gh-inari 0.16.0 → 0.17.1

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "inari",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "Governed GitHub Issue/PR/template workflows via the inari CLI. Prefer inari over raw gh for operations it owns; use inari skill for operational playbooks.",
   "skills": "skills/inari"
 }

package/README.md

@@ -52,6 +52,14 @@ Setup stores only a repository-scoped, secret-free Runtime profile. It never
 commits, pushes, approves, or merges Runtime Authority trust; `ready` is
 reported only after canonical protected-ref readiness succeeds.
 
+The local setup state is shared by the CLI and a loopback browser console:
+
+```bash
+inari setup status          # canonical state and the one next action
+inari setup next            # perform exactly that action through its owner
+inari setup console         # owned loopback setup host; works before any key or trust
+```
+
 ## The governed path
 
 ```text

package/dist/admission/authorization.d.ts

@@ -0,0 +1,68 @@
+import type { LocalSessionBinding } from "../local-control/session-binding.js";
+import type { LocalExecutorEvidenceRequest } from "../local-control/executor-http.js";
+import { type ExecutionIntent } from "../local-control/execution-intent.js";
+import { type Delegator } from "../agent-authority/delegator.js";
+import type { SessionCertificateRepository } from "../agent-authority/session-certificate.js";
+import { type AuthorizedExecution } from "../authorized-execution.js";
+import { type ChangeProjectionResult } from "../change.js";
+import { type LocalBranchPolicyInput } from "../cli/runtime/branch-observation.js";
+import type { LocalExecutorBranchPolicyRequest } from "../local-control/executor-http.js";
+import { type RuntimeFailure, type RuntimeFailureReason, type RuntimeFailureStage } from "../runtime-contracts/runtime-failure.js";
+/** Bounded Admission denial carrying the owner stage and catalog reason (#1180). */
+export declare class AdmissionAuthorizationError extends Error {
+    readonly code: RuntimeFailureReason;
+    readonly runtimeFailure: RuntimeFailure;
+    constructor(stage: RuntimeFailureStage, code: RuntimeFailureReason, message: string);
+}
+/** Reads current Executor evidence through the neutral Executor client protocol. */
+export type AdmissionEvidenceReader = (request: LocalExecutorEvidenceRequest) => Promise<unknown>;
+export interface AdmissionAuthorizationOptions {
+    readonly runtimeAuthority: Delegator;
+    readonly readEvidence: AdmissionEvidenceReader;
+    readonly environment?: NodeJS.ProcessEnv;
+    readonly now?: () => Date;
+    /**
+     * Reads the current repository branch-policy input from the Executor owner
+     * (#1179). Admission verifies every observed Session binding against this
+     * current evidence; it never accepts a caller-supplied observation.
+     */
+    readonly readBranchPolicy?: (request: LocalExecutorBranchPolicyRequest) => Promise<unknown>;
+}
+/** Current, owner-acquired branch-policy input for one governed Implementation. */
+export declare function currentBranchPolicyInput(repository: SessionCertificateRepository, implementation: number, options: AdmissionAuthorizationOptions, stage: RuntimeFailureStage): Promise<LocalBranchPolicyInput>;
+export interface AdmittedSession {
+    readonly id: string;
+    readonly status: string;
+    readonly exp: number;
+}
+/**
+ * Repository-bound Session readiness (#1182): the same current Executor
+ * repository binding and protected-ref trust evidence Session registration
+ * requires, for the Authority the caller expects Admission to have pinned. It
+ * admits nothing and stores nothing; every failure throws a bounded denial.
+ */
+export declare function observeRepositoryReadiness(repository: SessionCertificateRepository, expectedAuthority: {
+    readonly id: string;
+    readonly publicKeyFingerprint: string;
+}, options: AdmissionAuthorizationOptions): Promise<void>;
+/**
+ * A read on behalf of an active Session (#1181): the Session exists, is active
+ * and is bound to exactly the requested repository. It authorizes no effect.
+ */
+export declare function requireActiveSessionRepository(sessionId: string, repository: SessionCertificateRepository, options: AdmissionAuthorizationOptions): LocalSessionBinding;
+/**
+ * The current Change projection of the Session's Implementation (#1181), from
+ * the same Executor evidence and Authority/repository checks every execution
+ * uses. Read-only; it authorizes nothing.
+ */
+export declare function currentSessionChange(binding: LocalSessionBinding, options: AdmissionAuthorizationOptions): Promise<ChangeProjectionResult>;
+/** Admits a validated Session binding against current Executor trust evidence. */
+export declare function admitSession(binding: LocalSessionBinding, options: AdmissionAuthorizationOptions): Promise<AdmittedSession>;
+/** Closes a validated Session binding against current Executor trust evidence. */
+export declare function closeSession(binding: LocalSessionBinding, options: AdmissionAuthorizationOptions): Promise<Omit<AdmittedSession, "exp">>;
+/**
+ * Produces an `AuthorizedExecution` for a validated ExecutionIntent on an
+ * active Session, after every current-evidence, Implementation and capability
+ * check. It never dispatches the execution.
+ */
+export declare function authorizeExecutionIntent(intent: ExecutionIntent, sessionId: string, options: AdmissionAuthorizationOptions): Promise<AuthorizedExecution>;

package/dist/admission/authorization.js

@@ -0,0 +1,419 @@
+/**
+ * Admission authorization (#1107). Private Admission module: it admits and
+ * closes Sessions against current Executor trust evidence and produces an
+ * `AuthorizedExecution` only after the existing Session, repository, task,
+ * Implementation, capability, expiry and replay checks. It reuses the pure
+ * Session, Delegator and capability validators, reaches the Executor only
+ * through the evidence reader it is given, and holds no provider credential or
+ * private signing key. Every failure throws; the server maps it to a bounded
+ * denial.
+ */
+import { closeAdmissionSession, createAdmissionSession, readAdmissionSession } from "../local-control/session-store.js";
+import { executionIntentIssue } from "../local-control/execution-intent.js";
+import { validateDelegator } from "../agent-authority/delegator.js";
+import { delegatorPublicKeyFingerprint } from "../agent-authority/delegator-key.js";
+import { admitAuthenticatedSessionCapability, } from "../agent-authority/capability-admission.js";
+import { authorizeBranchAdvance } from "../agent-authority/branch-advance.js";
+import { createCapabilityExecutionProvenance, } from "../agent-authority/capability-provenance.js";
+import { canonicalJsonString } from "../agent-authority/codec.js";
+import { createAuthorizedExecution } from "../authorized-execution.js";
+import { changeReadRequest } from "../change-execution-port.js";
+import { validateChangeProjectionResult } from "../change.js";
+import { tryAuthorizeImplementation } from "../implementation-authorization.js";
+import { projectImplementationSessionAuthorizationBinding } from "../implementation-session-binding.js";
+import { tryProjectImplementationScope } from "../implementation-scope-projection.js";
+import { assertTrustedExecution, validateIssuerRepositoryIdentity, } from "../github/effect-authorizer.js";
+import { observeLocalBranch, validateLocalBranchPolicyInput, } from "../cli/runtime/branch-observation.js";
+import { runtimeFailure, } from "../runtime-contracts/runtime-failure.js";
+/** Bounded Admission denial carrying the owner stage and catalog reason (#1180). */
+export class AdmissionAuthorizationError extends Error {
+    code;
+    runtimeFailure;
+    constructor(stage, code, message) {
+        super(message);
+        this.name = "AdmissionAuthorizationError";
+        this.code = code;
+        this.runtimeFailure = runtimeFailure(stage, code);
+    }
+}
+function deny(stage, code, message) {
+    throw new AdmissionAuthorizationError(stage, code, message);
+}
+/** Current, owner-acquired branch-policy input for one governed Implementation. */
+export async function currentBranchPolicyInput(repository, implementation, options, stage) {
+    if (options.readBranchPolicy === undefined)
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_MISSING", "Current repository branch observation is missing.");
+    const input = validateLocalBranchPolicyInput(await options.readBranchPolicy({ version: 1, repository: evidenceRepository(repository), implementation }));
+    if (input === undefined)
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_STALE", "Current repository branch observation is invalid or stale.");
+    return input;
+}
+async function requireCurrentBranchObservation(binding, options, stage) {
+    if (binding.branchObservation === undefined)
+        return;
+    const input = await currentBranchPolicyInput(binding.repository, binding.task.number, options, stage);
+    let current;
+    try {
+        current = observeLocalBranch({ ...input, observedBranch: binding.branchObservation.observedBranch });
+    }
+    catch {
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_STALE", "Current repository branch observation is invalid or stale.");
+    }
+    if (canonicalJsonString(current) !==
+        canonicalJsonString(binding.branchObservation))
+        deny(stage, "ADMISSION_BRANCH_OBSERVATION_CONTRADICTED", "Current repository branch observation contradicts Session binding.");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function exactKeys(value, allowed) {
+    return Object.keys(value).every((key) => allowed.includes(key));
+}
+function pinnedRuntimeAuthority(value, stage) {
+    const result = validateDelegator(value);
+    if (!result.valid || result.value === undefined)
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Public Runtime Authority trust is invalid.");
+    return result.value;
+}
+function requirePinnedAuthorityMatch(current, binding, pinnedAuthority, stage) {
+    if (current.id !== binding.authority.id ||
+        delegatorPublicKeyFingerprint(current.key) !== binding.authority.publicKeyFingerprint ||
+        canonicalJsonString(current) !==
+            canonicalJsonString(pinnedAuthority))
+        deny(stage, "ADMISSION_RUNTIME_AUTHORITY_MISMATCH", "Current Runtime Authority trust does not match Admission configuration.");
+}
+function requireAuthorityRef(authority, stage) {
+    if (!isRecord(authority) ||
+        !exactKeys(authority, ["ref", "sha"]) ||
+        typeof authority.ref !== "string" ||
+        !/^refs\/heads\/[A-Za-z0-9._/-]+$/u.test(authority.ref) ||
+        typeof authority.sha !== "string" ||
+        !/^[a-f0-9]{40}$/u.test(authority.sha))
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Executor Authority evidence is malformed.");
+    return { ref: authority.ref, sha: authority.sha };
+}
+function sameRepository(left, right) {
+    if (!isRecord(left))
+        return false;
+    return (left.repositoryHost === "github.com" &&
+        left.repositoryId === right.id &&
+        (left.nameWithOwner === undefined ||
+            (typeof left.nameWithOwner === "string" && left.nameWithOwner.toLowerCase() === right.name.toLowerCase())));
+}
+function evidenceRepository(repository) {
+    return { id: repository.id, name: repository.name };
+}
+function intentRepositoryMatchesBinding(intent, binding) {
+    return (intent.repositoryHost === "github.com" &&
+        intent.repositoryId === binding.id &&
+        (intent.repositoryNameWithOwner === undefined ||
+            intent.repositoryNameWithOwner.toLocaleLowerCase("en-US") === binding.name.toLocaleLowerCase("en-US")));
+}
+function makeContext(binding, repository, authority, intent, operation, nowSeconds) {
+    const request = Object.freeze({
+        requestId: intent.requestId,
+        operation,
+        issuedAt: nowSeconds,
+        expiresAt: nowSeconds + 60,
+    });
+    return Object.freeze({
+        repository,
+        runtimeAuthority: Object.freeze({ id: binding.authority.id, kid: binding.authority.id }),
+        session: Object.freeze({ id: binding.sessionId, certificateJti: binding.signature }),
+        task: binding.task,
+        capabilities: binding.capabilities,
+        authority,
+        request,
+        semanticRequest: intent.request,
+    });
+}
+function capabilityOperation(intent) {
+    return intent.operation === "pullRequest.publish" ? "pullRequest.create" : intent.operation;
+}
+function intentSubject(intent) {
+    const issue = executionIntentIssue(intent);
+    if (issue === undefined)
+        throw new Error("ExecutionIntent has no task Issue.");
+    if (intent.operation === "branch.advance") {
+        const request = intent.request;
+        return { kind: "branch", issue, branch: request.branch };
+    }
+    if (intent.operation === "pullRequest.publish") {
+        const request = intent.request;
+        if (typeof request.expectedHead !== "string" || typeof request.expectedBase !== "string")
+            throw new Error("Pull request publication route is unavailable.");
+        return { kind: "pullRequest", issue, head: request.expectedHead, base: request.expectedBase };
+    }
+    return { kind: "change", issue };
+}
+function readTreeDelta(intent) {
+    if (intent.operation !== "branch.advance")
+        return undefined;
+    const request = intent.request;
+    return {
+        changes: request.changes.map((change) => ({ operation: "modify", path: change.path })),
+    };
+}
+function validateEvidence(value, binding, pinnedAuthority) {
+    const stage = "implementation-admission";
+    if (!isRecord(value) ||
+        !exactKeys(value, ["repository", "authority", "runtimeAuthority", "change", "implementation", "reviewEvidence"]))
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Executor evidence response is malformed.");
+    const repositoryResult = validateIssuerRepositoryIdentity(value.repository);
+    if (!repositoryResult.valid ||
+        repositoryResult.value === undefined ||
+        !sameRepository(repositoryResult.value, binding.repository))
+        deny(stage, "ADMISSION_REPOSITORY_MISMATCH", "Executor repository evidence does not match Session.");
+    const authority = requireAuthorityRef(value.authority, stage);
+    const runtime = pinnedRuntimeAuthority(value.runtimeAuthority, stage);
+    requirePinnedAuthorityMatch(runtime, binding, pinnedAuthority, stage);
+    const projection = validateChangeProjectionResult(value.change);
+    if (!projection.valid || projection.projection === undefined)
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Current Change evidence is malformed.");
+    if (!isRecord(value.implementation) ||
+        !exactKeys(value.implementation, [
+            "implementation",
+            "issue",
+            "repository",
+            "base",
+            "readiness",
+            "change",
+            "pullRequest",
+        ]))
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Current Implementation evidence is malformed.");
+    return {
+        repository: repositoryResult.value,
+        authority,
+        change: projection.projection,
+        implementation: value.implementation,
+        ...(value.reviewEvidence === undefined ? {} : { reviewEvidence: value.reviewEvidence }),
+    };
+}
+function validateTrustEvidence(value, subject, pinnedAuthority) {
+    const stage = "trust-evidence";
+    if (!isRecord(value) || !exactKeys(value, ["repository", "authority", "runtimeAuthority"]))
+        deny(stage, "ADMISSION_EVIDENCE_MALFORMED", "Executor Runtime Authority evidence is malformed.");
+    if (!sameRepository(value.repository, subject.repository))
+        deny(stage, "ADMISSION_REPOSITORY_MISMATCH", "Executor repository evidence does not match Session.");
+    requireAuthorityRef(value.authority, stage);
+    const current = pinnedRuntimeAuthority(value.runtimeAuthority, stage);
+    requirePinnedAuthorityMatch(current, subject, pinnedAuthority, stage);
+    return current;
+}
+function currentImplementationAuthorization(evidence, binding) {
+    const implementationEvidence = evidence.implementation;
+    const authorizationInput = {
+        implementation: implementationEvidence.implementation,
+        issue: implementationEvidence.issue,
+        repository: implementationEvidence.repository,
+        base: implementationEvidence.base,
+        readiness: implementationEvidence.readiness,
+    };
+    const authorization = tryAuthorizeImplementation(authorizationInput);
+    if (!authorization.valid || authorization.status !== "authorized" || authorization.authorization === undefined)
+        deny("implementation-admission", "ADMISSION_IMPLEMENTATION_UNAUTHORIZED", "Current Implementation is not authorized.");
+    const currentInput = { ...authorizationInput, authorization: authorization.authorization };
+    const bindingProjection = projectImplementationSessionAuthorizationBinding({
+        ...currentInput,
+        task: binding.task,
+    });
+    const scope = tryProjectImplementationScope(currentInput);
+    if (!scope.valid || scope.projection === undefined)
+        deny("implementation-admission", "ADMISSION_IMPLEMENTATION_SCOPE_UNAVAILABLE", "Current Implementation scope is unavailable.");
+    return { binding: bindingProjection, scope: scope.projection };
+}
+async function currentTrust(binding, options) {
+    const evidence = await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(binding.repository),
+        authorityId: binding.authority.id,
+    });
+    return validateTrustEvidence(evidence, binding, options.runtimeAuthority);
+}
+/**
+ * Repository-bound Session readiness (#1182): the same current Executor
+ * repository binding and protected-ref trust evidence Session registration
+ * requires, for the Authority the caller expects Admission to have pinned. It
+ * admits nothing and stores nothing; every failure throws a bounded denial.
+ */
+export async function observeRepositoryReadiness(repository, expectedAuthority, options) {
+    const pinned = options.runtimeAuthority;
+    if (pinned.id !== expectedAuthority.id ||
+        delegatorPublicKeyFingerprint(pinned.key) !== expectedAuthority.publicKeyFingerprint)
+        deny("trust-evidence", "ADMISSION_RUNTIME_AUTHORITY_MISMATCH", "The Authority Admission pins differs from the configured setup Authority.");
+    const subject = {
+        repository,
+        authority: { id: pinned.id, publicKeyFingerprint: expectedAuthority.publicKeyFingerprint },
+    };
+    const evidence = await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(repository),
+        authorityId: pinned.id,
+    });
+    validateTrustEvidence(evidence, subject, pinned);
+}
+/**
+ * A read on behalf of an active Session (#1181): the Session exists, is active
+ * and is bound to exactly the requested repository. It authorizes no effect.
+ */
+export function requireActiveSessionRepository(sessionId, repository, options) {
+    const stored = readAdmissionSession(sessionId, options.runtimeAuthority, {
+        environment: options.environment,
+        now: options.now?.(),
+    });
+    if (stored === undefined || stored.status !== "active")
+        deny("implementation-admission", "ADMISSION_SESSION_UNAVAILABLE", "Session is unavailable.");
+    const binding = stored.record.binding;
+    if (binding.repository.id !== repository.id ||
+        binding.repository.name.toLocaleLowerCase("en-US") !== repository.name.toLocaleLowerCase("en-US"))
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "The read repository does not match the Session.");
+    return binding;
+}
+/**
+ * The current Change projection of the Session's Implementation (#1181), from
+ * the same Executor evidence and Authority/repository checks every execution
+ * uses. Read-only; it authorizes nothing.
+ */
+export async function currentSessionChange(binding, options) {
+    if (binding.task.kind !== "issue")
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "The Session has no Implementation task.");
+    const evidence = validateEvidence(await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(binding.repository),
+        authorityId: binding.authority.id,
+        issue: binding.task.number,
+        implementationIssue: binding.task.number,
+    }), binding, options.runtimeAuthority);
+    return evidence.change;
+}
+/** Admits a validated Session binding against current Executor trust evidence. */
+export async function admitSession(binding, options) {
+    await requireCurrentBranchObservation(binding, options, "session-registration");
+    const current = await currentTrust(binding, options);
+    const snapshot = createAdmissionSession(binding, current, {
+        environment: options.environment,
+        now: options.now?.(),
+    });
+    return { id: snapshot.record.binding.sessionId, status: snapshot.status, exp: snapshot.record.binding.exp };
+}
+/** Closes a validated Session binding against current Executor trust evidence. */
+export async function closeSession(binding, options) {
+    const current = await currentTrust(binding, options);
+    const snapshot = closeAdmissionSession(binding, current, {
+        environment: options.environment,
+        now: options.now?.(),
+    });
+    return { id: snapshot.record.binding.sessionId, status: snapshot.status };
+}
+/**
+ * Produces an `AuthorizedExecution` for a validated ExecutionIntent on an
+ * active Session, after every current-evidence, Implementation and capability
+ * check. It never dispatches the execution.
+ */
+export async function authorizeExecutionIntent(intent, sessionId, options) {
+    const stored = readAdmissionSession(sessionId, options.runtimeAuthority, {
+        environment: options.environment,
+        now: options.now?.(),
+    });
+    if (stored === undefined || stored.status !== "active")
+        deny("implementation-admission", "ADMISSION_SESSION_UNAVAILABLE", "Session is unavailable.");
+    const binding = stored.record.binding;
+    await requireCurrentBranchObservation(binding, options, "implementation-admission");
+    if (binding.branchObservation !== undefined &&
+        intent.operation === "branch.advance" &&
+        intent.request.branch !== binding.branchObservation.expectedBranch)
+        deny("implementation-admission", "ADMISSION_BRANCH_SCOPE_DENIED", "Branch advance does not match the Session policy branch.");
+    if (!intentRepositoryMatchesBinding(intent.repository, binding.repository))
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "Execution repository does not match Session.");
+    const issue = executionIntentIssue(intent);
+    if (issue === undefined || binding.task.kind !== "issue" || binding.task.number !== issue)
+        deny("implementation-admission", "ADMISSION_TASK_MISMATCH", "Execution task does not match Session.");
+    const evidenceValue = await options.readEvidence({
+        version: 1,
+        repository: evidenceRepository(binding.repository),
+        authorityId: binding.authority.id,
+        issue,
+        implementationIssue: binding.task.number,
+    });
+    const evidence = validateEvidence(evidenceValue, binding, options.runtimeAuthority);
+    const current = currentImplementationAuthorization(evidence, binding);
+    const operation = capabilityOperation(intent);
+    const nowSeconds = Math.floor((options.now?.() ?? new Date()).getTime() / 1000);
+    const context = {
+        ...makeContext(binding, evidence.repository, evidence.authority, intent, operation, nowSeconds),
+        implementationBinding: current.binding,
+        implementationScope: current.scope,
+    };
+    let admission;
+    try {
+        admission = admitAuthenticatedSessionCapability({
+            context,
+            operation,
+            subject: intentSubject(intent),
+            projection: evidence.change,
+            ...(readTreeDelta(intent) === undefined ? {} : { treeDelta: readTreeDelta(intent) }),
+            ...(evidence.reviewEvidence === undefined ? {} : { reviewEvidence: evidence.reviewEvidence }),
+        });
+    }
+    catch (error) {
+        // Keep the capability owner's own denial (name/reason) and attach the bounded wire diagnostic.
+        if (error instanceof Error) {
+            Object.defineProperty(error, "runtimeFailure", {
+                value: runtimeFailure("implementation-admission", "ADMISSION_CAPABILITY_DENIED"),
+                enumerable: false,
+            });
+            throw error;
+        }
+        deny("implementation-admission", "ADMISSION_CAPABILITY_DENIED", "The Session capability does not authorize this operation.");
+    }
+    let branchAuthorization;
+    if (intent.operation === "branch.advance") {
+        const authorized = authorizeBranchAdvance({ context, admission, request: intent.request });
+        if (!authorized.valid)
+            deny("implementation-admission", "ADMISSION_BRANCH_SCOPE_DENIED", "Branch advance is outside the current authorized scope.");
+        branchAuthorization = authorized.authorization;
+    }
+    const provenanceRequest = {
+        ...context.request,
+        operation: intent.operation,
+    };
+    const provenance = createCapabilityExecutionProvenance({
+        version: 1,
+        stage: "authorized",
+        repository: evidence.repository,
+        runtimeAuthority: context.runtimeAuthority,
+        session: context.session,
+        authority: context.authority,
+        request: provenanceRequest,
+        subject: admission.subject,
+        capability: admission.capability,
+    });
+    const localAdmissionExecution = assertTrustedExecution({
+        version: 1,
+        runtime: "inari-local-admission",
+        event: "authorized-session-execution",
+        repository: evidence.repository,
+        requestId: intent.requestId,
+        sessionId: binding.sessionId,
+        sessionBindingSignature: binding.signature,
+        requester: `session:${binding.sessionId}`,
+    });
+    const executionInput = {
+        version: 1,
+        operation: intent.operation,
+        repository: evidence.repository,
+        task: binding.task,
+        subject: admission.subject,
+        capability: admission.capability,
+        provenance,
+        request: intent.operation === "change.show" ? changeReadRequest(issue) : intent.request,
+    };
+    if (intent.operation === "change.show")
+        executionInput.initialProjection = evidence.change;
+    else if (intent.operation === "branch.advance")
+        executionInput.branchAuthorization = branchAuthorization;
+    else
+        executionInput.execution = localAdmissionExecution;
+    return createAuthorizedExecution(executionInput);
+}
+//# sourceMappingURL=authorization.js.map

package/dist/admission/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../src/admission/authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAGxH,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,iBAAiB,EAAkB,MAAM,iCAAiC,CAAC;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EACL,mCAAmC,GAGpC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAqC,MAAM,sCAAsC,CAAC;AACjH,OAAO,EACL,mCAAmC,GAEpC,MAAM,6CAA6C,CAAC;AAGrD,OAAO,EAAE,mBAAmB,EAA2B,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAA4B,MAAM,4BAA4B,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,8BAA8B,EAA+B,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAyC,MAAM,oCAAoC,CAAC;AACvH,OAAO,EAAE,gDAAgD,EAAE,MAAM,sCAAsC,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EACL,sBAAsB,EACtB,gCAAgC,GAEjC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,kBAAkB,EAClB,8BAA8B,GAE/B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,cAAc,GAIf,MAAM,yCAAyC,CAAC;AAEjD,oFAAoF;AACpF,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,IAAI,CAAuB;IAC3B,cAAc,CAAiB;IAExC,YAAY,KAA0B,EAAE,IAA0B,EAAE,OAAe;QACjF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;CACF;AAED,SAAS,IAAI,CAAC,KAA0B,EAAE,IAA0B,EAAE,OAAe;IACnF,MAAM,IAAI,2BAA2B,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAkBD,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAAwC,EACxC,cAAsB,EACtB,OAAsC,EACtC,KAA0B;IAE1B,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACxC,IAAI,CAAC,KAAK,EAAE,sCAAsC,EAAE,mDAAmD,CAAC,CAAC;IAC3G,MAAM,KAAK,GAAG,8BAA8B,CAC1C,MAAM,OAAO,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,CAC3G,CAAC;IACF,IAAI,KAAK,KAAK,SAAS;QACrB,IAAI,CAAC,KAAK,EAAE,oCAAoC,EAAE,4DAA4D,CAAC,CAAC;IAClH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,OAA4B,EAC5B,OAAsC,EACtC,KAA0B;IAE1B,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO;IACpD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtG,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,OAAO,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,KAAK,EAAE,oCAAoC,EAAE,4DAA4D,CAAC,CAAC;IAClH,CAAC;IACD,IACE,mBAAmB,CAAC,OAAwC,CAAC;QAC7D,mBAAmB,CAAC,OAAO,CAAC,iBAAkD,CAAC;QAE/E,IAAI,CACF,KAAK,EACL,2CAA2C,EAC3C,oEAAoE,CACrE,CAAC;AACN,CAAC;AAQD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,OAA0B;IAC3E,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,KAA0B;IACxE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAC7C,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,4CAA4C,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAkB,EAClB,OAA+C,EAC/C,eAA0B,EAC1B,KAA0B;IAE1B,IACE,OAAO,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE;QACnC,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,oBAAoB;QACrF,mBAAmB,CAAC,OAAwC,CAAC;YAC3D,mBAAmB,CAAC,eAAgD,CAAC;QAEvE,IAAI,CACF,KAAK,EACL,sCAAsC,EACtC,yEAAyE,CAC1E,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,SAAkB,EAAE,KAA0B;IACzE,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACpB,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,kCAAkC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QACvD,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;QAEtC,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,2CAA2C,CAAC,CAAC;IAC3F,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,IAAa,EAAE,KAAmC;IACxE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,CACL,IAAI,CAAC,cAAc,KAAK,YAAY;QACpC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,EAAE;QAC9B,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAC7G,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAwC;IAClE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,8BAA8B,CACrC,MAAqC,EACrC,OAAqC;IAErC,OAAO,CACL,MAAM,CAAC,cAAc,KAAK,YAAY;QACtC,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,EAAE;QAClC,CAAC,MAAM,CAAC,uBAAuB,KAAK,SAAS;YAC3C,MAAM,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CACzG,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,OAA4B,EAC5B,UAA8B,EAC9B,SAAyD,EACzD,MAAuB,EACvB,SAAuC,EACvC,UAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS;QACT,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,UAAU,GAAG,EAAE;KAC3B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,UAAU;QACV,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACxF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACpF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS;QACT,OAAO;QACP,eAAe,EAAE,MAAM,CAAC,OAAkE;KAC3F,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAuB;IAClD,OAAO,MAAM,CAAC,SAAS,KAAK,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC/E,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;QAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,qBAAqB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,OAA+B,CAAC;QACvD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YACtF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,MAAuB;IAC5C,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuC,CAAC;IAC/D,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,QAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,OAA4B,EAC5B,eAA0B;IAQ1B,MAAM,KAAK,GAAG,0BAA0B,CAAC;IACzC,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAEhH,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,0CAA0C,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5E,IACE,CAAC,gBAAgB,CAAC,KAAK;QACvB,gBAAgB,CAAC,KAAK,KAAK,SAAS;QACpC,CAAC,cAAc,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC;QAE3D,IAAI,CAAC,KAAK,EAAE,+BAA+B,EAAE,sDAAsD,CAAC,CAAC;IACvG,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACtE,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,8BAA8B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,UAAU,KAAK,SAAS;QAC1D,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,uCAAuC,CAAC,CAAC;IACvF,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/B,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE;YAC/B,gBAAgB;YAChB,OAAO;YACP,YAAY;YACZ,MAAM;YACN,WAAW;YACX,QAAQ;YACR,aAAa;SACd,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,+CAA+C,CAAC,CAAC;IAC/F,OAAO;QACL,UAAU,EAAE,gBAAgB,CAAC,KAAK;QAClC,SAAS;QACT,MAAM,EAAE,UAAU,CAAC,UAAU;QAC7B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;KACxF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,OAA8D,EAC9D,eAA0B;IAE1B,MAAM,KAAK,GAAG,gBAAgB,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,EAAE,8BAA8B,EAAE,mDAAmD,CAAC,CAAC;IACnG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,+BAA+B,EAAE,sDAAsD,CAAC,CAAC;IACvG,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACtE,2BAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,kCAAkC,CACzC,QAA6C,EAC7C,OAA4B;IAE5B,MAAM,sBAAsB,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvD,MAAM,kBAAkB,GAAqC;QAC3D,cAAc,EAAE,sBAAsB,CAAC,cAAoE;QAC3G,KAAK,EAAE,sBAAsB,CAAC,KAAkD;QAChF,UAAU,EAAE,sBAAsB,CAAC,UAA4D;QAC/F,IAAI,EAAE,sBAAsB,CAAC,IAAgD;QAC7E,SAAS,EAAE,sBAAsB,CAAC,SAAS;KAC5C,CAAC;IACF,MAAM,aAAa,GAAG,0BAA0B,CAAC,kBAAkB,CAAC,CAAC;IACrE,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,KAAK,YAAY,IAAI,aAAa,CAAC,aAAa,KAAK,SAAS;QAC5G,IAAI,CACF,0BAA0B,EAC1B,uCAAuC,EACvC,2CAA2C,CAC5C,CAAC;IACJ,MAAM,YAAY,GAAG,EAAE,GAAG,kBAAkB,EAAE,aAAa,EAAE,aAAa,CAAC,aAAa,EAAE,CAAC;IAC3F,MAAM,iBAAiB,GAAG,gDAAgD,CAAC;QACzE,GAAG,YAAY;QACf,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAChD,IAAI,CACF,0BAA0B,EAC1B,4CAA4C,EAC5C,8CAA8C,CAC/C,CAAC;IACJ,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAA4B,EAAE,OAAsC;IAC9F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;KAClC,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,UAAwC,EACxC,iBAAiF,EACjF,OAAsC;IAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IACxC,IACE,MAAM,CAAC,EAAE,KAAK,iBAAiB,CAAC,EAAE;QAClC,6BAA6B,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,iBAAiB,CAAC,oBAAoB;QAEpF,IAAI,CACF,gBAAgB,EAChB,sCAAsC,EACtC,2EAA2E,CAC5E,CAAC;IACJ,MAAM,OAAO,GAAG;QACd,UAAU;QACV,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,oBAAoB,EAAE,iBAAiB,CAAC,oBAAoB,EAAE;KAClC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC1C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,UAAU,CAAC;QAC1C,WAAW,EAAE,MAAM,CAAC,EAAE;KACvB,CAAC,CAAC;IACH,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,SAAiB,EACjB,UAAwC,EACxC,OAAsC;IAEtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;QACvE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QACpD,IAAI,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACtC,IACE,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE;QACvC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;QAEjG,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,iDAAiD,CAAC,CAAC;IACjH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA4B,EAC5B,OAAsC;IAEtC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;QAC/B,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,yCAAyC,CAAC,CAAC;IACzG,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,MAAM,OAAO,CAAC,YAAY,CAAC;QACzB,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACjC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;QAC1B,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;KACzC,CAAC,EACF,OAAO,EACP,OAAO,CAAC,gBAAgB,CACzB,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B,EAC5B,OAAsC;IAEtC,MAAM,+BAA+B,CAAC,OAAO,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE;QACxD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AAC9G,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAA4B,EAC5B,OAAsC;IAEtC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE;QACvD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAuB,EACvB,SAAiB,EACjB,OAAsC;IAEtC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,EAAE;QACvE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ;QACpD,IAAI,CAAC,0BAA0B,EAAE,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IACtC,MAAM,+BAA+B,CAAC,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACpF,IACE,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACvC,MAAM,CAAC,SAAS,KAAK,gBAAgB;QACpC,MAAM,CAAC,OAAwC,CAAC,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,cAAc;QAEpG,IAAI,CACF,0BAA0B,EAC1B,+BAA+B,EAC/B,0DAA0D,CAC3D,CAAC;IACJ,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC;QACxE,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,8CAA8C,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,KAAK;QACvF,IAAI,CAAC,0BAA0B,EAAE,yBAAyB,EAAE,wCAAwC,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;QAC/C,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC;QAClD,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QACjC,KAAK;QACL,mBAAmB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM;KACzC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,kCAAkC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG;QACd,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC;QAC/F,qBAAqB,EAAE,OAAO,CAAC,OAAO;QACtC,mBAAmB,EAAE,OAAO,CAAC,KAAK;KACK,CAAC;IAC1C,IAAI,SAAiE,CAAC;IACtE,IAAI,CAAC;QACH,SAAS,GAAG,mCAAmC,CAAC;YAC9C,OAAO;YACP,SAAS;YACT,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,+FAA+F;QAC/F,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,gBAAgB,EAAE;gBAC7C,KAAK,EAAE,cAAc,CAAC,0BAA0B,EAAE,6BAA6B,CAAC;gBAChF,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CACF,0BAA0B,EAC1B,6BAA6B,EAC7B,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,IAAI,mBAA4B,CAAC;IACjC,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;QAC1C,MAAM,UAAU,GAAG,sBAAsB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,IAAI,CAAC,UAAU,CAAC,KAAK;YACnB,IAAI,CACF,0BAA0B,EAC1B,+BAA+B,EAC/B,yDAAyD,CAC1D,CAAC;QACJ,mBAAmB,GAAG,UAAU,CAAC,aAAa,CAAC;IACjD,CAAC;IACD,MAAM,iBAAiB,GAAG;QACxB,GAAG,OAAO,CAAC,OAAO;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;IACF,MAAM,UAAU,GAAkC,mCAAmC,CAAC;QACpF,OAAO,EAAE,CAAC;QACV,KAAK,EAAE,YAAY;QACnB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,iBAAiB;QAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;KACjC,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;QACrD,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,uBAAuB;QAChC,KAAK,EAAE,8BAA8B;QACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,uBAAuB,EAAE,OAAO,CAAC,SAAS;QAC1C,SAAS,EAAE,WAAW,OAAO,CAAC,SAAS,EAAE;KAC1C,CAAC,CAAC;IACH,MAAM,cAAc,GAA4B;QAC9C,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,SAAS,CAAC,OAAO;QAC1B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU;QACV,OAAO,EAAE,MAAM,CAAC,SAAS,KAAK,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;KACxF,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,aAAa;QAAE,cAAc,CAAC,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC;SACtF,IAAI,MAAM,CAAC,SAAS,KAAK,gBAAgB;QAAE,cAAc,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;;QACpG,cAAc,CAAC,SAAS,GAAG,uBAAuB,CAAC;IACxD,OAAO,yBAAyB,CAAC,cAAc,CAAC,CAAC;AACnD,CAAC"}

package/dist/admission/server.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Admission server (#1107). Public Admission role entry for serving: the
+ * bounded local Admission HTTP wire, mTLS enforcement and process startup.
+ * Session admission and execution authorization are delegated to the private
+ * authorization module; the Executor is reached only through the neutral
+ * `LocalExecutorClient` protocol client. The server holds no provider
+ * credential and no private signing key.
+ */
+import { type Server } from "node:http";
+import type { Delegator } from "../agent-authority/delegator.js";
+import type { AuthorizedExecution } from "../authorized-execution.js";
+import { type RepositoryIdentity } from "../github/effect-authorizer.js";
+import type { LocalAdmissionConfig } from "../local-control/config.js";
+import { type LocalExecutorBranchPolicyRequest, type LocalExecutorEvidenceRequest, type LocalExecutorGovernedContractRequest } from "../local-control/executor-http.js";
+import { type LocalRuntimeEndpoint } from "../local-control/runtime-discovery.js";
+import { type LocalMtlsIdentity } from "../local-control/transport-security.js";
+export declare const LOCAL_ADMISSION_STATUS_PATH: "/status";
+export declare const LOCAL_ADMISSION_PROTOCOL_VERSION: 1;
+export declare const LOCAL_ADMISSION_HEALTH_PATH: "/health";
+export declare const LOCAL_ADMISSION_SESSIONS_PATH: "/v1/sessions";
+export declare const LOCAL_ADMISSION_REPOSITORY_PATH: "/v1/repository";
+export declare const LOCAL_ADMISSION_EXECUTIONS_PATH: "/v1/executions";
+export declare const LOCAL_ADMISSION_READINESS_PATH: "/v1/readiness";
+export declare const LOCAL_ADMISSION_BRANCH_POLICY_PATH: "/v1/branch-policy";
+export declare const LOCAL_ADMISSION_PULL_REQUEST_CONTEXT_PATH: "/v1/pull-request-context";
+export declare const LOCAL_ADMISSION_SESSION_ID_HEADER: "x-inari-session-id";
+export declare const MAX_LOCAL_ADMISSION_BODY_BYTES = 1048576;
+/**
+ * Executor surface Admission consumes. `LocalExecutorClient` (the neutral
+ * client of the Executor wire protocol) implements it; Admission never loads
+ * Executor internals.
+ */
+export interface AdmissionExecutorClient {
+    verifyReady(): Promise<unknown>;
+    resolveRepository?(repositoryNameWithOwner: string): Promise<RepositoryIdentity>;
+    readEvidence(request: LocalExecutorEvidenceRequest): Promise<unknown>;
+    readBranchPolicy?(request: LocalExecutorBranchPolicyRequest): Promise<unknown>;
+    readGovernedContract?(request: LocalExecutorGovernedContractRequest): Promise<unknown>;
+    execute(execution: AuthorizedExecution): Promise<unknown>;
+}
+export declare function createLocalAdmissionHttpServer(config: LocalAdmissionConfig, version: string, runtimeAuthority: Delegator, executor: AdmissionExecutorClient, options?: {
+    readonly environment?: NodeJS.ProcessEnv;
+    readonly now?: () => Date;
+    readonly transport?: LocalMtlsIdentity;
+}): Server;
+export declare function startConfiguredLocalAdmission(version: string, environment?: NodeJS.ProcessEnv): Promise<{
+    readonly server: Server;
+    readonly config: LocalAdmissionConfig;
+    readonly announcement: LocalRuntimeEndpoint;
+}>;