@substrat-run/connector-scrive 0.0.2

package/dist/index.d.ts

@@ -0,0 +1,223 @@
+import { type ConnectionId } from '@substrat-run/contracts';
+import type { ConnectorHandler, ConnectorOptions, FetchLike, ScopeHost } from '@substrat-run/kernel';
+export { ScriveApi, SCRIVE_TESTBED, SCRIVE_PRODUCTION } from './api.js';
+export { ScriveMock } from './mock.js';
+export { renderPdf } from './pdf.js';
+/**
+ * The Scrive connector — the OUTBOUND half of external signing.
+ *
+ * `engine-protocol` emits `protocol.signatures-requested` when a vertical
+ * freezes a document and sends it for signature. This turns that into a Scrive
+ * document: create → set file → set parties (BankID) → start.
+ *
+ * ## The return path exists now (#97), but nothing schedules it yet
+ *
+ * The outbound half above is verified against the real testbed. The return path
+ * — recording a completed signature back onto the protocol instance — is
+ * `reconcileScriveDispatch` below. It could not be written until #97: a
+ * signature lives in the SCOPE database, `getScope` demands a `PrincipalId`, and
+ * a connector is not one. #97 gave a connection its own door
+ * (`getConnectorScope`) and made its authority an ordinary permission grant, so
+ * the driver records a signature by invoking `protocol/record-signature` as the
+ * connection itself.
+ *
+ * What each earlier gap became:
+ *
+ * 1. **Recording the provider's document id / dispatch idempotency.** Solved
+ *    without #97 by a directory-side ledger (`ctx.admin.putConnectorState`): a
+ *    redelivery finds the row and skips instead of sending a SECOND document.
+ *    Directory-side because a connector runs INSIDE the scope's dispatch and
+ *    re-entering the scope actor deadlocks. A narrow residual remains (ledger
+ *    write failing after `start` succeeds) — closable with provider-side dedup
+ *    via the `substrat_instance` tag.
+ * 2. **Recording a signature.** Solved by `reconcileScriveDispatch` on the #97
+ *    seam — a top-level operation, OUTSIDE any dispatch, so re-entering the scope
+ *    is safe. `sweepScriveReconciliations` is the poll driver over it: it
+ *    enumerates the dispatch ledger (`listConnectorState`) and reconciles every
+ *    outstanding instance, so completion needs no per-instance caller.
+ *
+ * The one gap that remains: **nothing calls the sweep on a timer** (#96, poll
+ * path). There is no cron, queue or Durable Object alarm in any deployment yet —
+ * the same trigger `drainDue` still lacks — so `sweepScriveReconciliations` runs
+ * from a test or by hand today. That trigger, not the seam or the driver, is why
+ * the connector stays unpublished; it is a deployment concern, not connector
+ * code.
+ */
+export interface ScriveConnectorOptions {
+    /** `SCRIVE_TESTBED` by default; production needs a paid licence. */
+    baseUrl?: string;
+    /**
+     * Where Scrive should POST status changes.
+     *
+     * Scrive's callbacks are **unauthenticated** — there is no signature to
+     * verify — so this must be a capability URL (an unguessable secret in the
+     * path), and a callback must never be trusted as a fact. It is a hint to
+     * re-read `documents/{id}/get`. Optional because polling alone is a complete
+     * strategy and needs no ingress at all (#96).
+     */
+    callbackUrl?: (instanceId: string) => string;
+}
+/**
+ * What the connector remembers about a dispatch, stored per-connection in the
+ * directory (`ctx.admin.putConnectorState`).
+ *
+ * Two jobs. **Outbound idempotency:** a redelivery finds this row and skips
+ * instead of creating a second document. **The return path (#97):** the poll
+ * driver reads it to map a signed provider party back to the scope operation
+ * that records it — which needs, per party, the `requestId` it resolves and the
+ * `signatory` to attribute it to, plus the frozen `contentHash` `recordSignature`
+ * checks the provider against, and the `vertical` to reopen the connection under.
+ * None of that is derivable from Scrive's document, so it is captured here at
+ * dispatch, when the event still carries it.
+ */
+export interface ScriveDispatchState {
+    documentId: string;
+    instanceId: string;
+    scopeId: string;
+    tenantId: string;
+    /** The scope's vertical — half the key that reopens the connection to poll. */
+    vertical: string;
+    /**
+     * The frozen content hash from `protocol.signatures-requested`. Reported back
+     * verbatim on record: `recordSignature` re-derives the frozen hash and refuses
+     * a signature whose reported hash disagrees, so the document that was signed is
+     * provably the document that was frozen.
+     */
+    contentHash: string;
+    /**
+     * The dispatched parties, in the order sent to Scrive — which is the order
+     * Scrive returns them, so the Nth provider party is this Nth entry. Carries
+     * what `recordSignature` cannot get from the provider: the `requestId` to
+     * resolve and the substrat `ref`/`kind` to attribute the signature to.
+     */
+    parties: {
+        requestId: string;
+        label: string;
+        kind: 'principal' | 'external';
+        /** The substrat signatory, when known up front; null when identity is only learned at signing. */
+        ref: string | null;
+    }[];
+    /** Requests already recorded by a prior poll — so a re-poll is a no-op, not a double. */
+    recordedRequestIds?: string[];
+    dispatchedAt: string;
+}
+/**
+ * Build the handler. Register it with `host.registerConnector`.
+ *
+ * Only reacts to `method: 'scrive'` — a vertical asking for BankID through
+ * another provider emits the same event, and this must not answer for it.
+ */
+export declare function scriveConnector(options: ScriveConnectorOptions): ConnectorHandler;
+/**
+ * Register the connector on a host.
+ *
+ * `maxAttempts` is deliberately higher than the executor default: a provider
+ * being briefly unreachable is ordinary, and giving up on a signature request
+ * after five tries would be giving up on a contract.
+ */
+export declare function registerScriveConnector(host: ScopeHost, options: ScriveConnectorOptions & {
+    id?: string;
+    retry?: ConnectorOptions;
+}): void;
+/** The outcome of reconciling one dispatched instance against the provider. */
+export interface ScriveReconcileResult {
+    /** The provider document reconciled. */
+    documentId: string;
+    /** Scrive's current document status (`pending`, `closed`, `rejected`, …). */
+    documentStatus: string;
+    /** Requests recorded as signed on THIS run (empty if nothing new completed). */
+    recorded: {
+        requestId: string;
+        signedAt: string;
+    }[];
+    /** Parties the provider reports as signed that the driver could not record, and why. */
+    skipped: {
+        requestId: string;
+        reason: string;
+    }[];
+    /** True once every party in the set has been recorded into the scope. */
+    complete: boolean;
+}
+/**
+ * The RETURN path (#97): read the provider's state for one dispatched instance
+ * and record any completed signatures back into the scope.
+ *
+ * This is the half the connector could not do until #97 landed. A provider's
+ * signature has to be written onto the protocol instance in the SCOPE, and a
+ * connector is not a `PrincipalId`, so `getScope` could not let it in. #97 gives
+ * the door a connection can walk through — `getConnectorScope(connectionId,
+ * scopeId)` returns a stub whose authority is the connection itself, and what it
+ * may do is an ordinary permission check against `connection:<id>` grants. So
+ * this records a signature by invoking `protocol/record-signature` on that stub;
+ * it works iff the connection was granted `protocol:record-signature`
+ * (`grantToConnection`), which appears in the permission diff like any grant.
+ *
+ * **Why a top-level function and not the dispatch handler.** A connector runs
+ * INSIDE the scope's dispatch, and re-entering the scope actor from there
+ * deadlocks (the reason dispatch idempotency lives in the directory, not the
+ * scope). Recording runs as its own top-level operation, outside any dispatch —
+ * which is exactly what a poll driver or a callback ingress is. Neither exists
+ * yet (nothing schedules this — issue #96); this is the reconcile step both will
+ * call, made correct and testable now, invoked by hand or by a test until a
+ * scheduler lands.
+ *
+ * Idempotent by construction: signed requests are remembered in the ledger, so a
+ * re-poll of a half-signed set records only what is newly done, and re-polling a
+ * fully-signed set records nothing.
+ *
+ * `fetch` is passed in because sanctioned egress is the host's to own and it
+ * exposes no top-level opener; the same `fetch` the host was built with is
+ * bound here to the connection (with health recorded via `recordConnectionUse`),
+ * mirroring what the dispatch context does internally.
+ */
+export declare function reconcileScriveDispatch(host: ScopeHost, connectionId: ConnectionId, instanceId: string, options: {
+    fetch: FetchLike;
+    baseUrl?: string;
+    timeoutMs?: number;
+}): Promise<ScriveReconcileResult>;
+/** What one sweep of a connection's outstanding dispatches did. */
+export interface ScriveSweepResult {
+    /** Dispatch ledger rows enumerated for the connection. */
+    found: number;
+    /** Rows the ledger already shows fully recorded — not polled against the provider. */
+    skipped: number;
+    /** Rows reconciled against the provider this sweep. */
+    polled: number;
+    /** Instances that reached "every party signed" this sweep. */
+    completed: string[];
+    /** Instances polled but still awaiting at least one signature. */
+    outstanding: string[];
+    /** Per-instance reconcile failures; the sweep continues past them. */
+    failed: {
+        instanceId: string;
+        error: string;
+    }[];
+}
+/**
+ * The SCHEDULER's unit of work (#96, poll path): reconcile every outstanding
+ * dispatch for one connection against the provider.
+ *
+ * `reconcileScriveDispatch` records the signatures for ONE known instance; this
+ * is what finds the instances. It enumerates the dispatch ledger
+ * (`listConnectorState(connectionId, 'scrive:dispatch:')` — the read that method
+ * exists for) and reconciles each row that is not already fully recorded. A
+ * timer calls this; it holds no timer itself. That keeps the trigger a
+ * deployment concern (a Cloudflare cron or Durable Object alarm, the same home
+ * `drainDue` still needs) and this a plain, testable function.
+ *
+ * Robust by construction, because a poller must be: a row already complete per
+ * the ledger is skipped without touching the provider (so a finished signature
+ * is not re-fetched on every tick), and a provider error on one instance is
+ * recorded and stepped over rather than sinking the batch. Idempotent — running
+ * it twice over the same state records nothing the second time.
+ *
+ * Scoped to one connection deliberately: a connection is (tenant, vertical,
+ * provider), so a sweep never crosses a tenant. A platform sweeper iterates the
+ * connections it is responsible for and calls this for each.
+ */
+export declare function sweepScriveReconciliations(host: ScopeHost, connectionId: ConnectionId, options: {
+    fetch: FetchLike;
+    baseUrl?: string;
+    timeoutMs?: number;
+}): Promise<ScriveSweepResult>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,YAAY,EAAoB,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAEV,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EAET,SAAS,EACV,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;CAC9C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC;QAC/B,kGAAkG;QAClG,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KACpB,EAAE,CAAC;IACJ,yFAAyF;IACzF,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;CACtB;AA6BD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,gBAAgB,CAiGjF;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,sBAAsB,GAAG;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,gBAAgB,CAAA;CAAE,GAC1E,IAAI,CAaN;AAED,+EAA+E;AAC/E,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,QAAQ,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD,wFAAwF;IACxF,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjD,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,SAAS,EACf,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,CAAC,qBAAqB,CAAC,CAyGhC;AAED,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IAChC,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,kEAAkE;IAClE,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,sEAAsE;IACtE,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,SAAS,EACf,YAAY,EAAE,YAAY,EAC1B,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAClE,OAAO,CAAC,iBAAiB,CAAC,CAgC5B"}

package/dist/index.js

@@ -0,0 +1,353 @@
+import { z } from 'zod';
+import { scopeId, tenantId } from '@substrat-run/contracts';
+import { ScriveApi, SCRIVE_TESTBED } from './api.js';
+import { renderPdf } from './pdf.js';
+export { ScriveApi, SCRIVE_TESTBED, SCRIVE_PRODUCTION } from './api.js';
+export { ScriveMock } from './mock.js';
+export { renderPdf } from './pdf.js';
+/**
+ * The connector-state key prefix under which every dispatch ledger row lives —
+ * the handle the poll sweep enumerates by (`listConnectorState(id, prefix)`).
+ */
+const DISPATCH_PREFIX = 'scrive:dispatch:';
+/** The connector-state key for one signature request set. */
+const dispatchKey = (instanceId) => `${DISPATCH_PREFIX}${instanceId}`;
+/** The payload half of `protocol.signatures-requested` this connector reads. */
+const signaturesRequested = z.object({
+    instanceId: z.string().min(1),
+    templateKey: z.string().min(1),
+    templateVersion: z.number().int(),
+    contentHash: z.string().min(1),
+    boundHash: z.string().nullable().optional(),
+    method: z.string().min(1),
+    parties: z.array(z.object({
+        requestId: z.string().min(1),
+        label: z.string().min(1),
+        kind: z.enum(['principal', 'external']),
+        ref: z.string().nullable(),
+        signatureKind: z.enum(['primary', 'counter']),
+    })),
+});
+/**
+ * Build the handler. Register it with `host.registerConnector`.
+ *
+ * Only reacts to `method: 'scrive'` — a vertical asking for BankID through
+ * another provider emits the same event, and this must not answer for it.
+ */
+export function scriveConnector(options) {
+    const baseUrl = options.baseUrl ?? SCRIVE_TESTBED;
+    return async (ctx, event) => {
+        const payload = signaturesRequested.parse(event.payload);
+        if (payload.method !== 'scrive')
+            return; // not ours; delivered, not effected
+        const conn = await ctx.connection('scrive');
+        // Idempotency (#101 gap 3). Delivery is at-least-once, so a redelivery must
+        // not create a SECOND Scrive document — duplicate legal paperwork sent to
+        // real signatories. The connector cannot record "done" in the scope, because
+        // it runs INSIDE the scope's dispatch and re-entering the scope actor
+        // deadlocks (verified). So the dispatch ledger lives in the directory, which
+        // `ctx.admin` reaches without touching the scope.
+        const key = dispatchKey(payload.instanceId);
+        const prior = (await ctx.admin.getConnectorState(conn.id, key));
+        if (prior)
+            return; // already dispatched — do nothing, idempotently
+        const api = new ScriveApi(conn, baseUrl);
+        // The artifact. NOT the avtal — this connector cannot read the vertical's
+        // content, and should not learn its vocabulary in order to try. It renders
+        // an attestation sheet naming what is being signed and the hash it is
+        // identified by. A real contract needs the vertical's own rendering plus a
+        // document store, and neither exists (see README).
+        const pdf = renderPdf({
+            title: `${payload.templateKey} v${payload.templateVersion}`,
+            lines: [
+                `Instans: ${payload.instanceId}`,
+                `Innehållshash (SHA-256): ${payload.contentHash}`,
+                ...(payload.boundHash ? [`Dokumenthash: ${payload.boundHash}`] : []),
+                '',
+                'Parter:',
+                ...payload.parties.map((p) => `  ${p.label} (${p.signatureKind})`),
+                '',
+                'Signaturen avser innehållet som identifieras av hashen ovan.',
+            ],
+        });
+        const doc = await api.createDocument();
+        await api.setFile(doc.id, `${payload.templateKey}.pdf`, pdf);
+        await api.update(doc.id, {
+            title: `${payload.templateKey} v${payload.templateVersion}`,
+            ...(options.callbackUrl ? { callbackUrl: options.callbackUrl(payload.instanceId) } : {}),
+            // Tag the document with the instance id (verified settable). It is not yet
+            // used for dedup — the list-by-tag filter needs a query syntax not settled
+            // here — but it makes the eventual provider-side reconciliation that would
+            // close the narrow create-then-record window (below) a filter away.
+            tags: [{ name: 'substrat_instance', value: payload.instanceId }],
+            parties: payload.parties.map((p) => ({
+                name: p.label,
+                // BankID for external signatories; a principal signing through the
+                // provider still authenticates, but the flow does not require the
+                // stronger method to be meaningful.
+                authenticationMethodToSign: p.kind === 'external' ? 'se_bankid' : 'standard',
+                // Scrive auto-adds the API user as the author, and exactly one party
+                // must be it. The issuing (primary) party is the sender's side, so it
+                // is the author — and it still signs. Verified: an explicit author
+                // party in `update` replaces the auto one.
+                isAuthor: p.signatureKind === 'primary',
+                isSignatory: true,
+            })),
+        });
+        await api.start(doc.id);
+        // Record the dispatch so a redelivery skips it. This is the write that
+        // closes the duplicate hole for the common case (a retry after a fully
+        // successful dispatch).
+        //
+        // The residual: if this write itself fails after `start` succeeded, the
+        // retry finds no state and creates a second document. Closing that fully
+        // needs provider-side dedup — the `substrat_instance` tag set above, once a
+        // list-by-tag query lets the connector adopt an existing document instead of
+        // creating one. Left as a follow-up; a rare double is a large improvement on
+        // every-retry-doubles.
+        const state = {
+            documentId: doc.id,
+            instanceId: payload.instanceId,
+            scopeId: ctx.scopeId,
+            tenantId: ctx.tenantId,
+            vertical: ctx.vertical,
+            contentHash: payload.contentHash,
+            parties: payload.parties.map((p) => ({
+                requestId: p.requestId,
+                label: p.label,
+                kind: p.kind,
+                ref: p.ref,
+            })),
+            dispatchedAt: event.occurredAt,
+        };
+        await ctx.admin.putConnectorState(conn.id, key, state);
+    };
+}
+/**
+ * Register the connector on a host.
+ *
+ * `maxAttempts` is deliberately higher than the executor default: a provider
+ * being briefly unreachable is ordinary, and giving up on a signature request
+ * after five tries would be giving up on a contract.
+ */
+export function registerScriveConnector(host, options) {
+    host.registerConnector(options.id ?? 'scrive', 'protocol.signatures-requested', scriveConnector(options), {
+        maxAttempts: 8,
+        baseDelayMs: 5_000,
+        maxDelayMs: 900_000,
+        timeoutMs: 30_000,
+        ...options.retry,
+    });
+}
+/**
+ * The RETURN path (#97): read the provider's state for one dispatched instance
+ * and record any completed signatures back into the scope.
+ *
+ * This is the half the connector could not do until #97 landed. A provider's
+ * signature has to be written onto the protocol instance in the SCOPE, and a
+ * connector is not a `PrincipalId`, so `getScope` could not let it in. #97 gives
+ * the door a connection can walk through — `getConnectorScope(connectionId,
+ * scopeId)` returns a stub whose authority is the connection itself, and what it
+ * may do is an ordinary permission check against `connection:<id>` grants. So
+ * this records a signature by invoking `protocol/record-signature` on that stub;
+ * it works iff the connection was granted `protocol:record-signature`
+ * (`grantToConnection`), which appears in the permission diff like any grant.
+ *
+ * **Why a top-level function and not the dispatch handler.** A connector runs
+ * INSIDE the scope's dispatch, and re-entering the scope actor from there
+ * deadlocks (the reason dispatch idempotency lives in the directory, not the
+ * scope). Recording runs as its own top-level operation, outside any dispatch —
+ * which is exactly what a poll driver or a callback ingress is. Neither exists
+ * yet (nothing schedules this — issue #96); this is the reconcile step both will
+ * call, made correct and testable now, invoked by hand or by a test until a
+ * scheduler lands.
+ *
+ * Idempotent by construction: signed requests are remembered in the ledger, so a
+ * re-poll of a half-signed set records only what is newly done, and re-polling a
+ * fully-signed set records nothing.
+ *
+ * `fetch` is passed in because sanctioned egress is the host's to own and it
+ * exposes no top-level opener; the same `fetch` the host was built with is
+ * bound here to the connection (with health recorded via `recordConnectionUse`),
+ * mirroring what the dispatch context does internally.
+ */
+export async function reconcileScriveDispatch(host, connectionId, instanceId, options) {
+    const admin = host.admin;
+    const key = dispatchKey(instanceId);
+    const state = (await admin.getConnectorState(connectionId, key));
+    if (!state) {
+        throw new Error(`no scrive dispatch recorded for instance ${instanceId} on connection ${connectionId} — ` +
+            `nothing to reconcile`);
+    }
+    // Read the provider's truth. A callback would only be a hint to do exactly
+    // this; the fact is `documents/{id}/get`.
+    const conn = await openScriveConnection(admin, options.fetch, tenantId.parse(state.tenantId), state.vertical, options.timeoutMs ?? 30_000);
+    const doc = await new ScriveApi(conn, options.baseUrl ?? SCRIVE_TESTBED).get(state.documentId);
+    // The connection acting as itself (#97). Refuses a scope in another tenant or
+    // running another vertical by construction, and every write below is gated on
+    // the connection's own `protocol:record-signature` grant.
+    const scope = await host.getConnectorScope(connectionId, scopeId.parse(state.scopeId));
+    const recorded = [];
+    const skipped = [];
+    const done = new Set(state.recordedRequestIds ?? []);
+    for (const [i, party] of state.parties.entries()) {
+        if (done.has(party.requestId))
+            continue; // recorded on an earlier poll
+        const providerParty = doc.parties[i];
+        const signedAt = providerParty?.sign_time ?? null;
+        if (!signedAt)
+            continue; // not signed yet
+        // Fail closed on a party-order mismatch rather than attributing a signature
+        // to the wrong request. The connector sends exactly the party set Scrive
+        // keeps, in order, so index alignment holds for this model; if a provider
+        // ever reorders, the name disagreeing is the signal to move to name-keyed
+        // matching — and until then this refuses to guess.
+        const providerName = providerParty?.fields?.find((f) => f.type === 'name')?.value;
+        if (providerName !== undefined && providerName !== party.label) {
+            skipped.push({
+                requestId: party.requestId,
+                reason: `provider party ${i} is '${String(providerName)}', dispatch expected '${party.label}' — refusing to attribute`,
+            });
+            continue;
+        }
+        if (!party.ref) {
+            // The request named no signatory up front and the connector does not
+            // extract the signer's identity from the provider (personnummer is direct
+            // PII we deliberately never persist), so there is no `ref` to attribute to.
+            skipped.push({
+                requestId: party.requestId,
+                reason: 'provider reports a signature but the request named no signatory ref to attribute it to',
+            });
+            continue;
+        }
+        try {
+            await scope.invoke('protocol/record-signature', {
+                requestId: party.requestId,
+                signatory: { kind: party.kind, ref: party.ref, label: party.label },
+                signedAt,
+                // Reported verbatim; `recordSignature` checks it against the re-derived
+                // frozen hash and fails closed on disagreement.
+                contentHash: state.contentHash,
+                // Where the proof lives at the provider — the sealed document.
+                evidenceRef: `scrive:document:${state.documentId}`,
+            });
+            recorded.push({ requestId: party.requestId, signedAt });
+            done.add(party.requestId);
+        }
+        catch (err) {
+            // A request already resolved (a racing poll, or a redelivery) is not an
+            // error to this driver — the signature is on the instance, which is the
+            // goal. Anything else is real and propagates.
+            const msg = err instanceof Error ? err.message : String(err);
+            if (/already/i.test(msg)) {
+                done.add(party.requestId);
+                continue;
+            }
+            throw err;
+        }
+    }
+    // Remember what is recorded so a re-poll skips it without leaning on
+    // `recordSignature` throwing. Same row as the dispatch ledger, so the dispatch
+    // idempotency guard still finds it.
+    if (recorded.length) {
+        await admin.putConnectorState(connectionId, key, {
+            ...state,
+            recordedRequestIds: [...done],
+        });
+    }
+    return {
+        documentId: state.documentId,
+        documentStatus: doc.status,
+        recorded,
+        skipped,
+        complete: state.parties.every((p) => done.has(p.requestId)),
+    };
+}
+/**
+ * The SCHEDULER's unit of work (#96, poll path): reconcile every outstanding
+ * dispatch for one connection against the provider.
+ *
+ * `reconcileScriveDispatch` records the signatures for ONE known instance; this
+ * is what finds the instances. It enumerates the dispatch ledger
+ * (`listConnectorState(connectionId, 'scrive:dispatch:')` — the read that method
+ * exists for) and reconciles each row that is not already fully recorded. A
+ * timer calls this; it holds no timer itself. That keeps the trigger a
+ * deployment concern (a Cloudflare cron or Durable Object alarm, the same home
+ * `drainDue` still needs) and this a plain, testable function.
+ *
+ * Robust by construction, because a poller must be: a row already complete per
+ * the ledger is skipped without touching the provider (so a finished signature
+ * is not re-fetched on every tick), and a provider error on one instance is
+ * recorded and stepped over rather than sinking the batch. Idempotent — running
+ * it twice over the same state records nothing the second time.
+ *
+ * Scoped to one connection deliberately: a connection is (tenant, vertical,
+ * provider), so a sweep never crosses a tenant. A platform sweeper iterates the
+ * connections it is responsible for and calls this for each.
+ */
+export async function sweepScriveReconciliations(host, connectionId, options) {
+    const entries = await host.admin.listConnectorState(connectionId, DISPATCH_PREFIX);
+    const result = {
+        found: entries.length,
+        skipped: 0,
+        polled: 0,
+        completed: [],
+        outstanding: [],
+        failed: [],
+    };
+    for (const { value } of entries) {
+        const state = value;
+        // The ledger already knows this one is done — don't poll a settled document.
+        const done = new Set(state.recordedRequestIds ?? []);
+        if (state.parties.length > 0 && state.parties.every((p) => done.has(p.requestId))) {
+            result.skipped += 1;
+            continue;
+        }
+        try {
+            const r = await reconcileScriveDispatch(host, connectionId, state.instanceId, options);
+            result.polled += 1;
+            (r.complete ? result.completed : result.outstanding).push(state.instanceId);
+        }
+        catch (err) {
+            result.failed.push({
+                instanceId: state.instanceId,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    return result;
+}
+/**
+ * Open the connection with egress bound to it — the same binding the dispatch
+ * context makes internally, rebuilt here from public `HostAdmin` methods because
+ * the host exposes no top-level opener. Health lands on the right connection via
+ * `recordConnectionUse`, exactly as a dispatched call's does.
+ *
+ * (The cleaner home is a host method that hands a `ConnectorConnection` to any
+ * caller, dispatch or poll; that is a kernel addition for when the scheduler
+ * lands, not a precondition for the record-back path.)
+ */
+async function openScriveConnection(admin, fetchImpl, tenant, vertical, timeoutMs) {
+    const open = await admin.openConnection(tenant, vertical, 'scrive');
+    if (!open) {
+        throw new Error(`no live 'scrive' connection for tenant ${tenant} / vertical '${vertical}'`);
+    }
+    return {
+        ...open,
+        fetch: async (input, init) => {
+            try {
+                const res = await fetchImpl(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+                await admin.recordConnectionUse(open.id, res.ok ? { ok: true } : { ok: false, error: `HTTP ${res.status} from scrive` });
+                return res;
+            }
+            catch (err) {
+                await admin.recordConnectionUse(open.id, {
+                    ok: false,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+                throw err;
+            }
+        },
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAuC,MAAM,yBAAyB,CAAC;AASjG,OAAO,EAAE,SAAS,EAAE,cAAc,EAAoB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAMrC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAsGrC;;;GAGG;AACH,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,6DAA6D;AAC7D,MAAM,WAAW,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,GAAG,eAAe,GAAG,UAAU,EAAE,CAAC;AAEtF,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,MAAM,CAAC;QACP,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;KAC9C,CAAC,CACH;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IAElD,OAAO,KAAK,EAAE,GAAG,EAAE,KAAkB,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,CAAC,oCAAoC;QAE7E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE5C,4EAA4E;QAC5E,0EAA0E;QAC1E,6EAA6E;QAC7E,sEAAsE;QACtE,6EAA6E;QAC7E,kDAAkD;QAClD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAEjD,CAAC;QACd,IAAI,KAAK;YAAE,OAAO,CAAC,gDAAgD;QAEnE,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEzC,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,GAAG,GAAG,SAAS,CAAC;YACpB,KAAK,EAAE,GAAG,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,eAAe,EAAE;YAC3D,KAAK,EAAE;gBACL,YAAY,OAAO,CAAC,UAAU,EAAE;gBAChC,4BAA4B,OAAO,CAAC,WAAW,EAAE;gBACjD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,EAAE;gBACF,SAAS;gBACT,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,aAAa,GAAG,CAAC;gBAClE,EAAE;gBACF,8DAA8D;aAC/D;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC;QACvC,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,WAAW,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;YACvB,KAAK,EAAE,GAAG,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,eAAe,EAAE;YAC3D,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,2EAA2E;YAC3E,2EAA2E;YAC3E,2EAA2E;YAC3E,oEAAoE;YACpE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;YAChE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAC1B,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC;gBACnB,IAAI,EAAE,CAAC,CAAC,KAAK;gBACb,mEAAmE;gBACnE,kEAAkE;gBAClE,oCAAoC;gBACpC,0BAA0B,EAAE,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;gBAC5E,qEAAqE;gBACrE,sEAAsE;gBACtE,mEAAmE;gBACnE,2CAA2C;gBAC3C,QAAQ,EAAE,CAAC,CAAC,aAAa,KAAK,SAAS;gBACvC,WAAW,EAAE,IAAI;aAClB,CAAC,CACH;SACF,CAAC,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAExB,uEAAuE;QACvE,uEAAuE;QACvE,wBAAwB;QACxB,EAAE;QACF,wEAAwE;QACxE,yEAAyE;QACzE,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,uBAAuB;QACvB,MAAM,KAAK,GAAwB;YACjC,UAAU,EAAE,GAAG,CAAC,EAAE;YAClB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnC,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,EAAE,CAAC,CAAC,GAAG;aACX,CAAC,CAAC;YACH,YAAY,EAAE,KAAK,CAAC,UAAU;SAC/B,CAAC;QACF,MAAM,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAe,EACf,OAA2E;IAE3E,IAAI,CAAC,iBAAiB,CACpB,OAAO,CAAC,EAAE,IAAI,QAAQ,EACtB,+BAA+B,EAC/B,eAAe,CAAC,OAAO,CAAC,EACxB;QACE,WAAW,EAAE,CAAC;QACd,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,MAAM;QACjB,GAAG,OAAO,CAAC,KAAK;KACjB,CACF,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAe,EACf,YAA0B,EAC1B,UAAkB,EAClB,OAAmE;IAEnE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAoC,CAAC;IACpG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,4CAA4C,UAAU,kBAAkB,YAAY,KAAK;YACvF,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,IAAI,GAAG,MAAM,oBAAoB,CACrC,KAAK,EACL,OAAO,CAAC,KAAK,EACb,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC9B,KAAK,CAAC,QAAQ,EACd,OAAO,CAAC,SAAS,IAAI,MAAM,CAC5B,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE/F,8EAA8E;IAC9E,8EAA8E;IAC9E,0DAA0D;IAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvF,MAAM,QAAQ,GAA8C,EAAE,CAAC;IAC/D,MAAM,OAAO,GAA4C,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;IAErD,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,8BAA8B;QACvE,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,aAAa,EAAE,SAAS,IAAI,IAAI,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,SAAS,CAAC,iBAAiB;QAE1C,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,0EAA0E;QAC1E,mDAAmD;QACnD,MAAM,YAAY,GAAG,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC;QAClF,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,kBAAkB,CAAC,QAAQ,MAAM,CAAC,YAAY,CAAC,yBAAyB,KAAK,CAAC,KAAK,2BAA2B;aACvH,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACf,qEAAqE;YACrE,0EAA0E;YAC1E,4EAA4E;YAC5E,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,wFAAwF;aACjG,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,MAAM,CAAC,2BAA2B,EAAE;gBAC9C,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBACnE,QAAQ;gBACR,wEAAwE;gBACxE,gDAAgD;gBAChD,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,+DAA+D;gBAC/D,WAAW,EAAE,mBAAmB,KAAK,CAAC,UAAU,EAAE;aACnD,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,wEAAwE;YACxE,8CAA8C;YAC9C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,+EAA+E;IAC/E,oCAAoC;IACpC,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,KAAK,CAAC,iBAAiB,CAAC,YAAY,EAAE,GAAG,EAAE;YAC/C,GAAG,KAAK;YACR,kBAAkB,EAAE,CAAC,GAAG,IAAI,CAAC;SACA,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,GAAG,CAAC,MAAM;QAC1B,QAAQ;QACR,OAAO;QACP,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;KAC5D,CAAC;AACJ,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAe,EACf,YAA0B,EAC1B,OAAmE;IAEnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IACnF,MAAM,MAAM,GAAsB;QAChC,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,CAAC;QACT,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAA4B,CAAC;QAC3C,6EAA6E;QAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvF,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,oBAAoB,CACjC,KAAgB,EAChB,SAAoB,EACpB,MAAyC,EACzC,QAAgB,EAChB,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,gBAAgB,QAAQ,GAAG,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACxF,MAAM,KAAK,CAAC,mBAAmB,CAC7B,IAAI,CAAC,EAAE,EACP,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,cAAc,EAAE,CAC/E,CAAC;gBACF,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE;oBACvC,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/mock.d.ts

@@ -0,0 +1,60 @@
+import type { FetchLike } from '@substrat-run/kernel';
+/**
+ * Scrive, in memory.
+ *
+ * ## What this is for
+ *
+ * A connector cannot be exercised end to end without a provider, and a provider
+ * account is not always available. This implements the documented endpoints so
+ * the seam — credential resolution, egress, health, retry, the document
+ * lifecycle — can be tested today.
+ *
+ * ## What it proves, and what it does not
+ *
+ * It proves OUR shape works. It cannot prove our reading of Scrive's API is
+ * right, because it *is* our reading of Scrive's API: same author, same
+ * misunderstandings, in both halves. A green suite here means "ready to check
+ * against a testbed account", never "verified".
+ *
+ * The specific things a mock like this will always get wrong until someone runs
+ * the real thing: auth handshakes, exact response shapes, error bodies, rate
+ * limits, and every asynchronous timing behaviour that matters.
+ *
+ * It stays useful afterwards: a real provider will not return 503 on demand, or
+ * let you fast-forward two days to a signature.
+ */
+interface MockDocument {
+    id: string;
+    status: 'preparation' | 'pending' | 'closed' | 'canceled' | 'timedout' | 'rejected';
+    title: string;
+    callbackUrl: string | null;
+    file: {
+        name: string;
+        bytes: number;
+    } | null;
+    parties: {
+        id: string;
+        name: string;
+        signTime: string | null;
+        auth: string;
+    }[];
+}
+export interface ScriveMockOptions {
+    /** Reject every call with this HTTP status — the failure path on demand. */
+    failWith?: number;
+}
+export declare class ScriveMock {
+    readonly documents: Map<string, MockDocument>;
+    private seq;
+    failWith: number | undefined;
+    constructor(options?: ScriveMockOptions);
+    /** Simulate a party completing BankID. The provider-side event we cannot cause for real. */
+    sign(documentId: string, partyIndex: number, at: string): void;
+    decline(documentId: string): void;
+    private mustGet;
+    private wire;
+    /** The `fetch` to hand a host. */
+    get fetch(): FetchLike;
+}
+export {};
+//# sourceMappingURL=mock.d.ts.map