@agentplat/trust 0.3.0-alpha.4

package/dist/quarantine.js

@@ -0,0 +1,742 @@
+import { deepFreeze, digestTrustJsonV1, TrustValidationError, } from "./canonical.js";
+import { digestScopeV1, digestSubjectV1 } from "./evidence.js";
+import { validateEvidenceFusionDecisionV1 } from "./fusion.js";
+import { digestEvidenceFusionPolicyV1, validateEvidenceFusionPolicyV1, } from "./policy.js";
+import { validateTrustProfileV1 } from "./profile.js";
+import { assertExactKeys, assertIdentifier, assertSafeInteger, assertTrustDigest, validateReasonCodeV1, } from "./validation.js";
+const compare = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const recordKeys = [
+    "schemaVersion",
+    "quarantineId",
+    "quarantineKey",
+    "revision",
+    "previousRecordId",
+    "tenantId",
+    "subjectDigest",
+    "scopeDigest",
+    "dimensionId",
+    "policyDigest",
+    "fusionDecisionId",
+    "activationEvidenceIds",
+    "activationEvidenceSetDigest",
+    "activationDependencyGroupIds",
+    "reasonCodes",
+    "activatedAtLogicalMs",
+    "reviewAfterLogicalMs",
+    "status",
+    "recoveredAtLogicalMs",
+    "recoveryDecisionId",
+];
+const recoveryKeys = [
+    "schemaVersion",
+    "recoveryDecisionId",
+    "recoveryDecisionDigest",
+    "quarantineId",
+    "quarantineKey",
+    "policyDigest",
+    "fusionDecisionId",
+    "evaluatedAtLogicalMs",
+    "recoveryEvidenceIds",
+    "recoveryEvidenceSetDigest",
+    "recoveryClaimSourceDependencyGroupIds",
+    "effectiveRecoveryWeightBasisPoints",
+    "scoreBasisPoints",
+    "uncertaintyBasisPoints",
+    "disposition",
+    "reasonCodes",
+];
+const tupleKinds = ["claim", "attestation", "content_resolution"];
+function assertContentId(value, prefix, label) {
+    assertIdentifier(value, label);
+    if (!new RegExp(`^${prefix}:[0-9a-f]{64}$`, "u").test(value))
+        throw new TrustValidationError(`${label} is not content-bound`);
+}
+function validateSortedIdentifiers(value, label, nonEmpty = false) {
+    if (!Array.isArray(value) || (nonEmpty && value.length === 0))
+        throw new TrustValidationError(`${label} is invalid`);
+    for (const item of value)
+        assertIdentifier(item, label);
+    if (value.some((item, index) => index > 0 && compare(value[index - 1], item) >= 0))
+        throw new TrustValidationError(`${label} must be canonically ordered and unique`);
+    return deepFreeze(structuredClone(value));
+}
+function validateSortedReasons(value, label) {
+    const reasons = validateSortedIdentifiers(value, label);
+    for (const reason of reasons)
+        validateReasonCodeV1(reason);
+    return reasons;
+}
+function tupleKey(value) {
+    return `${value.kind}\u0000${value.id}\u0000${value.digest}`;
+}
+export function validateQuarantineEvidenceTuplesV1(value, options = {}) {
+    if (!Array.isArray(value) ||
+        (options.nonEmpty === true && value.length === 0))
+        throw new TrustValidationError("quarantine evidence tuples are invalid");
+    const tuples = value.map((candidate) => {
+        assertExactKeys(candidate, ["kind", "id", "digest"], "evidence tuple");
+        const tuple = candidate;
+        if (!tupleKinds.includes(tuple.kind))
+            throw new TrustValidationError("evidence tuple kind is invalid");
+        assertTrustDigest(tuple.digest, "evidence tuple digest");
+        const prefix = tuple.kind === "content_resolution" ? "content-resolution" : tuple.kind;
+        assertContentId(tuple.id, prefix, "evidence tuple ID");
+        if (tuple.id !== `${prefix}:${tuple.digest}`)
+            throw new TrustValidationError("evidence tuple binding is invalid");
+        return tuple;
+    });
+    if (tuples.some((tuple, index) => index > 0 && compare(tupleKey(tuples[index - 1]), tupleKey(tuple)) >= 0))
+        throw new TrustValidationError("evidence tuples must be canonically ordered and unique");
+    return deepFreeze(structuredClone(tuples));
+}
+export function digestTrustQuarantineKeyV1(value) {
+    assertExactKeys(value, ["tenantId", "subjectDigest", "scopeDigest", "dimensionId", "policyDigest"], "quarantine key");
+    assertIdentifier(value.tenantId, "tenantId");
+    assertIdentifier(value.dimensionId, "dimensionId");
+    for (const key of ["subjectDigest", "scopeDigest", "policyDigest"])
+        assertTrustDigest(value[key], key);
+    return digestTrustJsonV1("quarantine-key", value);
+}
+export function digestQuarantineEvidenceSetV1(value, domain = "quarantine-evidence-set") {
+    const tuples = validateQuarantineEvidenceTuplesV1(value, {
+        nonEmpty: domain === "quarantine-evidence-set",
+    });
+    return digestTrustJsonV1(domain, tuples);
+}
+export const digestTrustQuarantineEvidenceSetV1 = (value) => digestQuarantineEvidenceSetV1(value, "quarantine-evidence-set");
+export const digestTrustRecoveryEvidenceSetV1 = (value) => digestQuarantineEvidenceSetV1(value, "recovery-evidence-set");
+function quarantineRecordBody(value) {
+    const { quarantineId: _id, ...body } = value;
+    return body;
+}
+export function digestQuarantineRecordV1(value) {
+    return digestTrustJsonV1("quarantine-record", quarantineRecordBody(value));
+}
+export function validateQuarantineRecordV1(value) {
+    assertExactKeys(value, recordKeys, "quarantine record");
+    const record = value;
+    if (record.schemaVersion !== 1)
+        throw new TrustValidationError("quarantine schema is invalid");
+    assertContentId(record.quarantineId, "quarantine-record", "quarantineId");
+    if (record.previousRecordId !== null)
+        assertContentId(record.previousRecordId, "quarantine-record", "previousRecordId");
+    assertIdentifier(record.tenantId, "tenantId");
+    assertIdentifier(record.dimensionId, "dimensionId");
+    assertContentId(record.fusionDecisionId, "fusion-decision", "fusionDecisionId");
+    for (const key of [
+        "quarantineKey",
+        "subjectDigest",
+        "scopeDigest",
+        "policyDigest",
+        "activationEvidenceSetDigest",
+    ])
+        assertTrustDigest(record[key], key);
+    if (record.quarantineKey !==
+        digestTrustQuarantineKeyV1({
+            tenantId: record.tenantId,
+            subjectDigest: record.subjectDigest,
+            scopeDigest: record.scopeDigest,
+            dimensionId: record.dimensionId,
+            policyDigest: record.policyDigest,
+        }))
+        throw new TrustValidationError("quarantine key binding is invalid");
+    assertSafeInteger(record.revision, "revision", 1);
+    if ((record.revision === 1) !== (record.previousRecordId === null))
+        throw new TrustValidationError("quarantine lineage is invalid");
+    validateSortedIdentifiers(record.activationEvidenceIds, "activation evidence", true);
+    validateSortedIdentifiers(record.activationDependencyGroupIds, "activation groups", true);
+    const reasons = validateSortedReasons(record.reasonCodes, "quarantine reasons");
+    assertSafeInteger(record.activatedAtLogicalMs, "activatedAtLogicalMs");
+    assertSafeInteger(record.reviewAfterLogicalMs, "reviewAfterLogicalMs");
+    if (record.reviewAfterLogicalMs <= record.activatedAtLogicalMs)
+        throw new TrustValidationError("quarantine review time is invalid");
+    if (!(record.status === "active" ||
+        record.status === "review_required" ||
+        record.status === "recovered"))
+        throw new TrustValidationError("quarantine status is invalid");
+    const expectedReason = {
+        active: "quarantine_activated",
+        review_required: "quarantine_review_required",
+        recovered: "quarantine_recovered",
+    }[record.status];
+    if (reasons.length !== 1 || reasons[0] !== expectedReason)
+        throw new TrustValidationError("quarantine status reason is invalid");
+    if (record.status === "recovered") {
+        assertSafeInteger(record.recoveredAtLogicalMs, "recoveredAtLogicalMs");
+        assertContentId(record.recoveryDecisionId, "recovery-decision", "recoveryDecisionId");
+        if (record.recoveredAtLogicalMs < record.reviewAfterLogicalMs)
+            throw new TrustValidationError("recovery precedes review");
+    }
+    else if (record.recoveredAtLogicalMs !== null ||
+        record.recoveryDecisionId !== null)
+        throw new TrustValidationError("quarantine recovery fields are invalid");
+    if (record.quarantineId !==
+        `quarantine-record:${digestQuarantineRecordV1(record)}`)
+        throw new TrustValidationError("quarantine digest is invalid");
+    return deepFreeze(structuredClone(record));
+}
+export function createQuarantineRecordV1(input) {
+    const digest = digestTrustJsonV1("quarantine-record", input);
+    return validateQuarantineRecordV1({
+        ...input,
+        quarantineId: `quarantine-record:${digest}`,
+    });
+}
+export function createActiveQuarantineRecordV1(input) {
+    assertExactKeys(input, [
+        "revision",
+        "previousRecordId",
+        "tenantId",
+        "subjectDigest",
+        "scopeDigest",
+        "dimensionId",
+        "policyDigest",
+        "fusionDecisionId",
+        "activationEvidence",
+        "activationDependencyGroupIds",
+        "activatedAtLogicalMs",
+        "reviewIntervalMs",
+    ], "active quarantine input");
+    assertSafeInteger(input.activatedAtLogicalMs, "activatedAtLogicalMs");
+    assertSafeInteger(input.reviewIntervalMs, "reviewIntervalMs", 1);
+    if (input.activatedAtLogicalMs >
+        Number.MAX_SAFE_INTEGER - input.reviewIntervalMs)
+        throw new TrustValidationError("quarantine review time overflows");
+    const evidence = validateQuarantineEvidenceTuplesV1(input.activationEvidence, { nonEmpty: true });
+    const activationEvidenceIds = [...evidence]
+        .map((item) => item.id)
+        .sort(compare);
+    validateSortedIdentifiers(activationEvidenceIds, "activation evidence IDs", true);
+    const activationDependencyGroupIds = validateSortedIdentifiers(input.activationDependencyGroupIds, "activation groups", true);
+    return createQuarantineRecordV1({
+        schemaVersion: 1,
+        quarantineKey: digestTrustQuarantineKeyV1({
+            tenantId: input.tenantId,
+            subjectDigest: input.subjectDigest,
+            scopeDigest: input.scopeDigest,
+            dimensionId: input.dimensionId,
+            policyDigest: input.policyDigest,
+        }),
+        revision: input.revision,
+        previousRecordId: input.previousRecordId,
+        tenantId: input.tenantId,
+        subjectDigest: input.subjectDigest,
+        scopeDigest: input.scopeDigest,
+        dimensionId: input.dimensionId,
+        policyDigest: input.policyDigest,
+        fusionDecisionId: input.fusionDecisionId,
+        activationEvidenceIds,
+        activationEvidenceSetDigest: digestTrustQuarantineEvidenceSetV1(evidence),
+        activationDependencyGroupIds,
+        reasonCodes: ["quarantine_activated"],
+        activatedAtLogicalMs: input.activatedAtLogicalMs,
+        reviewAfterLogicalMs: input.activatedAtLogicalMs + input.reviewIntervalMs,
+        status: "active",
+        recoveredAtLogicalMs: null,
+        recoveryDecisionId: null,
+    });
+}
+function validateProjectionBinding(state, profileValue, decisionValue, policyValue) {
+    const profile = validateTrustProfileV1(profileValue);
+    const decision = validateEvidenceFusionDecisionV1(decisionValue);
+    const policy = validateEvidenceFusionPolicyV1(policyValue, state.limits);
+    const policyDigest = digestEvidenceFusionPolicyV1(policy);
+    if (decision.policyId !== policy.policyId ||
+        decision.policyVersion !== policy.policyVersion ||
+        decision.policyDigest !== policyDigest ||
+        profile.policyId !== policy.policyId ||
+        profile.policyVersion !== policy.policyVersion ||
+        profile.policyDigest !== policyDigest ||
+        profile.tenantId !== decision.tenantId ||
+        profile.subjectDigest !== decision.subjectDigest ||
+        profile.scopeDigest !== decision.scopeDigest ||
+        profile.fusionDecisionId !== decision.fusionDecisionId ||
+        profile.fusionDecisionDigest !== decision.fusionDecisionDigest ||
+        profile.inputSetDigest !== decision.inputSetDigest ||
+        profile.updatedAtLogicalMs !== decision.evaluatedAtLogicalMs)
+        throw new TrustValidationError("quarantine projection binding is invalid");
+    return { profile, decision, policy };
+}
+function sortedTuples(values) {
+    const byKey = new Map(values.map((value) => [tupleKey(value), value]));
+    return validateQuarantineEvidenceTuplesV1([...byKey.values()].sort((left, right) => compare(tupleKey(left), tupleKey(right))));
+}
+function exactClaimEvidence(state, decision, classification, afterLogicalMs) {
+    const claim = state.records.find((record) => record.recordKind === "claim" &&
+        record.recordId === classification.claimId &&
+        record.recordDigest === classification.claimDigest);
+    if (!claim ||
+        (afterLogicalMs !== null && claim.acceptedAtLogicalMs <= afterLogicalMs))
+        return null;
+    const tuples = [
+        { kind: "claim", id: claim.recordId, digest: claim.recordDigest },
+    ];
+    for (const attestationId of classification.effectiveSupportingAttestationIds) {
+        const attestation = state.records.find((record) => record.recordKind === "attestation" &&
+            record.recordId === attestationId &&
+            "claimId" in record.record &&
+            "disposition" in record.record &&
+            record.record.claimId === claim.recordId &&
+            record.record.claimDigest === claim.recordDigest &&
+            record.record.disposition === "support");
+        if (!attestation ||
+            (afterLogicalMs !== null &&
+                attestation.acceptedAtLogicalMs <= afterLogicalMs))
+            return null;
+        tuples.push({
+            kind: "attestation",
+            id: attestation.recordId,
+            digest: attestation.recordDigest,
+        });
+    }
+    for (const resolutionId of classification.effectiveContentResolutionIds) {
+        const resolution = state.contentResolutions.find((candidate) => candidate.resolutionId === resolutionId &&
+            candidate.claimId === claim.recordId &&
+            candidate.claimDigest === claim.recordDigest &&
+            candidate.result === "verified" &&
+            candidate.resolvedAtLogicalMs <= decision.evaluatedAtLogicalMs);
+        if (!resolution ||
+            (afterLogicalMs !== null &&
+                resolution.resolvedAtLogicalMs <= afterLogicalMs))
+            return null;
+        tuples.push({
+            kind: "content_resolution",
+            id: resolution.resolutionId,
+            digest: resolution.resolutionDigest,
+        });
+    }
+    return sortedTuples(tuples);
+}
+export function deriveQuarantineActivationsV1(state, profileValue, decisionValue, policyValue, acceptedAfterLogicalMs = null) {
+    if (acceptedAfterLogicalMs !== null)
+        assertSafeInteger(acceptedAfterLogicalMs, "acceptedAfterLogicalMs");
+    const { profile, decision, policy } = validateProjectionBinding(state, profileValue, decisionValue, policyValue);
+    if (!policy.quarantinePolicy.enabled)
+        return deepFreeze([]);
+    const projections = [];
+    for (const rule of policy.quarantinePolicy.rules) {
+        const dimension = profile.dimensions.find((candidate) => candidate.dimensionId === rule.dimensionId);
+        if (!dimension ||
+            dimension.scoreBasisPoints > rule.activationScoreAtOrBelowBasisPoints)
+            continue;
+        const groups = new Set();
+        const tuples = [];
+        let weight = 0;
+        for (const classification of decision.claimClassifications) {
+            if (classification.dimensionId !== rule.dimensionId ||
+                !dimension.includedClaimIds.includes(classification.claimId) ||
+                classification.classification !== "supported" ||
+                classification.effectiveWeightBasisPoints <= 0 ||
+                classification.claimSourceDependencyGroupId === null)
+                continue;
+            const criterion = policy.criteria.find((candidate) => candidate.criterionId === classification.criterionId);
+            const claim = state.records.find((record) => record.recordKind === "claim" &&
+                record.recordId === classification.claimId &&
+                record.recordDigest === classification.claimDigest);
+            if (!criterion?.quarantineEligible ||
+                !claim ||
+                !("outcome" in claim.record) ||
+                claim.record.outcome !== "violated")
+                continue;
+            const evidence = exactClaimEvidence(state, decision, classification, acceptedAfterLogicalMs);
+            if (!evidence)
+                continue;
+            groups.add(classification.claimSourceDependencyGroupId);
+            weight = Math.min(10_000, weight + classification.effectiveWeightBasisPoints);
+            tuples.push(...evidence);
+        }
+        const activationDependencyGroupIds = [...groups].sort(compare);
+        if (activationDependencyGroupIds.length <
+            rule.minimumNegativeClaimSourceGroups ||
+            weight < rule.minimumNegativeWeightBasisPoints)
+            continue;
+        projections.push({
+            dimensionId: rule.dimensionId,
+            activationEvidence: sortedTuples(tuples),
+            activationDependencyGroupIds,
+            effectiveNegativeWeightBasisPoints: weight,
+            reviewIntervalMs: rule.reviewIntervalMs,
+        });
+    }
+    return deepFreeze(projections.sort((left, right) => compare(left.dimensionId, right.dimensionId)));
+}
+export function evaluateQuarantineRecoveryV1(state, quarantineValue, profileValue, decisionValue, policyValue, logicalTimeMs) {
+    const quarantine = validateQuarantineRecordV1(quarantineValue);
+    assertSafeInteger(logicalTimeMs, "logicalTimeMs");
+    const { profile, decision, policy } = validateProjectionBinding(state, profileValue, decisionValue, policyValue);
+    const exhaustedActive = quarantine.status === "active" &&
+        logicalTimeMs >= quarantine.reviewAfterLogicalMs &&
+        quarantine.revision >= state.limits.maximumQuarantineRevisionsPerHead;
+    if ((quarantine.status !== "review_required" && !exhaustedActive) ||
+        quarantine.policyDigest !== profile.policyDigest ||
+        quarantine.tenantId !== profile.tenantId ||
+        quarantine.subjectDigest !== profile.subjectDigest ||
+        quarantine.scopeDigest !== profile.scopeDigest ||
+        decision.evaluatedAtLogicalMs !== logicalTimeMs ||
+        logicalTimeMs < quarantine.reviewAfterLogicalMs)
+        throw new TrustValidationError("quarantine review binding is invalid");
+    const rule = policy.recoveryPolicy.rules.find((candidate) => candidate.dimensionId === quarantine.dimensionId);
+    const dimension = profile.dimensions.find((candidate) => candidate.dimensionId === quarantine.dimensionId);
+    const reasons = new Set();
+    const evidence = [];
+    const groups = new Set();
+    let weight = 0;
+    let unresolvedNegative = false;
+    let unresolvedRecoveryEvidence = false;
+    const blockerReasons = new Set();
+    const exactRecord = (recordId, recordDigest) => state.records.find((record) => record.recordId === recordId && record.recordDigest === recordDigest) ?? null;
+    const relationDigest = (record) => {
+        if ("claimRelationDigest" in record.record)
+            return record.record.claimRelationDigest;
+        if ("attestationRelationDigest" in record.record)
+            return record.record.attestationRelationDigest;
+        if ("challengeRelationDigest" in record.record)
+            return record.record.challengeRelationDigest;
+        return record.record.retractionRelationDigest;
+    };
+    const conflictedAtDecision = (record) => state.records.filter((candidate) => candidate.recordKind === record.recordKind &&
+        candidate.acceptedAtLogicalMs <= decision.evaluatedAtLogicalMs &&
+        relationDigest(candidate) === relationDigest(record)).length > 1;
+    const claimForRecord = (record) => {
+        if (record.recordKind === "claim")
+            return record;
+        if ((record.recordKind === "attestation" ||
+            record.recordKind === "retraction") &&
+            "claimId" in record.record &&
+            "claimDigest" in record.record)
+            return exactRecord(record.record.claimId, record.record.claimDigest);
+        if (record.recordKind === "challenge") {
+            if (!("targetId" in record.record))
+                return null;
+            const target = exactRecord(record.record.targetId, record.record.targetDigest);
+            if (!target)
+                return null;
+            if (target.recordKind === "claim")
+                return target;
+            if (target.recordKind === "attestation" &&
+                "claimId" in target.record &&
+                "claimDigest" in target.record)
+                return exactRecord(target.record.claimId, target.record.claimDigest);
+        }
+        if (record.recordKind === "retraction" && "targetId" in record.record) {
+            const target = exactRecord(record.record.targetId, record.record.targetDigest);
+            if (!target)
+                return null;
+            if (target.recordKind === "claim")
+                return target;
+            if (target.recordKind === "attestation" &&
+                "claimId" in target.record &&
+                "claimDigest" in target.record)
+                return exactRecord(target.record.claimId, target.record.claimDigest);
+        }
+        return null;
+    };
+    const relevantEquivocation = state.records.some((record) => {
+        if (!conflictedAtDecision(record) ||
+            record.acceptedAtLogicalMs <= quarantine.activatedAtLogicalMs ||
+            record.acceptedAtLogicalMs > decision.evaluatedAtLogicalMs ||
+            digestScopeV1(record.record.scope) !== quarantine.scopeDigest)
+            return false;
+        const claim = claimForRecord(record);
+        if (!claim ||
+            !("criterionId" in claim.record) ||
+            !("outcome" in claim.record))
+            return false;
+        if (digestSubjectV1(claim.record.subject) !== quarantine.subjectDigest)
+            return false;
+        const criterionId = claim.record.criterionId;
+        const criterion = policy.criteria.find((candidate) => candidate.criterionId === criterionId);
+        return (criterion?.dimensionId === quarantine.dimensionId &&
+            (criterion.quarantineEligible || criterion.recoveryEligible));
+    });
+    if (relevantEquivocation) {
+        unresolvedRecoveryEvidence = true;
+        blockerReasons.add("relationship_conflict");
+    }
+    for (const resolution of decision.challengeResolutions) {
+        if (resolution.result === "dismissed" || resolution.result === "sustained")
+            continue;
+        const blocksRecovery = resolution.challenges.some((reference) => {
+            const challenge = exactRecord(reference.challengeId, reference.challengeDigest);
+            if (!challenge ||
+                challenge.recordKind !== "challenge" ||
+                challenge.acceptedAtLogicalMs <= quarantine.activatedAtLogicalMs ||
+                challenge.acceptedAtLogicalMs > decision.evaluatedAtLogicalMs ||
+                digestScopeV1(challenge.record.scope) !== quarantine.scopeDigest)
+                return false;
+            const claim = claimForRecord(challenge);
+            if (!claim ||
+                !("criterionId" in claim.record) ||
+                digestSubjectV1(claim.record.subject) !== quarantine.subjectDigest)
+                return false;
+            const criterionId = claim.record.criterionId;
+            const criterion = policy.criteria.find((candidate) => candidate.criterionId === criterionId);
+            return (criterion?.dimensionId === quarantine.dimensionId &&
+                (criterion.quarantineEligible || criterion.recoveryEligible));
+        });
+        if (!blocksRecovery)
+            continue;
+        unresolvedRecoveryEvidence = true;
+        blockerReasons.add(resolution.result === "contested"
+            ? "challenge_contested"
+            : "challenge_unresolved");
+    }
+    if (rule && dimension) {
+        for (const classification of decision.claimClassifications) {
+            if (classification.dimensionId !== quarantine.dimensionId)
+                continue;
+            const criterion = policy.criteria.find((candidate) => candidate.criterionId === classification.criterionId);
+            const claim = state.records.find((record) => record.recordKind === "claim" &&
+                record.recordId === classification.claimId &&
+                record.recordDigest === classification.claimDigest);
+            if (!criterion || !claim || !("outcome" in claim.record))
+                continue;
+            const included = dimension.includedClaimIds.includes(classification.claimId);
+            const claimConflicted = conflictedAtDecision(claim);
+            const negativeExcludedAsUnresolved = decision.recordExclusions.some((exclusion) => exclusion.recordKind === "claim" &&
+                exclusion.recordId === classification.claimId &&
+                exclusion.recordDigest === classification.claimDigest &&
+                (exclusion.reasonCodes.includes("root_basis_conflict") ||
+                    exclusion.reasonCodes.includes("challenge_unresolved") ||
+                    exclusion.reasonCodes.includes("fusion_contested")));
+            if (claim.record.outcome === "violated" &&
+                criterion.quarantineEligible &&
+                claim.acceptedAtLogicalMs > quarantine.activatedAtLogicalMs &&
+                (claimConflicted ||
+                    (classification.classification === "supported" && included) ||
+                    classification.classification === "contested" ||
+                    (classification.classification === "unavailable" &&
+                        (classification.reasonCodes.includes("challenge_unresolved") ||
+                            classification.reasonCodes.includes("root_basis_conflict"))) ||
+                    negativeExcludedAsUnresolved))
+                unresolvedNegative = true;
+            if (claim.record.outcome === "violated" &&
+                claimConflicted &&
+                claim.acceptedAtLogicalMs > quarantine.activatedAtLogicalMs)
+                blockerReasons.add("relationship_conflict");
+            const recoveryClaimUnresolved = claim.record.outcome === "satisfied" &&
+                criterion.recoveryEligible &&
+                claim.acceptedAtLogicalMs > quarantine.activatedAtLogicalMs &&
+                (classification.classification === "contested" ||
+                    (classification.classification === "unavailable" &&
+                        classification.reasonCodes.includes("challenge_unresolved")) ||
+                    negativeExcludedAsUnresolved);
+            const recoverySupportUnresolved = decision.recordExclusions.some((exclusion) => {
+                if (exclusion.recordKind !== "attestation" ||
+                    !(exclusion.reasonCodes.includes("challenge_unresolved") ||
+                        exclusion.reasonCodes.includes("dependency_group_conflict")))
+                    return false;
+                const attestation = state.records.find((record) => record.recordKind === "attestation" &&
+                    record.recordId === exclusion.recordId &&
+                    record.recordDigest === exclusion.recordDigest &&
+                    "claimId" in record.record &&
+                    record.record.claimId === claim.recordId &&
+                    record.acceptedAtLogicalMs > quarantine.activatedAtLogicalMs);
+                if (attestation)
+                    for (const reason of exclusion.reasonCodes)
+                        if (reason === "challenge_unresolved" ||
+                            reason === "dependency_group_conflict")
+                            blockerReasons.add(reason);
+                return attestation !== undefined;
+            });
+            if (recoveryClaimUnresolved || recoverySupportUnresolved) {
+                unresolvedRecoveryEvidence = true;
+                if (classification.classification === "contested")
+                    blockerReasons.add("fusion_contested");
+                for (const exclusion of decision.recordExclusions)
+                    if (exclusion.recordId === classification.claimId &&
+                        exclusion.recordDigest === classification.claimDigest)
+                        for (const reason of exclusion.reasonCodes)
+                            if (reason === "root_basis_conflict" ||
+                                reason === "challenge_unresolved" ||
+                                reason === "fusion_contested")
+                                blockerReasons.add(reason);
+            }
+            const selfClaim = claim.record.sourceKind === "peer" &&
+                claim.record.sourceId === decision.subject.peerId;
+            if (claim.record.outcome !== "satisfied" ||
+                !criterion.recoveryEligible ||
+                selfClaim ||
+                !included ||
+                classification.classification !== "supported" ||
+                classification.effectiveWeightBasisPoints <= 0 ||
+                classification.claimSourceDependencyGroupId === null ||
+                quarantine.activationDependencyGroupIds.includes(classification.claimSourceDependencyGroupId) ||
+                claim.acceptedAtLogicalMs <= quarantine.activatedAtLogicalMs ||
+                logicalTimeMs - claim.effectiveAtLogicalMs >
+                    rule.maximumRecoveryEvidenceAgeMs)
+                continue;
+            const claimEvidence = exactClaimEvidence(state, decision, classification, quarantine.activatedAtLogicalMs);
+            if (!claimEvidence)
+                continue;
+            groups.add(classification.claimSourceDependencyGroupId);
+            weight = Math.min(10_000, weight + classification.effectiveWeightBasisPoints);
+            evidence.push(...claimEvidence);
+        }
+    }
+    if (unresolvedNegative)
+        blockerReasons.add("challenge_unresolved");
+    for (const reason of blockerReasons)
+        reasons.add(reason);
+    const recoveryEvidence = sortedTuples(evidence);
+    const recoveryGroups = [...groups].sort(compare);
+    const revisionAvailable = quarantine.revision < state.limits.maximumQuarantineRevisionsPerHead;
+    let disposition;
+    if (!rule || !dimension || !revisionAvailable) {
+        disposition = "unavailable";
+        reasons.add("quarantine_recovery_unavailable");
+    }
+    else if (unresolvedNegative ||
+        unresolvedRecoveryEvidence ||
+        dimension.scoreBasisPoints < rule.recoveryScoreAtOrAboveBasisPoints ||
+        dimension.uncertaintyBasisPoints >
+            rule.maximumRecoveryUncertaintyBasisPoints ||
+        recoveryGroups.length < rule.minimumRecoveryClaimSourceGroups ||
+        weight < rule.minimumRecoveryWeightBasisPoints) {
+        disposition = "insufficient";
+        reasons.add("quarantine_recovery_insufficient");
+    }
+    else {
+        disposition = "recovered";
+        reasons.add("quarantine_recovered");
+    }
+    return createQuarantineRecoveryDecisionV1({
+        schemaVersion: 1,
+        quarantineId: quarantine.quarantineId,
+        quarantineKey: quarantine.quarantineKey,
+        policyDigest: quarantine.policyDigest,
+        fusionDecisionId: decision.fusionDecisionId,
+        evaluatedAtLogicalMs: logicalTimeMs,
+        recoveryEvidenceIds: recoveryEvidence.map((item) => item.id).sort(compare),
+        recoveryEvidenceSetDigest: digestTrustRecoveryEvidenceSetV1(recoveryEvidence),
+        recoveryClaimSourceDependencyGroupIds: recoveryGroups,
+        effectiveRecoveryWeightBasisPoints: weight,
+        scoreBasisPoints: dimension?.scoreBasisPoints ?? 0,
+        uncertaintyBasisPoints: dimension?.uncertaintyBasisPoints ?? 10_000,
+        disposition,
+        reasonCodes: [...reasons].sort(compare),
+    });
+}
+export function createReviewRequiredQuarantineRecordV1(value, reviewedAtLogicalMs) {
+    const current = validateQuarantineRecordV1(value);
+    assertSafeInteger(reviewedAtLogicalMs, "reviewedAtLogicalMs");
+    if (current.status !== "active" ||
+        reviewedAtLogicalMs < current.reviewAfterLogicalMs)
+        throw new TrustValidationError("quarantine is not ready for review");
+    return createQuarantineRecordV1({
+        ...quarantineRecordBody(current),
+        revision: current.revision + 1,
+        previousRecordId: current.quarantineId,
+        reasonCodes: ["quarantine_review_required"],
+        status: "review_required",
+    });
+}
+function recoveryDecisionBody(value) {
+    const { recoveryDecisionId: _id, recoveryDecisionDigest: _digest, ...body } = value;
+    return body;
+}
+export function digestQuarantineRecoveryDecisionV1(value) {
+    return digestTrustJsonV1("recovery-decision", recoveryDecisionBody(value));
+}
+export function validateQuarantineRecoveryDecisionV1(value) {
+    assertExactKeys(value, recoveryKeys, "recovery decision");
+    const decision = value;
+    if (decision.schemaVersion !== 1)
+        throw new TrustValidationError("recovery schema is invalid");
+    assertContentId(decision.recoveryDecisionId, "recovery-decision", "recoveryDecisionId");
+    assertContentId(decision.quarantineId, "quarantine-record", "quarantineId");
+    assertContentId(decision.fusionDecisionId, "fusion-decision", "fusionDecisionId");
+    for (const key of [
+        "recoveryDecisionDigest",
+        "quarantineKey",
+        "policyDigest",
+        "recoveryEvidenceSetDigest",
+    ])
+        assertTrustDigest(decision[key], key);
+    assertSafeInteger(decision.evaluatedAtLogicalMs, "evaluatedAtLogicalMs");
+    validateSortedIdentifiers(decision.recoveryEvidenceIds, "recovery evidence");
+    validateSortedIdentifiers(decision.recoveryClaimSourceDependencyGroupIds, "recovery groups");
+    for (const key of [
+        "effectiveRecoveryWeightBasisPoints",
+        "scoreBasisPoints",
+        "uncertaintyBasisPoints",
+    ]) {
+        assertSafeInteger(decision[key], key);
+        if (decision[key] > 10_000)
+            throw new TrustValidationError("recovery basis points are invalid");
+    }
+    if (!(decision.disposition === "unavailable" ||
+        decision.disposition === "insufficient" ||
+        decision.disposition === "recovered"))
+        throw new TrustValidationError("recovery disposition is invalid");
+    const reasons = validateSortedReasons(decision.reasonCodes, "recovery reasons");
+    const primaryReason = {
+        unavailable: "quarantine_recovery_unavailable",
+        insufficient: "quarantine_recovery_insufficient",
+        recovered: "quarantine_recovered",
+    }[decision.disposition];
+    if (!reasons.includes(primaryReason))
+        throw new TrustValidationError("recovery disposition reason is invalid");
+    if (decision.disposition === "recovered" &&
+        (decision.recoveryEvidenceIds.length === 0 ||
+            decision.recoveryClaimSourceDependencyGroupIds.length === 0 ||
+            decision.effectiveRecoveryWeightBasisPoints === 0))
+        throw new TrustValidationError("recovered decision has no evidence");
+    if (decision.recoveryDecisionDigest !==
+        digestQuarantineRecoveryDecisionV1(decision) ||
+        decision.recoveryDecisionId !==
+            `recovery-decision:${decision.recoveryDecisionDigest}`)
+        throw new TrustValidationError("recovery digest is invalid");
+    return deepFreeze(structuredClone(decision));
+}
+export function createQuarantineRecoveryDecisionV1(input) {
+    const digest = digestTrustJsonV1("recovery-decision", input);
+    return validateQuarantineRecoveryDecisionV1({
+        ...input,
+        recoveryDecisionDigest: digest,
+        recoveryDecisionId: `recovery-decision:${digest}`,
+    });
+}
+export function createRecoveredQuarantineRecordV1(value, decisionValue) {
+    const current = validateQuarantineRecordV1(value);
+    const decision = validateQuarantineRecoveryDecisionV1(decisionValue);
+    if (current.status !== "review_required" ||
+        decision.disposition !== "recovered" ||
+        decision.quarantineId !== current.quarantineId ||
+        decision.quarantineKey !== current.quarantineKey ||
+        decision.policyDigest !== current.policyDigest ||
+        decision.evaluatedAtLogicalMs < current.reviewAfterLogicalMs)
+        throw new TrustValidationError("recovery decision does not bind the current quarantine");
+    return createQuarantineRecordV1({
+        ...quarantineRecordBody(current),
+        revision: current.revision + 1,
+        previousRecordId: current.quarantineId,
+        fusionDecisionId: decision.fusionDecisionId,
+        reasonCodes: ["quarantine_recovered"],
+        status: "recovered",
+        recoveredAtLogicalMs: decision.evaluatedAtLogicalMs,
+        recoveryDecisionId: decision.recoveryDecisionId,
+    });
+}
+export function quarantineHeadV1(value) {
+    const record = validateQuarantineRecordV1(value);
+    return deepFreeze({
+        quarantineKey: record.quarantineKey,
+        quarantineId: record.quarantineId,
+        revision: record.revision,
+        status: record.status,
+    });
+}
+export function validateQuarantineHeadV1(value) {
+    assertExactKeys(value, ["quarantineKey", "quarantineId", "revision", "status"], "quarantine head");
+    const head = value;
+    assertTrustDigest(head.quarantineKey, "quarantineKey");
+    assertContentId(head.quarantineId, "quarantine-record", "quarantineId");
+    assertSafeInteger(head.revision, "revision", 1);
+    if (!(head.status === "active" ||
+        head.status === "review_required" ||
+        head.status === "recovered"))
+        throw new TrustValidationError("quarantine head status is invalid");
+    return deepFreeze(structuredClone(head));
+}
+//# sourceMappingURL=quarantine.js.map