@agenticprimitives/fabric 0.0.0-alpha.4 → 0.0.0-alpha.8

package/dist/interaction-profile.js

@@ -0,0 +1,192 @@
+// The profile mechanism (spec 340 W4) — what replaces the frozen `MessageKind`/`CaseState` enums.
+//
+// A profile declares what one KIND of interaction permits: its roles, its acts, the context every
+// exchange in it must pin, which acts can create an obligation, and how it ends. A new interaction
+// type is therefore a new profile — data — rather than a new enum member and a schema change. That is
+// the whole extensibility story for anyone outside this repo.
+//
+// A PROFILE PERMITS NOTHING. `checkExchangeAgainstProfile` answers "is this move well-formed FOR THIS
+// KIND of interaction", which is a shape question. Whether the actor was allowed to make it is
+// `delegation` + `entitlements` + `tool-policy`, re-evaluated at the moment of acting (ADR-0041).
+// The two are easy to conflate precisely because both can say no, so: a profile refusal means the
+// record would be uninterpretable; an authority refusal means the party had no right. A profile
+// saying yes has granted nothing.
+//
+// Versioning is the anti-downgrade control (spec 340 §6). `<name>/<semver>`, pinned onto every
+// Exchange, and both halves required — a bare name would make the pin unfalsifiable.
+import { isProfileVersion } from './interaction-record.js';
+/**
+ * Every violation, not the first.
+ *
+ * A caller fixing one at a time needs N round trips to learn the exchange was never valid, and the
+ * usual outcome of that is a caller who stops checking.
+ */
+export function checkExchangeAgainstProfile(profile, exchange) {
+    const violations = [];
+    if (!isProfileVersion(exchange.profileVersion)) {
+        violations.push({ reason: 'malformed-profile-version', value: exchange.profileVersion });
+    }
+    else if (exchange.profileVersion !== profile.profileVersion) {
+        // Not automatically an attack — an interaction whose profile versioned mid-flight legitimately
+        // contains exchanges under both. It IS the signal, and the only thing that disagrees afterwards.
+        violations.push({
+            reason: 'profile-version-mismatch',
+            pinned: exchange.profileVersion,
+            expected: profile.profileVersion,
+        });
+    }
+    for (const act of exchange.acts) {
+        if (!profile.permittedActs.includes(act))
+            violations.push({ reason: 'act-not-permitted', act });
+    }
+    for (const kind of profile.requiredContextKinds) {
+        if (!exchange.contextKinds.includes(kind))
+            violations.push({ reason: 'missing-required-context', kind });
+    }
+    if (exchange.createsCommitment) {
+        const creating = exchange.acts.filter((a) => profile.commitmentCreatingActs.includes(a));
+        if (creating.length === 0) {
+            // The structural half of "an Offer is not a Commitment": an exchange cannot claim to have
+            // created an obligation without realizing an act this profile says can create one.
+            violations.push({ reason: 'commitment-from-non-creating-act', act: exchange.acts[0] ?? 'INFORM' });
+        }
+    }
+    return violations;
+}
+// ─── The library ─────────────────────────────────────────────────────────────
+/** Plain conversation. Creates no obligations, requires no context — and saying so explicitly is the
+ *  point: the overwhelming majority of exchanges are this, and they should not carry ceremony. */
+export const DIRECT_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'direct/1.0.0',
+    purpose: 'A conversation between two agents. Carries no obligation and evaluates no authority.',
+    roles: ['participant'],
+    permittedActs: ['INFORM', 'QUERY', 'NOTIFY', 'ACKNOWLEDGE'],
+    requiredContextKinds: [],
+    commitmentCreatingActs: [],
+    closeReasons: ['concluded', 'abandoned'],
+};
+/** Terms are proposed, countered and accepted. The only profile in this starter set where an ACCEPT
+ *  can create an obligation, which is exactly why ACCEPT is not in the others. */
+export const NEGOTIATION_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'negotiation/1.0.0',
+    purpose: 'Offer, counter-offer and acceptance over terms. A valid, authorized ACCEPT creates a Commitment.',
+    roles: ['proposer', 'counterparty'],
+    permittedActs: ['INFORM', 'QUERY', 'PROPOSE', 'COUNTER', 'ACCEPT', 'REJECT', 'RETRACT', 'ACKNOWLEDGE'],
+    requiredContextKinds: [],
+    commitmentCreatingActs: ['ACCEPT'],
+    closeReasons: ['agreed', 'declined', 'withdrawn', 'expired', 'abandoned'],
+};
+/** A question routed to a member and answered. `structured-only` by construction: the permitted acts
+ *  contain no PROPOSE, so a consultation cannot quietly become a negotiation. */
+export const CONSULTATION_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'consultation/1.0.0',
+    purpose: 'A routed question and its answers. Advice, never an offer — and structurally incapable of becoming one.',
+    roles: ['requester', 'router', 'consultant'],
+    permittedActs: ['QUERY', 'INFORM', 'ACKNOWLEDGE', 'REJECT'],
+    requiredContextKinds: ['delegation'],
+    commitmentCreatingActs: [],
+    closeReasons: ['answered', 'declined', 'expired', 'no-consultant-available'],
+};
+/**
+ * Spec 336's pre-task provider qualification, expressed as a profile of this model rather than as a
+ * parallel one. This is the profile mechanism's actual test: an existing, independently-designed
+ * chain either fits or it does not.
+ *
+ * IT MOSTLY FITS, AND WHERE IT DOES NOT, THE FINDING IS REAL — see `ENGAGEMENT_RESPONSE_KIND_AXES`
+ * below. `requiredContextKinds` is `['intent-projection']` because §3.1's rule is that an offer binds
+ * to the projection the provider REVIEWED, not to undisclosed facts in the intent; an engagement
+ * exchange that pins no projection cannot later be checked against what was actually disclosed.
+ *
+ * `commitmentCreatingActs` is EMPTY, and that is the load-bearing line. Nine of the chain's ten steps
+ * grant nothing; only the Mandate authorizes, and a Mandate is issued by `delegation`, not created by
+ * an act in this interaction. An engagement that could mint an obligation would be spec 336's central
+ * claim undone by its own profile.
+ */
+export const ENGAGEMENT_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'engagement/1.0.0',
+    purpose: 'Pre-task provider qualification (spec 336): probe a candidate against a minimized intent projection and receive terms. Grants nothing — only the Mandate authorizes.',
+    roles: ['requester', 'candidate-provider'],
+    permittedActs: ['QUERY', 'INFORM', 'PROPOSE', 'COUNTER', 'REJECT', 'ACKNOWLEDGE', 'RETRACT'],
+    requiredContextKinds: ['intent-projection'],
+    commitmentCreatingActs: [],
+    closeReasons: [
+        'offer-selected',
+        'declined',
+        'referred',
+        'temporarily-unavailable',
+        'not-selected',
+        'expired',
+        'cancelled',
+    ],
+};
+/**
+ * An org topic — the first profile that describes something already in production (spec 340 W11).
+ *
+ * Org topics were an Interaction in everything but name: the org SA owns the board, members join and
+ * leave, `facilitator`/`contributor` are its roles, and it opens and closes. This profile names that
+ * rather than building anything new.
+ *
+ * `commitmentCreatingActs` is empty and `PROPOSE`/`ACCEPT` are absent from the permitted set: a topic
+ * is a discussion board. If a negotiation happens in one, it belongs in its own Interaction under the
+ * negotiation profile — which is exactly ADR-0058 §14's rule that a thread is promoted only when it
+ * acquires an independent property, applied to the case that actually occurs.
+ */
+export const TOPIC_PROFILE = {
+    version: 'ap.interaction-profile.v1',
+    profileVersion: 'topic/1.0.0',
+    purpose: 'An organization discussion board. Members post, facilitators manage. Carries no obligation and is structurally incapable of becoming a negotiation.',
+    roles: ['facilitator', 'contributor'],
+    permittedActs: ['INFORM', 'QUERY', 'NOTIFY', 'ACKNOWLEDGE'],
+    requiredContextKinds: [],
+    commitmentCreatingActs: [],
+    // `archived` is deliberately NOT here. Shelving a board is an inbox/display concern and already
+    // exists as `InboxState.archived`; an interaction that is archived has still concluded or not.
+    closeReasons: ['concluded', 'abandoned'],
+};
+export const PROFILE_LIBRARY = [
+    DIRECT_PROFILE,
+    NEGOTIATION_PROFILE,
+    CONSULTATION_PROFILE,
+    ENGAGEMENT_PROFILE,
+    TOPIC_PROFILE,
+];
+export function profileFor(version) {
+    return PROFILE_LIBRARY.find((p) => p.profileVersion === version);
+}
+// ─── The finding W4 was run to produce ───────────────────────────────────────
+/**
+ * Spec 336 §3.5's six "response kinds" are NOT one axis.
+ *
+ * Four are performatives — WHAT the act does, its illocutionary force. Two are classifications of the
+ * CONTENT an INFORM carries. Modelling all six as one enumeration is the same defect spec 336 itself
+ * diagnosed one level up, when it split probe "mode" into three orthogonal axes because one
+ * enumeration doing three jobs made ordinary positions unsayable.
+ *
+ * The consequence if left merged: `human-ux-required` would need a performative of its own, and the
+ * scheme would grow a concept per business outcome until it was a catalog — exactly what SKOS act
+ * kinds exist to prevent. Keeping the split means a provider saying "I need a human channel" is an
+ * INFORM whose content says so, which is what it actually is.
+ *
+ * This is a finding against spec 336 §3.5, recorded here because the profile is where it surfaced.
+ * It changes no wire format: the response kind stays on the content, where it already lives.
+ */
+export const ENGAGEMENT_RESPONSE_KIND_AXES = {
+    offer: { axis: 'performative', performative: 'PROPOSE' },
+    decline: { axis: 'performative', performative: 'REJECT' },
+    'needs-clarification': { axis: 'performative', performative: 'QUERY' },
+    acknowledgement: { axis: 'performative', performative: 'ACKNOWLEDGE' },
+    // A referral is not a distinct force — it is an INFORM whose content names another provider.
+    // Promoting it would make "who to ask instead" an act rather than a fact.
+    referral: { axis: 'content', carriedBy: 'INFORM' },
+    // A fact about TIME, and the one spec 336 is most careful about: it must never be cached as
+    // absence, because a resolver that can only handle "yes" reads "not right now" as "no such provider".
+    'temporarily-unavailable': { axis: 'content', carriedBy: 'INFORM' },
+    // No performative, and it should not get one: needing a human channel is a property of HOW the
+    // answer must arrive, not of what was said.
+    'human-ux-required': { axis: 'content', carriedBy: 'INFORM' },
+};
+//# sourceMappingURL=interaction-profile.js.map

package/dist/interaction-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-profile.js","sourceRoot":"","sources":["../src/interaction-profile.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,EAAE;AACF,kGAAkG;AAClG,mGAAmG;AACnG,sGAAsG;AACtG,8DAA8D;AAC9D,EAAE;AACF,sGAAsG;AACtG,+FAA+F;AAC/F,kGAAkG;AAClG,kGAAkG;AAClG,gGAAgG;AAChG,kCAAkC;AAClC,EAAE;AACF,+FAA+F;AAC/F,qFAAqF;AAGrF,OAAO,EAAE,gBAAgB,EAAuB,MAAM,yBAAyB,CAAC;AA+ChF;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAA6B,EAC7B,QAA8B;IAE9B,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;IAC3F,CAAC;SAAM,IAAI,QAAQ,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC;QAC9D,+FAA+F;QAC/F,iGAAiG;QACjG,UAAU,CAAC,IAAI,CAAC;YACd,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,QAAQ,CAAC,cAAc;YAC/B,QAAQ,EAAE,OAAO,CAAC,cAAc;SACjC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACzF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,0FAA0F;YAC1F,mFAAmF;YACnF,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAEhF;kGACkG;AAClG,MAAM,CAAC,MAAM,cAAc,GAAyB;IAClD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,cAAc;IAC9B,OAAO,EAAE,sFAAsF;IAC/F,KAAK,EAAE,CAAC,aAAa,CAAC;IACtB,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC;IAC3D,oBAAoB,EAAE,EAAE;IACxB,sBAAsB,EAAE,EAAE;IAC1B,YAAY,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;CACzC,CAAC;AAEF;kFACkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,mBAAmB;IACnC,OAAO,EAAE,kGAAkG;IAC3G,KAAK,EAAE,CAAC,UAAU,EAAE,cAAc,CAAC;IACnC,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,CAAC;IACtG,oBAAoB,EAAE,EAAE;IACxB,sBAAsB,EAAE,CAAC,QAAQ,CAAC;IAClC,YAAY,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC;CAC1E,CAAC;AAEF;iFACiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACxD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,oBAAoB;IACpC,OAAO,EAAE,yGAAyG;IAClH,KAAK,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAC;IAC5C,aAAa,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC;IAC3D,oBAAoB,EAAE,CAAC,YAAY,CAAC;IACpC,sBAAsB,EAAE,EAAE;IAC1B,YAAY,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,yBAAyB,CAAC;CAC7E,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,kBAAkB;IAClC,OAAO,EACL,sKAAsK;IACxK,KAAK,EAAE,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC1C,aAAa,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,CAAC;IAC5F,oBAAoB,EAAE,CAAC,mBAAmB,CAAC;IAC3C,sBAAsB,EAAE,EAAE;IAC1B,YAAY,EAAE;QACZ,gBAAgB;QAChB,UAAU;QACV,UAAU;QACV,yBAAyB;QACzB,cAAc;QACd,SAAS;QACT,WAAW;KACZ;CACF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAyB;IACjD,OAAO,EAAE,2BAA2B;IACpC,cAAc,EAAE,aAAa;IAC7B,OAAO,EACL,qJAAqJ;IACvJ,KAAK,EAAE,CAAC,aAAa,EAAE,aAAa,CAAC;IACrC,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC;IAC3D,oBAAoB,EAAE,EAAE;IACxB,sBAAsB,EAAE,EAAE;IAC1B,gGAAgG;IAChG,+FAA+F;IAC/F,YAAY,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;CACzC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAoC;IAC9D,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,kBAAkB;IAClB,aAAa;CACd,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAEtC;IACF,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE;IACxD,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,QAAQ,EAAE;IACzD,qBAAqB,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE;IACtE,eAAe,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE;IACtE,6FAA6F;IAC7F,0EAA0E;IAC1E,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;IAClD,4FAA4F;IAC5F,sGAAsG;IACtG,yBAAyB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;IACnE,+FAA+F;IAC/F,4CAA4C;IAC5C,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE;CAC9D,CAAC"}

package/dist/interaction-record.d.ts

@@ -0,0 +1,168 @@
+import type { CanonicalAgentId } from '@agenticprimitives/types';
+import type { Hex32 } from './messaging/index.js';
+import type { ProtocolBindingV1 } from './protocol-binding.js';
+import type { InteractionState } from './interaction-machines.js';
+/** The interaction spine id. Ours, never a protocol's — an A2A `contextId` or a DIDComm `thid` is a
+ *  foreign key into someone else's namespace and is carried alongside, never used as this (spec 340 §11). */
+export type InteractionId = `ixn_${string}`;
+/** Content address of a `ContextSnapshotV1`. A snapshot is identified BY its bytes. */
+export type ContextDigest = Hex32;
+/**
+ * The version of an `InteractionProfile`, pinned onto every Exchange.
+ *
+ * A profile declares its own roles, permitted acts, required contexts, state machine and authority
+ * requirements — so a new interaction type is a NEW PROFILE, not a new `MessageKind` member and not a
+ * schema change (spec 340 §6). That is the extensibility mechanism external adopters get.
+ *
+ * `<name>/<semver>` and both halves are required. A bare name would make the pin unfalsifiable, which
+ * is the whole reason the pin exists.
+ */
+export type ProfileVersion = `${string}/${number}.${number}.${number}`;
+export declare function isProfileVersion(value: string): value is ProfileVersion;
+export declare function isFloatingVersion(value: string): boolean;
+/**
+ * ONE reference inside a snapshot — a delegation, an entitlement, a policy, a credential status.
+ *
+ * All four fields are required, and that is the point. A reference carrying only an id resolves to
+ * whatever exists when someone later asks, which means a historical record describes the present
+ * instead of the past. The failure is quiet and forensic: nothing breaks at write time, and a year
+ * later nobody can say what the evaluator actually saw.
+ */
+export interface ContextReferenceV1 {
+    /** What kind of thing this is — `delegation`, `entitlement`, `policy`, `status`, … */
+    kind: string;
+    /** Its canonical id in its OWN namespace. */
+    id: string;
+    /** The EXACT version. Never `current`/`latest` (see `assertReproducible`). */
+    version: string;
+    /** Digest of the referenced artifact as it stood. */
+    digest: Hex32;
+    /** When this reference was observed — not when the artifact was created. */
+    observedAt: string;
+}
+/**
+ * An immutable, digest-addressed bundle of exactly what was known and evaluated when an Exchange was
+ * made. Replaces `contextRefs[]`, which were floating pointers at live state.
+ */
+export interface ContextSnapshotV1 {
+    version: 'ap.context-snapshot.v1';
+    /** sha256 over the canonical body (every field except `digest` itself). */
+    digest: ContextDigest;
+    /** The profile version in force when this was taken. */
+    profileVersion: ProfileVersion;
+    refs: readonly ContextReferenceV1[];
+    takenAt: string;
+}
+export type ContextReproducibilityFailure = {
+    reason: 'floating_version';
+    ref: ContextReferenceV1;
+} | {
+    reason: 'floating_profile_version';
+    value: string;
+} | {
+    reason: 'malformed_profile_version';
+    value: string;
+} | {
+    reason: 'missing_field';
+    ref: ContextReferenceV1;
+    field: keyof ContextReferenceV1;
+};
+/**
+ * The reproducibility gate, as a TOTAL function over the failures rather than a boolean.
+ *
+ * Returns every problem, not the first: a caller fixing one floating ref at a time would otherwise
+ * need N round trips to learn the record was never reproducible.
+ */
+export declare function checkReproducible(input: Pick<ContextSnapshotV1, 'profileVersion' | 'refs'>): readonly ContextReproducibilityFailure[];
+/** Throwing form, for the write path. Fail-closed: an unreproducible snapshot is never stored. */
+export declare function assertReproducible(input: Pick<ContextSnapshotV1, 'profileVersion' | 'refs'>): void;
+/** Digest over the canonical body — every field except `digest`. */
+export declare function hashContextSnapshot(snapshot: Omit<ContextSnapshotV1, 'digest'> | ContextSnapshotV1): Promise<ContextDigest>;
+/** Build + seal. Refs are sorted so two callers observing the same context produce the same digest —
+ *  a content address that depended on insertion order would not be one. */
+export declare function buildContextSnapshot(input: {
+    profileVersion: ProfileVersion;
+    refs: readonly ContextReferenceV1[];
+    takenAt: string;
+}): Promise<ContextSnapshotV1>;
+/** Recompute and compare. A snapshot whose digest does not match its bytes is not evidence. */
+export declare function verifyContextSnapshot(snapshot: ContextSnapshotV1): Promise<boolean>;
+/**
+ * An agent's standing in an Interaction under a profile-defined role, over a time window.
+ *
+ * The role is a plain string BECAUSE the profile defines the role set. Enumerating roles here would
+ * reintroduce the frozen taxonomy profiles exist to replace — and a role, unlike a state, has no
+ * substrate-wide meaning to enumerate against.
+ */
+export interface ParticipationV1 {
+    agent: CanonicalAgentId;
+    /** Defined by the interaction's profile, not by this package. */
+    role: string;
+    joinedAt: string;
+    /** Absent while participating. Set on leaving; the record is never deleted. */
+    leftAt?: string;
+}
+/** Participants at an instant — a projection over join/leave windows, never a stored second copy. */
+export declare function participantsAt(participations: readonly ParticipationV1[], at: string): readonly ParticipationV1[];
+/**
+ * The durable governed situation. Deliberately does NOT carry its exchanges: they live in their own
+ * records and point INWARD via `ExchangeRecordV1.interactionId`. An aggregate that inlined its
+ * exchanges would have to be rewritten on every message, which is how an "immutable signed unit"
+ * quietly becomes a mutable row.
+ */
+export interface InteractionRecordV1 {
+    version: 'ap.interaction.v1';
+    interactionId: InteractionId;
+    /** The profile IN FORCE. Individual exchanges pin the version they were made under, which may be an
+     *  older one — that difference is exactly what makes a downgrade detectable rather than invisible. */
+    profileVersion: ProfileVersion;
+    /** The gateway owner SA the interaction is custodied by. */
+    principal: CanonicalAgentId;
+    /** Where the interaction is in ITS OWN lifecycle — one of the six machines, and not the same
+     *  question as any exchange's `exec`/`case`. Required rather than defaulted: a record that omitted
+     *  it would be read as `forming` by whoever looked, including after it had concluded. */
+    lifecycleState: InteractionState;
+    /**
+     * HOW membership is determined — the distinction org topics forced into the model.
+     *
+     * `asserted`: the list below IS the membership. Someone joined, someone left, and the record says so.
+     *
+     * `derived`: membership is computed by the custodian from a source that already owns it — for an open
+     * org topic, the organization's own membership. `participations` MUST then stay EMPTY. Copying the
+     * member list per interaction is exactly the duplication `apmsg:openParticipation` forbids
+     * ("derived at read time — never stored per topic"), and a stale copy of a membership list is how a
+     * removed member keeps posting.
+     */
+    participationMode: 'asserted' | 'derived';
+    /** Empty when `participationMode` is `derived` — see above. */
+    participations: readonly ParticipationV1[];
+    /** Foreign keys into other protocols' namespaces (A2A contextId, DIDComm thid, Matrix event id).
+     *  NEVER the canonical id — see `InteractionId` (spec 340 §11). A LIST of typed bindings rather
+     *  than a `Record<protocol, value>`: one protocol contributes several distinct correlators
+     *  (`a2a:contextId` and `a2a:taskId` are not the same key), and each is a claim about a moment, so
+     *  it carries its own `observedAt` like every other reference in this model. */
+    protocolBindings?: readonly ProtocolBindingV1[];
+    createdAt: string;
+    updatedAt: string;
+    /** Monotonic revision, mirroring `ExchangeRecordV1.rev`. */
+    rev: number;
+}
+export type ProfileDowngrade = {
+    exchangeId: string;
+    pinned: ProfileVersion;
+    inForce: ProfileVersion;
+};
+/**
+ * Detect exchanges pinned to a profile version OLDER than the one now in force.
+ *
+ * This is not an error — an interaction whose profile versioned mid-flight legitimately contains
+ * exchanges under both. It is a REPORT, because the attack it surfaces has no network component: an
+ * adversary who can edit the interaction's `profileVersion` reinterprets a Negotiation as a generic
+ * Conversation and takes its acceptance semantics with it. The pin on each Exchange is what makes
+ * that visible, and this is the function that looks.
+ */
+export declare function detectProfileDowngrades(interaction: Pick<InteractionRecordV1, 'profileVersion'>, exchanges: readonly {
+    exchangeId: string;
+    profileVersion?: ProfileVersion;
+}[]): readonly ProfileDowngrade[];
+//# sourceMappingURL=interaction-record.d.ts.map

package/dist/interaction-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-record.d.ts","sourceRoot":"","sources":["../src/interaction-record.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE;6GAC6G;AAC7G,MAAM,MAAM,aAAa,GAAG,OAAO,MAAM,EAAE,CAAC;AAE5C,uFAAuF;AACvF,MAAM,MAAM,aAAa,GAAG,KAAK,CAAC;AAIlC;;;;;;;;;GASG;AACH,MAAM,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;AAIvE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAEvE;AAKD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,MAAM,EAAE,KAAK,CAAC;IACd,4EAA4E;IAC5E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,wBAAwB,CAAC;IAClC,2EAA2E;IAC3E,MAAM,EAAE,aAAa,CAAC;IACtB,wDAAwD;IACxD,cAAc,EAAE,cAAc,CAAC;IAC/B,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,6BAA6B,GACrC;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,0BAA0B,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,2BAA2B,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,kBAAkB,CAAA;CAAE,CAAC;AAE1F;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC,GACxD,SAAS,6BAA6B,EAAE,CAkB1C;AAED,kGAAkG;AAClG,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,MAAM,CAAC,GAAG,IAAI,CAclG;AAED,oEAAoE;AACpE,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,GAAG,iBAAiB,GAC9D,OAAO,CAAC,aAAa,CAAC,CAGxB;AAED;2EAC2E;AAC3E,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,cAAc,EAAE,cAAc,CAAC;IAC/B,IAAI,EAAE,SAAS,kBAAkB,EAAE,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAY7B;AAED,+FAA+F;AAC/F,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEzF;AAID;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,gBAAgB,CAAC;IACxB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAC5B,cAAc,EAAE,SAAS,eAAe,EAAE,EAC1C,EAAE,EAAE,MAAM,GACT,SAAS,eAAe,EAAE,CAE5B;AAID;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,mBAAmB,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B;0GACsG;IACtG,cAAc,EAAE,cAAc,CAAC;IAC/B,4DAA4D;IAC5D,SAAS,EAAE,gBAAgB,CAAC;IAC5B;;6FAEyF;IACzF,cAAc,EAAE,gBAAgB,CAAC;IACjC;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,UAAU,GAAG,SAAS,CAAC;IAC1C,+DAA+D;IAC/D,cAAc,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C;;;;oFAIgF;IAChF,gBAAgB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;CACzB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,IAAI,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,EACxD,SAAS,EAAE,SAAS;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,cAAc,CAAA;CAAE,EAAE,GAC5E,SAAS,gBAAgB,EAAE,CAM7B"}

package/dist/interaction-record.js

@@ -0,0 +1,108 @@
+// The durable governed situation (spec 340 W2; ADR-0058) — the aggregate `ExchangeRecordV1` has been
+// living without.
+//
+// Today the model is Exchange-rooted: an exchange carries a `case?: CaseState` substate and there is no
+// record of the interaction ITSELF. That holds exactly as long as an interaction is one request-shaped
+// thing. It stops the moment participants join and leave, a profile versions, a context must be
+// reproducible, or a commitment outlives any single exchange.
+//
+//   Interaction   the governed situation      durable: participants, profile, state, commitments
+//     └── Exchange   one immutable signed unit crossing its boundary
+//
+// An Exchange without an Interaction is a message. An Interaction without Exchanges is an empty room.
+// Both are legitimate; neither is the other.
+//
+// WHAT THIS FILE CONFERS: nothing. An `InteractionRecordV1` records who is participating and under what
+// profile; it never decides whether an act is permitted. Participation is not authority — a role
+// explains WHY delegations were issued, it never substitutes for one (ADR-0048 §4). Authority stays in
+// `delegation` + `entitlements` + `tool-policy`, re-evaluated at the moment of acting.
+import { canonicalizeJson } from '@agenticprimitives/types';
+import { sha256Hex32 } from './messaging/index.js';
+const PROFILE_VERSION_RE = /^[a-z][a-z0-9-]*(?:\.[a-z0-9-]+)*\/\d+\.\d+\.\d+$/;
+export function isProfileVersion(value) {
+    return PROFILE_VERSION_RE.test(value);
+}
+/** Values that name "whatever exists now". Forbidden inside any historical record (spec 340 §7). */
+const FLOATING = new Set(['current', 'latest', 'head', 'main', 'tip', 'now']);
+export function isFloatingVersion(value) {
+    return FLOATING.has(value.trim().toLowerCase());
+}
+/**
+ * The reproducibility gate, as a TOTAL function over the failures rather than a boolean.
+ *
+ * Returns every problem, not the first: a caller fixing one floating ref at a time would otherwise
+ * need N round trips to learn the record was never reproducible.
+ */
+export function checkReproducible(input) {
+    const failures = [];
+    if (isFloatingVersion(input.profileVersion)) {
+        failures.push({ reason: 'floating_profile_version', value: input.profileVersion });
+    }
+    else if (!isProfileVersion(input.profileVersion)) {
+        failures.push({ reason: 'malformed_profile_version', value: input.profileVersion });
+    }
+    for (const ref of input.refs) {
+        for (const field of ['kind', 'id', 'version', 'digest', 'observedAt']) {
+            if (!ref[field])
+                failures.push({ reason: 'missing_field', ref, field });
+        }
+        if (ref.version && isFloatingVersion(ref.version)) {
+            failures.push({ reason: 'floating_version', ref });
+        }
+    }
+    return failures;
+}
+/** Throwing form, for the write path. Fail-closed: an unreproducible snapshot is never stored. */
+export function assertReproducible(input) {
+    const failures = checkReproducible(input);
+    if (failures.length === 0)
+        return;
+    throw new Error(`ContextSnapshot is not reproducible: ${failures
+        .map((f) => f.reason === 'floating_version'
+        ? `${f.ref.kind}:${f.ref.id} pins "${f.ref.version}"`
+        : f.reason === 'missing_field'
+            ? `${f.ref.kind}:${f.ref.id} missing ${f.field}`
+            : `profileVersion "${f.value}" (${f.reason})`)
+        .join('; ')}`);
+}
+/** Digest over the canonical body — every field except `digest`. */
+export async function hashContextSnapshot(snapshot) {
+    const { digest: _digest, ...body } = snapshot;
+    return sha256Hex32(canonicalizeJson(body));
+}
+/** Build + seal. Refs are sorted so two callers observing the same context produce the same digest —
+ *  a content address that depended on insertion order would not be one. */
+export async function buildContextSnapshot(input) {
+    assertReproducible(input);
+    const refs = [...input.refs].sort((a, b) => a.kind === b.kind ? (a.id === b.id ? a.digest.localeCompare(b.digest) : a.id.localeCompare(b.id)) : a.kind.localeCompare(b.kind));
+    const body = {
+        version: 'ap.context-snapshot.v1',
+        profileVersion: input.profileVersion,
+        refs,
+        takenAt: input.takenAt,
+    };
+    return { ...body, digest: await hashContextSnapshot(body) };
+}
+/** Recompute and compare. A snapshot whose digest does not match its bytes is not evidence. */
+export async function verifyContextSnapshot(snapshot) {
+    return (await hashContextSnapshot(snapshot)) === snapshot.digest;
+}
+/** Participants at an instant — a projection over join/leave windows, never a stored second copy. */
+export function participantsAt(participations, at) {
+    return participations.filter((p) => p.joinedAt <= at && (p.leftAt === undefined || p.leftAt > at));
+}
+/**
+ * Detect exchanges pinned to a profile version OLDER than the one now in force.
+ *
+ * This is not an error — an interaction whose profile versioned mid-flight legitimately contains
+ * exchanges under both. It is a REPORT, because the attack it surfaces has no network component: an
+ * adversary who can edit the interaction's `profileVersion` reinterprets a Negotiation as a generic
+ * Conversation and takes its acceptance semantics with it. The pin on each Exchange is what makes
+ * that visible, and this is the function that looks.
+ */
+export function detectProfileDowngrades(interaction, exchanges) {
+    return exchanges.flatMap((x) => x.profileVersion && x.profileVersion !== interaction.profileVersion
+        ? [{ exchangeId: x.exchangeId, pinned: x.profileVersion, inForce: interaction.profileVersion }]
+        : []);
+}
+//# sourceMappingURL=interaction-record.js.map

package/dist/interaction-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interaction-record.js","sourceRoot":"","sources":["../src/interaction-record.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,kBAAkB;AAClB,EAAE;AACF,wGAAwG;AACxG,uGAAuG;AACvG,gGAAgG;AAChG,8DAA8D;AAC9D,EAAE;AACF,iGAAiG;AACjG,qEAAqE;AACrE,EAAE;AACF,sGAAsG;AACtG,6CAA6C;AAC7C,EAAE;AACF,wGAAwG;AACxG,iGAAiG;AACjG,uGAAuG;AACvG,uFAAuF;AAEvF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AA2BnD,MAAM,kBAAkB,GAAG,mDAAmD,CAAC;AAE/E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,oGAAoG;AACpG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9E,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAClD,CAAC;AA6CD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAyD;IAEzD,MAAM,QAAQ,GAAoC,EAAE,CAAC;IAErD,IAAI,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAU,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,GAAG,CAAC,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,kBAAkB,CAAC,KAAyD;IAC1F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ;SAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC,CAAC,MAAM,KAAK,kBAAkB;QAC7B,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,OAAO,GAAG;QACrD,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,eAAe;YAC5B,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC,CAAC,KAAK,EAAE;YAChD,CAAC,CAAC,mBAAmB,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,MAAM,GAAG,CAClD;SACA,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAA+D;IAE/D,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,QAA6B,CAAC;IACnE,OAAO,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;2EAC2E;AAC3E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CACjI,CAAC;IACF,MAAM,IAAI,GAAG;QACX,OAAO,EAAE,wBAAiC;QAC1C,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,IAAI;QACJ,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;IACF,OAAO,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAA2B;IACrE,OAAO,CAAC,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC;AACnE,CAAC;AAoBD,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAC5B,cAA0C,EAC1C,EAAU;IAEV,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAsDD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAwD,EACxD,SAA6E;IAE7E,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC,cAAc;QACjE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,OAAO,EAAE,WAAW,CAAC,cAAc,EAAE,CAAC;QAC/F,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC"}

package/dist/interactions/machine.d.ts

@@ -1,4 +1,4 @@
-import { isTerminalCaseState, type CaseRejection } from '../case-machine.js';
+import { isTerminalCaseState, type CaseRejection, type CaseTransitionContext } from '../case-machine.js';
 import type { InteractionCaseV1, InteractionState, InteractionTransitionEventV1 } from './types.js';
 export declare const TERMINAL_STATES: readonly InteractionState[];
 export declare const isTerminalState: typeof isTerminalCaseState;
@@ -15,5 +15,5 @@ export type TransitionResult = {
  * interactions `interactionId` onto the case `caseId` and delegates to `applyCaseTransition`. Pure,
  * fail-closed, role-checked — unchanged semantics for the surviving transitions.
  */
-export declare function applyInteractionTransition(current: InteractionCaseV1, event: InteractionTransitionEventV1): TransitionResult;
+export declare function applyInteractionTransition(current: InteractionCaseV1, event: InteractionTransitionEventV1, ctx?: CaseTransitionContext): TransitionResult;
 //# sourceMappingURL=machine.d.ts.map

package/dist/interactions/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../src/interactions/machine.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,mBAAmB,EAEnB,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAEpG,eAAO,MAAM,eAAe,EAAE,SAAS,gBAAgB,EAAyB,CAAC;AACjF,eAAO,MAAM,eAAe,4BAAsB,CAAC;AAEnD,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAChD,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,4BAA4B,GAClC,gBAAgB,CAclB"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../src/interactions/machine.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,mBAAmB,EAEnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAEpG,eAAO,MAAM,eAAe,EAAE,SAAS,gBAAgB,EAAyB,CAAC;AACjF,eAAO,MAAM,eAAe,4BAAsB,CAAC;AAEnD,MAAM,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAChD,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,4BAA4B,EACnC,GAAG,GAAE,qBAA0B,GAC9B,gBAAgB,CAclB"}

package/dist/interactions/machine.js

@@ -13,7 +13,7 @@ export const isTerminalState = isTerminalCaseState;
  * interactions `interactionId` onto the case `caseId` and delegates to `applyCaseTransition`. Pure,
  * fail-closed, role-checked — unchanged semantics for the surviving transitions.
  */
-export function applyInteractionTransition(current, event) {
+export function applyInteractionTransition(current, event, ctx = {}) {
     return applyCaseTransition(current, {
         version: 'ap.case.event.v1',
         caseId: event.interactionId,
@@ -26,6 +26,6 @@ export function applyInteractionTransition(current, event) {
         evidenceRef: event.evidenceRef,
         authorityRef: event.authorityRef,
         signature: event.signature,
-    });
+    }, ctx);
 }
 //# sourceMappingURL=machine.js.map

package/dist/interactions/machine.js.map

@@ -1 +1 @@
-{"version":3,"file":"machine.js","sourceRoot":"","sources":["../../src/interactions/machine.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,2GAA2G;AAC3G,2GAA2G;AAC3G,sGAAsG;AACtG,EAAE;AACF,iGAAiG;AACjG,6EAA6E;AAE7E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,CAAC,MAAM,eAAe,GAAgC,oBAAoB,CAAC;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAOnD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAC1B,KAAmC;IAEnC,OAAO,mBAAmB,CAAC,OAAO,EAAE;QAClC,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"machine.js","sourceRoot":"","sources":["../../src/interactions/machine.ts"],"names":[],"mappings":"AAAA,2GAA2G;AAC3G,2GAA2G;AAC3G,2GAA2G;AAC3G,sGAAsG;AACtG,EAAE;AACF,iGAAiG;AACjG,6EAA6E;AAE7E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GAGrB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,CAAC,MAAM,eAAe,GAAgC,oBAAoB,CAAC;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAOnD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAA0B,EAC1B,KAAmC,EACnC,MAA6B,EAAE;IAE/B,OAAO,mBAAmB,CAAC,OAAO,EAAE;QAClC,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE,KAAK,CAAC,aAAa;QAC3B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,EAAE,GAAG,CAAC,CAAC;AACV,CAAC"}

package/dist/interactions/store.d.ts

@@ -1,9 +1,18 @@
 import { type TransitionResult } from './machine.js';
+import type { CommitmentRecordV1, DecisionRecordV1 } from '../interaction-machines.js';
 import type { InteractionCaseV1, InteractionId, InteractionState, InteractionTransitionEventV1 } from './types.js';
 export interface InteractionStore {
     /** Register a new case. Fail-closed: only `draft` cases enter; duplicate ids throw. */
     putCase(c: InteractionCaseV1): void;
     getCase(id: InteractionId): InteractionCaseV1 | null;
+    /**
+     * The determination this case produced, if any (spec 340 W10). `null` until a transition emits one —
+     * `approve`/`deny`/`expire` are the three that do. Separate from the case's own state on purpose:
+     * a decision has its own lifecycle, its own signer, and outlives the transition that recorded it.
+     */
+    getDecision(id: InteractionId): DecisionRecordV1 | null;
+    /** The obligation this case gave rise to, if any. `null` until `issue-credential` creates one. */
+    getCommitment(id: InteractionId): CommitmentRecordV1 | null;
     /**
      * Apply a signed transition event. Idempotent: replaying an event whose
      * `idempotencyKey` was already applied returns the current case unchanged

package/dist/interactions/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/interactions/store.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+C,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAEnH,MAAM,WAAW,gBAAgB;IAC/B,uFAAuF;IACvF,OAAO,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,iBAAiB,GAAG,IAAI,CAAC;IACrD;;;;OAIG;IACH,UAAU,CAAC,KAAK,EAAE,4BAA4B,GAAG,gBAAgB,CAAC;IAClE,UAAU,CAAC,EAAE,EAAE,aAAa,GAAG,4BAA4B,EAAE,CAAC;IAC9D,SAAS,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;IACzD;iEAC6D;IAC7D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAAC;CACjD;AAED,wBAAgB,8BAA8B,IAAI,gBAAgB,CA6DjE"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/interactions/store.ts"],"names":[],"mappings":"AAGA,OAAO,EAA+C,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElG,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACvF,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAEnH,MAAM,WAAW,gBAAgB;IAC/B,uFAAuF;IACvF,OAAO,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,EAAE,EAAE,aAAa,GAAG,iBAAiB,GAAG,IAAI,CAAC;IACrD;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,aAAa,GAAG,gBAAgB,GAAG,IAAI,CAAC;IACxD,kGAAkG;IAClG,aAAa,CAAC,EAAE,EAAE,aAAa,GAAG,kBAAkB,GAAG,IAAI,CAAC;IAC5D;;;;OAIG;IACH,UAAU,CAAC,KAAK,EAAE,4BAA4B,GAAG,gBAAgB,CAAC;IAClE,UAAU,CAAC,EAAE,EAAE,aAAa,GAAG,4BAA4B,EAAE,CAAC;IAC9D,SAAS,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;IACzD;iEAC6D;IAC7D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAAC;CACjD;AAED,wBAAgB,8BAA8B,IAAI,gBAAgB,CAyHjE"}