@agentplat/inference-control 0.3.0-alpha.3 → 0.3.0-alpha.5

package/dist/trust.js

@@ -0,0 +1,989 @@
+import { assertExactKeys, assertSafeInteger, createTrustEligibilityRequestV1, createEvidenceClaimV1, deepFreeze, digestScopeV1, digestSubjectV1, digestTrustProfileKeyV1, digestTrustJsonV1, evaluateTrustEligibilityV1, restoreEvidenceTrustSnapshotV1, validateEvidenceScopeV1, validateEvidenceTrustStateV1, validateTrustSubjectV1, } from "@agentplat/trust";
+import { digestControlJsonV1 } from "./canonical.js";
+import { actionDigest, scopeDigest, } from "./tools.js";
+import { outboundMessageDigest, } from "./messages.js";
+/**
+ * Returns an exact, content-free reference to the accepted assessment request.
+ * The reference digest commits to the whole request record, including its
+ * target and scope, but the Claim only carries this digest and identifiers.
+ */
+export function createAssessmentRequestReferenceV1(request) {
+    return controlReference("assessment_request", request.assessmentRequestId, digestControlJsonV1("trace", request));
+}
+/**
+ * Creates a local Claim candidate only; callers decide whether to admit it to
+ * Trust state. Candidate references intentionally bind identifiers and
+ * digests, never prompts, output, arguments, or message payloads.
+ */
+export function createClaimCandidateFromAcceptedInferenceOutcomeV1(input) {
+    return createAcceptedOutcomeClaimCandidate(input, []);
+}
+/**
+ * Converts a terminal, dispatched Action Gateway outcome to a local Claim
+ * candidate. It verifies an already accepted assessment; it never creates or
+ * consumes an Action Grant.
+ */
+export function createClaimCandidateFromAcceptedActionDispatchV1(input) {
+    assertAcceptedAssessment(input.assessmentRequest, input.assessment);
+    const dispatcherBindingDigest = digestActionDispatcherBindingV1(input.dispatcher);
+    const grant = input.grant;
+    if (input.assessmentRequest.checkpoint !== "pre_tool" ||
+        input.assessmentRequest.targetKind !== "action" ||
+        grant.status !== "dispatched" ||
+        grant.assessmentRequestId !== input.assessmentRequest.assessmentRequestId ||
+        grant.assessmentId !== input.assessment.assessmentId ||
+        grant.assessmentTargetDigest !== input.assessment.targetDigest ||
+        grant.scopeDigest !== controlScopeDigest(input.assessmentRequest.scope) ||
+        grant.scopeDigest !== controlScopeDigest(grant.scope) ||
+        grant.actionBindingId !== input.binding.actionBindingId ||
+        grant.actionBindingVersion !== input.binding.actionBindingVersion ||
+        grant.namespace !== input.binding.namespace ||
+        grant.toolId !== input.binding.toolId ||
+        grant.operation !== input.binding.operation ||
+        grant.handlerDigest !== input.binding.handlerDigest ||
+        input.binding.dispatcherId !== input.dispatcher.dispatcherId ||
+        input.binding.dispatcherVersion !== input.dispatcher.dispatcherVersion ||
+        input.binding.fencingMode !== input.dispatcher.fencingMode ||
+        grant.actionDigest !== actionDigest(grant, input.binding))
+        throw new Error("accepted_terminal_outcome_mismatch");
+    return createAcceptedOutcomeClaimCandidate(input, [
+        controlReference("action_gateway_outcome", grant.grantId, digestControlJsonV1("trace", {
+            schemaVersion: 1,
+            grantId: grant.grantId,
+            stateGeneration: grant.stateGeneration,
+            scopeDigest: grant.scopeDigest,
+            actionDigest: grant.actionDigest,
+            assessmentRequestId: grant.assessmentRequestId,
+            assessmentId: grant.assessmentId,
+            status: grant.status,
+        })),
+        trustReference("action_dispatcher_binding", input.dispatcher.dispatcherId, dispatcherBindingDigest),
+    ]);
+}
+/**
+ * Converts a terminal, sent outbound-message outcome to a local Claim
+ * candidate. It references digests only and never copies the message body.
+ */
+export function createClaimCandidateFromAcceptedOutboundMessageV1(input) {
+    assertAcceptedAssessment(input.assessmentRequest, input.assessment);
+    const dispatcherBindingDigest = digestOutboundMessageDispatcherBindingV1(input.dispatcher);
+    const attempt = input.attempt;
+    if (input.assessmentRequest.checkpoint !== "pre_message" ||
+        input.assessmentRequest.targetKind !== "outbound_message" ||
+        attempt.status !== "sent" ||
+        attempt.assessmentRequestId !==
+            input.assessmentRequest.assessmentRequestId ||
+        attempt.assessmentId !== input.assessment.assessmentId ||
+        attempt.scopeDigest !== controlScopeDigest(input.assessmentRequest.scope) ||
+        attempt.messageDigest !== input.assessment.targetDigest ||
+        attempt.dispatcherId !== input.dispatcher.dispatcherId ||
+        attempt.dispatcherVersion !== input.dispatcher.dispatcherVersion ||
+        attempt.dispatcherDigest !== input.dispatcher.dispatcherDigest)
+        throw new Error("accepted_terminal_outcome_mismatch");
+    return createAcceptedOutcomeClaimCandidate(input, [
+        controlReference("outbound_message_gateway_outcome", attempt.messageAttemptId, digestControlJsonV1("trace", {
+            schemaVersion: 1,
+            messageAttemptId: attempt.messageAttemptId,
+            messageId: attempt.messageId,
+            scopeDigest: attempt.scopeDigest,
+            messageDigest: attempt.messageDigest,
+            assessmentRequestId: attempt.assessmentRequestId,
+            assessmentId: attempt.assessmentId,
+            status: attempt.status,
+        })),
+        trustReference("outbound_message_dispatcher_binding", input.dispatcher.dispatcherId, dispatcherBindingDigest),
+    ]);
+}
+export function createInferenceControlTrustClaimMappingV1(input) {
+    if (input.schemaVersion !== 1)
+        throw new TypeError("trust_mapping_invalid");
+    assertIdentifier(input.mappingId, "mappingId");
+    assertPositiveInteger(input.mappingVersion, "mappingVersion");
+    assertIdentifier(input.sourceId, "sourceId");
+    assertIdentifier(input.criterionId, "criterionId");
+    if (!["satisfied", "violated", "inconclusive"].includes(input.outcome))
+        throw new TypeError("trust_mapping_invalid");
+    const mappingDigest = digestTrustJsonV1("dependency-binding", {
+        schemaVersion: 1,
+        mappingId: input.mappingId,
+        mappingVersion: input.mappingVersion,
+        sourceId: input.sourceId,
+        subject: input.subject,
+        scope: input.scope,
+        criterionId: input.criterionId,
+        outcome: input.outcome,
+    });
+    return Object.freeze({ ...input, mappingDigest });
+}
+const maximumTrustEligibilityStateIdentities = 4_096;
+const verifiedTrustEligibilityRuntimes = new WeakMap();
+const latestTrustEligibilitySnapshotByStateId = new Map();
+export function digestInferenceControlTrustRuntimeSourceBindingV1(value) {
+    assertIdentifier(value.sourceId, "sourceId");
+    assertPositiveInteger(value.sourceVersion, "sourceVersion");
+    assertTrustDigest(value.protectorBindingDigest, "protectorBindingDigest");
+    return digestTrustJsonV1("dependency-binding", {
+        schemaVersion: 1,
+        kind: "inference_trust_runtime_source",
+        sourceId: value.sourceId,
+        sourceVersion: value.sourceVersion,
+        protectorBindingDigest: value.protectorBindingDigest,
+    });
+}
+export function digestInferenceControlTrustSubjectMappingV1(value) {
+    assertIdentifier(value.controlTenantId, "controlTenantId");
+    assertIdentifier(value.controlRunId, "controlRunId");
+    assertControlDigest(value.controlScopeDigest, "controlScopeDigest");
+    const trustSubject = validateTrustSubjectV1(value.trustSubject);
+    const trustScope = validateEvidenceScopeV1(value.trustScope);
+    if (trustScope.tenantId !== value.controlTenantId)
+        throw new TypeError("trust_state_mapping_invalid");
+    return digestTrustJsonV1("inference-subject-mapping", {
+        schemaVersion: 1,
+        controlTenantId: value.controlTenantId,
+        controlRunId: value.controlRunId,
+        controlScopeDigest: value.controlScopeDigest,
+        trustSubjectDigest: digestSubjectV1(trustSubject),
+        trustScopeDigest: digestScopeV1(trustScope),
+    });
+}
+const stateEligibilityConfigKeys = [
+    "schemaVersion",
+    "operation",
+    "mode",
+    "controlTenantId",
+    "controlRunId",
+    "controlScopeDigest",
+    "trustSubject",
+    "trustScope",
+    "policyId",
+    "policyVersion",
+    "policyDigest",
+    "maximumProfileAgeMs",
+    "requirements",
+    "subjectMappingDigest",
+    "runtimeSourceBindingDigest",
+    "profileResolverBindingDigest",
+    "boundaryBindingDigest",
+    "baseBindingDigest",
+];
+export function createInferenceControlTrustStateEligibilityConfigV1(value) {
+    try {
+        assertExactKeys(value, stateEligibilityConfigKeys, "Inference Control Trust config");
+        if (value.schemaVersion !== 1 ||
+            !["model", "action", "outbound_message"].includes(value.operation) ||
+            (value.mode !== "observe" && value.mode !== "restrict"))
+            throw new TypeError("trust_state_config_invalid");
+        assertIdentifier(value.policyId, "policyId");
+        assertSafeInteger(value.policyVersion, "policyVersion", 1);
+        assertTrustDigest(value.policyDigest, "policyDigest");
+        for (const digest of [
+            value.subjectMappingDigest,
+            value.runtimeSourceBindingDigest,
+            value.profileResolverBindingDigest,
+            value.boundaryBindingDigest,
+            value.baseBindingDigest,
+        ])
+            assertTrustDigest(digest, "Trust binding digest");
+        if (value.profileResolverBindingDigest === value.boundaryBindingDigest ||
+            value.subjectMappingDigest !==
+                digestInferenceControlTrustSubjectMappingV1(value))
+            throw new TypeError("trust_state_config_invalid");
+        const trustSubject = validateTrustSubjectV1(value.trustSubject);
+        const trustScope = validateEvidenceScopeV1(value.trustScope);
+        const validationProfileDigest = "0".repeat(64);
+        const request = createTrustEligibilityRequestV1({
+            schemaVersion: 1,
+            tenantId: value.controlTenantId,
+            subject: trustSubject,
+            subjectDigest: digestSubjectV1(trustSubject),
+            scope: trustScope,
+            scopeDigest: digestScopeV1(trustScope),
+            policyId: value.policyId,
+            policyVersion: value.policyVersion,
+            policyDigest: value.policyDigest,
+            profileId: `profile:${validationProfileDigest}`,
+            profileDigest: validationProfileDigest,
+            maximumProfileAgeMs: value.maximumProfileAgeMs,
+            requirements: value.requirements,
+        });
+        return deepFreeze({
+            ...value,
+            trustSubject,
+            trustScope,
+            requirements: request.requirements,
+        });
+    }
+    catch (error) {
+        throw new TypeError("trust_state_config_invalid", { cause: error });
+    }
+}
+export function digestInferenceControlTrustStateEligibilityConfigV1(value) {
+    const config = createInferenceControlTrustStateEligibilityConfigV1(value);
+    return digestTrustJsonV1("inference-eligibility-config", {
+        schemaVersion: config.schemaVersion,
+        operation: config.operation,
+        mode: config.mode,
+        controlTenantId: config.controlTenantId,
+        controlRunId: config.controlRunId,
+        controlScopeDigest: config.controlScopeDigest,
+        trustSubject: config.trustSubject,
+        trustScope: config.trustScope,
+        policyId: config.policyId,
+        policyVersion: config.policyVersion,
+        policyDigest: config.policyDigest,
+        maximumProfileAgeMs: config.maximumProfileAgeMs,
+        requirements: config.requirements,
+        subjectMappingDigest: config.subjectMappingDigest,
+        runtimeSourceBindingDigest: config.runtimeSourceBindingDigest,
+        baseBindingDigest: config.baseBindingDigest,
+    });
+}
+export function restoreInferenceControlTrustEligibilityRuntimeV1(snapshot, anchor, protector, runtimeSourceBindingDigest, options = {}) {
+    assertTrustDigest(runtimeSourceBindingDigest, "runtimeSourceBindingDigest");
+    const state = restoreEvidenceTrustSnapshotV1(snapshot, anchor, protector, options);
+    const prior = latestTrustEligibilitySnapshotByStateId.get(snapshot.stateId);
+    if (!prior &&
+        latestTrustEligibilitySnapshotByStateId.size >=
+            maximumTrustEligibilityStateIdentities)
+        throw new TypeError("trust_state_capacity_exceeded");
+    if (prior &&
+        (snapshot.generation < prior.generation ||
+            (snapshot.generation === prior.generation &&
+                snapshot.snapshotDigest !== prior.snapshotDigest)))
+        throw new TypeError("trust_state_snapshot_not_current");
+    latestTrustEligibilitySnapshotByStateId.set(snapshot.stateId, {
+        generation: snapshot.generation,
+        snapshotDigest: snapshot.snapshotDigest,
+    });
+    const rollbackAnchor = deepFreeze({ ...anchor });
+    const runtimeId = digestTrustJsonV1("dependency-binding", {
+        schemaVersion: 1,
+        kind: "inference_trust_eligibility_runtime",
+        stateId: snapshot.stateId,
+        generation: snapshot.generation,
+        snapshotDigest: snapshot.snapshotDigest,
+        logicalTimeMs: snapshot.createdAtLogicalMs,
+        runtimeSourceBindingDigest,
+        rollbackAnchor,
+    });
+    const runtime = Object.freeze({
+        schemaVersion: 1,
+        runtimeId,
+    });
+    verifiedTrustEligibilityRuntimes.set(runtime, {
+        runtimeId,
+        stateId: snapshot.stateId,
+        generation: snapshot.generation,
+        snapshotDigest: snapshot.snapshotDigest,
+        logicalTimeMs: snapshot.createdAtLogicalMs,
+        runtimeSourceBindingDigest,
+        rollbackAnchor,
+        state,
+    });
+    return runtime;
+}
+/**
+ * Evaluates an exact Inference Control target against a current, strictly
+ * restored Trust snapshot. Runtime failures are projected as unavailable;
+ * malformed construction-time configuration remains a caller error.
+ */
+export function evaluateInferenceControlTrustStateEligibilityV1(integration, target) {
+    const snapshot = snapshotTrustStateIntegration(integration);
+    assertStateEligibilityTargetBinding(snapshot.config, target);
+    const result = evaluateTrustStateEligibilityFromSnapshot(snapshot, target);
+    emitTrustStateDiagnostic(snapshot, target, result);
+    return result;
+}
+/** Derives the model boundary binding from its local implementation identity. */
+export function digestInferenceControlTrustModelBoundaryV1(boundary) {
+    validateTrustModelBoundaryIdentity(boundary);
+    return digestTrustJsonV1("dependency-binding", {
+        schemaVersion: 1,
+        kind: "model_boundary",
+        modelBoundaryId: boundary.modelBoundaryId,
+        modelBoundaryVersion: boundary.modelBoundaryVersion,
+        implementationDigest: boundary.implementationDigest,
+    });
+}
+/** Derives the real Action dispatcher binding from its public identity. */
+export function digestActionDispatcherBindingV1(dispatcher) {
+    validateActionDispatcherIdentity(dispatcher);
+    return digestTrustJsonV1("dependency-binding", {
+        schemaVersion: 1,
+        kind: "action_dispatcher",
+        dispatcherId: dispatcher.dispatcherId,
+        dispatcherVersion: dispatcher.dispatcherVersion,
+        fencingMode: dispatcher.fencingMode,
+    });
+}
+/** Derives the real Message dispatcher binding, including its dispatcher digest. */
+export function digestOutboundMessageDispatcherBindingV1(dispatcher) {
+    validateMessageDispatcherIdentity(dispatcher);
+    return digestTrustJsonV1("dependency-binding", {
+        schemaVersion: 1,
+        kind: "outbound_message_dispatcher",
+        dispatcherId: dispatcher.dispatcherId,
+        dispatcherVersion: dispatcher.dispatcherVersion,
+        dispatcherDigest: dispatcher.dispatcherDigest,
+        fencingMode: dispatcher.fencingMode,
+    });
+}
+export function digestTrustEligibilityBindingV1(integration, baseBindingDigest) {
+    const snapshot = snapshotIntegration(integration);
+    assertTrustDigest(baseBindingDigest, "baseBindingDigest");
+    return digestTrustEligibilityBindingFromSnapshot(snapshot, baseBindingDigest);
+}
+/**
+ * Runs a model-boundary eligibility check before starting the supplied model
+ * operation. Existing executors remain untouched unless this helper is used.
+ */
+export function runWithTrustEligibilityV1(integration, target, run) {
+    const snapshot = snapshotIntegration(integration);
+    assertTrustDigest(integration.modelBindingDigest, "modelBindingDigest");
+    const bindingDigest = digestTrustEligibilityBindingFromSnapshot(snapshot, integration.modelBindingDigest);
+    requireOrObserveEligibility(snapshot, target, bindingDigest);
+    return run();
+}
+export function wrapActionDispatcherWithTrustV1(dispatcher, integration, mapTarget) {
+    const base = snapshotActionDispatcher(dispatcher);
+    const snapshot = snapshotIntegration(integration);
+    const bindingDigest = digestTrustEligibilityBindingFromSnapshot(snapshot, digestActionDispatcherBindingV1(base));
+    const map = mapTarget.bind(undefined);
+    return Object.freeze({
+        dispatcherId: base.dispatcherId,
+        dispatcherVersion: base.dispatcherVersion,
+        fencingMode: base.fencingMode,
+        trustBindingDigest: bindingDigest,
+        dispatch: async (input) => {
+            const target = map(input);
+            assertActionEligibilityTargetBinding(target, input);
+            requireOrObserveEligibility(snapshot, target, bindingDigest);
+            return base.dispatch(input);
+        },
+    });
+}
+export function wrapOutboundMessageDispatcherWithTrustV1(dispatcher, integration, mapTarget) {
+    const base = snapshotOutboundMessageDispatcher(dispatcher);
+    const snapshot = snapshotIntegration(integration);
+    const bindingDigest = digestTrustEligibilityBindingFromSnapshot(snapshot, digestOutboundMessageDispatcherBindingV1(base));
+    const map = mapTarget.bind(undefined);
+    return Object.freeze({
+        dispatcherId: base.dispatcherId,
+        dispatcherVersion: base.dispatcherVersion,
+        dispatcherDigest: base.dispatcherDigest,
+        fencingMode: base.fencingMode,
+        trustBindingDigest: bindingDigest,
+        send: async (input) => {
+            const target = map(input);
+            assertOutboundMessageEligibilityTargetBinding(target, input);
+            requireOrObserveEligibility(snapshot, target, bindingDigest);
+            return base.send(input);
+        },
+    });
+}
+/**
+ * Runs a model operation only after sampling the current authenticated Trust
+ * runtime. No asynchronous gap is introduced between the final check and run.
+ */
+export function runWithTrustStateEligibilityV1(integration, target, boundary) {
+    return wrapModelBoundaryWithTrustStateV1(boundary, integration).run(target);
+}
+/**
+ * Construction-binds the model implementation and passes the exact target
+ * checked by Trust to that same boundary.
+ */
+export function wrapModelBoundaryWithTrustStateV1(boundary, integration) {
+    const base = snapshotTrustModelBoundary(boundary);
+    const snapshot = snapshotTrustStateIntegration(integration);
+    const baseBindingDigest = digestInferenceControlTrustModelBoundaryV1(base);
+    if (snapshot.config.operation !== "model" ||
+        snapshot.config.baseBindingDigest !== baseBindingDigest)
+        throw new TypeError("trust_state_binding_mismatch");
+    return Object.freeze({
+        modelBoundaryId: base.modelBoundaryId,
+        modelBoundaryVersion: base.modelBoundaryVersion,
+        implementationDigest: base.implementationDigest,
+        trustBindingDigest: snapshot.config.boundaryBindingDigest,
+        run: (targetValue) => {
+            const target = snapshotTrustEligibilityTarget(targetValue);
+            assertStateEligibilityTargetBinding(snapshot.config, target);
+            const result = requireTrustStateEligibility(snapshot, target);
+            const output = base.run(target);
+            emitTrustStateDiagnostic(snapshot, target, result);
+            return output;
+        },
+    });
+}
+/**
+ * Adds a state-backed Trust predicate to an Action dispatcher without
+ * changing its grant, authority, reservation, or fencing contracts.
+ */
+export function wrapActionDispatcherWithTrustStateV1(dispatcher, integration) {
+    const base = snapshotActionDispatcher(dispatcher);
+    const baseBindingDigest = digestActionDispatcherBindingV1(base);
+    const snapshot = snapshotTrustStateIntegration(integration);
+    if (snapshot.config.operation !== "action" ||
+        snapshot.config.baseBindingDigest !== baseBindingDigest)
+        throw new TypeError("trust_state_binding_mismatch");
+    return Object.freeze({
+        dispatcherId: base.dispatcherId,
+        dispatcherVersion: base.dispatcherVersion,
+        fencingMode: base.fencingMode,
+        trustBindingDigest: snapshot.config.boundaryBindingDigest,
+        dispatch: async (input) => {
+            const target = Object.freeze({
+                schemaVersion: 1,
+                operation: "action",
+                tenantId: input.context.tenant.tenantId,
+                runId: snapshot.config.controlRunId,
+                scopeDigest: input.permit.scopeDigest,
+                targetDigest: input.permit.actionDigest,
+            });
+            assertActionEligibilityTargetBinding(target, input);
+            assertStateEligibilityTargetBinding(snapshot.config, target);
+            const result = requireTrustStateEligibility(snapshot, target);
+            const output = base.dispatch(input);
+            emitTrustStateDiagnostic(snapshot, target, result);
+            return output;
+        },
+    });
+}
+/**
+ * Adds a state-backed Trust predicate to an outbound Message dispatcher while
+ * preserving the base dispatcher's attempt and fencing behavior.
+ */
+export function wrapOutboundMessageDispatcherWithTrustStateV1(dispatcher, integration) {
+    const base = snapshotOutboundMessageDispatcher(dispatcher);
+    const baseBindingDigest = digestOutboundMessageDispatcherBindingV1(base);
+    const snapshot = snapshotTrustStateIntegration(integration);
+    if (snapshot.config.operation !== "outbound_message" ||
+        snapshot.config.baseBindingDigest !== baseBindingDigest)
+        throw new TypeError("trust_state_binding_mismatch");
+    return Object.freeze({
+        dispatcherId: base.dispatcherId,
+        dispatcherVersion: base.dispatcherVersion,
+        dispatcherDigest: base.dispatcherDigest,
+        fencingMode: base.fencingMode,
+        trustBindingDigest: snapshot.config.boundaryBindingDigest,
+        send: async (input) => {
+            const target = Object.freeze({
+                schemaVersion: 1,
+                operation: "outbound_message",
+                tenantId: input.message.tenantId,
+                runId: input.message.runId,
+                scopeDigest: input.permit.scopeDigest,
+                targetDigest: input.permit.messageDigest,
+            });
+            assertOutboundMessageEligibilityTargetBinding(target, input);
+            assertStateEligibilityTargetBinding(snapshot.config, target);
+            const result = requireTrustStateEligibility(snapshot, target);
+            const output = base.send(input);
+            emitTrustStateDiagnostic(snapshot, target, result);
+            return output;
+        },
+    });
+}
+function snapshotTrustStateIntegration(integration) {
+    if (!integration || typeof integration !== "object")
+        throw new TypeError("trust_state_integration_invalid");
+    const config = createInferenceControlTrustStateEligibilityConfigV1(integration.config);
+    const source = integration.runtime;
+    if (!source ||
+        typeof source !== "object" ||
+        typeof source.current !== "function" ||
+        (integration.onDiagnostic !== undefined &&
+            typeof integration.onDiagnostic !== "function"))
+        throw new TypeError("trust_state_integration_invalid");
+    const runtimeSourceBindingDigest = digestInferenceControlTrustRuntimeSourceBindingV1(source);
+    if (source.bindingDigest !== runtimeSourceBindingDigest ||
+        config.runtimeSourceBindingDigest !== runtimeSourceBindingDigest)
+        throw new TypeError("trust_state_integration_invalid");
+    return Object.freeze({
+        config,
+        current: source.current.bind(source),
+        runtimeSourceBindingDigest,
+        protectorBindingDigest: source.protectorBindingDigest,
+        onDiagnostic: integration.onDiagnostic === undefined
+            ? undefined
+            : integration.onDiagnostic.bind(integration),
+    });
+}
+function assertStateEligibilityTargetBinding(config, target) {
+    validateTarget(target);
+    if (target.operation !== config.operation ||
+        target.tenantId !== config.controlTenantId ||
+        target.runId !== config.controlRunId ||
+        target.scopeDigest !== config.controlScopeDigest)
+        throw new Error("trust_eligibility_target_mismatch");
+}
+function requireTrustStateEligibility(integration, target) {
+    const result = evaluateTrustStateEligibilityFromSnapshot(integration, target);
+    if (integration.config.mode === "restrict" && result.status !== "eligible") {
+        emitTrustStateDiagnostic(integration, target, result);
+        throw new Error("trust_eligibility_restricted");
+    }
+    return result;
+}
+function emitTrustStateDiagnostic(integration, target, result) {
+    try {
+        integration.onDiagnostic?.(Object.freeze({
+            schemaVersion: 1,
+            operation: target.operation,
+            mode: integration.config.mode,
+            status: result.status,
+            bindingDigest: integration.config.boundaryBindingDigest,
+        }));
+    }
+    catch {
+        // Diagnostics are redacted, observational, and cannot alter delegation.
+    }
+}
+function unavailableTrustStateEligibility(reasonCode) {
+    return deepFreeze({
+        status: "unavailable",
+        eligibilityDecisionId: null,
+        reasonCodes: [reasonCode],
+    });
+}
+function trustStateDecisionResult(decision) {
+    return deepFreeze({
+        status: decision.disposition,
+        eligibilityDecisionId: decision.eligibilityDecisionId,
+        reasonCodes: decision.reasonCodes,
+    });
+}
+function trustDependencyBindingIsCurrent(state, binding, logicalTimeMs) {
+    return (binding !== undefined &&
+        binding.registeredAtLogicalMs <= logicalTimeMs &&
+        binding.validFromLogicalMs <= logicalTimeMs &&
+        (binding.validUntilLogicalMs === null ||
+            logicalTimeMs < binding.validUntilLogicalMs) &&
+        state.dependencyBindingHeads.some((head) => head.bindingKind === binding.bindingKind &&
+            head.bindingName === binding.bindingName &&
+            head.bindingVersion === binding.bindingVersion &&
+            head.bindingDigest === binding.bindingDigest));
+}
+function inferenceTrustBindingsAreCurrent(state, config, logicalTimeMs) {
+    const resolver = state.dependencyBindings.find((binding) => binding.bindingDigest === config.profileResolverBindingDigest);
+    const boundary = state.dependencyBindings.find((binding) => binding.bindingDigest === config.boundaryBindingDigest);
+    const expectedBoundaryKind = config.operation === "model"
+        ? "model_boundary"
+        : config.operation === "action"
+            ? "action_dispatcher"
+            : "message_dispatcher";
+    return (trustDependencyBindingIsCurrent(state, resolver, logicalTimeMs) &&
+        resolver.bindingKind === "profile_resolver" &&
+        resolver.policyDigest === config.policyDigest &&
+        resolver.subjectMappingDigest === config.subjectMappingDigest &&
+        trustDependencyBindingIsCurrent(state, boundary, logicalTimeMs) &&
+        boundary.bindingKind === expectedBoundaryKind &&
+        boundary.policyDigest === config.policyDigest &&
+        boundary.subjectMappingDigest === config.subjectMappingDigest &&
+        boundary.upstreamBindingDigest === resolver.bindingDigest &&
+        boundary.configurationDigest ===
+            digestInferenceControlTrustStateEligibilityConfigV1(config) &&
+        boundary.implementationDigest === config.baseBindingDigest);
+}
+function rollbackAnchorMatches(left, right) {
+    return (left.schemaVersion === 1 &&
+        left.stateId === right.stateId &&
+        left.requiredGeneration === right.requiredGeneration &&
+        left.requiredSnapshotDigest === right.requiredSnapshotDigest &&
+        left.minimumLogicalHighWaterMs === right.minimumLogicalHighWaterMs &&
+        left.protectorBindingDigest === right.protectorBindingDigest);
+}
+function evaluateTrustStateEligibilityFromSnapshot(integration, target) {
+    const config = integration.config;
+    let state;
+    let logicalTimeMs;
+    try {
+        const sample = integration.current();
+        assertExactKeys(sample, ["schemaVersion", "runtime", "rollbackAnchor"], "Inference Control Trust runtime sample");
+        if (sample.schemaVersion !== 1)
+            return unavailableTrustStateEligibility("state_conflict");
+        const runtime = sample.runtime;
+        assertExactKeys(runtime, ["schemaVersion", "runtimeId"], "Inference Control Trust runtime");
+        assertExactKeys(sample.rollbackAnchor, [
+            "schemaVersion",
+            "stateId",
+            "requiredGeneration",
+            "requiredSnapshotDigest",
+            "minimumLogicalHighWaterMs",
+            "protectorBindingDigest",
+        ], "Inference Control Trust rollback anchor");
+        const metadata = runtime && typeof runtime === "object"
+            ? verifiedTrustEligibilityRuntimes.get(runtime)
+            : undefined;
+        const latest = metadata
+            ? latestTrustEligibilitySnapshotByStateId.get(metadata.stateId)
+            : undefined;
+        if (!metadata ||
+            !latest ||
+            runtime.schemaVersion !== 1 ||
+            runtime.runtimeId !== metadata.runtimeId ||
+            metadata.runtimeSourceBindingDigest !==
+                integration.runtimeSourceBindingDigest ||
+            metadata.rollbackAnchor.protectorBindingDigest !==
+                integration.protectorBindingDigest ||
+            !rollbackAnchorMatches(sample.rollbackAnchor, metadata.rollbackAnchor) ||
+            latest.generation !== metadata.generation ||
+            latest.snapshotDigest !== metadata.snapshotDigest)
+            return unavailableTrustStateEligibility("state_conflict");
+        state = validateEvidenceTrustStateV1(metadata.state);
+        logicalTimeMs = metadata.logicalTimeMs;
+        if (state.stateId !== metadata.stateId ||
+            logicalTimeMs < state.logicalTimeHighWaterMs)
+            return unavailableTrustStateEligibility("logical_time_rollback");
+    }
+    catch {
+        return unavailableTrustStateEligibility("state_conflict");
+    }
+    try {
+        if (!inferenceTrustBindingsAreCurrent(state, config, logicalTimeMs))
+            return unavailableTrustStateEligibility("dependency_binding_invalid");
+        const subjectDigest = digestSubjectV1(config.trustSubject);
+        const trustScopeDigest = digestScopeV1(config.trustScope);
+        const profileKey = digestTrustProfileKeyV1({
+            tenantId: config.controlTenantId,
+            subjectDigest,
+            scopeDigest: trustScopeDigest,
+            policyDigest: config.policyDigest,
+        });
+        const profileHead = state.profileHeads.find((head) => head.profileKey === profileKey);
+        if (!profileHead)
+            return unavailableTrustStateEligibility("profile_unavailable");
+        const decision = evaluateTrustEligibilityV1(state, createTrustEligibilityRequestV1({
+            schemaVersion: 1,
+            tenantId: config.controlTenantId,
+            subject: config.trustSubject,
+            subjectDigest,
+            scope: config.trustScope,
+            scopeDigest: trustScopeDigest,
+            policyId: config.policyId,
+            policyVersion: config.policyVersion,
+            policyDigest: config.policyDigest,
+            profileId: profileHead.profileId,
+            profileDigest: profileHead.profileDigest,
+            maximumProfileAgeMs: config.maximumProfileAgeMs,
+            requirements: config.requirements,
+        }), logicalTimeMs);
+        return trustStateDecisionResult(decision);
+    }
+    catch {
+        return unavailableTrustStateEligibility("profile_unavailable");
+    }
+}
+function createAcceptedOutcomeClaimCandidate(input, terminalReferences) {
+    if (input.schemaVersion !== 1)
+        throw new TypeError("accepted_outcome_invalid");
+    assertAcceptedAssessment(input.assessmentRequest, input.assessment);
+    assertControlDigest(input.assessorBindingDigest, "assessorBindingDigest");
+    assertControlDigest(input.dependencyBindingDigest, "dependencyBindingDigest");
+    const mapping = validateClaimMapping(input.mapping);
+    const scopeDigest = controlScopeDigest(input.assessmentRequest.scope);
+    const assessmentDigest = digestControlJsonV1("trace", {
+        schemaVersion: 1,
+        assessmentId: input.assessment.assessmentId,
+        assessmentRequestId: input.assessment.assessmentRequestId,
+        requestGeneration: input.assessment.requestGeneration,
+        targetDigest: input.assessment.targetDigest,
+        checkpoint: input.assessment.checkpoint,
+        disposition: input.assessment.disposition,
+    });
+    const reasonCodesDigest = digestControlJsonV1("trace", [
+        ...input.assessment.reasonCodes,
+    ]);
+    const references = [
+        controlReference("assessment", input.assessment.assessmentId, assessmentDigest),
+        createAssessmentRequestReferenceV1(input.assessmentRequest),
+        controlReference("assessor_binding", input.assessment.assessorId, input.assessorBindingDigest),
+        controlReference("control_scope", input.assessmentRequest.runId, scopeDigest),
+        controlReference("dependency_binding", input.assessment.policyId, input.dependencyBindingDigest),
+        controlReference("outcome_reason_codes", input.assessment.assessmentId, reasonCodesDigest),
+        trustReference("trust_mapping", mapping.mappingId, mapping.mappingDigest),
+        ...terminalReferences,
+    ].sort(referenceOrder);
+    return createEvidenceClaimV1({
+        schemaVersion: 1,
+        sourceId: mapping.sourceId,
+        sourceKind: "local",
+        causationId: input.assessment.assessmentId,
+        subject: mapping.subject,
+        scope: mapping.scope,
+        criterionId: mapping.criterionId,
+        outcome: mapping.outcome,
+        content: null,
+        basisReferences: references,
+        observedAt: input.observedAt,
+    });
+}
+function assertActionEligibilityTargetBinding(target, input) {
+    if (target.operation !== "action" ||
+        target.targetDigest !== input.permit.actionDigest ||
+        target.scopeDigest !== input.permit.scopeDigest ||
+        target.tenantId !== input.context.tenant.tenantId ||
+        target.runId !== input.context.runId)
+        throw new Error("trust_eligibility_target_mismatch");
+}
+function assertOutboundMessageEligibilityTargetBinding(target, input) {
+    const message = input.message;
+    const { messageDigest: declaredMessageDigest, ...unsignedMessage } = message;
+    const actualMessageDigest = outboundMessageDigest(unsignedMessage);
+    const actualScopeDigest = scopeDigest(message.scope);
+    if (target.operation !== "outbound_message" ||
+        target.targetDigest !== actualMessageDigest ||
+        target.scopeDigest !== actualScopeDigest ||
+        target.tenantId !== message.tenantId ||
+        target.runId !== message.runId ||
+        declaredMessageDigest !== actualMessageDigest ||
+        input.permit.messageDigest !== actualMessageDigest ||
+        input.permit.scopeDigest !== actualScopeDigest)
+        throw new Error("trust_eligibility_target_mismatch");
+}
+function requireOrObserveEligibility(integration, target, bindingDigest) {
+    validateTarget(target);
+    let status = "unavailable";
+    try {
+        const decision = integration.resolver.resolve(target);
+        status = eligibilityStatus(integration, target, decision) ?? "mismatch";
+    }
+    catch {
+        status = "unavailable";
+    }
+    try {
+        integration.onDiagnostic?.(Object.freeze({
+            schemaVersion: 1,
+            operation: target.operation,
+            mode: integration.policy.mode,
+            status,
+            bindingDigest,
+        }));
+    }
+    catch {
+        // Diagnostics are observational and cannot influence delegation.
+    }
+    if (integration.policy.mode === "restrict" && status !== "eligible")
+        throw new Error("trust_eligibility_restricted");
+}
+function eligibilityStatus(integration, target, decision) {
+    if (!decision || decision.schemaVersion !== 1)
+        return undefined;
+    if (!isEligibilityStatus(decision.status))
+        return undefined;
+    if (decision.policyDigest !== integration.policy.policyDigest ||
+        decision.resolverDigest !== integration.resolver.resolverDigest ||
+        decision.mappingDigest !== integration.mapping.mappingDigest ||
+        decision.scopeDigest !== target.scopeDigest ||
+        decision.targetDigest !== target.targetDigest)
+        return "mismatch";
+    return decision.status;
+}
+function assertAcceptedAssessment(request, assessment) {
+    if (request.status !== "accepted" ||
+        assessment.disposition !== "allow" ||
+        request.assessmentRequestId !== assessment.assessmentRequestId ||
+        request.requestGeneration !== assessment.requestGeneration ||
+        request.runId !== assessment.runId ||
+        request.tenantId !== assessment.tenantId ||
+        request.policyId !== assessment.policyId ||
+        request.policyVersion !== assessment.policyVersion ||
+        request.checkpoint !== assessment.checkpoint ||
+        request.assessorId !== assessment.assessorId ||
+        request.assessorVersion !== assessment.assessorVersion ||
+        request.targetKind !== assessment.targetKind ||
+        request.targetDigest !== assessment.targetDigest ||
+        request.zoneDigest !== assessment.zoneDigest ||
+        request.provenanceDigest !== assessment.provenanceDigest ||
+        controlScopeDigest(request.scope) !== controlScopeDigest(assessment.scope))
+        throw new Error("accepted_outcome_mismatch");
+}
+function snapshotIntegration(integration) {
+    validateIntegration(integration);
+    const resolver = integration.resolver;
+    const onDiagnostic = integration.onDiagnostic;
+    return Object.freeze({
+        policy: Object.freeze({ ...integration.policy }),
+        resolver: Object.freeze({
+            resolverId: resolver.resolverId,
+            resolverVersion: resolver.resolverVersion,
+            resolverDigest: resolver.resolverDigest,
+            resolve: resolver.resolve.bind(resolver),
+        }),
+        mapping: Object.freeze({ ...integration.mapping }),
+        onDiagnostic: onDiagnostic === undefined ? undefined : onDiagnostic.bind(integration),
+    });
+}
+function snapshotTrustModelBoundary(boundary) {
+    validateTrustModelBoundaryIdentity(boundary);
+    if (typeof boundary.run !== "function")
+        throw new TypeError("model_boundary_invalid");
+    return Object.freeze({
+        modelBoundaryId: boundary.modelBoundaryId,
+        modelBoundaryVersion: boundary.modelBoundaryVersion,
+        implementationDigest: boundary.implementationDigest,
+        run: boundary.run.bind(boundary),
+    });
+}
+function snapshotActionDispatcher(dispatcher) {
+    validateActionDispatcherIdentity(dispatcher);
+    if (typeof dispatcher.dispatch !== "function")
+        throw new TypeError("dispatcher_invalid");
+    return Object.freeze({
+        dispatcherId: dispatcher.dispatcherId,
+        dispatcherVersion: dispatcher.dispatcherVersion,
+        fencingMode: dispatcher.fencingMode,
+        dispatch: dispatcher.dispatch.bind(dispatcher),
+    });
+}
+function snapshotOutboundMessageDispatcher(dispatcher) {
+    validateMessageDispatcherIdentity(dispatcher);
+    if (typeof dispatcher.send !== "function")
+        throw new TypeError("dispatcher_invalid");
+    return Object.freeze({
+        dispatcherId: dispatcher.dispatcherId,
+        dispatcherVersion: dispatcher.dispatcherVersion,
+        dispatcherDigest: dispatcher.dispatcherDigest,
+        fencingMode: dispatcher.fencingMode,
+        send: dispatcher.send.bind(dispatcher),
+    });
+}
+function digestTrustEligibilityBindingFromSnapshot(integration, baseBindingDigest) {
+    return digestTrustJsonV1("dependency-binding", {
+        schemaVersion: 1,
+        policyDigest: integration.policy.policyDigest,
+        resolverDigest: integration.resolver.resolverDigest,
+        mappingDigest: integration.mapping.mappingDigest,
+        baseBindingDigest,
+    });
+}
+function validateClaimMapping(mapping) {
+    const expected = createInferenceControlTrustClaimMappingV1({
+        schemaVersion: mapping.schemaVersion,
+        mappingId: mapping.mappingId,
+        mappingVersion: mapping.mappingVersion,
+        sourceId: mapping.sourceId,
+        subject: mapping.subject,
+        scope: mapping.scope,
+        criterionId: mapping.criterionId,
+        outcome: mapping.outcome,
+    });
+    if (expected.mappingDigest !== mapping.mappingDigest)
+        throw new Error("trust_mapping_mismatch");
+    return expected;
+}
+function controlScopeDigest(scope) {
+    return digestControlJsonV1("scope", scope);
+}
+function controlReference(referenceType, referenceId, referenceDigest) {
+    return {
+        schemaVersion: 1,
+        kind: "control_record",
+        referenceType,
+        referenceId,
+        referenceDigest,
+    };
+}
+function trustReference(referenceType, referenceId, referenceDigest) {
+    return {
+        schemaVersion: 1,
+        kind: "external",
+        referenceType,
+        referenceId,
+        referenceDigest,
+    };
+}
+function referenceOrder(left, right) {
+    const leftKey = `${left.kind}\u0000${left.referenceType}\u0000${left.referenceId}\u0000${left.referenceDigest}`;
+    const rightKey = `${right.kind}\u0000${right.referenceType}\u0000${right.referenceId}\u0000${right.referenceDigest}`;
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+}
+function validateIntegration(integration) {
+    const { policy, resolver, mapping } = integration;
+    assertIdentifier(policy.policyId, "policyId");
+    assertPositiveInteger(policy.policyVersion, "policyVersion");
+    assertTrustDigest(policy.policyDigest, "policyDigest");
+    if (policy.mode !== "observe" && policy.mode !== "restrict")
+        throw new TypeError("trust_policy_invalid");
+    assertIdentifier(resolver.resolverId, "resolverId");
+    assertPositiveInteger(resolver.resolverVersion, "resolverVersion");
+    assertTrustDigest(resolver.resolverDigest, "resolverDigest");
+    if (typeof resolver.resolve !== "function")
+        throw new TypeError("trust_resolver_invalid");
+    assertIdentifier(mapping.mappingId, "mappingId");
+    assertPositiveInteger(mapping.mappingVersion, "mappingVersion");
+    assertTrustDigest(mapping.mappingDigest, "mappingDigest");
+    if (integration.onDiagnostic !== undefined &&
+        typeof integration.onDiagnostic !== "function")
+        throw new TypeError("trust_diagnostic_invalid");
+}
+function validateTrustModelBoundaryIdentity(boundary) {
+    assertIdentifier(boundary.modelBoundaryId, "modelBoundaryId");
+    assertPositiveInteger(boundary.modelBoundaryVersion, "modelBoundaryVersion");
+    assertTrustDigest(boundary.implementationDigest, "implementationDigest");
+}
+function validateActionDispatcherIdentity(dispatcher) {
+    assertIdentifier(dispatcher.dispatcherId, "dispatcherId");
+    assertPositiveInteger(dispatcher.dispatcherVersion, "dispatcherVersion");
+    if (dispatcher.fencingMode !== "local_only" &&
+        dispatcher.fencingMode !== "downstream_atomic")
+        throw new TypeError("dispatcher_invalid");
+}
+function validateMessageDispatcherIdentity(dispatcher) {
+    validateActionDispatcherIdentity(dispatcher);
+    assertControlDigest(dispatcher.dispatcherDigest, "dispatcherDigest");
+}
+function validateTarget(target) {
+    if (target.schemaVersion !== 1 ||
+        !["model", "action", "outbound_message"].includes(target.operation))
+        throw new TypeError("trust_eligibility_target_invalid");
+    assertIdentifier(target.tenantId, "tenantId");
+    assertIdentifier(target.runId, "runId");
+    assertControlDigest(target.scopeDigest, "scopeDigest");
+    assertControlDigest(target.targetDigest, "targetDigest");
+}
+function snapshotTrustEligibilityTarget(target) {
+    if (!target || typeof target !== "object")
+        throw new TypeError("trust_eligibility_target_invalid");
+    const snapshot = Object.freeze({
+        schemaVersion: target.schemaVersion,
+        operation: target.operation,
+        tenantId: target.tenantId,
+        runId: target.runId,
+        scopeDigest: target.scopeDigest,
+        targetDigest: target.targetDigest,
+    });
+    validateTarget(snapshot);
+    return snapshot;
+}
+function isEligibilityStatus(value) {
+    return (typeof value === "string" &&
+        [
+            "eligible",
+            "restricted",
+            "unavailable",
+            "stale",
+            "mismatch",
+            "quarantined",
+        ].includes(value));
+}
+function assertIdentifier(value, label) {
+    if (typeof value !== "string" ||
+        value.length === 0 ||
+        value.length > 256 ||
+        /[\u0000-\u001f\u007f]/u.test(value))
+        throw new TypeError(`${label}_invalid`);
+}
+function assertPositiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value < 1)
+        throw new TypeError(`${label}_invalid`);
+}
+function assertControlDigest(value, label) {
+    if (typeof value !== "string" || !/^sha256:[0-9a-f]{64}$/u.test(value))
+        throw new TypeError(`${label}_invalid`);
+}
+function assertTrustDigest(value, label) {
+    if (typeof value !== "string" || !/^[0-9a-f]{64}$/u.test(value))
+        throw new TypeError(`${label}_invalid`);
+}
+//# sourceMappingURL=trust.js.map