@agentplat/trust 0.3.0-alpha.4

package/dist/lifecycle.js

@@ -0,0 +1,1369 @@
+import { canonicalTrustJsonBytesV1, deepFreeze, digestTrustJsonV1, TrustValidationError, } from "./canonical.js";
+import { digestScopeV1, validateEvidenceAttestationV1, validateEvidenceChallengeV1, validateEvidenceClaimV1, validateEvidenceRetractionV1, } from "./evidence.js";
+import { validateEvidenceTrustStateV1 } from "./state.js";
+import { evaluateEvidenceFusionV1 } from "./fusion.js";
+import { dependencyBindingHeadV1, digestEvidenceFusionPolicyV1, validateEvidenceFusionPolicyV1, validateEvidenceTrustDependencyBindingV1, } from "./policy.js";
+import { createEvidenceCausalAuthorizationV1 } from "./causal.js";
+import { createTrustProfileV1, digestTrustProfileKeyV1, trustProfileHeadV1, } from "./profile.js";
+import { createActiveQuarantineRecordV1, createRecoveredQuarantineRecordV1, createReviewRequiredQuarantineRecordV1, deriveQuarantineActivationsV1, digestTrustQuarantineKeyV1, evaluateQuarantineRecoveryV1, quarantineHeadV1, } from "./quarantine.js";
+import { assertExactKeys, assertIdentifier, assertSafeInteger, assertToken, assertTrustDigest, validateReasonCodeV1, } from "./validation.js";
+const STATE_LIMITS = {
+    maximumBytes: 67_108_864,
+    maximumDepth: 64,
+    maximumNodes: 100_000,
+    maximumKeysPerObject: 256,
+    maximumItemsPerArray: 100_000,
+};
+const compareUnicode = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+const reachedPendingAge = (laterLogicalMs, acceptedAtLogicalMs, maximumPendingAgeMs) => laterLogicalMs >= acceptedAtLogicalMs &&
+    laterLogicalMs - acceptedAtLogicalMs >= maximumPendingAgeMs;
+function recordKind(record) {
+    if ("claimId" in record && "outcome" in record)
+        return "claim";
+    if ("attestationId" in record)
+        return "attestation";
+    if ("challengeId" in record)
+        return "challenge";
+    return "retraction";
+}
+function recordId(record) {
+    if ("claimId" in record && "outcome" in record)
+        return record.claimId;
+    if ("attestationId" in record)
+        return record.attestationId;
+    if ("challengeId" in record)
+        return record.challengeId;
+    return record.retractionId;
+}
+/** The record digest is the content-bound suffix of the validated derived ID. */
+export function digestEvidenceRecordV1(recordValue) {
+    const record = validateEvidenceRecordV1(recordValue);
+    const id = recordId(record);
+    const separator = id.indexOf(":");
+    const digest = id.slice(separator + 1);
+    assertTrustDigest(digest, "recordDigest");
+    return digest;
+}
+export function validateEvidenceRecordV1(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TrustValidationError("evidence record is invalid");
+    const record = value;
+    if ("outcome" in record)
+        return validateEvidenceClaimV1(record);
+    if ("attestationId" in record)
+        return validateEvidenceAttestationV1(record);
+    if ("challengeId" in record)
+        return validateEvidenceChallengeV1(record);
+    if ("retractionId" in record)
+        return validateEvidenceRetractionV1(record);
+    throw new TrustValidationError("evidence record kind is invalid");
+}
+function relationDigest(record) {
+    if ("claimRelationDigest" in record)
+        return record.claimRelationDigest;
+    if ("attestationRelationDigest" in record)
+        return record.attestationRelationDigest;
+    if ("challengeRelationDigest" in record)
+        return record.challengeRelationDigest;
+    return record.retractionRelationDigest;
+}
+function recordScopeDigest(record) {
+    return digestScopeV1(record.scope);
+}
+function recordSource(record) {
+    return record.sourceId;
+}
+function targetOf(record) {
+    if ("claimId" in record && "outcome" in record)
+        return null;
+    if ("attestationId" in record)
+        return { kind: "claim", id: record.claimId, digest: record.claimDigest };
+    return {
+        kind: record.targetKind,
+        id: record.targetId,
+        digest: record.targetDigest,
+    };
+}
+function basisReferences(record) {
+    return "basisReferences" in record ? record.basisReferences : [];
+}
+function requireDigest(value, label) {
+    assertTrustDigest(value, label);
+    return value;
+}
+export function validateEvidenceRecordStateV1(value) {
+    assertExactKeys(value, [
+        "schemaVersion",
+        "recordKind",
+        "recordId",
+        "recordDigest",
+        "record",
+        "origin",
+        "originBindingDigest",
+        "originVerifierBindingDigest",
+        "originProofDigest",
+        "acceptedAtLogicalMs",
+        "effectiveAtLogicalMs",
+        "status",
+    ], "record state");
+    const input = value;
+    if (input.schemaVersion !== 1)
+        throw new TrustValidationError("record state schema is invalid");
+    const record = validateEvidenceRecordV1(input.record);
+    const kind = recordKind(record), id = recordId(record), digest = digestEvidenceRecordV1(record);
+    if (input.recordKind !== kind ||
+        input.recordId !== id ||
+        input.recordDigest !== digest)
+        throw new TrustValidationError("record state does not bind record content");
+    if (input.origin !== "local" && input.origin !== "verified_mesh")
+        throw new TrustValidationError("record origin is invalid");
+    requireDigest(input.originBindingDigest, "originBindingDigest");
+    if (input.origin === "local") {
+        if (input.originVerifierBindingDigest !== null ||
+            input.originProofDigest !== null)
+            throw new TrustValidationError("local origin metadata is invalid");
+    }
+    else {
+        requireDigest(input.originVerifierBindingDigest, "originVerifierBindingDigest");
+        requireDigest(input.originProofDigest, "originProofDigest");
+    }
+    assertSafeInteger(input.acceptedAtLogicalMs, "acceptedAtLogicalMs");
+    assertSafeInteger(input.effectiveAtLogicalMs, "effectiveAtLogicalMs");
+    if (input.effectiveAtLogicalMs >
+        input.acceptedAtLogicalMs)
+        throw new TrustValidationError("record effective time follows acceptance");
+    if (![
+        "active",
+        "pending",
+        "retracted",
+        "challenged",
+        "conflicted",
+        "unavailable",
+    ].includes(input.status))
+        throw new TrustValidationError("record status is invalid");
+    return deepFreeze({ ...input, record });
+}
+function resolutionBody(resolution) {
+    const { resolutionId: _id, resolutionDigest: _digest, ...body } = resolution;
+    return body;
+}
+export function validateEvidenceContentResolutionV1(value) {
+    assertExactKeys(value, [
+        "schemaVersion",
+        "resolutionId",
+        "resolutionDigest",
+        "claimId",
+        "claimDigest",
+        "scopeDigest",
+        "referenceId",
+        "referenceDigest",
+        "contentDigest",
+        "mediaType",
+        "encodedBytes",
+        "result",
+        "resolverBindingDigest",
+        "resolvedAtLogicalMs",
+    ], "content resolution");
+    const resolution = value;
+    if (resolution.schemaVersion !== 1)
+        throw new TrustValidationError("content resolution schema is invalid");
+    assertIdentifier(resolution.claimId, "claimId");
+    for (const key of [
+        "claimDigest",
+        "scopeDigest",
+        "contentDigest",
+        "resolverBindingDigest",
+    ])
+        requireDigest(resolution[key], key);
+    assertIdentifier(resolution.referenceId, "referenceId");
+    assertToken(resolution.mediaType, "mediaType");
+    assertSafeInteger(resolution.encodedBytes, "encodedBytes");
+    assertSafeInteger(resolution.resolvedAtLogicalMs, "resolvedAtLogicalMs");
+    if (!["verified", "unavailable", "mismatched"].includes(resolution.result))
+        throw new TrustValidationError("content resolution result is invalid");
+    const candidate = resolution;
+    const digest = digestTrustJsonV1("content-resolution", resolutionBody(candidate));
+    if (candidate.resolutionDigest !== digest ||
+        candidate.resolutionId !== `content-resolution:${digest}`)
+        throw new TrustValidationError("content resolution digest is invalid");
+    return deepFreeze(structuredClone(candidate));
+}
+function invalidationBody(invalidation) {
+    const { invalidationId: _id, ...body } = invalidation;
+    return body;
+}
+export function validateEvidenceContentResolutionInvalidationV1(value) {
+    assertExactKeys(value, [
+        "schemaVersion",
+        "invalidationId",
+        "resolutionId",
+        "resolutionDigest",
+        "resolverBindingDigest",
+        "invalidatedAtLogicalMs",
+        "reasonCode",
+    ], "content invalidation");
+    const invalidation = value;
+    if (invalidation.schemaVersion !== 1)
+        throw new TrustValidationError("content invalidation schema is invalid");
+    assertIdentifier(invalidation.resolutionId, "resolutionId");
+    requireDigest(invalidation.resolutionDigest, "resolutionDigest");
+    requireDigest(invalidation.resolverBindingDigest, "resolverBindingDigest");
+    assertSafeInteger(invalidation.invalidatedAtLogicalMs, "invalidatedAtLogicalMs");
+    validateReasonCodeV1(invalidation.reasonCode);
+    const candidate = invalidation;
+    const digest = digestTrustJsonV1("content-resolution-invalidation", invalidationBody(candidate));
+    if (candidate.invalidationId !== `content-resolution-invalidation:${digest}`)
+        throw new TrustValidationError("content invalidation digest is invalid");
+    return deepFreeze(structuredClone(candidate));
+}
+function diagnostic(record, reasonCode) {
+    return {
+        schemaVersion: 1,
+        recordId: record.recordId,
+        recordDigest: record.recordDigest,
+        reasonCode,
+    };
+}
+function findExact(records, id, digest) {
+    return records.find((item) => item.recordId === id && item.recordDigest === digest);
+}
+/** Policy-neutral content projection. Fusion decides whether an unavailable result matters. */
+export function projectEvidenceContentStatusV1(record, resolutions, invalidations, currentBinding) {
+    if (record.recordKind !== "claim" || !("content" in record.record))
+        return "not_required";
+    const content = record.record.content;
+    if (!content || content.kind !== "reference")
+        return "not_required";
+    const exact = resolutions.filter((resolution) => resolution.claimId === record.recordId &&
+        resolution.claimDigest === record.recordDigest &&
+        resolution.scopeDigest === recordScopeDigest(record.record) &&
+        resolution.referenceId === content.reference.referenceId &&
+        resolution.referenceDigest === content.reference.referenceDigest &&
+        resolution.contentDigest === content.contentDigest &&
+        resolution.mediaType === content.mediaType &&
+        resolution.encodedBytes === content.encodedBytes);
+    const verified = exact.filter((resolution) => resolution.result === "verified");
+    if (verified.some((resolution) => currentBinding === resolution.resolverBindingDigest &&
+        !invalidations.some((invalidation) => invalidation.resolutionId === resolution.resolutionId &&
+            invalidation.resolutionDigest === resolution.resolutionDigest &&
+            invalidation.resolverBindingDigest ===
+                resolution.resolverBindingDigest)))
+        return "verified";
+    if (verified.length > 0)
+        return "stale";
+    if (exact.some((resolution) => resolution.result === "mismatched"))
+        return "mismatched";
+    return "unavailable";
+}
+function targetStatus(record, records) {
+    const target = targetOf(record.record);
+    if (!target)
+        return null;
+    const found = findExact(records, target.id, target.digest);
+    if (!found)
+        return "relationship_target_missing";
+    if (found.recordKind !== target.kind ||
+        recordScopeDigest(found.record) !== recordScopeDigest(record.record))
+        return "scope_mismatch";
+    if (record.recordKind === "retraction" &&
+        recordSource(found.record) !== recordSource(record.record))
+        return "claim_subject_authority_invalid";
+    return null;
+}
+function effect(kind, record, reasonCode) {
+    return {
+        schemaVersion: 1,
+        kind,
+        recordId: record?.recordId ?? null,
+        recordDigest: record?.recordDigest ?? null,
+        reasonCode,
+    };
+}
+function quarantineEffect(kind, record, reasonCode) {
+    return {
+        schemaVersion: 1,
+        kind,
+        recordId: record.quarantineId,
+        recordDigest: record.quarantineId.slice("quarantine-record:".length),
+        reasonCode,
+    };
+}
+function ordered(values) {
+    return [...values].sort((a, b) => compareUnicode(a.recordDigest ?? a.resolutionDigest ?? a.invalidationId ?? "", b.recordDigest ?? b.resolutionDigest ?? b.invalidationId ?? ""));
+}
+/** Re-derives all lifecycle status; no clocks, I/O, or mutable global state are read. */
+export function projectEvidenceLifecycleV1(input) {
+    const records = ordered(input.records);
+    const recordKey = (recordId, recordDigest) => `${recordId}\u0000${recordDigest}`;
+    const byId = new Map(records.map((record) => [
+        recordKey(record.recordId, record.recordDigest),
+        record,
+    ]));
+    const relations = new Map();
+    for (const record of records) {
+        const key = `${record.recordKind}:${relationDigest(record.record)}`;
+        relations.set(key, (relations.get(key) ?? 0) + 1);
+    }
+    const evaluateAll = (retracted, challenged) => {
+        const memo = new Map();
+        const evaluate = (record, remainingBasisDepth, path) => {
+            const memoKey = `${record.recordDigest}\u0000${remainingBasisDepth}`;
+            const cached = memo.get(memoKey);
+            if (cached)
+                return cached;
+            const result = derive(record, remainingBasisDepth, path);
+            memo.set(memoKey, result);
+            return result;
+        };
+        const derive = (record, remainingBasisDepth, path) => {
+            const unavailable = (reason, resolvedAt = record.acceptedAtLogicalMs, maximumBasisDepth = 0) => ({
+                status: "unavailable",
+                reason,
+                resolvedAt,
+                maximumBasisDepth,
+            });
+            if ((relations.get(`${record.recordKind}:${relationDigest(record.record)}`) ?? 0) > 1)
+                return {
+                    status: "conflicted",
+                    reason: "relationship_conflict",
+                    resolvedAt: record.acceptedAtLogicalMs,
+                    maximumBasisDepth: 0,
+                };
+            let resolvedAt = record.acceptedAtLogicalMs;
+            let maximumBasisDepth = 0;
+            const pending = () => reachedPendingAge(input.logicalTimeMs, record.acceptedAtLogicalMs, input.limits.maximumPendingAgeMs)
+                ? unavailable("evidence_unavailable", resolvedAt, maximumBasisDepth)
+                : {
+                    status: "pending",
+                    reason: "pending_target",
+                    resolvedAt,
+                    maximumBasisDepth,
+                };
+            const direct = targetOf(record.record);
+            if (direct) {
+                const target = byId.get(recordKey(direct.id, direct.digest));
+                if (!target)
+                    return pending();
+                if (target.recordKind !== direct.kind ||
+                    recordScopeDigest(target.record) !== recordScopeDigest(record.record))
+                    return unavailable("scope_mismatch", resolvedAt, maximumBasisDepth);
+                if (record.recordKind === "retraction" &&
+                    recordSource(target.record) !== recordSource(record.record))
+                    return unavailable("claim_subject_authority_invalid", resolvedAt, maximumBasisDepth);
+                // Direct relationship edges establish presence and causal timing. They
+                // do not consume evidence-basis depth and Challenge/Retraction records
+                // remain inspectable when their exact target is independently
+                // ineffective, as required by policy-bound resolution and audit.
+                if (path.has(target.recordDigest))
+                    return unavailable("evidence_cycle", resolvedAt, maximumBasisDepth);
+                const targetResult = evaluate(target, remainingBasisDepth, new Set([...path, target.recordDigest]));
+                resolvedAt = Math.max(resolvedAt, targetResult.resolvedAt);
+                if (targetResult.status === "pending")
+                    return pending();
+                if (record.recordKind === "attestation" &&
+                    targetResult.status !== "active")
+                    return unavailable(targetResult.reason === "evidence_cycle" ||
+                        targetResult.reason === "evidence_depth_exceeded" ||
+                        targetResult.reason === "scope_mismatch"
+                        ? targetResult.reason
+                        : "evidence_unavailable", resolvedAt, maximumBasisDepth);
+            }
+            for (const reference of basisReferences(record.record)) {
+                if (reference.kind !== "evidence")
+                    continue;
+                const target = byId.get(recordKey(reference.referenceId, reference.referenceDigest));
+                if (!target)
+                    return pending();
+                if (recordScopeDigest(target.record) !== recordScopeDigest(record.record))
+                    return unavailable("scope_mismatch", resolvedAt, maximumBasisDepth);
+                if (path.has(target.recordDigest))
+                    return unavailable("evidence_cycle", resolvedAt, maximumBasisDepth);
+                if (remainingBasisDepth === 0)
+                    return unavailable("evidence_depth_exceeded", resolvedAt, maximumBasisDepth + 1);
+                const targetResult = evaluate(target, remainingBasisDepth - 1, new Set([...path, target.recordDigest]));
+                resolvedAt = Math.max(resolvedAt, targetResult.resolvedAt);
+                maximumBasisDepth = Math.max(maximumBasisDepth, 1 + targetResult.maximumBasisDepth);
+                if (targetResult.status === "pending")
+                    return pending();
+                if (targetResult.status !== "active" ||
+                    retracted.has(target.recordDigest) ||
+                    challenged.has(target.recordDigest))
+                    return unavailable(record.recordKind === "challenge"
+                        ? "challenge_basis_unavailable"
+                        : targetResult.reason === "evidence_cycle" ||
+                            targetResult.reason === "evidence_depth_exceeded" ||
+                            targetResult.reason === "scope_mismatch"
+                            ? targetResult.reason
+                            : "evidence_unavailable", resolvedAt, maximumBasisDepth);
+            }
+            if (reachedPendingAge(resolvedAt, record.acceptedAtLogicalMs, input.limits.maximumPendingAgeMs))
+                return unavailable("evidence_unavailable", resolvedAt, maximumBasisDepth);
+            return {
+                status: "active",
+                reason: "accepted",
+                resolvedAt,
+                maximumBasisDepth,
+            };
+        };
+        return new Map(records.map((record) => [
+            record.recordDigest,
+            evaluate(record, input.limits.maximumRelationshipDepth, new Set([record.recordDigest])),
+        ]));
+    };
+    const base = evaluateAll(new Set(), new Set());
+    const retracted = new Set(records
+        .filter((record) => record.recordKind === "retraction" &&
+        base.get(record.recordDigest)?.status === "active" &&
+        base.get(targetOf(record.record)?.digest ?? "")?.status === "active")
+        .map((record) => targetOf(record.record)?.digest)
+        .filter((digest) => digest !== undefined));
+    const afterRetractions = evaluateAll(retracted, new Set());
+    const challengeCandidates = new Set(records
+        .filter((record) => record.recordKind === "challenge" &&
+        afterRetractions.get(record.recordDigest)?.status === "active")
+        .map((record) => record.recordDigest));
+    const candidateRecords = records.filter((record) => challengeCandidates.has(record.recordDigest));
+    const targetDigests = [
+        ...new Set(candidateRecords
+            .map((record) => targetOf(record.record)?.digest)
+            .filter((digest) => digest !== undefined)),
+    ].sort(compareUnicode);
+    const targetIndex = new Map(targetDigests.map((recordDigest, index) => [recordDigest, index]));
+    const wordCount = Math.ceil(targetDigests.length / 32);
+    const sensitiveMemo = new Map();
+    const sensitiveVisiting = new Set();
+    const mergeBits = (target, source) => {
+        for (let index = 0; index < target.length; index += 1)
+            target[index] = (target[index] | source[index]) >>> 0;
+    };
+    const setBit = (bits, index) => {
+        bits[Math.floor(index / 32)] =
+            (bits[Math.floor(index / 32)] | (1 << (index % 32))) >>> 0;
+    };
+    const hasBit = (bits, index) => (bits[Math.floor(index / 32)] & (1 << (index % 32))) !== 0;
+    const challengeSensitiveTargets = (record) => {
+        const cached = sensitiveMemo.get(record.recordDigest);
+        if (cached)
+            return cached;
+        const bits = new Uint32Array(wordCount);
+        if (sensitiveVisiting.has(record.recordDigest))
+            return bits;
+        sensitiveVisiting.add(record.recordDigest);
+        if (record.recordKind === "attestation") {
+            const direct = targetOf(record.record);
+            const target = direct
+                ? byId.get(recordKey(direct.id, direct.digest))
+                : undefined;
+            if (target)
+                mergeBits(bits, challengeSensitiveTargets(target));
+        }
+        for (const reference of basisReferences(record.record)) {
+            if (reference.kind !== "evidence")
+                continue;
+            const index = targetIndex.get(reference.referenceDigest);
+            if (index !== undefined)
+                setBit(bits, index);
+            const target = byId.get(recordKey(reference.referenceId, reference.referenceDigest));
+            if (target)
+                mergeBits(bits, challengeSensitiveTargets(target));
+        }
+        sensitiveVisiting.delete(record.recordDigest);
+        sensitiveMemo.set(record.recordDigest, bits);
+        return bits;
+    };
+    const sensitiveByChallenge = candidateRecords.map((record) => challengeSensitiveTargets(record));
+    const challengeTargetIndexes = candidateRecords.map((record) => targetIndex.get(targetOf(record.record).digest));
+    const groupUnknown = new Uint32Array(targetDigests.length);
+    for (const index of challengeTargetIndexes)
+        groupUnknown[index] += 1;
+    const groupHasActive = new Uint8Array(targetDigests.length);
+    const challengeState = new Uint8Array(candidateRecords.length);
+    const unresolvedGroups = new Uint32Array(candidateRecords.length);
+    for (let challenge = 0; challenge < candidateRecords.length; challenge += 1)
+        for (let group = 0; group < targetDigests.length; group += 1)
+            if (hasBit(sensitiveByChallenge[challenge], group))
+                unresolvedGroups[challenge] += 1;
+    const queue = [];
+    const assignChallenge = (index, state) => {
+        if (challengeState[index] !== 0)
+            return;
+        challengeState[index] = state;
+        queue.push(index);
+    };
+    for (let index = 0; index < candidateRecords.length; index += 1)
+        if (unresolvedGroups[index] === 0)
+            assignChallenge(index, 1);
+    for (let cursor = 0; cursor < queue.length; cursor += 1) {
+        const challenge = queue[cursor];
+        const group = challengeTargetIndexes[challenge];
+        groupUnknown[group] -= 1;
+        if (challengeState[challenge] === 1 && groupHasActive[group] === 0) {
+            groupHasActive[group] = 1;
+            for (let dependent = 0; dependent < candidateRecords.length; dependent += 1)
+                if (hasBit(sensitiveByChallenge[dependent], group))
+                    assignChallenge(dependent, 2);
+        }
+        else if (challengeState[challenge] === 2 &&
+            groupHasActive[group] === 0 &&
+            groupUnknown[group] === 0) {
+            for (let dependent = 0; dependent < candidateRecords.length; dependent += 1) {
+                if (!hasBit(sensitiveByChallenge[dependent], group))
+                    continue;
+                unresolvedGroups[dependent] -= 1;
+                if (unresolvedGroups[dependent] === 0)
+                    assignChallenge(dependent, 1);
+            }
+        }
+    }
+    // State 1 is the well-founded lower fixed point. State 0 is an unresolved
+    // recursive blocker cycle; state 2 is definitely blocked. Both are
+    // unavailable and therefore cannot mark a target.
+    const activeChallenges = new Set(candidateRecords
+        .filter((_record, index) => challengeState[index] === 1)
+        .map((record) => record.recordDigest));
+    const unresolvedChallengeDependencies = new Set([...challengeCandidates].filter((recordDigest) => !activeChallenges.has(recordDigest)));
+    const challenged = new Set(records
+        .filter((record) => activeChallenges.has(record.recordDigest))
+        .map((record) => targetOf(record.record)?.digest)
+        .filter((digest) => digest !== undefined));
+    const final = evaluateAll(retracted, challenged);
+    if ([...activeChallenges].some((recordDigest) => final.get(recordDigest)?.status !== "active"))
+        throw new TrustValidationError("challenge projection disagrees with lifecycle closure");
+    const projected = records.map((record) => {
+        const result = final.get(record.recordDigest);
+        const status = unresolvedChallengeDependencies.has(record.recordDigest)
+            ? "unavailable"
+            : retracted.has(record.recordDigest)
+                ? "retracted"
+                : result.status !== "active"
+                    ? result.status
+                    : challenged.has(record.recordDigest)
+                        ? "challenged"
+                        : "active";
+        const reason = unresolvedChallengeDependencies.has(record.recordDigest)
+            ? "challenge_basis_unavailable"
+            : status === "challenged"
+                ? "challenge_unresolved"
+                : status === "retracted"
+                    ? "evidence_unavailable"
+                    : result.reason;
+        return { record: { ...record, status }, reason };
+    });
+    return {
+        records: projected.map((entry) => entry.record),
+        diagnostics: projected.map((entry) => diagnostic(entry.record, entry.reason)),
+    };
+}
+function stateEncodedBytes(state) {
+    return canonicalTrustJsonBytesV1({ ...state, encodedBytes: 0 }, { ...STATE_LIMITS, maximumBytes: state.limits.maximumStateCanonicalBytes }).byteLength;
+}
+function validateInputShape(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        throw new TrustValidationError("reducer input is invalid");
+    const candidate = input;
+    if (candidate.kind === "record_admitted")
+        assertExactKeys(candidate, [
+            "schemaVersion",
+            "kind",
+            "record",
+            "origin",
+            "originBindingDigest",
+            "originVerifierBindingDigest",
+            "originProofDigest",
+            "effectiveAtLogicalMs",
+            "logicalTimeMs",
+        ], "record admission input");
+    else if (candidate.kind === "policy_registered")
+        assertExactKeys(candidate, ["schemaVersion", "kind", "policy", "logicalTimeMs"], "policy registration input");
+    else if (candidate.kind === "dependency_binding_registered")
+        assertExactKeys(candidate, ["schemaVersion", "kind", "binding", "logicalTimeMs"], "dependency binding registration input");
+    else if (candidate.kind === "causal_authorization_recorded")
+        assertExactKeys(candidate, ["schemaVersion", "kind", "authorization", "logicalTimeMs"], "causal authorization input");
+    else if (candidate.kind === "fusion_evaluated")
+        assertExactKeys(candidate, ["schemaVersion", "kind", "request", "logicalTimeMs"], "fusion evaluation input");
+    else if (candidate.kind === "profile_evaluated")
+        assertExactKeys(candidate, [
+            "schemaVersion",
+            "kind",
+            "fusionDecisionId",
+            "fusionDecisionDigest",
+            "logicalTimeMs",
+        ], "profile evaluation input");
+    else if (candidate.kind === "quarantine_reviewed")
+        assertExactKeys(candidate, [
+            "schemaVersion",
+            "kind",
+            "quarantineKey",
+            "quarantineId",
+            "fusionDecisionId",
+            "fusionDecisionDigest",
+            "profileId",
+            "profileDigest",
+            "logicalTimeMs",
+        ], "quarantine review input");
+    else if (candidate.kind === "content_resolution_recorded")
+        assertExactKeys(candidate, ["schemaVersion", "kind", "resolution", "logicalTimeMs"], "content resolution input");
+    else if (candidate.kind === "content_resolution_invalidated")
+        assertExactKeys(candidate, ["schemaVersion", "kind", "invalidation", "logicalTimeMs"], "content invalidation input");
+    else if (candidate.kind === "advance_logical_time")
+        assertExactKeys(candidate, ["schemaVersion", "kind", "logicalTimeMs"], "logical time input");
+    else
+        throw new TrustValidationError("reducer input kind is invalid");
+    if (candidate.schemaVersion !== 1)
+        throw new TrustValidationError("reducer input schema is invalid");
+    assertSafeInteger(candidate.logicalTimeMs, "logicalTimeMs");
+    if (candidate.kind === "record_admitted") {
+        assertSafeInteger(candidate.effectiveAtLogicalMs, "effectiveAtLogicalMs");
+        if (candidate.effectiveAtLogicalMs >
+            candidate.logicalTimeMs)
+            throw new TrustValidationError("record effective time follows acceptance");
+    }
+    if (candidate.kind === "profile_evaluated") {
+        assertIdentifier(candidate.fusionDecisionId, "fusionDecisionId");
+        assertTrustDigest(candidate.fusionDecisionDigest, "fusionDecisionDigest");
+    }
+    if (candidate.kind === "quarantine_reviewed") {
+        assertTrustDigest(candidate.quarantineKey, "quarantineKey");
+        for (const key of [
+            "quarantineId",
+            "fusionDecisionId",
+            "profileId",
+        ])
+            assertIdentifier(candidate[key], key);
+        for (const key of ["fusionDecisionDigest", "profileDigest"])
+            assertTrustDigest(candidate[key], key);
+    }
+    return candidate;
+}
+function normalizeReducerOptions(options) {
+    if (!options || typeof options !== "object" || Array.isArray(options))
+        throw new TrustValidationError("reducer options are invalid");
+    assertExactKeys(options, [
+        "verifiedMeshAdmissionVerifierRegistry",
+        "currentContentResolverBindingDigest",
+        "causalAuthorityVerifierRegistry",
+    ].filter((key) => key in options), "reducer options");
+    const registry = options.verifiedMeshAdmissionVerifierRegistry;
+    if (registry !== undefined) {
+        assertExactKeys(registry, ["resolve"], "mesh admission verifier registry");
+        if (typeof registry.resolve !== "function")
+            throw new TrustValidationError("mesh admission verifier registry is invalid");
+    }
+    const causalRegistry = options.causalAuthorityVerifierRegistry;
+    if (causalRegistry !== undefined) {
+        assertExactKeys(causalRegistry, ["resolve"], "causal authority verifier registry");
+        if (typeof causalRegistry.resolve !== "function")
+            throw new TrustValidationError("causal authority verifier registry is invalid");
+    }
+    if (options.currentContentResolverBindingDigest !== undefined &&
+        options.currentContentResolverBindingDigest !== null)
+        assertTrustDigest(options.currentContentResolverBindingDigest, "currentContentResolverBindingDigest");
+    const checkedRegistry = registry;
+    const checkedCausalRegistry = causalRegistry;
+    return Object.freeze({
+        ...(checkedRegistry
+            ? {
+                verifiedMeshAdmissionVerifierRegistry: Object.freeze({
+                    resolve: checkedRegistry.resolve.bind(checkedRegistry),
+                }),
+            }
+            : {}),
+        ...(options.currentContentResolverBindingDigest !== undefined
+            ? {
+                currentContentResolverBindingDigest: options.currentContentResolverBindingDigest,
+            }
+            : {}),
+        ...(options.causalAuthorityVerifierRegistry !== undefined
+            ? {
+                causalAuthorityVerifierRegistry: Object.freeze({
+                    resolve: checkedCausalRegistry.resolve.bind(checkedCausalRegistry),
+                }),
+            }
+            : {}),
+    });
+}
+export function resolveVerifiedMeshAdmissionVerifierV1(registry, bindingDigest) {
+    const verifier = registry.resolve(bindingDigest);
+    if (verifier === null)
+        return null;
+    assertExactKeys(verifier, ["verifierBindingDigest", "upstreamBindingDigest", "verify"], "mesh admission verifier");
+    assertTrustDigest(verifier.verifierBindingDigest, "verifierBindingDigest");
+    assertTrustDigest(verifier.upstreamBindingDigest, "upstreamBindingDigest");
+    if (typeof verifier.verify !== "function")
+        throw new TrustValidationError("mesh admission verifier is invalid");
+    return Object.freeze({
+        verifierBindingDigest: verifier.verifierBindingDigest,
+        upstreamBindingDigest: verifier.upstreamBindingDigest,
+        verify: verifier.verify.bind(verifier),
+    });
+}
+export function resolveEvidenceCausalAuthorityVerifierV1(registry, bindingDigest) {
+    const verifier = registry.resolve(bindingDigest);
+    if (verifier === null)
+        return null;
+    assertExactKeys(verifier, [
+        "authorityBindingDigest",
+        "policyDigest",
+        "upstreamBindingDigest",
+        "verify",
+    ], "causal authority verifier");
+    assertTrustDigest(verifier.authorityBindingDigest, "authorityBindingDigest");
+    assertTrustDigest(verifier.policyDigest, "policyDigest");
+    assertTrustDigest(verifier.upstreamBindingDigest, "upstreamBindingDigest");
+    if (typeof verifier.verify !== "function")
+        throw new TrustValidationError("causal authority verifier is invalid");
+    return Object.freeze({
+        authorityBindingDigest: verifier.authorityBindingDigest,
+        policyDigest: verifier.policyDigest,
+        upstreamBindingDigest: verifier.upstreamBindingDigest,
+        verify: verifier.verify.bind(verifier),
+    });
+}
+export function reduceEvidenceTrustStateV1(stateValue, inputValue, options = {}) {
+    const state = validateEvidenceTrustStateV1(stateValue), input = validateInputShape(inputValue), normalizedOptions = normalizeReducerOptions(options);
+    if (state.causalAuthorizations.length > 0) {
+        const registry = normalizedOptions.causalAuthorityVerifierRegistry;
+        if (!registry)
+            throw new TrustValidationError("retained causal authority requires verifier registry");
+        for (const authorization of state.causalAuthorizations) {
+            const binding = state.dependencyBindings.find((item) => item.bindingDigest === authorization.authorityBindingDigest);
+            const verifier = resolveEvidenceCausalAuthorityVerifierV1(registry, authorization.authorityBindingDigest);
+            if (!binding ||
+                !verifier ||
+                binding.bindingKind !== "causal_authority" ||
+                binding.policyDigest !== authorization.policyDigest ||
+                verifier.authorityBindingDigest !==
+                    authorization.authorityBindingDigest ||
+                verifier.policyDigest !== authorization.policyDigest ||
+                verifier.upstreamBindingDigest !== binding.upstreamBindingDigest ||
+                !verifier.verify(authorization))
+                throw new TrustValidationError("retained causal authority verification failed");
+        }
+    }
+    if (input.logicalTimeMs < state.logicalTimeHighWaterMs)
+        throw new TrustValidationError("logical time rollback");
+    let records = [...state.records], resolutions = [...state.contentResolutions], invalidations = [...state.contentInvalidations], policies = [...state.policies], dependencyBindings = [...state.dependencyBindings], fusionDecisions = [...state.fusionDecisions], causalAuthorizations = [...state.causalAuthorizations], profiles = [...state.profiles], quarantines = [...state.quarantines], recoveryDecisions = [...state.recoveryDecisions];
+    const effects = [];
+    const currentQuarantineHeads = () => [
+        ...quarantines
+            .reduce((heads, quarantine) => {
+            const head = quarantineHeadV1(quarantine);
+            const previous = heads.get(head.quarantineKey);
+            if (!previous || previous.revision < head.revision)
+                heads.set(head.quarantineKey, head);
+            return heads;
+        }, new Map())
+            .values(),
+    ].sort((left, right) => compareUnicode(left.quarantineKey, right.quarantineKey));
+    const dueReviews = currentQuarantineHeads().filter((head) => {
+        if (head.status !== "active")
+            return false;
+        const quarantine = quarantines.find((candidate) => candidate.quarantineId === head.quarantineId);
+        return (quarantine !== undefined &&
+            quarantine.reviewAfterLogicalMs <= input.logicalTimeMs);
+    });
+    for (const head of dueReviews) {
+        const current = quarantines.find((candidate) => candidate.quarantineId === head.quarantineId);
+        if (quarantines.filter((candidate) => candidate.quarantineKey === current.quarantineKey).length >= state.limits.maximumQuarantineRevisionsPerHead) {
+            if (state.logicalTimeHighWaterMs < current.reviewAfterLogicalMs)
+                effects.push(quarantineEffect("quarantine_review_required", current, "quarantine_review_required"));
+            continue;
+        }
+        const review = createReviewRequiredQuarantineRecordV1(current, input.logicalTimeMs);
+        quarantines.push(review);
+        effects.push(quarantineEffect("quarantine_review_required", review, "quarantine_review_required"));
+    }
+    if (input.kind === "fusion_evaluated") {
+        const decision = evaluateEvidenceFusionV1(state, input.request, input.logicalTimeMs);
+        const existing = fusionDecisions.find((candidate) => candidate.fusionDecisionId === decision.fusionDecisionId);
+        if (existing) {
+            if (existing.fusionDecisionDigest !== decision.fusionDecisionDigest)
+                throw new TrustValidationError("fusion decision ID conflicts with existing content");
+            effects.push(effect("fusion_evaluated", null, "duplicate"));
+        }
+        else {
+            if (fusionDecisions.length >= state.limits.maximumRetainedFusionDecisions)
+                throw new TrustValidationError("fusion decision capacity exceeded");
+            fusionDecisions.push(decision);
+            effects.push(effect("fusion_evaluated", null, "accepted"));
+        }
+    }
+    else if (input.kind === "profile_evaluated") {
+        const decision = fusionDecisions.find((candidate) => candidate.fusionDecisionId === input.fusionDecisionId &&
+            candidate.fusionDecisionDigest === input.fusionDecisionDigest);
+        if (!decision || decision.evaluatedAtLogicalMs !== input.logicalTimeMs)
+            throw new TrustValidationError("profile Fusion decision is unavailable");
+        const existing = profiles.find((profile) => profile.fusionDecisionId === decision.fusionDecisionId &&
+            profile.fusionDecisionDigest === decision.fusionDecisionDigest);
+        if (existing) {
+            effects.push(effect("profile_evaluated", null, "duplicate"));
+        }
+        else {
+            const policy = policies.find((candidate) => candidate.policyId === decision.policyId &&
+                candidate.policyVersion === decision.policyVersion &&
+                digestEvidenceFusionPolicyV1(candidate) === decision.policyDigest);
+            const policyHead = state.policyHeads.find((head) => head.policyId === decision.policyId);
+            if (!policy ||
+                !policyHead ||
+                policyHead.policyVersion !== decision.policyVersion ||
+                policyHead.policyDigest !== decision.policyDigest)
+                throw new TrustValidationError("profile policy head is unavailable");
+            const profileKey = digestTrustProfileKeyV1({
+                tenantId: decision.tenantId,
+                scopeDigest: decision.scopeDigest,
+                subjectDigest: decision.subjectDigest,
+                policyDigest: decision.policyDigest,
+            });
+            const currentHead = state.profileHeads.find((head) => head.profileKey === profileKey);
+            if (decision.previousProfileDigest !== (currentHead?.profileDigest ?? null))
+                throw new TrustValidationError("profile Fusion decision does not bind the current head");
+            const historyLength = profiles.filter((profile) => digestTrustProfileKeyV1({
+                tenantId: profile.tenantId,
+                scopeDigest: profile.scopeDigest,
+                subjectDigest: profile.subjectDigest,
+                policyDigest: profile.policyDigest,
+            }) === profileKey).length;
+            if (!currentHead &&
+                state.profileHeads.length >= state.limits.maximumProfileHeads)
+                throw new TrustValidationError("profile head capacity exceeded");
+            if (historyLength >= state.limits.maximumProfileRevisionsPerHead)
+                throw new TrustValidationError("profile revision capacity exceeded");
+            const createdProfile = createTrustProfileV1({
+                fusionDecision: decision,
+                policy,
+                revision: (currentHead?.revision ?? 0) + 1,
+                previousProfileId: currentHead?.profileId ?? null,
+                previousProfileDigest: currentHead?.profileDigest ?? null,
+                updatedAtLogicalMs: input.logicalTimeMs,
+            });
+            const activationProjections = deriveQuarantineActivationsV1(state, createdProfile, decision, policy);
+            for (const initialProjection of activationProjections) {
+                const quarantineKey = digestTrustQuarantineKeyV1({
+                    tenantId: decision.tenantId,
+                    subjectDigest: decision.subjectDigest,
+                    scopeDigest: decision.scopeDigest,
+                    dimensionId: initialProjection.dimensionId,
+                    policyDigest: decision.policyDigest,
+                });
+                const head = currentQuarantineHeads().find((candidate) => candidate.quarantineKey === quarantineKey);
+                if (head?.status === "active" || head?.status === "review_required")
+                    continue;
+                const previous = head
+                    ? quarantines.find((candidate) => candidate.quarantineId === head.quarantineId)
+                    : null;
+                const projection = previous?.status === "recovered"
+                    ? deriveQuarantineActivationsV1(state, createdProfile, decision, policy, previous.recoveredAtLogicalMs).find((candidate) => candidate.dimensionId === initialProjection.dimensionId)
+                    : initialProjection;
+                if (!projection)
+                    continue;
+                const heads = currentQuarantineHeads();
+                if (!head && heads.length >= state.limits.maximumQuarantineHeads)
+                    throw new TrustValidationError("quarantine head capacity exceeded");
+                const historyLength = quarantines.filter((candidate) => candidate.quarantineKey === quarantineKey).length;
+                if (historyLength >= state.limits.maximumQuarantineRevisionsPerHead)
+                    throw new TrustValidationError("quarantine revision capacity exceeded");
+                const activeForPolicy = heads.filter((candidate) => {
+                    const record = quarantines.find((item) => item.quarantineId === candidate.quarantineId);
+                    return (record?.policyDigest === decision.policyDigest &&
+                        (candidate.status === "active" ||
+                            candidate.status === "review_required"));
+                }).length;
+                if (activeForPolicy >= policy.quarantinePolicy.maximumActiveRecords)
+                    throw new TrustValidationError("active quarantine capacity exceeded");
+                const active = createActiveQuarantineRecordV1({
+                    revision: (head?.revision ?? 0) + 1,
+                    previousRecordId: previous?.quarantineId ?? null,
+                    tenantId: decision.tenantId,
+                    subjectDigest: decision.subjectDigest,
+                    scopeDigest: decision.scopeDigest,
+                    dimensionId: projection.dimensionId,
+                    policyDigest: decision.policyDigest,
+                    fusionDecisionId: decision.fusionDecisionId,
+                    activationEvidence: projection.activationEvidence,
+                    activationDependencyGroupIds: projection.activationDependencyGroupIds,
+                    activatedAtLogicalMs: input.logicalTimeMs,
+                    reviewIntervalMs: projection.reviewIntervalMs,
+                });
+                quarantines.push(active);
+                effects.push(quarantineEffect("quarantine_activated", active, "quarantine_activated"));
+            }
+            profiles.push(createdProfile);
+            effects.push(effect("profile_evaluated", null, "accepted"));
+        }
+    }
+    else if (input.kind === "quarantine_reviewed") {
+        const target = quarantines.find((candidate) => candidate.quarantineId === input.quarantineId &&
+            candidate.quarantineKey === input.quarantineKey);
+        const decision = fusionDecisions.find((candidate) => candidate.fusionDecisionId === input.fusionDecisionId &&
+            candidate.fusionDecisionDigest === input.fusionDecisionDigest);
+        const profile = profiles.find((candidate) => candidate.profileId === input.profileId &&
+            candidate.profileDigest === input.profileDigest);
+        if (!target || !decision || !profile)
+            throw new TrustValidationError("quarantine review inputs are unavailable");
+        const existing = recoveryDecisions.find((candidate) => candidate.quarantineId === target.quarantineId &&
+            candidate.fusionDecisionId === decision.fusionDecisionId &&
+            candidate.evaluatedAtLogicalMs === input.logicalTimeMs);
+        if (existing) {
+            effects.push(quarantineEffect("quarantine_reviewed", target, "duplicate"));
+        }
+        else {
+            const head = currentQuarantineHeads().find((candidate) => candidate.quarantineKey === target.quarantineKey);
+            const historyLength = quarantines.filter((candidate) => candidate.quarantineKey === target.quarantineKey).length;
+            const exhaustedActive = target.status === "active" &&
+                input.logicalTimeMs >= target.reviewAfterLogicalMs &&
+                historyLength >= state.limits.maximumQuarantineRevisionsPerHead;
+            if (head?.quarantineId !== target.quarantineId ||
+                (target.status !== "review_required" && !exhaustedActive) ||
+                input.logicalTimeMs < target.reviewAfterLogicalMs)
+                throw new TrustValidationError("quarantine review does not target the current review head");
+            if (decision.evaluatedAtLogicalMs !== input.logicalTimeMs ||
+                profile.fusionDecisionId !== decision.fusionDecisionId ||
+                profile.fusionDecisionDigest !== decision.fusionDecisionDigest ||
+                profile.updatedAtLogicalMs !== input.logicalTimeMs ||
+                profile.tenantId !== target.tenantId ||
+                profile.subjectDigest !== target.subjectDigest ||
+                profile.scopeDigest !== target.scopeDigest ||
+                profile.policyDigest !== target.policyDigest)
+                throw new TrustValidationError("quarantine review profile binding is invalid");
+            const profileKey = digestTrustProfileKeyV1({
+                tenantId: profile.tenantId,
+                subjectDigest: profile.subjectDigest,
+                scopeDigest: profile.scopeDigest,
+                policyDigest: profile.policyDigest,
+            });
+            const profileHead = state.profileHeads.find((candidate) => candidate.profileKey === profileKey);
+            if (profileHead?.profileId !== profile.profileId ||
+                profileHead.profileDigest !== profile.profileDigest)
+                throw new TrustValidationError("quarantine review profile is not the current head");
+            const policy = policies.find((candidate) => digestEvidenceFusionPolicyV1(candidate) === target.policyDigest);
+            const policyHead = state.policyHeads.find((candidate) => candidate.policyId === policy?.policyId);
+            if (!policy ||
+                policyHead?.policyVersion !== policy.policyVersion ||
+                policyHead.policyDigest !== target.policyDigest)
+                throw new TrustValidationError("quarantine review policy head is unavailable");
+            if (recoveryDecisions.length >= state.limits.maximumRecoveryDecisions)
+                throw new TrustValidationError("recovery decision capacity exceeded");
+            const recovery = evaluateQuarantineRecoveryV1(state, target, profile, decision, policy, input.logicalTimeMs);
+            recoveryDecisions.push(recovery);
+            effects.push(quarantineEffect("quarantine_reviewed", target, recovery.disposition === "unavailable"
+                ? "quarantine_recovery_unavailable"
+                : recovery.disposition === "insufficient"
+                    ? "quarantine_recovery_insufficient"
+                    : "quarantine_recovered"));
+            if (recovery.disposition === "recovered") {
+                const recovered = createRecoveredQuarantineRecordV1(target, recovery);
+                quarantines.push(recovered);
+                effects.push(quarantineEffect("quarantine_recovered", recovered, "quarantine_recovered"));
+            }
+        }
+    }
+    else if (input.kind === "policy_registered") {
+        const policy = validateEvidenceFusionPolicyV1(input.policy, state.limits);
+        const policyDigest = digestEvidenceFusionPolicyV1(policy);
+        const existing = policies.find((candidate) => candidate.policyId === policy.policyId &&
+            candidate.policyVersion === policy.policyVersion);
+        if (existing) {
+            if (digestEvidenceFusionPolicyV1(existing) !== policyDigest)
+                throw new TrustValidationError("policy version conflicts with existing content");
+            effects.push(effect("record_duplicate", null, "duplicate"));
+        }
+        else {
+            if (policies.length >= state.limits.maximumPolicies)
+                throw new TrustValidationError("policy capacity exceeded");
+            if ((policy.policyVersion === 1) !== (policy.parentPolicyDigest === null))
+                throw new TrustValidationError("policy lineage is invalid");
+            if (policy.parentPolicyDigest !== null) {
+                const parent = policies.find((candidate) => digestEvidenceFusionPolicyV1(candidate) ===
+                    policy.parentPolicyDigest);
+                if (!parent ||
+                    parent.policyId !== policy.policyId ||
+                    parent.policyVersion + 1 !== policy.policyVersion)
+                    throw new TrustValidationError("policy lineage is invalid");
+            }
+            policies.push(policy);
+            effects.push(effect("policy_registered", null, "accepted"));
+        }
+    }
+    else if (input.kind === "dependency_binding_registered") {
+        const binding = validateEvidenceTrustDependencyBindingV1(input.binding);
+        const existing = dependencyBindings.find((candidate) => candidate.bindingKind === binding.bindingKind &&
+            candidate.bindingName === binding.bindingName &&
+            candidate.bindingVersion === binding.bindingVersion);
+        if (existing) {
+            if (existing.bindingDigest !== binding.bindingDigest)
+                throw new TrustValidationError("dependency binding version conflicts with existing content");
+            effects.push(effect("record_duplicate", null, "duplicate"));
+        }
+        else {
+            if (dependencyBindings.length >=
+                state.limits.maximumDependencyBindingVersions)
+                throw new TrustValidationError("dependency binding capacity exceeded");
+            if (binding.registeredAtLogicalMs !== input.logicalTimeMs)
+                throw new TrustValidationError("dependency binding registration time is invalid");
+            if (binding.policyDigest !== null &&
+                !policies.some((policy) => digestEvidenceFusionPolicyV1(policy) === binding.policyDigest))
+                throw new TrustValidationError("dependency binding policy is unregistered");
+            if ((binding.bindingVersion === 1) !==
+                (binding.parentBindingDigest === null))
+                throw new TrustValidationError("dependency binding lineage is invalid");
+            if (binding.parentBindingDigest !== null) {
+                const parent = dependencyBindings.find((candidate) => candidate.bindingDigest === binding.parentBindingDigest);
+                if (!parent ||
+                    parent.bindingKind !== binding.bindingKind ||
+                    parent.bindingName !== binding.bindingName ||
+                    parent.bindingVersion + 1 !== binding.bindingVersion)
+                    throw new TrustValidationError("dependency binding lineage is invalid");
+            }
+            if (binding.upstreamBindingDigest !== null &&
+                !dependencyBindings.some((candidate) => candidate.bindingDigest === binding.upstreamBindingDigest))
+                throw new TrustValidationError("dependency binding upstream is unregistered");
+            dependencyBindings.push(binding);
+            effects.push(effect("dependency_binding_registered", null, "accepted"));
+        }
+    }
+    else if (input.kind === "causal_authorization_recorded") {
+        const authorization = createEvidenceCausalAuthorizationV1({
+            ...input.authorization,
+            authorizedAtLogicalMs: input.logicalTimeMs,
+        });
+        const record = findExact(records, authorization.recordId, authorization.recordDigest);
+        const binding = dependencyBindings.find((item) => item.bindingDigest === authorization.authorityBindingDigest);
+        const visibleHead = binding
+            ? dependencyBindings
+                .filter((item) => item.bindingKind === binding.bindingKind &&
+                item.bindingName === binding.bindingName &&
+                item.registeredAtLogicalMs <= input.logicalTimeMs)
+                .sort((left, right) => right.bindingVersion - left.bindingVersion)[0]
+            : null;
+        if (!record ||
+            record.recordKind !== authorization.recordKind ||
+            !binding ||
+            binding.bindingKind !== "causal_authority" ||
+            binding.policyDigest !== authorization.policyDigest ||
+            binding.registeredAtLogicalMs > input.logicalTimeMs ||
+            binding.validFromLogicalMs > input.logicalTimeMs ||
+            (binding.validUntilLogicalMs !== null &&
+                input.logicalTimeMs >= binding.validUntilLogicalMs) ||
+            visibleHead?.bindingDigest !== binding.bindingDigest)
+            throw new TrustValidationError("causal authorization binding is invalid");
+        const registry = normalizedOptions.causalAuthorityVerifierRegistry;
+        const verifier = registry
+            ? resolveEvidenceCausalAuthorityVerifierV1(registry, authorization.authorityBindingDigest)
+            : null;
+        if (!verifier ||
+            verifier.authorityBindingDigest !==
+                authorization.authorityBindingDigest ||
+            verifier.policyDigest !== authorization.policyDigest ||
+            verifier.upstreamBindingDigest !== binding.upstreamBindingDigest ||
+            !verifier.verify(authorization))
+            throw new TrustValidationError("causal authorization proof is invalid");
+        const existing = causalAuthorizations.find((item) => item.authorizationId === authorization.authorizationId);
+        if (existing) {
+            if (existing.authorizationDigest !== authorization.authorizationDigest)
+                throw new TrustValidationError("causal authorization ID conflicts with existing content");
+            effects.push(effect("causal_authorization_recorded", null, "duplicate"));
+        }
+        else {
+            if (causalAuthorizations.length >= state.limits.maximumCausalAuthorizations)
+                throw new TrustValidationError("causal authorization capacity exceeded");
+            causalAuthorizations.push(authorization);
+            effects.push(effect("causal_authorization_recorded", null, "accepted"));
+        }
+    }
+    else if (input.kind === "record_admitted") {
+        const record = validateEvidenceRecordV1(input.record), digest = digestEvidenceRecordV1(record), id = recordId(record);
+        requireDigest(input.originBindingDigest, "originBindingDigest");
+        if (input.origin !== "local" && input.origin !== "verified_mesh")
+            throw new TrustValidationError("record origin is invalid");
+        if (input.origin === "local") {
+            if (input.originVerifierBindingDigest !== null ||
+                input.originProofDigest !== null)
+                throw new TrustValidationError("local origin metadata is invalid");
+        }
+        else {
+            requireDigest(input.originVerifierBindingDigest, "originVerifierBindingDigest");
+            requireDigest(input.originProofDigest, "originProofDigest");
+            const registry = normalizedOptions.verifiedMeshAdmissionVerifierRegistry;
+            const originVerifierBindingDigest = input.originVerifierBindingDigest;
+            const originProofDigest = input.originProofDigest;
+            const verifier = registry
+                ? resolveVerifiedMeshAdmissionVerifierV1(registry, originVerifierBindingDigest)
+                : null;
+            if (!verifier ||
+                verifier.verifierBindingDigest !== originVerifierBindingDigest ||
+                verifier.upstreamBindingDigest !== input.originBindingDigest ||
+                !verifier.verify({
+                    recordId: id,
+                    recordDigest: digest,
+                    originBindingDigest: input.originBindingDigest,
+                    originVerifierBindingDigest,
+                    originProofDigest,
+                    effectiveAtLogicalMs: input.effectiveAtLogicalMs,
+                }))
+                throw new TrustValidationError("verified mesh origin proof is invalid");
+        }
+        if (basisReferences(record).length >
+            state.limits.maximumBasisReferencesPerRecord)
+            throw new TrustValidationError("basis reference limit exceeded");
+        if (recordKind(record) === "claim" &&
+            "content" in record &&
+            record.content !== null) {
+            const contentLimit = record.content.kind === "reference"
+                ? state.limits.maximumContentReferenceBytes
+                : state.limits.maximumInlineSummaryBytes;
+            if (record.content.encodedBytes > contentLimit)
+                throw new TrustValidationError("evidence content size limit exceeded");
+        }
+        if (canonicalTrustJsonBytesV1(record).byteLength >
+            state.limits.maximumRecordCanonicalBytes)
+            throw new TrustValidationError("record size limit exceeded");
+        const existing = records.find((item) => item.recordId === id);
+        if (existing) {
+            if (existing.recordDigest !== digest)
+                throw new TrustValidationError("record ID conflicts with existing content");
+            effects.push(effect("record_duplicate", existing, "duplicate"));
+        }
+        else {
+            const familyLimit = {
+                claim: state.limits.maximumClaims,
+                attestation: state.limits.maximumAttestations,
+                challenge: state.limits.maximumChallenges,
+                retraction: state.limits.maximumRetractions,
+            }[recordKind(record)];
+            if (records.filter((item) => item.recordKind === recordKind(record))
+                .length >= familyLimit)
+                throw new TrustValidationError("record family capacity exceeded");
+            if (recordKind(record) === "challenge") {
+                const scopeDigest = recordScopeDigest(record);
+                const sourceChallenges = records.filter((item) => item.recordKind === "challenge" &&
+                    recordSource(item.record) === record.sourceId &&
+                    item.record.sourceKind === record.sourceKind &&
+                    recordScopeDigest(item.record) === scopeDigest);
+                if (sourceChallenges.length >=
+                    state.limits.maximumChallengesPerSourceScope)
+                    throw new TrustValidationError("challenge source scope capacity exceeded");
+                if (targetStatus({ record }, records) ===
+                    "relationship_target_missing" &&
+                    sourceChallenges.filter((item) => item.status === "pending").length >=
+                        state.limits.maximumPendingChallengesPerSourceScope)
+                    throw new TrustValidationError("pending challenge source scope capacity exceeded");
+            }
+            const admitted = {
+                schemaVersion: 1,
+                recordKind: recordKind(record),
+                recordId: id,
+                recordDigest: digest,
+                record,
+                origin: input.origin,
+                originBindingDigest: input.originBindingDigest,
+                originVerifierBindingDigest: input.originVerifierBindingDigest,
+                originProofDigest: input.originProofDigest,
+                acceptedAtLogicalMs: input.logicalTimeMs,
+                effectiveAtLogicalMs: input.effectiveAtLogicalMs,
+                status: "active",
+            };
+            records.push(admitted);
+            effects.push(effect("record_accepted", admitted, "accepted"));
+        }
+    }
+    else if (input.kind === "content_resolution_recorded") {
+        const resolution = input.resolution;
+        assertExactKeys(resolution, [
+            "schemaVersion",
+            "claimId",
+            "claimDigest",
+            "scopeDigest",
+            "referenceId",
+            "referenceDigest",
+            "contentDigest",
+            "mediaType",
+            "encodedBytes",
+            "result",
+            "resolverBindingDigest",
+        ], "content resolution input");
+        const body = { ...resolution, resolvedAtLogicalMs: input.logicalTimeMs };
+        const digest = digestTrustJsonV1("content-resolution", body);
+        const accepted = validateEvidenceContentResolutionV1({
+            ...body,
+            resolutionDigest: digest,
+            resolutionId: `content-resolution:${digest}`,
+        });
+        const claim = findExact(records, accepted.claimId, accepted.claimDigest);
+        if (!claim ||
+            claim.recordKind !== "claim" ||
+            recordScopeDigest(claim.record) !== accepted.scopeDigest)
+            throw new TrustValidationError("content resolution target is invalid");
+        const content = "content" in claim.record ? claim.record.content : null;
+        if (!content ||
+            content.kind !== "reference" ||
+            content.reference.referenceId !== accepted.referenceId ||
+            content.reference.referenceDigest !== accepted.referenceDigest ||
+            content.contentDigest !== accepted.contentDigest ||
+            content.mediaType !== accepted.mediaType ||
+            content.encodedBytes !== accepted.encodedBytes)
+            throw new TrustValidationError("content resolution does not match claim descriptor");
+        if (accepted.result === "verified" &&
+            normalizedOptions.currentContentResolverBindingDigest !==
+                accepted.resolverBindingDigest)
+            throw new TrustValidationError("content resolver binding is not current");
+        if (!resolutions.some((item) => item.resolutionId === accepted.resolutionId)) {
+            if (resolutions.length >= state.limits.maximumContentResolutions)
+                throw new TrustValidationError("content resolution capacity exceeded");
+            resolutions.push(accepted);
+            effects.push(effect("content_resolution_recorded", null, "accepted"));
+        }
+        else
+            effects.push(effect("record_duplicate", null, "duplicate"));
+    }
+    else if (input.kind === "content_resolution_invalidated") {
+        const invalidation = input.invalidation;
+        assertExactKeys(invalidation, [
+            "schemaVersion",
+            "resolutionId",
+            "resolutionDigest",
+            "resolverBindingDigest",
+            "reasonCode",
+        ], "content invalidation input");
+        const body = {
+            ...invalidation,
+            invalidatedAtLogicalMs: input.logicalTimeMs,
+        };
+        const digest = digestTrustJsonV1("content-resolution-invalidation", body);
+        const accepted = validateEvidenceContentResolutionInvalidationV1({
+            ...body,
+            invalidationId: `content-resolution-invalidation:${digest}`,
+        });
+        const resolution = resolutions.find((item) => item.resolutionId === accepted.resolutionId &&
+            item.resolutionDigest === accepted.resolutionDigest);
+        if (!resolution ||
+            resolution.resolverBindingDigest !== accepted.resolverBindingDigest)
+            throw new TrustValidationError("content invalidation target is invalid");
+        if (!invalidations.some((item) => item.invalidationId === accepted.invalidationId)) {
+            if (invalidations.length >= state.limits.maximumContentInvalidations)
+                throw new TrustValidationError("content invalidation capacity exceeded");
+            invalidations.push(accepted);
+            effects.push(effect("content_invalidation_recorded", null, "accepted"));
+        }
+        else
+            effects.push(effect("record_duplicate", null, "duplicate"));
+    }
+    else
+        effects.push(effect("logical_time_advanced", null, "accepted"));
+    const derived = projectEvidenceLifecycleV1({
+        records,
+        logicalTimeMs: input.logicalTimeMs,
+        limits: state.limits,
+        contentResolutions: resolutions,
+        contentInvalidations: invalidations,
+        currentContentResolverBindingDigest: normalizedOptions.currentContentResolverBindingDigest,
+    });
+    if (derived.records.filter((item) => item.status === "pending").length >
+        state.limits.maximumPendingRecords)
+        throw new TrustValidationError("pending record capacity exceeded");
+    const statusReasons = new Map(derived.diagnostics.map((item) => [item.recordDigest, item.reasonCode]));
+    const finalizedEffects = effects.map((item) => item.kind === "record_accepted" && item.recordDigest !== null
+        ? {
+            ...item,
+            reasonCode: statusReasons.get(item.recordDigest) ?? item.reasonCode,
+        }
+        : item);
+    effects.splice(0, effects.length, ...finalizedEffects);
+    for (const item of derived.records) {
+        const before = state.records.find((candidate) => candidate.recordDigest === item.recordDigest);
+        if (before && before.status !== item.status)
+            effects.push(effect("record_status_changed", item, statusReasons.get(item.recordDigest) ?? "evidence_unavailable"));
+    }
+    const nextBase = {
+        ...state,
+        logicalTimeHighWaterMs: input.logicalTimeMs,
+        policies: policies.sort((a, b) => compareUnicode(`${a.policyId}\u0000${String(a.policyVersion).padStart(16, "0")}\u0000${digestEvidenceFusionPolicyV1(a)}`, `${b.policyId}\u0000${String(b.policyVersion).padStart(16, "0")}\u0000${digestEvidenceFusionPolicyV1(b)}`)),
+        policyHeads: [
+            ...[...policies]
+                .reduce((heads, policy) => {
+                const prior = heads.get(policy.policyId);
+                if (!prior || prior.policyVersion < policy.policyVersion)
+                    heads.set(policy.policyId, {
+                        policyId: policy.policyId,
+                        policyVersion: policy.policyVersion,
+                        policyDigest: digestEvidenceFusionPolicyV1(policy),
+                    });
+                return heads;
+            }, new Map())
+                .values(),
+        ].sort((a, b) => compareUnicode(a.policyId, b.policyId)),
+        dependencyBindings: dependencyBindings.sort((a, b) => compareUnicode(`${a.bindingKind}\u0000${a.bindingName}\u0000${String(a.bindingVersion).padStart(16, "0")}\u0000${a.bindingDigest}`, `${b.bindingKind}\u0000${b.bindingName}\u0000${String(b.bindingVersion).padStart(16, "0")}\u0000${b.bindingDigest}`)),
+        dependencyBindingHeads: [
+            ...[...dependencyBindings]
+                .reduce((heads, binding) => {
+                const key = `${binding.bindingKind}\u0000${binding.bindingName}`;
+                const prior = heads.get(key);
+                if (!prior || prior.bindingVersion < binding.bindingVersion)
+                    heads.set(key, dependencyBindingHeadV1(binding));
+                return heads;
+            }, new Map())
+                .values(),
+        ].sort((a, b) => compareUnicode(`${a.bindingKind}\u0000${a.bindingName}`, `${b.bindingKind}\u0000${b.bindingName}`)),
+        causalAuthorizations: causalAuthorizations.sort((a, b) => compareUnicode(a.authorizationDigest, b.authorizationDigest)),
+        fusionDecisions: fusionDecisions.sort((a, b) => compareUnicode(a.fusionDecisionDigest, b.fusionDecisionDigest)),
+        profiles: profiles.sort((a, b) => {
+            const leftKey = digestTrustProfileKeyV1({
+                tenantId: a.tenantId,
+                scopeDigest: a.scopeDigest,
+                subjectDigest: a.subjectDigest,
+                policyDigest: a.policyDigest,
+            });
+            const rightKey = digestTrustProfileKeyV1({
+                tenantId: b.tenantId,
+                scopeDigest: b.scopeDigest,
+                subjectDigest: b.subjectDigest,
+                policyDigest: b.policyDigest,
+            });
+            return (compareUnicode(leftKey, rightKey) ||
+                a.revision - b.revision ||
+                compareUnicode(a.profileDigest, b.profileDigest));
+        }),
+        profileHeads: [
+            ...profiles
+                .reduce((heads, profile) => {
+                const head = trustProfileHeadV1(profile);
+                const prior = heads.get(head.profileKey);
+                if (!prior || prior.revision < head.revision)
+                    heads.set(head.profileKey, head);
+                return heads;
+            }, new Map())
+                .values(),
+        ].sort((a, b) => compareUnicode(a.profileKey, b.profileKey)),
+        quarantines: quarantines.sort((a, b) => compareUnicode(`${a.quarantineKey}\u0000${String(a.revision).padStart(16, "0")}\u0000${a.quarantineId}`, `${b.quarantineKey}\u0000${String(b.revision).padStart(16, "0")}\u0000${b.quarantineId}`)),
+        quarantineHeads: currentQuarantineHeads(),
+        recoveryDecisions: recoveryDecisions.sort((a, b) => compareUnicode(a.recoveryDecisionDigest, b.recoveryDecisionDigest)),
+        records: derived.records,
+        contentResolutions: ordered(resolutions),
+        contentInvalidations: ordered(invalidations),
+        pendingRecords: derived.records
+            .filter((item) => item.status === "pending")
+            .map((item) => item.recordId)
+            .sort(compareUnicode),
+        diagnostics: derived.diagnostics.slice(0, state.limits.maximumDiagnostics),
+        traceDigest: digestTrustJsonV1("trace", {
+            previousTraceDigest: state.traceDigest,
+            inputKind: input.kind,
+            logicalTimeMs: input.logicalTimeMs,
+            effects: effects
+                .map((item) => ({
+                kind: item.kind,
+                recordDigest: item.recordDigest,
+                reasonCode: item.reasonCode,
+            }))
+                .sort((a, b) => compareUnicode(`${a.kind}:${a.recordDigest ?? ""}`, `${b.kind}:${b.recordDigest ?? ""}`)),
+        }),
+    };
+    const encodedBytes = stateEncodedBytes(nextBase);
+    if (encodedBytes > state.limits.maximumStateCanonicalBytes)
+        throw new TrustValidationError("state capacity exceeded");
+    const next = validateEvidenceTrustStateV1({ ...nextBase, encodedBytes });
+    return deepFreeze({
+        state: next,
+        effects: [...effects].sort((a, b) => compareUnicode(`${a.kind}:${a.recordDigest ?? ""}`, `${b.kind}:${b.recordDigest ?? ""}`)),
+    });
+}
+//# sourceMappingURL=lifecycle.js.map