@agentplat/trust 0.3.0-alpha.4

package/LICENSE

@@ -0,0 +1,202 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+

package/README.md

@@ -0,0 +1,14 @@
+# @agentplat/trust
+
+Provider-neutral, browser-safe primitives for deterministic Evidence and Trust
+state. The package has no network, clock, persistence, key-discovery or
+dispatch dependency.
+
+The root exports strict canonical JSON handling, domain-separated digests,
+closed Evidence contracts, immutable empty state and protected snapshot helpers.
+`@agentplat/trust/mesh-records` exports pure Mesh-to-local normalizers; callers
+must perform authentication and authority checks before admitting their output.
+
+This package supplies no global reputation, identity, admission, lease or action
+authority. Those boundaries remain with the application and their existing
+packages.

package/dist/canonical.d.ts

@@ -0,0 +1,20 @@
+import type { JsonValue } from "@agentplat/core";
+import type { TrustDigestDomainV1 } from "./types.js";
+export declare class TrustValidationError extends Error {
+    readonly name = "TrustValidationError";
+}
+export interface StrictJsonLimitsV1 {
+    readonly maximumBytes: number;
+    readonly maximumDepth: number;
+    readonly maximumNodes: number;
+    readonly maximumKeysPerObject: number;
+    readonly maximumItemsPerArray: number;
+}
+export declare const DEFAULT_STRICT_JSON_LIMITS_V1: Readonly<StrictJsonLimitsV1>;
+export declare function canonicalizeTrustJsonV1(value: JsonValue, limits?: StrictJsonLimitsV1): string;
+export declare function canonicalTrustJsonBytesV1(value: JsonValue, limits?: StrictJsonLimitsV1): Uint8Array;
+export declare function digestTrustJsonV1(domain: TrustDigestDomainV1, value: JsonValue, limits?: StrictJsonLimitsV1): string;
+export declare function sha256TrustBytesV1(bytes: Uint8Array): string;
+export declare function utf8ByteLengthV1(value: string): number;
+export declare function deepFreeze<T>(value: T, seen?: Set<object>): T;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AA+CtD,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,0BAA0B;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,eAAO,MAAM,6BAA6B,EAAE,QAAQ,CAAC,kBAAkB,CAOnE,CAAC;AA6GL,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,EAChB,MAAM,GAAE,kBAAkD,GACzD,MAAM,CAKR;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,EAChB,MAAM,CAAC,EAAE,kBAAkB,GAC1B,UAAU,CAEZ;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,mBAAmB,EAC3B,KAAK,EAAE,SAAS,EAChB,MAAM,CAAC,EAAE,kBAAkB,GAC1B,MAAM,CAQR;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAE5D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,cAAoB,GAAG,CAAC,CAQnE"}

package/dist/canonical.js

@@ -0,0 +1,173 @@
+import { sha256Hex } from "./sha256.js";
+const encoder = new TextEncoder();
+const trustDigestDomains = new Set([
+    "scope",
+    "subject",
+    "claim",
+    "claim-relation",
+    "attestation",
+    "attestation-relation",
+    "challenge",
+    "challenge-relation",
+    "challenge-resolution",
+    "retraction",
+    "retraction-relation",
+    "assertion",
+    "root-basis",
+    "content-resolution",
+    "content-resolution-invalidation",
+    "policy",
+    "source-binding",
+    "fusion-input",
+    "fusion-decision",
+    "profile-key",
+    "profile",
+    "eligibility-request",
+    "eligibility-decision",
+    "quarantine-key",
+    "quarantine-evidence-set",
+    "quarantine-record",
+    "recovery-evidence-set",
+    "recovery-decision",
+    "mesh-subject-mapping",
+    "mesh-eligibility-config",
+    "inference-subject-mapping",
+    "inference-eligibility-config",
+    "dependency-binding",
+    "causal-authorization",
+    "origin-proof",
+    "state",
+    "snapshot",
+    "snapshot-integrity",
+    "trace",
+    "observation",
+]);
+export class TrustValidationError extends Error {
+    name = "TrustValidationError";
+}
+export const DEFAULT_STRICT_JSON_LIMITS_V1 = Object.freeze({
+    maximumBytes: 65_536,
+    maximumDepth: 32,
+    maximumNodes: 4_096,
+    maximumKeysPerObject: 256,
+    maximumItemsPerArray: 4_096,
+});
+function assertWellFormedUnicode(value, label) {
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code >= 0xd800 && code <= 0xdbff) {
+            index += 1;
+            if (index >= value.length ||
+                value.charCodeAt(index) < 0xdc00 ||
+                value.charCodeAt(index) > 0xdfff)
+                throw new TrustValidationError(`${label} contains an unpaired surrogate`);
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff) {
+            throw new TrustValidationError(`${label} contains an unpaired surrogate`);
+        }
+    }
+}
+function canonical(value, seen, limits, depth, counters) {
+    if (depth > limits.maximumDepth)
+        throw new TrustValidationError("JSON maximum depth exceeded");
+    counters.nodes += 1;
+    if (counters.nodes > limits.maximumNodes)
+        throw new TrustValidationError("JSON maximum nodes exceeded");
+    if (value === null)
+        return "null";
+    switch (typeof value) {
+        case "boolean":
+            return value ? "true" : "false";
+        case "string":
+            assertWellFormedUnicode(value, "JSON string");
+            return JSON.stringify(value);
+        case "number":
+            if (!Number.isFinite(value))
+                throw new TrustValidationError("JSON numbers must be finite");
+            if (Number.isInteger(value) && !Number.isSafeInteger(value))
+                throw new TrustValidationError("JSON integers must be safe");
+            return Object.is(value, -0) ? "0" : JSON.stringify(value);
+        case "object":
+            break;
+        default:
+            throw new TrustValidationError("JSON contains a non-JSON value");
+    }
+    if (seen.has(value))
+        throw new TrustValidationError("JSON may not contain cycles");
+    seen.add(value);
+    let result;
+    if (Array.isArray(value)) {
+        if (value.length > limits.maximumItemsPerArray)
+            throw new TrustValidationError("JSON maximum array items exceeded");
+        if (Object.getOwnPropertySymbols(value).length)
+            throw new TrustValidationError("JSON arrays may not contain symbol keys");
+        const names = Object.getOwnPropertyNames(value);
+        for (let index = 0; index < value.length; index += 1) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+            if (!descriptor)
+                throw new TrustValidationError("JSON arrays may not be sparse");
+            if (!descriptor.enumerable || descriptor.get || descriptor.set)
+                throw new TrustValidationError("JSON arrays must contain enumerable data");
+        }
+        if (names.length !== value.length + 1 || !names.includes("length"))
+            throw new TrustValidationError("JSON arrays may not contain extra properties");
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+        if (!lengthDescriptor || lengthDescriptor.get || lengthDescriptor.set)
+            throw new TrustValidationError("JSON arrays have an invalid length property");
+        result = `[${value.map((item) => canonical(item, seen, limits, depth + 1, counters)).join(",")}]`;
+    }
+    else {
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null)
+            throw new TrustValidationError("JSON requires plain objects");
+        if (Object.getOwnPropertySymbols(value).length)
+            throw new TrustValidationError("JSON may not contain symbol keys");
+        const keys = Object.getOwnPropertyNames(value);
+        if (keys.length > limits.maximumKeysPerObject)
+            throw new TrustValidationError("JSON maximum object keys exceeded");
+        keys.sort();
+        for (const key of keys) {
+            assertWellFormedUnicode(key, "JSON key");
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor ||
+                !descriptor.enumerable ||
+                descriptor.get ||
+                descriptor.set)
+                throw new TrustValidationError("JSON must contain enumerable data properties");
+        }
+        result = `{${keys.map((key) => `${JSON.stringify(key)}:${canonical(value[key], seen, limits, depth + 1, counters)}`).join(",")}}`;
+    }
+    seen.delete(value);
+    return result;
+}
+export function canonicalizeTrustJsonV1(value, limits = DEFAULT_STRICT_JSON_LIMITS_V1) {
+    const result = canonical(value, new Set(), limits, 0, { nodes: 0 });
+    if (encoder.encode(result).byteLength > limits.maximumBytes)
+        throw new TrustValidationError("JSON maximum bytes exceeded");
+    return result;
+}
+export function canonicalTrustJsonBytesV1(value, limits) {
+    return encoder.encode(canonicalizeTrustJsonV1(value, limits));
+}
+export function digestTrustJsonV1(domain, value, limits) {
+    if (!trustDigestDomains.has(domain))
+        throw new TrustValidationError("digest domain is invalid");
+    return sha256Hex(encoder.encode(`agentplat.trust/${domain}/v1\0${canonicalizeTrustJsonV1(value, limits)}`));
+}
+export function sha256TrustBytesV1(bytes) {
+    return sha256Hex(bytes);
+}
+export function utf8ByteLengthV1(value) {
+    assertWellFormedUnicode(value, "string");
+    return encoder.encode(value).byteLength;
+}
+export function deepFreeze(value, seen = new Set()) {
+    if (value && typeof value === "object" && !seen.has(value)) {
+        seen.add(value);
+        for (const item of Object.values(value))
+            deepFreeze(item, seen);
+        Object.freeze(value);
+    }
+    return value;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAsB;IACtD,OAAO;IACP,SAAS;IACT,OAAO;IACP,gBAAgB;IAChB,aAAa;IACb,sBAAsB;IACtB,WAAW;IACX,oBAAoB;IACpB,sBAAsB;IACtB,YAAY;IACZ,qBAAqB;IACrB,WAAW;IACX,YAAY;IACZ,oBAAoB;IACpB,iCAAiC;IACjC,QAAQ;IACR,gBAAgB;IAChB,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,SAAS;IACT,qBAAqB;IACrB,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,mBAAmB;IACnB,uBAAuB;IACvB,mBAAmB;IACnB,sBAAsB;IACtB,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,oBAAoB;IACpB,sBAAsB;IACtB,cAAc;IACd,OAAO;IACP,UAAU;IACV,oBAAoB;IACpB,OAAO;IACP,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,sBAAsB,CAAC;CACxC;AAUD,MAAM,CAAC,MAAM,6BAA6B,GACxC,MAAM,CAAC,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM;IACpB,YAAY,EAAE,EAAE;IAChB,YAAY,EAAE,KAAK;IACnB,oBAAoB,EAAE,GAAG;IACzB,oBAAoB,EAAE,KAAK;CAC5B,CAAC,CAAC;AAEL,SAAS,uBAAuB,CAAC,KAAa,EAAE,KAAa;IAC3D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,KAAK,IAAI,CAAC,CAAC;YACX,IACE,KAAK,IAAI,KAAK,CAAC,MAAM;gBACrB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM;gBAChC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,MAAM;gBAEhC,MAAM,IAAI,oBAAoB,CAC5B,GAAG,KAAK,iCAAiC,CAC1C,CAAC;QACN,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,oBAAoB,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAChB,KAAc,EACd,IAAiB,EACjB,MAA0B,EAC1B,KAAa,EACb,QAA2B;IAE3B,IAAI,KAAK,GAAG,MAAM,CAAC,YAAY;QAC7B,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;IAChE,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC;IACpB,IAAI,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,YAAY;QACtC,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAClC,KAAK,QAAQ;YACX,uBAAuB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,QAAQ;YACX,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACzB,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;gBACzD,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;YAC/D,OAAO,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5D,KAAK,QAAQ;YACX,MAAM;QACR;YACE,MAAM,IAAI,oBAAoB,CAAC,gCAAgC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QACjB,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,MAAc,CAAC;IACnB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB;YAC5C,MAAM,IAAI,oBAAoB,CAAC,mCAAmC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM;YAC5C,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAChD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU;gBACb,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG;gBAC5D,MAAM,IAAI,oBAAoB,CAC5B,0CAA0C,CAC3C,CAAC;QACN,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChE,MAAM,IAAI,oBAAoB,CAC5B,8CAA8C,CAC/C,CAAC;QACJ,MAAM,gBAAgB,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1E,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,GAAG,IAAI,gBAAgB,CAAC,GAAG;YACnE,MAAM,IAAI,oBAAoB,CAC5B,6CAA6C,CAC9C,CAAC;QACJ,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpG,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;YACtD,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,MAAM;YAC5C,MAAM,IAAI,oBAAoB,CAAC,kCAAkC,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB;YAC3C,MAAM,IAAI,oBAAoB,CAAC,mCAAmC,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,uBAAuB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IACE,CAAC,UAAU;gBACX,CAAC,UAAU,CAAC,UAAU;gBACtB,UAAU,CAAC,GAAG;gBACd,UAAU,CAAC,GAAG;gBAEd,MAAM,IAAI,oBAAoB,CAC5B,8CAA8C,CAC/C,CAAC;QACN,CAAC;QACD,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,CAAE,KAAiC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACjK,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAgB,EAChB,SAA6B,6BAA6B;IAE1D,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,YAAY;QACzD,MAAM,IAAI,oBAAoB,CAAC,6BAA6B,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAgB,EAChB,MAA2B;IAE3B,OAAO,OAAO,CAAC,MAAM,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAA2B,EAC3B,KAAgB,EAChB,MAA2B;IAE3B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;QACjC,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,CAAC,CAAC;IAC7D,OAAO,SAAS,CACd,OAAO,CAAC,MAAM,CACZ,mBAAmB,MAAM,QAAQ,uBAAuB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAC1E,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,UAAU,CAAI,KAAQ,EAAE,OAAO,IAAI,GAAG,EAAU;IAC9D,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;YAChE,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/causal.d.ts

@@ -0,0 +1,7 @@
+import type { EvidenceCausalAuthorizationBasisV1, EvidenceCausalAuthorizationV1 } from "./types.js";
+export declare function validateEvidenceCausalAuthorizationBasisV1(value: unknown): EvidenceCausalAuthorizationBasisV1;
+export declare function digestEvidenceCausalAuthorizationV1(value: unknown): string;
+export declare function validateEvidenceCausalAuthorizationV1(value: unknown): EvidenceCausalAuthorizationV1;
+export declare function createEvidenceCausalAuthorizationV1(input: Omit<EvidenceCausalAuthorizationV1, "authorizationId" | "authorizationDigest">): EvidenceCausalAuthorizationV1;
+export declare function causalAuthorizationReferenceKeyV1(value: Pick<EvidenceCausalAuthorizationBasisV1, "kind" | "referenceType" | "referenceId" | "referenceDigest">): string;
+//# sourceMappingURL=causal.d.ts.map

package/dist/causal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"causal.d.ts","sourceRoot":"","sources":["../src/causal.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,kCAAkC,EAClC,6BAA6B,EAE9B,MAAM,YAAY,CAAC;AAuDpB,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,OAAO,GACb,kCAAkC,CAgCpC;AAWD,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAM1E;AAoFD,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,OAAO,GACb,6BAA6B,CAE/B;AACD,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,IAAI,CACT,6BAA6B,EAC7B,iBAAiB,GAAG,qBAAqB,CAC1C,GACA,6BAA6B,CAuB/B;AAED,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,IAAI,CACT,kCAAkC,EAClC,MAAM,GAAG,eAAe,GAAG,aAAa,GAAG,iBAAiB,CAC7D,GACA,MAAM,CAER"}

package/dist/causal.js

@@ -0,0 +1,155 @@
+import { deepFreeze, digestTrustJsonV1, TrustValidationError, } from "./canonical.js";
+import { assertExactKeys, assertIdentifier, assertSafeInteger, assertTrustDigest, validateEvidenceReferenceV1, } from "./validation.js";
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const relationValues = new Set([
+    "subject_self",
+    "work_assignee",
+    "work_owner",
+    "objective_observer",
+    "recovery_witness",
+    "local_system",
+    "target_author",
+]);
+const authorizationKeys = [
+    "schemaVersion",
+    "authorizationId",
+    "authorizationDigest",
+    "recordId",
+    "recordDigest",
+    "recordKind",
+    "policyDigest",
+    "criterionId",
+    "subjectDigest",
+    "scopeDigest",
+    "targetRecordId",
+    "targetRecordDigest",
+    "sourceRelation",
+    "authorityBindingDigest",
+    "authorityProofDigest",
+    "bases",
+    "authorizedAtLogicalMs",
+];
+const basisKeys = [
+    "schemaVersion",
+    "kind",
+    "referenceType",
+    "referenceId",
+    "referenceDigest",
+    "resolvedDigest",
+    "trustedEffectiveAtLogicalMs",
+    "resolverBindingDigest",
+    "resolutionProofDigest",
+];
+function referenceKey(value) {
+    return `${value.kind}\u0000${value.referenceType}\u0000${value.referenceId}\u0000${value.referenceDigest}`;
+}
+export function validateEvidenceCausalAuthorizationBasisV1(value) {
+    assertExactKeys(value, basisKeys, "causal authorization basis");
+    const v = value;
+    if (v.schemaVersion !== 1)
+        throw new TrustValidationError("causal authorization basis schema is invalid");
+    // Reuse the public reference grammar, including Mesh and Control digest domains.
+    validateEvidenceReferenceV1({
+        schemaVersion: v.schemaVersion,
+        kind: v.kind,
+        referenceType: v.referenceType,
+        referenceId: v.referenceId,
+        referenceDigest: v.referenceDigest,
+    });
+    assertTrustDigest(v.resolvedDigest, "resolvedDigest");
+    assertSafeInteger(v.trustedEffectiveAtLogicalMs, "trustedEffectiveAtLogicalMs");
+    if (v.kind === "evidence") {
+        if (v.resolverBindingDigest !== null || v.resolutionProofDigest !== null)
+            throw new TrustValidationError("evidence causal basis may not carry a resolver proof");
+    }
+    else {
+        assertTrustDigest(v.resolverBindingDigest, "resolverBindingDigest");
+        assertTrustDigest(v.resolutionProofDigest, "resolutionProofDigest");
+    }
+    return deepFreeze(structuredClone(v));
+}
+function authorizationBody(value) {
+    const { authorizationId: _id, authorizationDigest: _digest, ...body } = value;
+    return body;
+}
+export function digestEvidenceCausalAuthorizationV1(value) {
+    const authorization = validateCausalAuthorization(value, false);
+    return digestTrustJsonV1("causal-authorization", authorizationBody(authorization));
+}
+function validateCausalAuthorization(value, verifyDigest) {
+    assertExactKeys(value, authorizationKeys, "causal authorization");
+    const v = value;
+    if (v.schemaVersion !== 1 ||
+        (v.recordKind !== "claim" && v.recordKind !== "challenge"))
+        throw new TrustValidationError("causal authorization schema is invalid");
+    for (const key of ["recordId", "criterionId"])
+        assertIdentifier(v[key], key);
+    for (const key of [
+        "recordDigest",
+        "policyDigest",
+        "subjectDigest",
+        "scopeDigest",
+        "authorityBindingDigest",
+        "authorityProofDigest",
+    ])
+        assertTrustDigest(v[key], key);
+    if ((v.targetRecordId === null) !== (v.targetRecordDigest === null))
+        throw new TrustValidationError("causal authorization target is inconsistent");
+    if (v.targetRecordId !== null) {
+        assertIdentifier(v.targetRecordId, "targetRecordId");
+        assertTrustDigest(v.targetRecordDigest, "targetRecordDigest");
+    }
+    if (typeof v.sourceRelation !== "string" ||
+        !relationValues.has(v.sourceRelation))
+        throw new TrustValidationError("causal authorization source relation is invalid");
+    assertSafeInteger(v.authorizedAtLogicalMs, "authorizedAtLogicalMs");
+    if (!Array.isArray(v.bases) || v.bases.length === 0)
+        throw new TrustValidationError("causal authorization requires bases");
+    const bases = v.bases.map(validateEvidenceCausalAuthorizationBasisV1);
+    const keys = bases.map(referenceKey);
+    if (keys.some((key, index) => index > 0 && compare(keys[index - 1], key) >= 0))
+        throw new TrustValidationError("causal authorization bases must be canonically ordered and unique");
+    if (bases.some((basis) => basis.trustedEffectiveAtLogicalMs > v.authorizedAtLogicalMs))
+        throw new TrustValidationError("causal authorization basis cannot come from the future");
+    if (verifyDigest) {
+        assertTrustDigest(v.authorizationDigest, "authorizationDigest");
+        const candidate = {
+            ...v,
+            bases,
+        };
+        const digest = digestTrustJsonV1("causal-authorization", authorizationBody(candidate));
+        if (v.authorizationDigest !== digest ||
+            v.authorizationId !== `causal-authorization:${digest}`)
+            throw new TrustValidationError("causal authorization digest is invalid");
+    }
+    else {
+        assertIdentifier(v.authorizationId, "authorizationId");
+        assertTrustDigest(v.authorizationDigest, "authorizationDigest");
+    }
+    return deepFreeze(structuredClone({
+        ...v,
+        bases,
+    }));
+}
+export function validateEvidenceCausalAuthorizationV1(value) {
+    return validateCausalAuthorization(value, true);
+}
+export function createEvidenceCausalAuthorizationV1(input) {
+    const body = structuredClone(input);
+    // Temporary derived fields let the closed validator normalize bases before digesting.
+    const provisional = validateCausalAuthorization({
+        ...body,
+        authorizationId: "causal-authorization:pending",
+        authorizationDigest: "0".repeat(64),
+    }, false);
+    const digest = digestTrustJsonV1("causal-authorization", authorizationBody(provisional));
+    return validateCausalAuthorization({
+        ...body,
+        authorizationId: `causal-authorization:${digest}`,
+        authorizationDigest: digest,
+    }, true);
+}
+export function causalAuthorizationReferenceKeyV1(value) {
+    return `${value.kind}\u0000${value.referenceType}\u0000${value.referenceId}\u0000${value.referenceDigest}`;
+}
+//# sourceMappingURL=causal.js.map

package/dist/causal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"causal.js","sourceRoot":"","sources":["../src/causal.ts"],"names":[],"mappings":"AACA,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAMxB,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EAEjB,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAEzB,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CACtD,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc;IACd,eAAe;IACf,YAAY;IACZ,oBAAoB;IACpB,kBAAkB;IAClB,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,iBAAiB,GAAG;IACxB,eAAe;IACf,iBAAiB;IACjB,qBAAqB;IACrB,UAAU;IACV,cAAc;IACd,YAAY;IACZ,cAAc;IACd,aAAa;IACb,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,oBAAoB;IACpB,gBAAgB;IAChB,wBAAwB;IACxB,sBAAsB;IACtB,OAAO;IACP,uBAAuB;CACf,CAAC;AACX,MAAM,SAAS,GAAG;IAChB,eAAe;IACf,MAAM;IACN,eAAe;IACf,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,6BAA6B;IAC7B,uBAAuB;IACvB,uBAAuB;CACf,CAAC;AAEX,SAAS,YAAY,CAAC,KAAyC;IAC7D,OAAO,GAAG,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,aAAa,SAAS,KAAK,CAAC,WAAW,SAAS,KAAK,CAAC,eAAe,EAAE,CAAC;AAC7G,CAAC;AACD,MAAM,UAAU,0CAA0C,CACxD,KAAc;IAEd,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,4BAA4B,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC5B,8CAA8C,CAC/C,CAAC;IACJ,iFAAiF;IACjF,2BAA2B,CAAC;QAC1B,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;KACnC,CAAC,CAAC;IACH,iBAAiB,CAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACtD,iBAAiB,CACf,CAAC,CAAC,2BAA2B,EAC7B,6BAA6B,CAC9B,CAAC;IACF,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,qBAAqB,KAAK,IAAI,IAAI,CAAC,CAAC,qBAAqB,KAAK,IAAI;YACtE,MAAM,IAAI,oBAAoB,CAC5B,sDAAsD,CACvD,CAAC;IACN,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,CAAC,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACpE,iBAAiB,CAAC,CAAC,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CACf,eAAe,CAAC,CAAC,CAAkD,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAoC;IAKpC,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,UAAU,mCAAmC,CAAC,KAAc;IAChE,MAAM,aAAa,GAAG,2BAA2B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAChE,OAAO,iBAAiB,CACtB,sBAAsB,EACtB,iBAAiB,CAAC,aAAa,CAAyB,CACzD,CAAC;AACJ,CAAC;AACD,SAAS,2BAA2B,CAClC,KAAc,EACd,YAAqB;IAErB,eAAe,CAAC,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IACE,CAAC,CAAC,aAAa,KAAK,CAAC;QACrB,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,CAAC;QAE1D,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IAC3E,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAU;QACpD,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI;QAChB,cAAc;QACd,cAAc;QACd,eAAe;QACf,aAAa;QACb,wBAAwB;QACxB,sBAAsB;KACd;QACR,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,KAAK,IAAI,CAAC;QACjE,MAAM,IAAI,oBAAoB,CAC5B,6CAA6C,CAC9C,CAAC;IACJ,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC9B,gBAAgB,CAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACrD,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IAChE,CAAC;IACD,IACE,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;QACpC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;QAErC,MAAM,IAAI,oBAAoB,CAC5B,iDAAiD,CAClD,CAAC;IACJ,iBAAiB,CAAC,CAAC,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACjD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,IACE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAE1E,MAAM,IAAI,oBAAoB,CAC5B,mEAAmE,CACpE,CAAC;IACJ,IACE,KAAK,CAAC,IAAI,CACR,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,2BAA2B,GAAI,CAAC,CAAC,qBAAgC,CAC1E;QAED,MAAM,IAAI,oBAAoB,CAC5B,wDAAwD,CACzD,CAAC;IACJ,IAAI,YAAY,EAAE,CAAC;QACjB,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG;YAChB,GAAG,CAAC;YACJ,KAAK;SACsC,CAAC;QAC9C,MAAM,MAAM,GAAG,iBAAiB,CAC9B,sBAAsB,EACtB,iBAAiB,CAAC,SAAS,CAAyB,CACrD,CAAC;QACF,IACE,CAAC,CAAC,mBAAmB,KAAK,MAAM;YAChC,CAAC,CAAC,eAAe,KAAK,wBAAwB,MAAM,EAAE;YAEtD,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,CAAC,CAAC;IAC7E,CAAC;SAAM,CAAC;QACN,gBAAgB,CAAC,CAAC,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACvD,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,UAAU,CACf,eAAe,CAAC;QACd,GAAG,CAAC;QACJ,KAAK;KACN,CAA6C,CAC/C,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,qCAAqC,CACnD,KAAc;IAEd,OAAO,2BAA2B,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,mCAAmC,CACjD,KAGC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,sFAAsF;IACtF,MAAM,WAAW,GAAG,2BAA2B,CAC7C;QACE,GAAG,IAAI;QACP,eAAe,EAAE,8BAA8B;QAC/C,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACpC,EACD,KAAK,CACN,CAAC;IACF,MAAM,MAAM,GAAG,iBAAiB,CAC9B,sBAAsB,EACtB,iBAAiB,CAAC,WAAW,CAAyB,CACvD,CAAC;IACF,OAAO,2BAA2B,CAChC;QACE,GAAG,IAAI;QACP,eAAe,EAAE,wBAAwB,MAAM,EAAE;QACjD,mBAAmB,EAAE,MAAM;KAC5B,EACD,IAAI,CACL,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAGC;IAED,OAAO,GAAG,KAAK,CAAC,IAA+B,SAAS,KAAK,CAAC,aAAa,SAAS,KAAK,CAAC,WAAW,SAAS,KAAK,CAAC,eAAe,EAAE,CAAC;AACxI,CAAC"}

package/dist/eligibility.d.ts

@@ -0,0 +1,8 @@
+import type { EvidenceTrustStateV1, TrustEligibilityDecisionV1, TrustEligibilityRequestV1 } from "./types.js";
+export declare function validateTrustEligibilityRequestV1(value: unknown): TrustEligibilityRequestV1;
+export declare const createTrustEligibilityRequestV1: typeof validateTrustEligibilityRequestV1;
+export declare function digestTrustEligibilityRequestV1(value: TrustEligibilityRequestV1): string;
+export declare function digestTrustEligibilityDecisionV1(value: TrustEligibilityDecisionV1): string;
+export declare function validateTrustEligibilityDecisionV1(value: unknown): TrustEligibilityDecisionV1;
+export declare function evaluateTrustEligibilityV1(stateValue: EvidenceTrustStateV1, requestValue: TrustEligibilityRequestV1, logicalTimeMs: number): TrustEligibilityDecisionV1;
+//# sourceMappingURL=eligibility.d.ts.map

package/dist/eligibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eligibility.d.ts","sourceRoot":"","sources":["../src/eligibility.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EAG1B,MAAM,YAAY,CAAC;AAyGpB,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,GACb,yBAAyB,CAiC3B;AACD,eAAO,MAAM,+BAA+B,0CACT,CAAC;AAEpC,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,yBAAyB,GAC/B,MAAM,CAKR;AASD,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,0BAA0B,GAChC,MAAM,CAKR;AAED,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,OAAO,GACb,0BAA0B,CAsH5B;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,oBAAoB,EAChC,YAAY,EAAE,yBAAyB,EACvC,aAAa,EAAE,MAAM,GACpB,0BAA0B,CAyL5B"}