidence exceeds its declaration: ${id}`,
+                });
+            }
+        }
+        const effective = new Set([...declared, ...evidenceIds]);
+        const assuranceIds = new Set((route.assurance ?? []).map((item) => item.id));
+        for (const id of effective) {
+            const definition = definitions.get(id);
+            if (definition === undefined)
+                continue;
+            if (SAFE_METHODS.has(route.method) &&
+                definition.zone === "domain" &&
+                definition.access === "write") {
+                findings.push({
+                    code: "safe-method-domain-write",
+                    method: route.method,
+                    path: route.path,
+                    capability: id,
+                    message: `${route.method} ${route.path} cannot carry domain write capability ${id}`,
+                });
+            }
+            if (definition.idempotency === "request" &&
+                !assuranceIds.has(NIFRA_ASSURANCE_IDS.IDEMPOTENCY_KEY)) {
+                findings.push({
+                    code: "missing-request-idempotency",
+                    method: route.method,
+                    path: route.path,
+                    capability: id,
+                    message: `${route.method} ${route.path} capability ${id} requires request idempotency evidence`,
+                });
+            }
+            if (definition.idempotency === "durable" &&
+                !assuranceIds.has(NIFRA_ASSURANCE_IDS.DURABLE_COMMAND)) {
+                findings.push({
+                    code: "missing-durable-idempotency",
+                    method: route.method,
+                    path: route.path,
+                    capability: id,
+                    message: `${route.method} ${route.path} capability ${id} requires durable command/provider-key evidence`,
+                });
+            }
+        }
+        routes.push(Object.freeze({
+            method: route.method,
+            path: route.path,
+            declared: Object.freeze([...declared]),
+            evidence: Object.freeze(evidence),
+            unproven: Object.freeze(declared.filter((id) => !evidenceIds.has(id))),
+            covered,
+            ...(route.classification !== undefined ? { classification: route.classification } : {}),
+        }));
+    }
+    return Object.freeze({
+        ok: findings.length === 0,
+        routes: Object.freeze(routes),
+        findings: Object.freeze(findings),
+    });
+}
+/**
+ * Runtime effect beacon for owned adapters. It fails closed when the route omitted the capability or
+ * when no route guard is present. Static provenance is still required: code can bypass a beacon.
+ */
+export function useCapability(context, capability) {
+    if (!validCapabilityId(capability)) {
+        throw new Error(`capability assurance: invalid runtime capability ${JSON.stringify(capability)}`);
+    }
+    const guard = context[CAPABILITY_GUARD];
+    if (guard === undefined) {
+        throw new Error(`capability assurance: ${capability} used on a route with no capability declaration`);
+    }
+    if (!guard.allowed.includes(capability)) {
+        throw new Error(`capability assurance: ${capability} is not declared for ${guard.method} ${guard.path}`);
+    }
+    guard.onUse?.({ capability, method: guard.method, path: guard.path });
+}
+/** Deterministic, PII-free lockfile material. */
+export function snapshotCapabilities(report) {
+    const routes = report.routes
+        .map((route) => ({
+        method: route.method,
+        path: route.path,
+        declared: Object.freeze([...route.declared].sort()),
+        evidenced: Object.freeze([...new Set(route.evidence.map((item) => item.id))].sort()),
+        unproven: Object.freeze([...route.unproven].sort()),
+        ...(route.classification !== undefined ? { classification: route.classification } : {}),
+    }))
+        .sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method));
+    return Object.freeze({ nifraCapabilities: 1, routes: Object.freeze(routes) });
+}
+//# sourceMappingURL=capabilities.js.map

package/dist/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,gBAAgB,EAGhB,iBAAiB,GAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AA8H/C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;AAE7C,OAAO,EAAE,iBAAiB,EAAE,CAAA;AAE5B,SAAS,aAAa,CAAC,MAAyB,EAAE,KAAa;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAA;IAC5E,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACvF,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACf,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;AAC9E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACpC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAA;IAC7C,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAwB,EAAE;QAC9E,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,+CAA+C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAC/E,CAAA;QACH,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;QAChG,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QACtB,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,0CAA0C,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QAC5E,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,4CAA4C,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,IAAI,MAAM,CAAA;QACpD,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,iDAAiD,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QACnF,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,yCAAyC,UAAU,CAAC,EAAE,6BAA6B,CACpF,CAAA;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAwB,EAAE;QAC3E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACnE,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAA;QAC1E,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,EAAE,EAAE,CAAC,CAAA;QAC5F,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,CAAC,gBAAgB,CAAC,GAAG,CAC7D,CAAC,IAAI,EAA6B,EAAE;QAClC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjF,CAAC,CACF,CAAA;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,IAAI,EAAyB,EAAE;QACvF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAC1C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;YAC1F,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACpC,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS;oBAClC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE;oBACtF,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3F,CAAC;YACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC;QACvC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YAC/B,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACjD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrF,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,wBAAwB;KACtD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAA;AAC3C,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,2BAA2B,CACzC,MAAe,EACf,WAA6B,EAC7B,WAAkC;IAElC,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;IAChG,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAC/E,CAAA;IACD,MAAM,QAAQ,GAAwB,EAAE,CAAA;IACxC,MAAM,MAAM,GAA6B,EAAE,CAAA;IAE3C,KAAK,MAAM,KAAK,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAA;QACzC,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QACxE,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAA;QAC1C,MAAM,QAAQ,GAAyB,EAAE,CAAA;QACzC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QACrC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC5C,IACE,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;gBACnD,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EACjC,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAA;YACtD,IACE,QAAQ,CAAC,IAAI,CACX,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,EAAE,KAAK,GAAG,CACjF;gBAED,SAAQ;YACV,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;YACnF,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1B,CAAC;QAED,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,gCAAgC,EAAE,EAAE;iBAC3E,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,oCAAoC;aAC3E,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gCAAgC;oBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,sCAAsC,EAAE,EAAE;iBACjF,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC,CAAA;QACxD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAC5E,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,UAAU,KAAK,SAAS;gBAAE,SAAQ;YACtC,IACE,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC9B,UAAU,CAAC,IAAI,KAAK,QAAQ;gBAC5B,UAAU,CAAC,MAAM,KAAK,OAAO,EAC7B,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,0BAA0B;oBAChC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,yCAAyC,EAAE,EAAE;iBACpF,CAAC,CAAA;YACJ,CAAC;YACD,IACE,UAAU,CAAC,WAAW,KAAK,SAAS;gBACpC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,eAAe,CAAC,EACtD,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,6BAA6B;oBACnC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,eAAe,EAAE,wCAAwC;iBAChG,CAAC,CAAA;YACJ,CAAC;YACD,IACE,UAAU,CAAC,WAAW,KAAK,SAAS;gBACpC,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,eAAe,CAAC,EACtD,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,6BAA6B;oBACnC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,eAAe,EAAE,iDAAiD;iBACzG,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QACD,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,MAAM,CAAC;YACZ,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;YACtC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACjC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO;YACP,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC,CACH,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;KAClC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,UAAkB;IAC/D,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CACjF,CAAA;IACH,CAAC;IACD,MAAM,KAAK,GAAI,OAA6D,CAAC,gBAAgB,CAAC,CAAA;IAC9F,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,iDAAiD,CACrF,CAAA;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,wBAAwB,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CACxF,CAAA;IACH,CAAC;IACD,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,oBAAoB,CAAC,MAAiC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM;SACzB,GAAG,CACF,CAAC,KAAK,EAA2B,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxF,CAAC,CACH;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACnF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAC/E,CAAC"}

package/dist/classification.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Response data-classification tags. A route can declare the highest sensitivity its response body
+ * carries (`schema.classification`). This is a declarative, compile-time + introspection fact — never
+ * read on the request hot path and never enforced at runtime here. Downstream consumers use it: a
+ * partner-API surface refuses to expose a route whose response is `pii`/`secret`, privacy tooling
+ * learns which routes emit regulated data, and the capability lockfile records it so a route that
+ * *starts* returning PII flips the lockfile and forces a review.
+ */
+/** Sensitivity of the data a response carries. Ordered `public` < `pii` < `secret`. */
+export type DataClassification = "public" | "pii" | "secret";
+/** Total order over classifications; higher = more sensitive. */
+export declare const DATA_CLASSIFICATION_RANK: Readonly<Record<DataClassification, number>>;
+/** Whether `value` is a known classification token. */
+export declare function isDataClassification(value: unknown): value is DataClassification;
+/** The most sensitive classification among the inputs; `"public"` when none are given. */
+export declare function maxClassification(values: Iterable<DataClassification>): DataClassification;
+/** True when `value` is at least as sensitive as `floor` (e.g. `classificationAtLeast(x, "pii")`). */
+export declare function classificationAtLeast(value: DataClassification, floor: DataClassification): boolean;
+//# sourceMappingURL=classification.d.ts.map

package/dist/classification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.d.ts","sourceRoot":"","sources":["../src/classification.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,uFAAuF;AACvF,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAA;AAE5D,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAMjF,CAAA;AAID,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAEhF;AAED,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAM1F;AAED,sGAAsG;AACtG,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,kBAAkB,EACzB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAET"}

package/dist/classification.js

@@ -0,0 +1,33 @@
+/**
+ * Response data-classification tags. A route can declare the highest sensitivity its response body
+ * carries (`schema.classification`). This is a declarative, compile-time + introspection fact — never
+ * read on the request hot path and never enforced at runtime here. Downstream consumers use it: a
+ * partner-API surface refuses to expose a route whose response is `pii`/`secret`, privacy tooling
+ * learns which routes emit regulated data, and the capability lockfile records it so a route that
+ * *starts* returning PII flips the lockfile and forces a review.
+ */
+/** Total order over classifications; higher = more sensitive. */
+export const DATA_CLASSIFICATION_RANK = Object.freeze({
+    public: 0,
+    pii: 1,
+    secret: 2,
+});
+const CLASSIFICATIONS = Object.keys(DATA_CLASSIFICATION_RANK);
+/** Whether `value` is a known classification token. */
+export function isDataClassification(value) {
+    return typeof value === "string" && CLASSIFICATIONS.includes(value);
+}
+/** The most sensitive classification among the inputs; `"public"` when none are given. */
+export function maxClassification(values) {
+    let max = "public";
+    for (const value of values) {
+        if (DATA_CLASSIFICATION_RANK[value] > DATA_CLASSIFICATION_RANK[max])
+            max = value;
+    }
+    return max;
+}
+/** True when `value` is at least as sensitive as `floor` (e.g. `classificationAtLeast(x, "pii")`). */
+export function classificationAtLeast(value, floor) {
+    return DATA_CLASSIFICATION_RANK[value] >= DATA_CLASSIFICATION_RANK[floor];
+}
+//# sourceMappingURL=classification.js.map

package/dist/classification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.js","sourceRoot":"","sources":["../src/classification.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,iEAAiE;AACjE,MAAM,CAAC,MAAM,wBAAwB,GAAiD,MAAM,CAAC,MAAM,CACjG;IACE,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;CACV,CACF,CAAA;AAED,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAkC,CAAA;AAE9F,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,eAAqC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC5F,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,MAAoC;IACpE,IAAI,GAAG,GAAuB,QAAQ,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,wBAAwB,CAAC,KAAK,CAAC,GAAG,wBAAwB,CAAC,GAAG,CAAC;YAAE,GAAG,GAAG,KAAK,CAAA;IAClF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,qBAAqB,CACnC,KAAyB,EACzB,KAAyB;IAEzB,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAA;AAC3E,CAAC"}

package/dist/errors.d.ts

@@ -8,7 +8,7 @@ export declare class FrameworkError extends Error {
     constructor(code: string, message: string);
 }
 /** Stable codes for boot-time (L2) route configuration failures. */
-export type RouteConfigErrorCode = "DUPLICATE_ROUTE" | "DUPLICATE_PARAM" | "PARAM_NAME_CONFLICT" | "INVALID_PATH" | "INVALID_PARAM_NAME" | "WILDCARD_NOT_LAST" | "INVALID_METHOD";
+export type RouteConfigErrorCode = "DUPLICATE_ROUTE" | "DUPLICATE_PARAM" | "PARAM_NAME_CONFLICT" | "INVALID_PATH" | "INVALID_PARAM_NAME" | "WILDCARD_NOT_LAST" | "INVALID_METHOD" | "INVALID_ASSURANCE";
 /**
  * Thrown at route registration when a route is misconfigured. This is the
  * boot-time rejection layer: loud and early,

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;gBAET,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,mBAAmB,GACnB,gBAAgB,CAAA;AAEpB;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,cAAc;IAElD,SAAiB,IAAI,EAAE,oBAAoB,CAAA;gBAE/B,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM;CAIxD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;gBAET,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAK1C;AAED,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,iBAAiB,GACjB,qBAAqB,GACrB,cAAc,GACd,oBAAoB,GACpB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,CAAA;AAEvB;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,cAAc;IAElD,SAAiB,IAAI,EAAE,oBAAoB,CAAA;gBAE/B,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM;CAIxD"}

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAQ;IAErB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAYD;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,cAAc;IAIlD,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAQ;IAErB,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IAClB,CAAC;CACF;AAaD;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,cAAc;IAIlD,YAAY,IAA0B,EAAE,OAAe;QACrD,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QACpB,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;IAChC,CAAC;CACF"}

package/dist/idempotency.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Idempotency primitive. A mutating route can declare `schema.idempotency`; the server then dedupes
+ * on an `Idempotency-Key` header: the first request runs and its response is stored, and a retry with
+ * the same key replays the stored response byte-for-byte without re-running the handler. A retry that
+ * reuses a key with a *different* request body is rejected (409) — a key binds to one request.
+ *
+ * This module is the runtime-neutral core: the store interface, an in-memory store, the request
+ * fingerprint, and response (de)serialization. The server owns the request-path lane that reads the
+ * body, consults the store, and captures the response. All logic here is pure/injectable so it is
+ * unit-tested without a server. A durable store (cross-restart) implements the same interface.
+ */
+/** Whether a route's idempotency is satisfied by an in-process store or a durable (cross-restart) one. */
+export type IdempotencyScope = "request" | "durable";
+/** Default retention for a stored idempotent response: 24 hours. */
+export declare const DEFAULT_IDEMPOTENCY_TTL_MS = 86400000;
+/** Canonical request header carrying the client-chosen idempotency key. */
+export declare const DEFAULT_IDEMPOTENCY_HEADER = "idempotency-key";
+/** Header stamped on a replayed response so clients/proxies can tell a replay from a fresh run. */
+export declare const IDEMPOTENT_REPLAY_HEADER = "x-nifra-idempotent-replay";
+/** A serialized response held by a store. `body` is base64 so binary payloads round-trip intact. */
+export interface StoredResponse {
+    readonly status: number;
+    readonly headers: readonly (readonly [string, string])[];
+    /** Base64-encoded response body; `""` when the response had no body. */
+    readonly body: string;
+}
+/**
+ * Outcome of reserving a key. `new` → the caller runs the handler and later calls {@link
+ * IdempotencyStore.complete}. `replay` → return the stored response, handler never runs. `mismatch`
+ * → same key, different request fingerprint (client bug) → 409. `in-flight` → the key is reserved but
+ * not yet completed (a concurrent duplicate) → 409 + Retry-After.
+ */
+export type IdempotencyBeginResult = {
+    readonly state: "new";
+} | {
+    readonly state: "replay";
+    readonly response: StoredResponse;
+} | {
+    readonly state: "mismatch";
+} | {
+    readonly state: "in-flight";
+};
+/**
+ * Storage seam for idempotent responses. `begin` MUST be atomic: for one key, exactly one concurrent
+ * caller sees `new`; the rest see `in-flight` (or `replay` once completed). The in-memory store gets
+ * this free from the single-threaded event loop; a durable store uses an atomic insert.
+ */
+export interface IdempotencyStore {
+    /** Reserve `key` for `fingerprint`, retaining any stored response for `ttlMs`. */
+    begin(key: string, fingerprint: string, ttlMs: number): IdempotencyBeginResult | Promise<IdempotencyBeginResult>;
+    /** Persist the final response for a reserved key so later retries replay it. */
+    complete(key: string, response: StoredResponse): void | Promise<void>;
+    /** Release a reservation that produced no cacheable response, so the client may retry. */
+    abandon(key: string): void | Promise<void>;
+}
+/** A key must be a non-empty, bounded, control-char-free token. Fail closed on anything else. */
+export declare function validIdempotencyKey(key: string): boolean;
+/**
+ * SHA-256 fingerprint binding a key to one request: method, path (+ query), and the raw body bytes.
+ * A collision-resistant hash matters — a weak hash would let a crafted body replay another's response.
+ */
+export declare function computeIdempotencyFingerprint(method: string, path: string, body: Uint8Array): Promise<string>;
+/** Buffer a response into a storable form. Clones first so the live response body stays intact. */
+export declare function serializeResponse(response: Response): Promise<StoredResponse>;
+/** Rebuild a live response from storage, stamping the replay marker header. */
+export declare function responseFromStored(stored: StoredResponse): Response;
+export interface MemoryIdempotencyStoreOptions {
+    /** Injectable clock (epoch ms) for deterministic TTL tests. Default `Date.now`. */
+    readonly now?: () => number;
+}
+/**
+ * In-process idempotency store. Reservation is atomic by construction — `begin` never awaits, so the
+ * single-threaded event loop serializes concurrent callers for one key. Expired entries are treated
+ * as absent (lazy eviction on access); a periodic {@link MemoryIdempotencyStore.sweep} bounds memory.
+ */
+export declare class MemoryIdempotencyStore implements IdempotencyStore {
+    private readonly entries;
+    private readonly now;
+    constructor(options?: MemoryIdempotencyStoreOptions);
+    begin(key: string, fingerprint: string, ttlMs: number): IdempotencyBeginResult;
+    complete(key: string, response: StoredResponse): void;
+    abandon(key: string): void;
+    /** Evict expired entries. Callers may run this on an interval; access-time eviction covers the rest. */
+    sweep(): void;
+    /** Live entry count (post-sweep semantics are the caller's; this is a raw size for tests/metrics). */
+    get size(): number;
+}
+/** Convenience factory mirroring the other core primitives' `create*` style. */
+export declare function createMemoryIdempotencyStore(options?: MemoryIdempotencyStoreOptions): MemoryIdempotencyStore;
+//# sourceMappingURL=idempotency.d.ts.map

package/dist/idempotency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.d.ts","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,0GAA0G;AAC1G,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,SAAS,CAAA;AAEpD,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,WAAa,CAAA;AAEpD,2EAA2E;AAC3E,eAAO,MAAM,0BAA0B,oBAAoB,CAAA;AAE3D,mGAAmG;AACnG,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAInE,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAA;IACxD,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAA;AAEnC;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,KAAK,CACH,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAA;IAC3D,gFAAgF;IAChF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrE,0FAA0F;IAC1F,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C;AAED,iGAAiG;AACjG,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOxD;AAID;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,MAAM,CAAC,CAUjB;AAmBD,mGAAmG;AACnG,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAOnF;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,QAAQ,CASnE;AAQD,MAAM,WAAW,6BAA6B;IAC5C,mFAAmF;IACnF,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,YAAW,gBAAgB;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;gBAEtB,OAAO,GAAE,6BAAkC;IAIvD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,sBAAsB;IAe9E,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;IAKrD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM1B,wGAAwG;IACxG,KAAK,IAAI,IAAI;IAOb,sGAAsG;IACtG,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED,gFAAgF;AAChF,wBAAgB,4BAA4B,CAC1C,OAAO,CAAC,EAAE,6BAA6B,GACtC,sBAAsB,CAExB"}

package/dist/idempotency.js

@@ -0,0 +1,135 @@
+/**
+ * Idempotency primitive. A mutating route can declare `schema.idempotency`; the server then dedupes
+ * on an `Idempotency-Key` header: the first request runs and its response is stored, and a retry with
+ * the same key replays the stored response byte-for-byte without re-running the handler. A retry that
+ * reuses a key with a *different* request body is rejected (409) — a key binds to one request.
+ *
+ * This module is the runtime-neutral core: the store interface, an in-memory store, the request
+ * fingerprint, and response (de)serialization. The server owns the request-path lane that reads the
+ * body, consults the store, and captures the response. All logic here is pure/injectable so it is
+ * unit-tested without a server. A durable store (cross-restart) implements the same interface.
+ */
+/** Default retention for a stored idempotent response: 24 hours. */
+export const DEFAULT_IDEMPOTENCY_TTL_MS = 86_400_000;
+/** Canonical request header carrying the client-chosen idempotency key. */
+export const DEFAULT_IDEMPOTENCY_HEADER = "idempotency-key";
+/** Header stamped on a replayed response so clients/proxies can tell a replay from a fresh run. */
+export const IDEMPOTENT_REPLAY_HEADER = "x-nifra-idempotent-replay";
+const KEY_MAX_LENGTH = 255;
+/** A key must be a non-empty, bounded, control-char-free token. Fail closed on anything else. */
+export function validIdempotencyKey(key) {
+    if (typeof key !== "string" || key.length === 0 || key.length > KEY_MAX_LENGTH)
+        return false;
+    for (let i = 0; i < key.length; i++) {
+        const code = key.charCodeAt(i);
+        if (code <= 31 || code === 127)
+            return false;
+    }
+    return true;
+}
+const encoder = new TextEncoder();
+/**
+ * SHA-256 fingerprint binding a key to one request: method, path (+ query), and the raw body bytes.
+ * A collision-resistant hash matters — a weak hash would let a crafted body replay another's response.
+ */
+export async function computeIdempotencyFingerprint(method, path, body) {
+    const head = encoder.encode(`${method.toUpperCase()}\n${path}\n`);
+    const material = new Uint8Array(head.length + body.length);
+    material.set(head, 0);
+    material.set(body, head.length);
+    const digest = await crypto.subtle.digest("SHA-256", material);
+    const bytes = new Uint8Array(digest);
+    let hex = "";
+    for (let i = 0; i < bytes.length; i++)
+        hex += bytes[i].toString(16).padStart(2, "0");
+    return hex;
+}
+const BASE64_CHUNK = 0x8000;
+function bytesToBase64(bytes) {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i += BASE64_CHUNK) {
+        binary += String.fromCharCode(...bytes.subarray(i, i + BASE64_CHUNK));
+    }
+    return btoa(binary);
+}
+function base64ToBytes(value) {
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+/** Buffer a response into a storable form. Clones first so the live response body stays intact. */
+export async function serializeResponse(response) {
+    const bytes = new Uint8Array(await response.clone().arrayBuffer());
+    return {
+        status: response.status,
+        headers: [...response.headers],
+        body: bytes.length > 0 ? bytesToBase64(bytes) : "",
+    };
+}
+/** Rebuild a live response from storage, stamping the replay marker header. */
+export function responseFromStored(stored) {
+    const headers = new Headers(stored.headers);
+    headers.set(IDEMPOTENT_REPLAY_HEADER, "1");
+    // Reference the Response body type structurally: `BodyInit` isn't a named type under every lib config,
+    // but a fresh `Uint8Array` is a valid body — the cast bridges the `ArrayBufferLike` generic variance.
+    const body = (stored.body === "" ? null : base64ToBytes(stored.body));
+    return new Response(body, { status: stored.status, headers });
+}
+/**
+ * In-process idempotency store. Reservation is atomic by construction — `begin` never awaits, so the
+ * single-threaded event loop serializes concurrent callers for one key. Expired entries are treated
+ * as absent (lazy eviction on access); a periodic {@link MemoryIdempotencyStore.sweep} bounds memory.
+ */
+export class MemoryIdempotencyStore {
+    entries = new Map();
+    now;
+    constructor(options = {}) {
+        this.now = options.now ?? Date.now;
+    }
+    begin(key, fingerprint, ttlMs) {
+        const existing = this.entries.get(key);
+        if (existing !== undefined && existing.expiresAt > this.now()) {
+            if (existing.fingerprint !== fingerprint)
+                return { state: "mismatch" };
+            if (existing.response !== undefined)
+                return { state: "replay", response: existing.response };
+            return { state: "in-flight" };
+        }
+        this.entries.set(key, {
+            fingerprint,
+            expiresAt: this.now() + ttlMs,
+            response: undefined,
+        });
+        return { state: "new" };
+    }
+    complete(key, response) {
+        const entry = this.entries.get(key);
+        if (entry !== undefined)
+            entry.response = response;
+    }
+    abandon(key) {
+        const entry = this.entries.get(key);
+        // Only drop a still-pending reservation; never evict a completed (replayable) response.
+        if (entry !== undefined && entry.response === undefined)
+            this.entries.delete(key);
+    }
+    /** Evict expired entries. Callers may run this on an interval; access-time eviction covers the rest. */
+    sweep() {
+        const now = this.now();
+        for (const [key, entry] of this.entries) {
+            if (entry.expiresAt <= now)
+                this.entries.delete(key);
+        }
+    }
+    /** Live entry count (post-sweep semantics are the caller's; this is a raw size for tests/metrics). */
+    get size() {
+        return this.entries.size;
+    }
+}
+/** Convenience factory mirroring the other core primitives' `create*` style. */
+export function createMemoryIdempotencyStore(options) {
+    return new MemoryIdempotencyStore(options);
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../src/idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,oEAAoE;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,UAAU,CAAA;AAEpD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,iBAAiB,CAAA;AAE3D,mGAAmG;AACnG,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAA;AAEnE,MAAM,cAAc,GAAG,GAAG,CAAA;AAwC1B,iGAAiG;AACjG,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc;QAAE,OAAO,KAAK,CAAA;IAC5F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC9B,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,KAAK,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAAc,EACd,IAAY,EACZ,IAAgB;IAEhB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1D,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC9D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAK,KAAK,CAAC,CAAC,CAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAChG,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,YAAY,GAAG,MAAM,CAAA;AAE3B,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC;QACpD,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,CAAA;IACvE,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACvE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IAClE,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC,OAAO,CAA2C;QACxE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;KACnD,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IACvD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,OAA6B,CAAC,CAAA;IACjE,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAA;IAC1C,uGAAuG;IACvG,sGAAsG;IACtG,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAEhE,CAAA;IACJ,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/D,CAAC;AAaD;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAChB,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAA;IACxC,GAAG,CAAc;IAElC,YAAY,UAAyC,EAAE;QACrD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,WAAmB,EAAE,KAAa;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9D,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;YACtE,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAA;YAC5F,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;QAC/B,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;YACpB,WAAW;YACX,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAA;QACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED,QAAQ,CAAC,GAAW,EAAE,QAAwB;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAA;IACpD,CAAC;IAED,OAAO,CAAC,GAAW;QACjB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,wFAAwF;QACxF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACnF,CAAC;IAED,wGAAwG;IACxG,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACtD,CAAC;IACH,CAAC;IAED,sGAAsG;IACtG,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IAC1B,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,CAC1C,OAAuC;IAEvC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC5C,CAAC"}

package/dist/index.d.ts

@@ -11,11 +11,14 @@
  * (it shipped at "0.0.0" through 1.0.0 before those guards existed). Kept narrow (`as const`) so
  * consumers can pin it at the type level — see `test/version.test-d.ts`.
  */
-export declare const VERSION: "1.9.0";
+export declare const VERSION: "1.10.0";
 export type Version = typeof VERSION;
 export * from "./assurance.js";
+export * from "./capabilities.js";
+export * from "./classification.js";
 export * from "./diff.js";
 export { FrameworkError, RouteConfigError, type RouteConfigErrorCode } from "./errors.js";
+export * from "./idempotency.js";
 export { FRAMEWORK_NAME, type FrameworkName } from "./internal/brand.js";
 export * from "./reflection.js";
 export { METHODS, type Method, Router, type RouterMatch } from "./router/router.js";
@@ -27,7 +30,7 @@ export { type ContextForOp, type ContractShape, defineContract, type HandlersFor
 export { type CookieOptions, parseCookies, serializeCookie, signValue, unsignValue, } from "./server/cookies.js";
 export { commonSecretPatterns, jsonLogger, type LogFields, type Logger, type RedactOptions, redactLogFields, silentLogger, } from "./server/logger.js";
 export type { Registry, RouteInfo } from "./server/registry.js";
-export { type AnyServer, type DurableObjectNamespaceLike, defineIdentityPlugin, definePlugin, defineRouterPlugin, type ExecutionContext, type Handler, type IdentityPlugin, type McpPromptDescriptor, type McpResourceDescriptor, type Middleware, type NifraPlugin, type NodeServeOutcome, type OnRequestResult, type PromptArgument, type PromptMessage, type ResponseFinalization, type RouteDescriptor, type RunningServer, type ScheduledController, type ScheduledHandler, Server, type ServerOptions, server, type ToolAnnotations, toFetchHandler, } from "./server/server.js";
+export { type AdmissionController, type AdmissionDecision, type AnyServer, type DurableObjectNamespaceLike, defineIdentityPlugin, definePlugin, defineRouterPlugin, type ExecutionContext, type Handler, type IdentityPlugin, type McpPromptDescriptor, type McpResourceDescriptor, type Middleware, type NifraPlugin, type NodeServeOutcome, type OnRequestResult, type PromptArgument, type PromptMessage, type ResponseFinalization, type RouteDescriptor, type RunningServer, type ScheduledController, type ScheduledHandler, Server, type ServerOptions, server, type ToolAnnotations, toFetchHandler, } from "./server/server.js";
 export { type SSEContext, type SSEInit, type SSEMessage, type SSEStream, sse, type TypedSSEStream, typedSSEStream, } from "./server/sse.js";
 export { type SignatureEncoding, type VerifyWebhookOptions, verifyWebhook, type WebhookFailureReason, type WebhookProvider, type WebhookResult, } from "./server/webhook.js";
 export type { NifraWebSocket, StandardWebSocket, WebSocketContext, WebSocketData, WebSocketHandler, WebSocketUpgradeOutcome, } from "./server/websocket.js";