apcore-a2a 0.5.0 → 0.7.0

package/dist/openapi-backend.js

@@ -0,0 +1,453 @@
+/**
+ * OpenAPI backend — serve an OpenAPI 3.0/3.1 document as A2A Skills.
+ *
+ * Pipeline:
+ *
+ *     loadSpec -> OpenAPIScanner.scan -> [repair] -> HTTPProxyRegistryWriter.write -> Registry
+ *
+ * The scanner and the writer live in apcore-toolkit; this module composes them
+ * and adds the two repairs the composition needs, neither of which the toolkit
+ * can make on its own:
+ *
+ * - **FR-OAS-002 module-ID projection.** The toolkit sanitizes a derived ID into
+ *   `[A-Za-z0-9_.-]`; apcore's registry accepts only
+ *   `^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$`. Without the projection the canonical
+ *   Swagger Petstore scans cleanly and registers nothing — the server starts and
+ *   serves an Agent Card with zero skills, and nothing in the path raises.
+ * - **FR-OAS-003 description repair.** An operation with neither `summary` nor
+ *   `description` yields `""`, and `AgentCardBuilder` skips a module whose
+ *   description is empty — so the operation would vanish from the Agent Card with
+ *   no diagnostic.
+ *
+ * See `apcore-a2a/docs/features/openapi-backend.md` for the specification and
+ * `conformance/fixtures/openapi_backend.json` for the shared contract.
+ */
+import path from "node:path";
+import { Config, Registry } from "apcore-js";
+import { HTTPProxyRegistryWriter, OpenAPIScanner, cloneModule, loadSpec, } from "apcore-toolkit";
+/**
+ * One dot-separated segment of an apcore-legal module ID. apcore enforces
+ * `^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$` at `Registry.register` and again at
+ * `Executor.call`; a segment may not begin with a digit, which is why some
+ * derived IDs cannot be repaired at all.
+ */
+export const MODULE_ID_SEGMENT = /^[a-z][a-z0-9_]*$/;
+/** HTTP methods that change state. The population FR-OAS-005 warns about. */
+export const WRITE_METHODS = new Set([
+    "POST",
+    "PUT",
+    "PATCH",
+    "DELETE",
+]);
+const URL_SCHEMES = ["http://", "https://"];
+const CONSOLE_LOGGER = {
+    warn: (message) => console.warn(message),
+    error: (message) => console.error(message),
+    info: (message) => console.info(message),
+};
+/**
+ * Project a toolkit-derived module ID into apcore's registry alphabet.
+ *
+ * Lowercase, then `-` -> `_`. Returns `null` when the result still has a segment
+ * apcore would reject — such an ID cannot be repaired without *inventing* a
+ * character, which is a naming decision belonging to the operator's own hook
+ * rather than to a silent default. The module is dropped and reported by the
+ * caller.
+ */
+export function projectModuleId(moduleId) {
+    const candidate = moduleId.toLowerCase().replace(/-/g, "_");
+    if (candidate === "")
+        return null;
+    if (!candidate.split(".").every((segment) => MODULE_ID_SEGMENT.test(segment))) {
+        return null;
+    }
+    return candidate;
+}
+/** The first segment of a projected ID that apcore would still reject. */
+function offendingSegment(moduleId) {
+    const candidate = moduleId.toLowerCase().replace(/-/g, "_");
+    return (candidate.split(".").find((segment) => !MODULE_ID_SEGMENT.test(segment)) ?? candidate);
+}
+/**
+ * Build a `{METHOD} {path}` description for an undocumented operation.
+ *
+ * Uses the `http_method` / `url_path` metadata keys `HTTPProxyRegistryWriter`
+ * already requires, so the value is factual and stable across scans of the same
+ * document. Deliberately terse so it reads as a placeholder rather than as
+ * documentation.
+ */
+export function synthesizeDescription(module) {
+    const metadata = module.metadata ?? {};
+    // String-only, never a coercion. `String(123)` would put a bare number on the
+    // PUBLIC Agent Card as if it were an HTTP method, and `String(false)` would
+    // put "FALSE" there — a method that does not exist, published to a route
+    // served without authentication and built to be crawled. A non-string here
+    // means the metadata is malformed — reachable from a caller's own
+    // `transformOperation` hook or a vendor extension — and the honest answer is
+    // to treat the field as absent and fall through the chain below. Rust's
+    // `as_str()` already did this; TypeScript and Python were the two that coerced.
+    const rawMethod = metadata.http_method;
+    const rawPath = metadata.url_path;
+    const method = typeof rawMethod === "string" ? rawMethod.trim().toUpperCase() : "";
+    const urlPath = typeof rawPath === "string" ? rawPath.trim() : "";
+    if (method && urlPath)
+        return `${method} ${urlPath}`;
+    if (method)
+        return method;
+    return urlPath || String(module.moduleId ?? "") || "operation";
+}
+/**
+ * The base a relative `spec` resolves against (FR-OAS-004 rule 3).
+ *
+ * `Config.projectRoot` is apcore 0.30.0's public accessor. It reports a base and
+ * applies nothing, which is exactly the division of labour this key needs: the
+ * adapter owns the resolution because `Config.pathTypedKeys()` never reaches a
+ * consumer namespace.
+ */
+export function resolveProjectRoot(explicit) {
+    if (explicit)
+        return explicit;
+    try {
+        const root = Config.load(undefined, { validate: false }).projectRoot;
+        if (root)
+            return root;
+    }
+    catch {
+        // A missing or unloadable apcore config is not fatal here; the CWD is the
+        // same answer `Config.projectRoot` gives when no config file was found.
+    }
+    return process.cwd();
+}
+/**
+ * Resolve `apcore-a2a.openapi.spec` (FR-OAS-004).
+ *
+ * apcore 0.30.0 declared the closed set of path-typed configuration keys and the
+ * base a relative one resolves against, but `Config.pathTypedKeys()` is a fixed
+ * list of apcore's own keys and never consults a namespace registered through
+ * `Config.registerNamespace` — verified against apcore 0.30.0. The §9.2.1
+ * requirement-5 empty-value discard is gated on that same set, so
+ * `APCORE_A2A_OPENAPI_SPEC=` would otherwise become an ordinary override to `""`,
+ * a legal relative path to every filesystem API and never the one an operator
+ * meant. This binding therefore owns the three rules rather than inheriting them.
+ *
+ * 1. A value beginning `http://` / `https://` is a URL, used verbatim — never
+ *    path-resolved, never made absolute.
+ * 2. A set-but-empty value is discarded with a WARNING and the caller falls
+ *    through to the next configuration tier. It is never joined to a base, which
+ *    would silently yield the project root.
+ * 3. A relative path resolves against `Config.projectRoot` — not the process CWD,
+ *    and not the document's own directory.
+ *
+ * @returns the URL unchanged, an absolute path, the already-parsed document, or
+ *   `null` when the value was empty and the caller should fall through.
+ */
+export function resolveSpecLocation(spec, options = {}) {
+    if (spec === null || spec === undefined)
+        return null;
+    // An already-parsed document. Nothing to resolve.
+    if (typeof spec !== "string")
+        return spec;
+    if (spec.trim() === "") {
+        (options.logger ?? CONSOLE_LOGGER).warn("apcore-a2a.openapi.spec is set but empty; discarding it and falling through to " +
+            "the next configuration tier. An empty value is not a path.");
+        return null;
+    }
+    if (URL_SCHEMES.some((scheme) => spec.startsWith(scheme)))
+        return spec;
+    if (path.isAbsolute(spec))
+        return spec;
+    return path.resolve(resolveProjectRoot(options.projectRoot), spec);
+}
+/** `servers[0].url`, when it is a usable absolute URL. */
+function documentServerUrl(document) {
+    const servers = document.servers;
+    if (!Array.isArray(servers) || servers.length === 0)
+        return undefined;
+    const first = servers[0];
+    const url = first?.url;
+    if (typeof url !== "string")
+        return undefined;
+    return URL_SCHEMES.some((scheme) => url.startsWith(scheme)) ? url : undefined;
+}
+/**
+ * Every module ID in `registry`, hidden ones included.
+ *
+ * The `catch` is narrow on purpose, and only for the compatibility case it is
+ * named for: a `TypeError` from an older `Registry` whose `list` does not accept
+ * the `visibility` option. **Every other failure propagates.** Swallowing them
+ * and returning `[]` silently disables the FR-OAS-006 collision preflight — with
+ * an empty `existing` set no collision is ever detected, so a duplicate arrives
+ * instead as a failed `WriteResult`, which is exactly the partial-registry
+ * failure the preflight exists to close: a skill the document advertises, absent
+ * from the card, with one log line as the only notice. Python catches only
+ * `TypeError` here and Rust's `Registry::list` is infallible.
+ */
+function registryIds(registry) {
+    try {
+        return registry.list({ visibility: ["public", "hidden"] }) ?? [];
+    }
+    catch (error) {
+        if (!(error instanceof TypeError))
+            throw error;
+        return registry.list() ?? [];
+    }
+}
+function httpMethodOf(module) {
+    const metadata = (module.metadata ?? {});
+    return String(metadata.http_method ?? "").toUpperCase();
+}
+/**
+ * FR-OAS-005 — the unapproved-write warning.
+ *
+ * The toolkit infers annotations from the HTTP method alone and never infers
+ * `requiresApproval`, so every scanned module arrives with it `false`: a
+ * `POST /charges` that moves money is annotated exactly like a `POST /echo`.
+ *
+ * This reports the **absence of a gate, never the presence of protection** — the
+ * rule apcore states on `GovernanceState.unprotectedControlSurface`: *a wired ACL
+ * that permits every call still yields false*. So an attached ACL never
+ * suppresses this warning; it only softens the wording when at least one rule
+ * carries `approval: required`, because whether that rule's `targets` cover these
+ * modules is a match-relation question this cannot decide.
+ *
+ * The message names the public Agent Card because that is the exposure that
+ * distinguishes the A2A binding: `/.well-known/agent-card.json` is auth-exempt by
+ * design and A2A clients are built to crawl it.
+ */
+function warnUnapprovedWrites(modules, options) {
+    if (options.acknowledge)
+        return;
+    const unapproved = modules.filter((module) => WRITE_METHODS.has(httpMethodOf(module)) && !module.annotations?.requiresApproval);
+    if (unapproved.length === 0)
+        return;
+    const methods = [...new Set(unapproved.map(httpMethodOf))].sort();
+    const ids = unapproved
+        .map((module) => module.moduleId)
+        .sort()
+        .slice(0, 10)
+        .join(", ");
+    const state = options.governanceState;
+    const gateWired = state?.builtinApprovalGateWired ?? state?.builtin_approval_gate_wired;
+    // TWO tiers, never three. See the note on GovernanceStateLike above.
+    let lead;
+    if (gateWired === false) {
+        // Escalated: under the `internal`, `testing` and `minimal` strategies the
+        // approval gate is not in the pipeline at all, so neither a module-level
+        // annotation nor an ACL rule's `approval: required` would fire.
+        lead =
+            "the approval gate is NOT in the execution pipeline under the active strategy, " +
+                "so neither a module annotation nor an ACL rule's `approval: required` would fire for";
+    }
+    else {
+        // "module-level" is normative: the backend can speak to the annotation and
+        // must not appear to speak to the deployment's governance, which it cannot
+        // see from here.
+        lead = "no module-level approval requirement is declared for";
+    }
+    options.log.warn(`apcore-a2a: ${lead} ${unapproved.length} scanned write operation(s) ` +
+        `(${methods.join("/")}). They will be advertised on the PUBLIC Agent Card at ` +
+        "/.well-known/agent-card.json, which is served without authentication. Configure " +
+        "an ACL rule carrying `approval: required`, set requiresApproval via a " +
+        "transformModule hook, or set apcore-a2a.openapi.acknowledge_unapproved_writes: " +
+        `true to record this as intended. Affected: ${ids}`);
+}
+/**
+ * Build an apcore `Registry` from an OpenAPI 3.0/3.1 document.
+ *
+ * `spec` is a URL, a filesystem path (resolved per FR-OAS-004), or an
+ * already-parsed document object. `timeout` is the **spec-fetch** timeout in
+ * seconds, never the per-call proxy timeout — the two are different concerns.
+ *
+ * Never returns a partially-populated registry: the collision preflight and
+ * every validation run before the first write.
+ */
+export async function openapiBackend(spec, options = {}) {
+    const log = { ...CONSOLE_LOGGER, ...options.logger };
+    // Checked FIRST, before any fetch or scan: the scanner deduplicates within one
+    // scan only and knows nothing about modules already in the registry, so a
+    // misconfiguration here must fail without a network round trip.
+    if (options.hasOtherBackendSource && !options.prefix) {
+        throw new Error("apcore-a2a.openapi.prefix is required when another backend source is also " +
+            "configured: without it a derived module ID can collide with a project module ID.");
+    }
+    // --- 1. Locate and load ---------------------------------------------------
+    const resolved = resolveSpecLocation(spec, {
+        projectRoot: options.projectRoot,
+        logger: log,
+    });
+    if (resolved === null) {
+        throw new Error("apcore-a2a.openapi.spec is required and resolved to nothing.");
+    }
+    const document = typeof resolved === "string"
+        ? await loadSpec(resolved, {
+            headers: options.headers,
+            // The Config Bus key is SECONDS; `LoadSpecOptions.timeout` is
+            // MILLISECONDS. Converting here is the whole of the fix — passing the
+            // seconds value straight through turns a documented `timeout: 30` into
+            // a 30 ms fetch timeout.
+            timeout: Math.round((options.timeout ?? 30) * 1000),
+        })
+        : resolved;
+    // --- 2. Scan, repairing each module on the way out ------------------------
+    const dropped = [];
+    const synthesized = [];
+    const repair = (scanned) => {
+        // A caller's own hook runs FIRST so the two invariants below hold
+        // unconditionally, whatever it returns.
+        let module = scanned;
+        if (options.transformModule) {
+            module = options.transformModule(module);
+            if (module === null || module === undefined)
+                return null;
+        }
+        // FR-OAS-003: repair the description before the module can reach a card
+        // filter that would silently drop it.
+        const wasSynthesized = !(module.description ?? "").trim();
+        if (wasSynthesized) {
+            module = cloneModule(module, { description: synthesizeDescription(module) });
+        }
+        // FR-OAS-002, LAST: so "every registered module ID is apcore-legal" holds
+        // unconditionally. Runs before the scanner's own `deduplicateIds`, because
+        // lowercasing can CREATE a collision the document did not have —
+        // `listPets` and `listpets` are two operations to OpenAPI and one module ID
+        // to apcore, and projecting afterwards would register one and lose the other
+        // with no warning.
+        const projected = projectModuleId(module.moduleId);
+        if (projected === null) {
+            dropped.push({
+                derivedId: module.moduleId,
+                segment: offendingSegment(module.moduleId),
+            });
+            return null;
+        }
+        if (projected !== module.moduleId) {
+            module = cloneModule(module, { moduleId: projected });
+        }
+        // Report the PROJECTED id: it is the one that reaches the Agent Card, and a
+        // diagnostic naming the pre-projection id sends the operator looking for a
+        // skill that does not exist.
+        if (wasSynthesized)
+            synthesized.push(projected);
+        return module;
+    };
+    const modules = new OpenAPIScanner().scan(document, {
+        include: options.include,
+        exclude: options.exclude,
+        basePathPrefix: options.prefix,
+        includeDeprecated: options.includeDeprecated ?? true,
+        transformOperation: options.transformOperation,
+        deriveModuleId: options.deriveModuleId,
+        transformModule: repair,
+    });
+    // A `transformModule` returning null drops the module SILENTLY, so reporting
+    // is this module's responsibility and cannot be delegated to the scanner.
+    for (const drop of dropped) {
+        log.warn(`apcore-a2a: skipping OpenAPI operation '${drop.derivedId}' — the derived module ` +
+            `ID has a segment ('${drop.segment}') apcore's registry cannot accept (it must ` +
+            "match ^[a-z][a-z0-9_]*$), and it cannot be repaired without inventing an ID. " +
+            "Supply a deriveModuleId or transformModule hook to name this operation yourself.");
+    }
+    for (const module of modules) {
+        for (const warning of module.warnings ?? []) {
+            log.warn(`apcore-a2a: ${module.moduleId}: ${warning}`);
+        }
+    }
+    if (modules.length === 0) {
+        log.warn("apcore-a2a: the OpenAPI document produced no registrable modules; the Agent Card " +
+            "will have no skills.");
+    }
+    if (synthesized.length > 0) {
+        log.info(`apcore-a2a: ${synthesized.length} of ${modules.length + dropped.length} scanned ` +
+            'operations had no summary or description; a "{METHOD} {path}" description was ' +
+            "synthesized so they appear on the Agent Card. Affected: " +
+            [...synthesized].sort().join(", "));
+    }
+    // --- 3. Collision preflight -----------------------------------------------
+    // Full-set, before the first write. Toolkit writers report per-module
+    // WriteResults and never abort, so without this a duplicate would arrive as a
+    // failed WriteResult, get logged and skipped, and leave a partial registry: a
+    // skill the document advertises, absent from the card, with one log line as
+    // the only notice.
+    const target = options.registry ?? new Registry();
+    const existing = new Set(registryIds(target));
+    const collisions = [
+        ...new Set(modules.map((m) => m.moduleId).filter((id) => existing.has(id))),
+    ].sort();
+    if (collisions.length > 0) {
+        throw new Error("OpenAPI-derived module IDs collide with modules already in the registry: " +
+            `${collisions.join(", ")}. Nothing was registered. Set apcore-a2a.openapi.prefix ` +
+            "to namespace them.");
+    }
+    // --- 4. Base URL ----------------------------------------------------------
+    const baseUrl = options.baseUrl ?? documentServerUrl(document);
+    if (!baseUrl) {
+        throw new Error("No base_url: the document has no usable absolute servers[0].url, so every proxied " +
+            "call would resolve against an unknown host. Set apcore-a2a.openapi.base_url.");
+    }
+    // --- 5. Write -------------------------------------------------------------
+    const writer = new HTTPProxyRegistryWriter({
+        baseUrl,
+        authHeaderFactory: options.authHeaderFactory,
+    });
+    for (const result of writer.write([...modules], target)) {
+        if (result.verificationError) {
+            log.error(`apcore-a2a: ${result.moduleId} failed to register as an HTTP proxy: ` +
+                result.verificationError);
+        }
+    }
+    warnUnapprovedWrites(modules, {
+        acknowledge: options.acknowledgeUnapprovedWrites ?? false,
+        governanceState: options.governanceState,
+        log,
+    });
+    return target;
+}
+/**
+ * Build the backend from an `apcore-a2a.openapi` Config Bus section.
+ *
+ * The raw Config Bus value is a plain object (from `apcore.yaml` or
+ * `APCORE_A2A_OPENAPI_*` env vars) in snake_case, not the camelCase options
+ * {@link openapiBackend} takes, so this is the one place that translates between
+ * them.
+ *
+ * Returns `null` when the section is absent or falsy, so a caller can treat "no
+ * OpenAPI configured" as an ordinary outcome.
+ *
+ * `authHeaderFactory` is deliberately not read from the section: it is a
+ * callable, and a value sourced from YAML/JSON/env can never carry one.
+ */
+export async function buildOpenapiBackendFromConfig(openapiConfig, options = {}) {
+    if (!openapiConfig)
+        return null;
+    if (typeof openapiConfig !== "object" || Array.isArray(openapiConfig)) {
+        throw new Error("apcore-a2a.openapi must be a mapping.");
+    }
+    const cfg = openapiConfig;
+    const spec = cfg.spec;
+    if (spec === null || spec === undefined || (typeof spec === "string" && !spec.trim())) {
+        throw new Error("apcore-a2a.openapi.spec is required.");
+    }
+    return openapiBackend(spec, {
+        baseUrl: typeof cfg.base_url === "string" ? cfg.base_url : undefined,
+        prefix: typeof cfg.prefix === "string" ? cfg.prefix : undefined,
+        include: typeof cfg.include === "string" ? cfg.include : undefined,
+        exclude: typeof cfg.exclude === "string" ? cfg.exclude : undefined,
+        includeDeprecated: typeof cfg.include_deprecated === "boolean" ? cfg.include_deprecated : true,
+        headers: cfg.headers,
+        // Seconds here, milliseconds at the `loadSpec` boundary.
+        timeout: typeof cfg.timeout === "number" ? cfg.timeout : 30,
+        registry: options.registry,
+        hasOtherBackendSource: options.hasOtherBackendSource ?? false,
+        // Resolve the project root HERE rather than leaving it to the default: this
+        // is the route most deployments use, and leaving it unset is exactly what
+        // makes a relative `spec` resolve against the process CWD instead of
+        // `Config.projectRoot`, contradicting FR-OAS-004 rule 3.
+        projectRoot: resolveProjectRoot(null),
+        acknowledgeUnapprovedWrites: typeof cfg.acknowledge_unapproved_writes === "boolean"
+            ? cfg.acknowledge_unapproved_writes
+            : false,
+        governanceState: options.governanceState,
+        logger: options.logger,
+    });
+}
+//# sourceMappingURL=openapi-backend.js.map

package/dist/openapi-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-backend.js","sourceRoot":"","sources":["../src/openapi-backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,WAAW,EACX,QAAQ,GAET,MAAM,gBAAgB,CAAC;AAExB;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACxD,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,SAAS,EAAE,UAAU,CAAU,CAAC;AAgBrD,MAAM,cAAc,GAAyB;IAC3C,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;IAChD,KAAK,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAClD,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;CACjD,CAAC;AA+EF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,CACL,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,CACtF,CAAC;AACJ,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyB;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,8EAA8E;IAC9E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,kEAAkE;IAClE,6EAA6E;IAC7E,wEAAwE;IACxE,gFAAgF;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAClC,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,MAAM,IAAI,OAAO;QAAE,OAAO,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IACrD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,OAAO,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,WAAW,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IACzD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC;QACrE,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,wEAAwE;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAa,EACb,UAAqF,EAAE;IAEvF,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrD,kDAAkD;IAClD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE1C,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvB,CAAC,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,IAAI,CACrC,iFAAiF;YAC/E,4DAA4D,CAC/D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,0DAA0D;AAC1D,SAAS,iBAAiB,CAAC,QAAiC;IAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAkC,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,WAAW,CAAC,QAAkB;IACrC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,SAAS,CAAC;YAAE,MAAM,KAAK,CAAC;QAC/C,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAqB;IACzC,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACpE,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,oBAAoB,CAC3B,OAAiC,EACjC,OAIC;IAED,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO;IAEhC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAC/B,CAAC,MAAM,EAAE,EAAE,CACT,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,gBAAgB,CACnF,CAAC;IACF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEpC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,UAAU;SACnB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;SAChC,IAAI,EAAE;SACN,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,EAAE,wBAAwB,IAAI,KAAK,EAAE,2BAA2B,CAAC;IAExF,qEAAqE;IACrE,IAAI,IAAY,CAAC;IACjB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,IAAI;YACF,gFAAgF;gBAChF,sFAAsF,CAAC;IAC3F,CAAC;SAAM,CAAC;QACN,2EAA2E;QAC3E,2EAA2E;QAC3E,iBAAiB;QACjB,IAAI,GAAG,sDAAsD,CAAC;IAChE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,eAAe,IAAI,IAAI,UAAU,CAAC,MAAM,8BAA8B;QACpE,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,yDAAyD;QAC9E,kFAAkF;QAClF,wEAAwE;QACxE,iFAAiF;QACjF,8CAA8C,GAAG,EAAE,CACtD,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,UAAiC,EAAE;IAEnC,MAAM,GAAG,GAAyB,EAAE,GAAG,cAAc,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAE3E,+EAA+E;IAC/E,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,OAAO,CAAC,qBAAqB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE;QACzC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GACZ,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,8DAA8D;YAC9D,sEAAsE;YACtE,uEAAuE;YACvE,yBAAyB;YACzB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;SACpD,CAAC;QACJ,CAAC,CAAE,QAAoC,CAAC;IAE5C,6EAA6E;IAC7E,MAAM,OAAO,GAAkD,EAAE,CAAC;IAClE,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,MAAM,MAAM,GAAG,CAAC,OAAsB,EAAwB,EAAE;QAC9D,kEAAkE;QAClE,wCAAwC;QACxC,IAAI,MAAM,GAAyB,OAAO,CAAC;QAC3C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;QAC3D,CAAC;QAED,wEAAwE;QACxE,sCAAsC;QACtC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,iEAAiE;QACjE,4EAA4E;QAC5E,6EAA6E;QAC7E,mBAAmB;QACnB,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC;aAC3C,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,SAAS,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,6BAA6B;QAC7B,IAAI,cAAc;YAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE;QAClD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,MAAM;QAC9B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;QACpD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,MAAM;KACxB,CAAC,CAAC;IAEH,6EAA6E;IAC7E,0EAA0E;IAC1E,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CACN,2CAA2C,IAAI,CAAC,SAAS,yBAAyB;YAChF,sBAAsB,IAAI,CAAC,OAAO,8CAA8C;YAChF,+EAA+E;YAC/E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CACN,mFAAmF;YACjF,sBAAsB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CACN,eAAe,WAAW,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,WAAW;YAChF,gFAAgF;YAChF,0DAA0D;YAC1D,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,QAAQ,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;KAC5E,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D;YAClF,oBAAoB,CACvB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,oFAAoF;YAClF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,uBAAuB,CAAC;QACzC,OAAO;QACP,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC7C,CAAC,CAAC;IACH,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7B,GAAG,CAAC,KAAK,CACP,eAAe,MAAM,CAAC,QAAQ,wCAAwC;gBACpE,MAAM,CAAC,iBAAiB,CAC3B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,OAAO,EAAE;QAC5B,WAAW,EAAE,OAAO,CAAC,2BAA2B,IAAI,KAAK;QACzD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,GAAG;KACJ,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,aAAsB,EACtB,UAKI,EAAE;IAEN,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,aAAwC,CAAC;IAErD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,cAAc,CAAC,IAAI,EAAE;QAC1B,OAAO,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACpE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAC/D,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClE,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAClE,iBAAiB,EACf,OAAO,GAAG,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;QAC7E,OAAO,EAAE,GAAG,CAAC,OAA6C;QAC1D,yDAAyD;QACzD,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QAC3D,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,KAAK;QAC7D,4EAA4E;QAC5E,0EAA0E;QAC1E,qEAAqE;QACrE,yDAAyD;QACzD,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;QACrC,2BAA2B,EACzB,OAAO,GAAG,CAAC,6BAA6B,KAAK,SAAS;YACpD,CAAC,CAAC,GAAG,CAAC,6BAA6B;YACnC,CAAC,CAAC,KAAK;QACX,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC"}

package/dist/serve.d.ts

@@ -16,6 +16,18 @@ export interface AsyncServeOptions {
     executionTimeout?: number;
     metrics?: boolean;
     sysModules?: boolean;
+    /**
+     * Forward apcore's own reason for a governance refusal (ACL denial, approval
+     * denial, approval timeout) instead of the fixed per-class string
+     * (srs FR-ERR-011). Off by default.
+     *
+     * The *class* of refusal is conveyed either way — each has its own JSON-RPC
+     * code and a `rejected` task state; this decides only whether the *detail*
+     * travels with it. A server whose callers are its own agents wants it on: that
+     * is what the apcore MCP binding reports today. A server facing untrusted
+     * callers keeps the default.
+     */
+    discloseRefusalReason?: boolean;
 }
 export interface ServeOptions extends AsyncServeOptions {
     host?: string;

package/dist/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA2BpD,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,UAAU,kBAAmB,SAAQ,QAAQ;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,UAAU,YAAY;IACpB,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,GACX;IAAE,QAAQ,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,CA0B1D;AA0BD,wBAAsB,UAAU,CAC9B,kBAAkB,EAAE,OAAO,EAC3B,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,OAAO,CAAC,CA4DlB;AAED,wBAAgB,KAAK,CACnB,kBAAkB,EAAE,OAAO,EAC3B,IAAI,GAAE,YAAiB,GACtB,IAAI,CAwCN"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGvC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA2BpD,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;OAUG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,YAAa,SAAQ,iBAAiB;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,UAAU,kBAAmB,SAAQ,QAAQ;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,UAAU,YAAY;IACpB,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,OAAO,GACX;IAAE,QAAQ,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,CA0B1D;AA0BD,wBAAsB,UAAU,CAC9B,kBAAkB,EAAE,OAAO,EAC3B,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,OAAO,CAAC,CA6DlB;AAED,wBAAgB,KAAK,CACnB,kBAAkB,EAAE,OAAO,EAC3B,IAAI,GAAE,YAAiB,GACtB,IAAI,CAwCN"}

package/dist/serve.js

@@ -108,6 +108,7 @@ export async function asyncServe(registryOrExecutor, opts = {}) {
         executionTimeout: resolveExecutionTimeout(opts.executionTimeout),
         metrics: opts.metrics,
         sysModules: opts.sysModules,
+        discloseRefusalReason: opts.discloseRefusalReason,
     });
     return app;
 }

package/dist/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAKvD,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,yBAAyB,GAAG,GAAG,CAAC,CAAC,qDAAqD;AAE5F;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,QAAiB;IAChD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAChE,GAAG,aAAa,oBAAoB,CACrC,CAAC;IACF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAU,CAAC;AACnE,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAsCtD,MAAM,UAAU,0BAA0B,CACxC,GAAY;IAEZ,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,kEAAkE;IAClE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAA4B,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,CAAkC,CAAC;QACpD,MAAM,cAAc,GAAI,CAA6B,CAAC,QAAoC,CAAC;QAC3F,IAAI,OAAO,cAAc,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;YACpD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QAChD,CAAC;QACD,oEAAoE;QACpE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAmC,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAkE;IAElE,IAAI,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,kFAAkF;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/C,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAe,CAA4B,CAAC;QAC5F,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CACjB,gFAAgF;YAC9E,uDAAuD,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,kBAA2B,EAC3B,OAA0B,EAAE;IAE5B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CACjD,0BAA0B,CAAC,kBAAkB,CAAC,CAC/C,CAAC;IAEF,4CAA4C;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,MAAM,aAAa,GACf,QAAQ,CAAC,MAAkC,EAAE,OAAmC,IAAI,EAAE,CAAC;IAC3F,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,IAAK,aAAa,CAAC,IAAe,IAAI,cAAc,CAAC;IACnF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,IAAK,aAAa,CAAC,OAAkB,IAAI,OAAO,CAAC;IACrF,MAAM,mBAAmB,GACvB,IAAI,CAAC,WAAW;QACf,aAAa,CAAC,WAAsB;QACrC,qBAAqB,OAAO,CAAC,MAAM,SAAS,CAAC;IAE/C,sBAAsB;IACtB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,IAAI,CAAC,IAA2C,CAAC,CAAC,CAAC,KAAK,UAAU,CAClF,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,IAAI,CAAC,SAAgD,CAAC,CAAC,CAAC,KAAK,UAAU,CACvF,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE;QACjD,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,eAAe;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,uBAAuB;QACxC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,gBAAgB,EAAE,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAChE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;KAC5B,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,kBAA2B,EAC3B,OAAqB,EAAE;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;IAEzD,UAAU,CAAC,kBAAkB,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;SAC1D,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAEtC,4DAA4D;QAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YAEpB,mEAAmE;YACnE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC7B,OAAO,CAAC,GAAG,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAW,SAAQ,KAAK;IAC5B,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF"}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAKvD,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,yBAAyB,GAAG,GAAG,CAAC,CAAC,qDAAqD;AAE5F;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,QAAiB;IAChD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAChE,GAAG,aAAa,oBAAoB,CACrC,CAAC;IACF,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,iBAAiB,CAAU,CAAC;AACnE,MAAM,mBAAmB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAkDtD,MAAM,UAAU,0BAA0B,CACxC,GAAY;IAEZ,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,kEAAkE;IAClE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,CAA4B,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,CAAkC,CAAC;QACpD,MAAM,cAAc,GAAI,CAA6B,CAAC,QAAoC,CAAC;QAC3F,IAAI,OAAO,cAAc,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;YACpD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QAChD,CAAC;QACD,oEAAoE;QACpE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAmC,EAAE,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,QAAkE;IAElE,IAAI,OAAO,QAAQ,CAAC,QAAQ,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,kFAAkF;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/C,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAe,CAA4B,CAAC;QAC5F,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CACjB,gFAAgF;YAC9E,uDAAuD,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,kBAA2B,EAC3B,OAA0B,EAAE;IAE5B,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CACjD,0BAA0B,CAAC,kBAAkB,CAAC,CAC/C,CAAC;IAEF,4CAA4C;IAC5C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAClB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,MAAM,aAAa,GACf,QAAQ,CAAC,MAAkC,EAAE,OAAmC,IAAI,EAAE,CAAC;IAC3F,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,IAAK,aAAa,CAAC,IAAe,IAAI,cAAc,CAAC;IACnF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,IAAK,aAAa,CAAC,OAAkB,IAAI,OAAO,CAAC;IACrF,MAAM,mBAAmB,GACvB,IAAI,CAAC,WAAW;QACf,aAAa,CAAC,WAAsB;QACrC,qBAAqB,OAAO,CAAC,MAAM,SAAS,CAAC;IAE/C,sBAAsB;IACtB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,IAAI,CAAC,IAA2C,CAAC,CAAC,CAAC,KAAK,UAAU,CAClF,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,IAAI,CAAC,SAAgD,CAAC,CAAC,CAAC,KAAK,UAAU,CACvF,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,uCAAuC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACvC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE;QACjD,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,eAAe;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,uBAAuB;QACxC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,gBAAgB,EAAE,uBAAuB,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAChE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;KAClD,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,KAAK,CACnB,kBAA2B,EAC3B,OAAqB,EAAE;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC;IAEzD,UAAU,CAAC,kBAAkB,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;SAC1D,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAEtC,4DAA4D;QAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE;YAC/B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,GAAG,EAAE;YACpB,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YAEpB,mEAAmE;YACnE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACzE,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC7B,OAAO,CAAC,GAAG,CAAC,0BAA0B,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAW,SAAQ,KAAK;IAC5B,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF"}

package/dist/server/context.d.ts

@@ -10,7 +10,7 @@ import type { Identity } from "apcore-js";
  * `Context`, so governance and task scoping name the same caller.
  */
 export declare class IdentityUser implements User {
-    private readonly identity;
+    readonly identity: Identity;
     constructor(identity: Identity);
     get isAuthenticated(): boolean;
     get userName(): string;
@@ -54,4 +54,15 @@ export declare function identityUserBuilder(_req: Request): Promise<User>;
  * authenticated principal's tasks.
  */
 export declare function anonymousContext(): ServerCallContext;
+/**
+ * The apcore `Identity` behind a `ServerCallContext`, if authenticated.
+ *
+ * The extended Agent Card filters skills against the caller's own identity
+ * (srs FR-AGC-004), and an ACL rule's `conditions` block reads `identityType`
+ * and `roles` — none of which survive the reduction to `userName`.
+ *
+ * Returns `null` for `UnauthenticatedUser`, which is the value the card filter
+ * treats as the anonymous principal.
+ */
+export declare function identityOf(context: ServerCallContext): Identity | null;
 //# sourceMappingURL=context.d.ts.map

package/dist/server/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAuB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,IAAI;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,QAAQ;IAE/C,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CAEpD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAuB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAG1C;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,IAAI;IAC3B,QAAQ,CAAC,QAAQ,EAAE,QAAQ;gBAAlB,QAAQ,EAAE,QAAQ;IAEvC,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,IAAI,QAAQ,IAAI,MAAM,CAErB;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,iBAAiB,CAEpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,GAAG,IAAI,CAGtE"}

package/dist/server/context.js

@@ -63,4 +63,18 @@ export function identityUserBuilder(_req) {
 export function anonymousContext() {
     return new ServerCallContext({ user: new UnauthenticatedUser() });
 }
+/**
+ * The apcore `Identity` behind a `ServerCallContext`, if authenticated.
+ *
+ * The extended Agent Card filters skills against the caller's own identity
+ * (srs FR-AGC-004), and an ACL rule's `conditions` block reads `identityType`
+ * and `roles` — none of which survive the reduction to `userName`.
+ *
+ * Returns `null` for `UnauthenticatedUser`, which is the value the card filter
+ * treats as the anonymous principal.
+ */
+export function identityOf(context) {
+    const user = context.user;
+    return user?.identity ?? null;
+}
 //# sourceMappingURL=context.js.map

package/dist/server/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG5E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAEnD,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/server/context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG5E,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACF;IAArB,YAAqB,QAAkB;QAAlB,aAAQ,GAAR,QAAQ,CAAU;IAAG,CAAC;IAE3C,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,mBAAmB,EAAE,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,OAA0B;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAA2C,CAAC;IACjE,OAAO,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;AAChC,CAAC"}

package/dist/server/executor.d.ts

@@ -9,6 +9,11 @@ export interface ApCoreAgentExecutorOptions {
     registry?: Registry;
     executionTimeout?: number;
     onStateChange?: (oldState: string, newState: string) => void;
+    /**
+     * Forward apcore's own reason for a governance refusal instead of the fixed
+     * per-class string (srs FR-ERR-011). Off by default.
+     */
+    discloseRefusalReason?: boolean;
 }
 export declare class ApCoreAgentExecutor implements AgentExecutor {
     private executor;
@@ -17,6 +22,7 @@ export declare class ApCoreAgentExecutor implements AgentExecutor {
     private executionTimeoutMs;
     private onStateChange?;
     private cancelTokens;
+    private errorMapper;
     constructor(opts: ApCoreAgentExecutorOptions);
     private notify;
     execute(context: RequestContext, eventBus: ExecutionEventBus): Promise<void>;
@@ -28,6 +34,8 @@ export declare class ApCoreAgentExecutor implements AgentExecutor {
     cancelTask(taskId: string, eventBus: ExecutionEventBus): Promise<void>;
     private publishCompleted;
     private publishFailed;
+    /** Emit REJECTED status for a governance refusal (srs FR-ERR-012). */
+    private publishRejected;
     private publishInputRequired;
     private publishCanceled;
 }

package/dist/server/executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/server/executor.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAsE1D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE;QACR,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9D;AAED,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,QAAQ,CAAyC;IACzD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,CAAW;IAG5B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,aAAa,CAAC,CAA+C;IAErE,OAAO,CAAC,YAAY,CAAyC;gBAEjD,IAAI,EAAE,0BAA0B;IAQ5C,OAAO,CAAC,MAAM;IAUR,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoKlF;;;OAGG;YACW,gBAAgB;IA+ExB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB5E,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,oBAAoB;IAgB5B,OAAO,CAAC,eAAe;CAexB"}
+{"version":3,"file":"executor.d.ts","sourceRoot":"","sources":["../../src/server/executor.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACvB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AA4E1D,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE;QACR,SAAS,CACP,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACvC,OAAO,CAAC,EAAE,OAAO,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;KACrC,CAAC;IACF,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D;;;OAGG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,qBAAa,mBAAoB,YAAW,aAAa;IACvD,OAAO,CAAC,QAAQ,CAAyC;IACzD,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,CAAW;IAG5B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,aAAa,CAAC,CAA+C;IAErE,OAAO,CAAC,YAAY,CAAyC;IAC7D,OAAO,CAAC,WAAW,CAAc;gBAErB,IAAI,EAAE,0BAA0B;IAW5C,OAAO,CAAC,MAAM;IAUR,OAAO,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkLlF;;;OAGG;YACW,gBAAgB;IA+ExB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB5E,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,aAAa;IAgBrB,sEAAsE;IACtE,OAAO,CAAC,eAAe;IAgBvB,OAAO,CAAC,oBAAoB;IAgB5B,OAAO,CAAC,eAAe;CAexB"}