@agentunion/fastaun 0.5.25 → 0.5.27

package/dist/semantic-facade.js

@@ -0,0 +1,611 @@
+import { buildManagementBinding, bytesDigest, canonicalJson, decodeSignedJson, digest, parseJsonStrict, SemanticProtocolError, signRecord, validateAuthorizationRequestTime, validateLineageEntry, validateManagementParams, validateSignedRecord, validateStatusProof, validateWindow, verifyRecord, createEvidenceRef, resolveEvidence, archiveMessage, verifyMessageBody, } from './semantic-protocol.js';
+export class SemanticRPCFailure extends Error {
+    data;
+    code = -32000;
+    retryable;
+    constructor(message, data) {
+        super(message);
+        this.data = data;
+        this.name = 'SemanticRPCFailure';
+        this.retryable = data.retryable;
+    }
+}
+function fail(message, code = 'SEMANTIC_FORMAT_INVALID') {
+    throw new SemanticProtocolError(code, message);
+}
+function clone(value) { return structuredClone(value); }
+function canonicalObject(value) { return parseJsonStrict(canonicalJson(value)); }
+function same(left, right, message) {
+    if (digest(left) !== digest(right))
+        fail(message, 'SEMANTIC_BINDING_INVALID');
+}
+function reference(metadata, cid) {
+    return { cid, original_hash: metadata.original_hash, metadata_hash: digest(metadata), metadata_version: metadata.version };
+}
+function recordReference(value) {
+    return { cid: value.cid, original_hash: value.original_hash, metadata_hash: value.metadata_hash, metadata_version: value.metadata_version };
+}
+function usageReference(metadata) {
+    return metadata.usage ? { epoch: metadata.usage.epoch, hash: digest(metadata.usage) } : undefined;
+}
+function usageMatches(value, expected) {
+    if (expected === undefined) {
+        if (value.usage !== undefined)
+            fail('unexpected usage reference', 'SEMANTIC_BINDING_INVALID');
+    }
+    else
+        same(value.usage, expected, 'usage reference differs from confirmed contract');
+}
+function decoded(value) {
+    return value && typeof value === 'object' && Object.hasOwn(value, 'bytes_base64') ? decodeSignedJson(value) : value;
+}
+export class SemanticCredentialFacade {
+    client;
+    options;
+    state = {};
+    tail = Promise.resolve();
+    proofFirstSeen = new Map();
+    allocationProofFirstSeen = new Map();
+    statusCache = new Map();
+    constructor(client, options = {}) {
+        this.client = client;
+        this.options = { ...options };
+    }
+    configure(options) {
+        Object.assign(this.options, options);
+        this.statusCache.clear();
+    }
+    clock() { return Math.trunc(Date.now() / 1000); }
+    monotonic() { return this.options.monotonicNow?.() ?? performance.now() / 1000; }
+    identity() {
+        const actor = this.client.aid ?? this.client.currentAid?.aid;
+        if (!actor)
+            fail('authenticated client identity is required', 'SEMANTIC_IDENTITY_INVALID');
+        return this.client._semanticContextKey?.() ?? actor;
+    }
+    guard(actor) { if (this.identity() !== actor)
+        fail('semantic operation identity changed', 'SEMANTIC_IDENTITY_INVALID'); }
+    async service(options = {}) {
+        const aid = options.serviceAid ?? this.options.serviceAid ?? await this.client._semanticServiceAid?.();
+        if (aid)
+            return aid;
+        const actor = this.client.aid ?? this.client.currentAid.aid;
+        return 'credential.' + actor.slice(actor.indexOf('.') + 1);
+    }
+    context(extra = {}) {
+        const base = this.options.verificationContext ?? this.client._semanticVerificationContext?.();
+        const context = { ...base, ...extra };
+        if (typeof context.resolveCertificate !== 'function' || typeof context.verifyCertificateTrust !== 'function')
+            fail('certificate resolver and trust verifier are required', 'SEMANTIC_IDENTITY_INVALID');
+        return context;
+    }
+    async mutate(operation) {
+        const actor = this.identity();
+        const task = this.tail.then(async () => {
+            this.guard(actor);
+            const current = clone(await this.client._loadSemanticState?.() ?? this.state);
+            const result = await operation(current);
+            this.guard(actor);
+            await this.client._saveSemanticState?.(current);
+            this.guard(actor);
+            this.state = current;
+            return result;
+        });
+        this.tail = task.catch(() => { });
+        return task;
+    }
+    async invoke(method, input, options, verify) {
+        const actor = this.identity(), service = await this.service(options);
+        this.guard(actor);
+        if (Object.hasOwn(input, 'request_binding'))
+            fail('facade input must omit request_binding');
+        const params = clone(input);
+        params.request_binding = buildManagementBinding(method, service, params, this.clock());
+        validateManagementParams(method, params, { target: service });
+        const began = this.monotonic();
+        let result;
+        try {
+            result = await this.client.call(method, params);
+        }
+        catch (error) {
+            const data = error?.data;
+            if (data && typeof data.error_code === 'string' && data.error_code.startsWith('SEMANTIC_'))
+                throw new SemanticRPCFailure(error.message ?? data.error_code, data);
+            throw error;
+        }
+        this.guard(actor);
+        await verify(result, params, service, began);
+        this.guard(actor);
+        return result;
+    }
+    async responseRecord(domain, value, service, options) {
+        await verifyRecord(domain, value, this.context({ ...options.verificationContext, expectedAid: service }));
+    }
+    async registered(records, cid, metadata, service, options) {
+        const parsed = metadata.map(item => decoded(item));
+        const expected = parsed.flatMap(item => item.aud).sort();
+        same(records.map(item => item.audience), expected, 'registered audiences differ from requested metadata');
+        for (const record of records) {
+            const candidate = parsed.find(item => item.aud.includes(record.audience));
+            if (!candidate || !Number.isSafeInteger(record.state_seq) || record.state_seq < 1)
+                fail('invalid registered audience');
+            same(record.revision, reference(candidate, cid), 'registered revision differs from requested metadata');
+            await this.responseRecord('registration-receipt', record.registration_receipt, service, options);
+            same(recordReference(record.registration_receipt), record.revision, 'receipt revision differs from registered audience');
+            same(record.registration_receipt.audiences, candidate.aud, 'receipt audiences differ from metadata');
+            usageMatches(record.registration_receipt, usageReference(candidate));
+        }
+    }
+    async revisionHeads(records, withdrawn, service) {
+        await this.mutate(state => {
+            for (const [items, status] of [[records, 'current'], [withdrawn, 'withdrawn']])
+                for (const item of items) {
+                    const revision = status === 'current' ? item.revision : item.last_revision;
+                    if (!revision || !Number.isSafeInteger(item.state_seq) || item.state_seq < 1)
+                        fail('invalid lifecycle head');
+                    const key = JSON.stringify([service, revision.cid, item.audience]), prior = state.sequences?.[key];
+                    if (prior && item.state_seq < prior.state_seq)
+                        fail('revision head is older than observed lifecycle state', 'SEMANTIC_REVISION_CONFLICT');
+                    (state.sequences ??= {})[key] = { state_seq: item.state_seq, status, revision };
+                }
+        });
+    }
+    async register(input, options = {}) {
+        return this.invoke('credential.semantic.register', input, options, async (result, params, service) => {
+            if (result.cid !== params.credential_cid || result.original_hash !== digest(decodeSignedJson(params.original)))
+                fail('register original binding differs', 'SEMANTIC_BINDING_INVALID');
+            await this.registered(result.audiences, result.cid, params.metadata, service, options);
+            await this.revisionHeads(result.audiences, [], service);
+        });
+    }
+    async revise(input, options = {}) {
+        return this.invoke('credential.semantic.revise', input, options, async (result, params, service) => {
+            if (result.kind !== params.kind)
+                fail('revision kind differs from request', 'SEMANTIC_BINDING_INVALID');
+            if (result.kind === 'metadata') {
+                if (result.cid !== params.credential_cid)
+                    fail('revision CID differs', 'SEMANTIC_BINDING_INVALID');
+                await this.registered(result.audiences, result.cid, params.change.metadata, service, options);
+                same(result.withdrawn.map((entry) => entry.audience), params.change.withdraw ?? [], 'withdrawn audiences differ');
+                await this.revisionHeads(result.audiences, result.withdrawn, service);
+            }
+            else {
+                const transition = result.transition;
+                await this.responseRecord('usage-transition', transition, service, options);
+                if (transition.cid !== params.credential_cid || transition.transition_id !== params.transition_id || params.fence !== undefined && transition.fence !== params.fence)
+                    fail('transition binding differs from request', 'SEMANTIC_BINDING_INVALID');
+                if (params.from_usage)
+                    same(transition.from_usage, params.from_usage, 'transition source UsageRef differs');
+                if (params.to_usage)
+                    same(transition.to_usage, params.to_usage, 'transition target UsageRef differs');
+            }
+            this.statusCache.clear();
+        });
+    }
+    async prepareUsage(input, options = {}) {
+        return (await this.revise({ ...input, kind: 'usage_prepare' }, options)).transition;
+    }
+    async commitUsage(input, options = {}) {
+        return (await this.revise({ ...input, kind: 'usage_commit' }, options)).transition;
+    }
+    async abortUsage(input, options = {}) {
+        return (await this.revise({ ...input, kind: 'usage_abort' }, options)).transition;
+    }
+    async get(input, options = {}) {
+        return this.invoke('credential.semantic.get', input, options, async (result, params, service) => {
+            const original = decodeSignedJson(result.original);
+            if (original.cid !== params.credential_cid)
+                fail('get returned another CID', 'SEMANTIC_BINDING_INVALID');
+            if ((params.transition_id !== undefined) !== (result.kind === 'transition'))
+                fail('get response kind differs from selected branch', 'SEMANTIC_BINDING_INVALID');
+            if (result.kind === 'transition') {
+                await this.responseRecord('usage-transition', result.transition, service, options);
+                if (result.transition.transition_id !== params.transition_id || result.transition.cid !== original.cid || result.transition.original_hash !== digest(original))
+                    fail('get transition binding differs', 'SEMANTIC_BINDING_INVALID');
+            }
+            else if (result.kind === 'revision') {
+                const metadata = decodeSignedJson(result.metadata);
+                same(result.revision, reference(metadata, original.cid), 'get revision differs from metadata');
+                if (metadata.original_hash !== digest(original) || !metadata.aud.includes(params.audience) || params.metadata_version && metadata.version !== params.metadata_version || result.head.audience !== params.audience)
+                    fail('get metadata selection differs', 'SEMANTIC_BINDING_INVALID');
+                await this.responseRecord('registration-receipt', result.registration_receipt, service, options);
+                same(recordReference(result.registration_receipt), result.revision, 'get receipt differs from metadata');
+            }
+            else
+                fail('unknown semantic get result kind');
+        });
+    }
+    proofIdentity(proof) {
+        const { signature: ignored, ...statement } = proof;
+        return digest([this.identity(), statement]);
+    }
+    async rememberProof(key, received, local) {
+        return this.mutate(state => {
+            let firstSeen = local.get(key);
+            if (firstSeen === undefined) {
+                if (state.proofs?.[key])
+                    fail('status proof requires a fresh local time basis', 'SEMANTIC_STATE_UNAVAILABLE');
+                firstSeen = received;
+                local.set(key, firstSeen);
+            }
+            (state.proofs ??= {})[key] = true;
+            return firstSeen;
+        });
+    }
+    async observe(proof, service) {
+        await this.mutate(state => {
+            const key = JSON.stringify([service, proof.cid, proof.audience]), revokedKey = JSON.stringify([service, proof.cid]);
+            const sequences = state.sequences ??= {}, revoked = state.revoked ??= {};
+            const previous = sequences[key];
+            if (revoked[revokedKey] && proof.status !== 'revoked' || previous && proof.state_seq < previous.state_seq)
+                fail('proof is older than observed lifecycle state', 'SEMANTIC_REVISION_CONFLICT');
+            if (previous && proof.state_seq === previous.state_seq) {
+                same(previous.revision, recordReference(proof), 'equal state sequence has another revision');
+                if (previous.status === 'withdrawn' || previous.status === 'revoked' && proof.status !== 'revoked'
+                    || previous.status === 'expired' && proof.status === 'active')
+                    fail('proof conflicts with observed terminal lifecycle state', 'SEMANTIC_REVISION_CONFLICT');
+            }
+            sequences[key] = { state_seq: proof.state_seq, status: proof.status, revision: recordReference(proof) };
+            if (proof.status === 'revoked')
+                revoked[revokedKey] = true;
+        });
+    }
+    async status(input, options = {}) {
+        const service = await this.service(options), actor = this.identity();
+        const key = digest([actor, service, input.credential_cid, input.audience, input.expected_revision, input.policy]);
+        const cached = this.statusCache.get(key);
+        if (input.policy.mode === 'bounded' && cached) {
+            if (this.monotonic() - cached.firstSeen < input.policy.max_staleness_seconds) {
+                validateStatusProof(cached.proof, input.policy, { now: this.clock(), elapsedSeconds: this.monotonic() - cached.firstSeen });
+                await this.observe(cached.proof, service);
+                validateStatusProof(cached.proof, input.policy, { now: this.clock(), elapsedSeconds: this.monotonic() - cached.firstSeen });
+                return clone(cached.proof);
+            }
+            this.statusCache.delete(key);
+        }
+        return this.invoke('credential.semantic.status', input, options, async (proof, params, boundService, began) => {
+            const received = this.monotonic();
+            await this.responseRecord('credential-status', proof, boundService, options);
+            same(recordReference(proof), params.expected_revision, 'status revision differs from query');
+            if (proof.audience !== params.audience)
+                fail('status audience differs from query', 'SEMANTIC_BINDING_INVALID');
+            const proofKey = this.proofIdentity(proof), firstSeen = await this.rememberProof(proofKey, received, this.proofFirstSeen);
+            validateStatusProof(proof, params.policy, { now: this.clock(), elapsedSeconds: params.policy.mode === 'online' ? this.monotonic() - began : this.monotonic() - firstSeen, query: params.query });
+            await this.observe(proof, boundService);
+            validateStatusProof(proof, params.policy, { now: this.clock(), elapsedSeconds: params.policy.mode === 'online' ? Math.max(this.monotonic() - began, this.monotonic() - firstSeen) : this.monotonic() - firstSeen, query: params.query });
+            if (params.policy.mode === 'bounded')
+                this.statusCache.set(key, { proof: clone(proof), service: boundService, firstSeen });
+        });
+    }
+    async revoke(input, options = {}) {
+        return this.invoke('credential.semantic.revoke', input, options, async (result, params, service) => {
+            if (result.cid !== params.credential_cid || !Array.isArray(result.affected) || !result.affected.length)
+                fail('revoke result differs from request', 'SEMANTIC_BINDING_INVALID');
+            if (result.transition) {
+                await this.responseRecord('usage-transition', result.transition, service, options);
+                if (result.transition.cid !== result.cid || result.transition.original_hash !== result.original_hash || result.transition.state !== 'aborted'
+                    || result.transition.recovery.eligible !== false || result.transition.recovery.reason !== 'credential_revoked')
+                    fail('revocation transition differs from CID terminal state', 'SEMANTIC_BINDING_INVALID');
+            }
+            await this.mutate(state => {
+                (state.revoked ??= {})[JSON.stringify([service, result.cid])] = true;
+                for (const affected of result.affected) {
+                    const key = JSON.stringify([service, result.cid, affected.audience]), previous = state.sequences?.[key];
+                    if (!previous || affected.state_seq >= previous.state_seq)
+                        (state.sequences ??= {})[key] = { state_seq: affected.state_seq, status: 'revoked', revision: affected.revision };
+                }
+            });
+            this.statusCache.clear();
+        });
+    }
+    async revocations(input, options = {}) {
+        return this.invoke('credential.semantic.revocationList', input, options, async (page, params, service) => {
+            await this.responseRecord('semantic-crl', page, service, options);
+            same(page.scope, params.scope, 'CRL scope differs from query');
+            same(page.query, { params_hash: params.request_binding.params_hash, nonce: params.nonce }, 'CRL management query differs');
+            if (page.cursor !== params.cursor || page.after_event_seq !== params.after_event_seq || page.events.length > params.limit)
+                fail('CRL page selection differs from query', 'SEMANTIC_BINDING_INVALID');
+            await this.mutate(state => {
+                const scopeKey = digest([this.identity(), service, params.scope]), scopes = state.scopes ??= {}, previous = scopes[scopeKey];
+                const { signature: ignored, ...statement } = page;
+                const pageKey = digest([scopeKey, statement]);
+                if (state.mergedPages?.[pageKey])
+                    return;
+                if (params.cursor !== null && (!previous || previous.next_cursor !== params.cursor || previous.after_event_seq !== params.after_event_seq || previous.upper_event_seq !== page.upper_event_seq))
+                    fail('CRL continuation has no matching scope snapshot', 'SEMANTIC_BINDING_INVALID');
+                if (params.cursor === null && previous && params.after_event_seq !== previous.after_event_seq && params.after_event_seq !== previous.upper_event_seq)
+                    fail('CRL incremental sequence differs from scope progress', 'SEMANTIC_BINDING_INVALID');
+                for (const event of page.events) {
+                    (state.revoked ??= {})[JSON.stringify([service, event.cid])] = true;
+                    for (const affected of event.affected) {
+                        const key = JSON.stringify([service, event.cid, affected.audience]), prior = state.sequences?.[key];
+                        if (!prior || affected.state_seq >= prior.state_seq)
+                            (state.sequences ??= {})[key] = { state_seq: affected.state_seq, status: 'revoked', revision: affected.revision };
+                    }
+                }
+                scopes[scopeKey] = { after_event_seq: page.next_cursor === null ? page.upper_event_seq : page.after_event_seq, upper_event_seq: page.upper_event_seq, next_cursor: page.next_cursor };
+                (state.mergedPages ??= {})[pageKey] = true;
+            });
+            this.statusCache.clear();
+        });
+    }
+    signer(value) {
+        const signer = value ?? this.client.currentAid;
+        if (!signer)
+            fail('local signing identity is required', 'SEMANTIC_IDENTITY_INVALID');
+        return signer;
+    }
+    async signCredential(value, signer, options = {}) { return signRecord('semantic-credential', value, this.signer(signer), options); }
+    async signMetadata(value, signer, options = {}) { return signRecord('registration-metadata', value, this.signer(signer), options); }
+    async verifyAllocation(value, context) {
+        validateLineageEntry(context.parent);
+        validateLineageEntry(context.child);
+        const parent = this.effective(context.parent), child = this.effective(context.child);
+        if (!parent.usage || !child.usage)
+            fail('allocation requires parent and child usage contracts', 'SEMANTIC_BINDING_INVALID');
+        const allocation = decoded(value);
+        const report = await verifyRecord('usage-allocation', allocation, this.context({ ...context, expectedAid: allocation.parent_authority }));
+        if (allocation.parent_original_hash !== digest(context.parent.credential) || allocation.child_original_hash !== digest(context.child.credential)
+            || allocation.grant_key !== parent.usage.grant_key || allocation.parent_epoch !== parent.usage.epoch || allocation.child_epoch !== child.usage.epoch)
+            fail('allocation original or usage binding differs', 'SEMANTIC_BINDING_INVALID');
+        if (!allocation.audiences.includes(context.audience))
+            fail('allocation does not cover requested audience', 'SEMANTIC_BINDING_INVALID');
+        for (const [effective, authority] of [[parent, allocation.parent_authority], [child, allocation.child_authority]]) {
+            for (const audience of allocation.audiences) {
+                const ledger = effective.usage.ledger;
+                if (!effective.aud.includes(audience) || !effective.usage.audiences.includes(audience)
+                    || (ledger.scope === 'global' ? ledger.authority : ledger.authorities[audience]) !== authority)
+                    fail('allocation audience or ledger authority differs', 'SEMANTIC_BINDING_INVALID');
+            }
+            if (allocation.nbf < effective.nbf || effective.exp !== null && allocation.exp > effective.exp)
+                fail('allocation exceeds confirmed time bounds', 'SEMANTIC_BINDING_INVALID');
+        }
+        const exceeds = (amount, limit) => {
+            const [whole, fraction = ''] = amount.split('.'), [limitWhole, limitFraction = ''] = limit.split('.');
+            if (whole.length !== limitWhole.length)
+                return whole.length > limitWhole.length;
+            if (whole !== limitWhole)
+                return whole > limitWhole;
+            const precision = Math.max(fraction.length, limitFraction.length);
+            return fraction.padEnd(precision, '0') > limitFraction.padEnd(precision, '0');
+        };
+        for (const budget of allocation.budgets) {
+            const parentLimit = parent.usage.limits.find((limit) => limit.id === budget.parent_limit_id);
+            const childLimit = child.usage.limits.find((limit) => limit.id === budget.child_limit_id);
+            if (!parentLimit || !childLimit || [parentLimit, childLimit].some(limit => limit.metric !== budget.metric || limit.unit !== budget.unit || exceeds(budget.amount, limit.limit)))
+                fail('allocation budget exceeds or differs from confirmed limits', 'SEMANTIC_BINDING_INVALID');
+        }
+        return { ...report, revisions_bound: true, checked: [...report.checked, 'allocation_bindings', 'audience_bindings', 'ledger_authorities', 'allocation_budgets', 'allocation_time_bounds'],
+            required: [...report.required.filter(item => item !== 'revision_bindings'), 'package_verification', 'usage_reservation'] };
+    }
+    async signAllocation(value, signer, options = {}) { return signRecord('usage-allocation', value, this.signer(signer), options); }
+    async signUsageRecord(domain, value, signer, options = {}) {
+        if (!['usage-allocation', 'allocation-status', 'semantic-crl', 'usage-transition', 'usage-checkpoint', 'usage-acceptance', 'ledger-abort'].includes(domain))
+            fail('unsupported usage record domain');
+        return signRecord(domain, value, this.signer(signer), options);
+    }
+    async verifyAllocationStatus(value, context) {
+        const began = this.monotonic(), proof = decoded(value), allocation = decoded(context.allocation);
+        if (!Number.isFinite(context.elapsedSeconds) || context.elapsedSeconds < 0 || context.elapsedSeconds >= 30)
+            fail('allocation status requires monotonic query elapsed time below 30 seconds');
+        validateSignedRecord('usage-allocation', allocation);
+        if (proof.authority !== allocation.parent_authority || proof.allocation_id !== allocation.allocation_id || proof.allocation_hash !== digest(allocation))
+            fail('allocation status differs from original allocation', 'SEMANTIC_BINDING_INVALID');
+        same(proof.query, context.query, 'allocation status query differs from request');
+        const report = await verifyRecord('allocation-status', proof, this.context({ ...context, expectedAid: allocation.parent_authority }));
+        const { signature: ignored, ...statement } = proof;
+        const proofKey = digest([this.identity(), statement]), firstSeen = await this.rememberProof(proofKey, began, this.allocationProofFirstSeen);
+        if (Math.max(context.elapsedSeconds + this.monotonic() - began, this.monotonic() - firstSeen) >= 30)
+            fail('allocation status monotonic lifetime exceeded');
+        await this.mutate(state => {
+            const key = JSON.stringify([proof.authority, proof.allocation_id]), prior = state.allocations?.[key];
+            const order = { active: 0, draining: 1, closed: 2 };
+            if (prior && (prior.allocation_hash !== proof.allocation_hash || proof.state_seq < prior.state_seq || order[proof.state] < order[prior.state] || proof.state_seq === prior.state_seq && proof.state !== prior.state))
+                fail('allocation status conflicts with observed state', 'SEMANTIC_REVISION_CONFLICT');
+            (state.allocations ??= {})[key] = { allocation_hash: proof.allocation_hash, state_seq: proof.state_seq, state: proof.state };
+        });
+        if (Math.max(context.elapsedSeconds + this.monotonic() - began, this.monotonic() - firstSeen) >= 30)
+            fail('allocation status monotonic lifetime exceeded');
+        return { ...report, revisions_bound: true, checked: [...report.checked, 'allocation_binding', 'query_binding', 'monotonic_ttl', 'allocation_state'],
+            required: [...report.required.filter(item => item !== 'revision_bindings'), 'allocation_verification', 'usage_reservation'] };
+    }
+    async verifyUsageRecord(domain, value, context = {}) {
+        if (!['usage-allocation', 'allocation-status', 'semantic-crl', 'usage-transition', 'usage-checkpoint', 'usage-acceptance', 'ledger-abort'].includes(domain))
+            fail('unsupported usage record domain');
+        return verifyRecord(domain, decoded(value), this.context(context));
+    }
+    async verifyOriginal(value, context = {}) { return verifyRecord('semantic-credential', decoded(value), this.context(context)); }
+    async verifyMetadata(value, context = {}) { return verifyRecord('registration-metadata', decoded(value), this.context(context)); }
+    async verifyReceipt(value, context = {}) { return verifyRecord('registration-receipt', decoded(value), this.context(context)); }
+    async verifyStatus(value, context = {}) {
+        const began = this.monotonic(), proof = decoded(value);
+        const service = context.expectedServiceAid ?? context.expectedAid ?? await this.service();
+        const report = await verifyRecord('credential-status', proof, this.context({ ...context, expectedAid: service }));
+        const key = this.proofIdentity(proof), firstSeen = await this.rememberProof(key, began, this.proofFirstSeen);
+        if (context.policy) {
+            if (context.elapsedSeconds !== undefined && (!Number.isFinite(context.elapsedSeconds) || context.elapsedSeconds < 0) || context.policy.mode === 'online' && context.elapsedSeconds === undefined)
+                fail('status requires valid monotonic query elapsed time');
+            validateStatusProof(proof, context.policy, { now: context.now ?? this.clock(),
+                elapsedSeconds: Math.max((context.elapsedSeconds ?? 0) + this.monotonic() - began, this.monotonic() - firstSeen), query: context.query });
+        }
+        await this.observe(proof, service);
+        if (context.policy)
+            validateStatusProof(proof, context.policy, { now: context.now ?? this.clock(),
+                elapsedSeconds: Math.max((context.elapsedSeconds ?? 0) + this.monotonic() - began, this.monotonic() - firstSeen), query: context.query });
+        return report;
+    }
+    async buildPackage(lineage) {
+        if (!Array.isArray(lineage) || !lineage.length || lineage.length > 9)
+            fail('lineage must contain root through leaf, maximum delegation depth 8');
+        lineage.forEach(validateLineageEntry);
+        this.lineageBindings(lineage);
+        return clone({ lineage });
+    }
+    effective(entry) { return entry.credential.ver === 'aun-cap/semantic-1' ? entry.metadata : entry.credential; }
+    lineageBindings(lineage) {
+        const seen = new Set();
+        for (let index = 0; index < lineage.length; index++) {
+            const entry = lineage[index], credential = entry.credential, effective = this.effective(entry);
+            if (seen.has(credential.cid))
+                fail('lineage contains duplicate CID');
+            seen.add(credential.cid);
+            if ((effective.delegation_depth ?? 0) !== index || index === 0 && effective.parent !== undefined)
+                fail('lineage root or depth differs');
+            if (index > 0) {
+                const parent = this.effective(lineage[index - 1]);
+                if (effective.parent !== lineage[index - 1].credential.cid || effective.iss !== parent.sub || parent.delegate !== true || effective.nbf < parent.nbf || parent.exp !== null && (effective.exp === null || effective.exp > parent.exp) || effective.aud.some((aud) => !parent.aud.includes(aud)))
+                    fail('lineage delegation identity or upper bounds differ');
+            }
+            for (const chain of [credential.proof_chain, effective === credential ? undefined : effective.proof_chain]) {
+                if (chain !== undefined)
+                    same(chain.map((item) => digest(item)), lineage.slice(0, index).reverse().map(item => digest(item.credential)), 'proof_chain differs from ordered lineage');
+            }
+        }
+    }
+    async verifyPackage(value, context) {
+        const began = this.monotonic(), grant = await this.buildPackage(value.lineage), now = context.now ?? this.clock();
+        const required = new Set(['issuer_authority', 'authorization_policy', 'business_acceptance', 'parent_semantics', 'capability_intersection', 'usage_reservation']);
+        for (const entry of grant.lineage) {
+            const effective = this.effective(entry);
+            if (!effective.aud.includes(context.audience))
+                fail('package audience differs from request', 'SEMANTIC_BINDING_INVALID');
+            if (entry.credential.ver === 'aun-cap/1') {
+                if (!context.legacyVerifier)
+                    fail('trusted legacy credential verifier is required', 'SEMANTIC_STATE_UNAVAILABLE');
+                await context.legacyVerifier(entry, context.audience, now);
+                continue;
+            }
+            const semantic = entry;
+            const signer = context.originalSigner ? await context.originalSigner(entry) : context.expectedAid;
+            const originalReport = await this.verifyOriginal(semantic.credential, { ...context, expectedAid: signer, now });
+            originalReport.required.forEach(item => required.add(item));
+            await this.verifyMetadata(semantic.metadata, { ...context, expectedAid: semantic.metadata.confirmation.authority, now });
+            const originalHash = digest(semantic.credential), metadata = semantic.metadata;
+            if (metadata.original_hash !== originalHash)
+                fail('metadata binds another original', 'SEMANTIC_BINDING_INVALID');
+            for (const field of ['iss', 'sub', 'parent', 'delegation_depth'])
+                if (semantic.credential[field] !== undefined && semantic.credential[field] !== metadata[field])
+                    fail(`explicit original ${field} differs from metadata`, 'SEMANTIC_BINDING_INVALID');
+            if (semantic.credential.aud && metadata.aud.some(aud => !semantic.credential.aud.includes(aud)) || semantic.credential.nbf !== undefined && metadata.nbf < semantic.credential.nbf || semantic.credential.exp !== undefined && (metadata.exp === null || metadata.exp > semantic.credential.exp) || semantic.credential.delegate === false && metadata.delegate)
+                fail('metadata expands explicit original upper bound', 'SEMANTIC_BINDING_INVALID');
+            const expected = reference(metadata, semantic.credential.cid);
+            same(recordReference(semantic.registration_receipt), expected, 'package receipt binds another revision');
+            same(recordReference(semantic.status), expected, 'package status binds another revision');
+            same(semantic.registration_receipt.audiences, metadata.aud, 'package receipt audiences differ');
+            usageMatches(semantic.registration_receipt, usageReference(metadata));
+            usageMatches(semantic.status, usageReference(metadata));
+            const service = context.serviceFor ? await context.serviceFor(semantic.credential.cid) : context.expectedServiceAid ?? await this.service();
+            await this.verifyReceipt(semantic.registration_receipt, { ...context, expectedAid: service, now });
+            await this.verifyStatus(semantic.status, { ...context, expectedAid: service, expectedServiceAid: service, now,
+                policy: context.statePolicy ?? { mode: 'online' }, elapsedSeconds: context.elapsedSeconds === undefined ? undefined : context.elapsedSeconds + this.monotonic() - began, query: context.queries?.[semantic.credential.cid] });
+            if (semantic.status.audience !== context.audience || semantic.status.status !== 'active')
+                fail('package lifecycle state is not active', 'SEMANTIC_REVISION_CONFLICT');
+            validateWindow(metadata.nbf, metadata.exp, now);
+        }
+        for (const entry of grant.lineage)
+            if (entry.credential.ver === 'aun-cap/semantic-1') {
+                const semantic = entry;
+                const firstSeen = this.proofFirstSeen.get(this.proofIdentity(semantic.status)) ?? began;
+                validateStatusProof(semantic.status, context.statePolicy ?? { mode: 'online' }, { now: context.now ?? this.clock(),
+                    elapsedSeconds: Math.max((context.elapsedSeconds ?? 0) + this.monotonic() - began, this.monotonic() - firstSeen),
+                    query: context.queries?.[semantic.credential.cid] });
+            }
+        return { original_hash: digest(grant.lineage.at(-1).credential), signatures_verified: true, identities_bound: true, revisions_bound: true,
+            checked: ['original_signatures', 'metadata_signatures', 'receipt_signatures', 'status_signatures', 'revision_bindings', 'lineage', 'time_windows', 'lifecycle_state'], required: [...required] };
+    }
+    async requestHash(request) {
+        const { grant, request_binding: ignored, ...operation } = request;
+        const lineage = grant.lineage.map(entry => entry.credential.ver === 'aun-cap/semantic-1'
+            ? { revision: reference(entry.metadata, entry.credential.cid), receipt_hash: digest(entry.registration_receipt) }
+            : { revision: { cid: entry.credential.cid, original_hash: digest(entry.credential) }, ...(entry.legacy.registration_receipt ? { receipt_hash: digest(entry.legacy.registration_receipt) } : {}) });
+        return digest(['aun-cap-request/1', { ...operation, lineage }]);
+    }
+    async buildRequest(input, options = {}) {
+        const request = canonicalObject(input), now = options.now ?? this.clock();
+        if (!Number.isSafeInteger(request.expires_at) || request.expires_at <= now || request.expires_at - now > 300)
+            fail('sender request lifetime must be within 300 seconds');
+        await this.buildPackage(request.grant.lineage);
+        request.params_hash = digest(request.params);
+        request.request_binding = { profile: 'aun-cap-request/1', request_hash: await this.requestHash(request) };
+        this.requestShape(request);
+        await this.rememberRequest(request);
+        return request;
+    }
+    requestShape(request) {
+        const fields = ['request_id', 'nonce', 'actor', 'sub', 'target', 'aud', 'ns', 'action', 'resource', 'params', 'params_hash', 'expires_at', 'grant', 'request_binding'];
+        if (Object.keys(request).some(key => !fields.includes(key)) || fields.some(key => !Object.hasOwn(request, key)))
+            fail('authorization request fields differ from contract');
+        for (const key of ['request_id', 'actor', 'sub', 'target', 'aud', 'ns', 'action', 'resource'])
+            if (typeof request[key] !== 'string' || !request[key])
+                fail('authorization request identifier is empty');
+        for (const key of ['actor', 'sub', 'target', 'aud'])
+            if (!/^[^\s/]+\.[^\s/]+$/.test(request[key]))
+                fail('authorization request identity is not an AID');
+        if (!/^[A-Za-z0-9_-]+$/.test(request.nonce) || Buffer.from(request.nonce, 'base64url').length < 16 || Buffer.from(request.nonce, 'base64url').toString('base64url') !== request.nonce)
+            fail('authorization request nonce is invalid');
+        if (!request.params || typeof request.params !== 'object' || Array.isArray(request.params) || !request.request_binding || Object.keys(request.request_binding).sort().join(',') !== 'profile,request_hash' || request.request_binding.profile !== 'aun-cap-request/1' || !/^sha256:[0-9a-f]{64}$/.test(request.request_binding.request_hash))
+            fail('authorization request params or profile is invalid');
+    }
+    async rememberRequest(request, accepted = false, now = this.clock()) {
+        await this.mutate(state => {
+            const requests = state.requests ??= {}, nonces = state.nonces ??= {};
+            const requestKey = JSON.stringify([request.actor, request.aud, request.request_id]), nonceKey = JSON.stringify([request.actor, request.aud, request.nonce]);
+            const existing = requests[requestKey], used = nonces[nonceKey];
+            if (existing && existing.request_hash !== request.request_binding.request_hash)
+                fail('request_id already binds another request', 'SEMANTIC_IDEMPOTENCY_CONFLICT');
+            if (used && (used.request_id !== request.request_id || used.request_hash !== request.request_binding.request_hash))
+                fail('nonce already binds another request', 'SEMANTIC_BINDING_INVALID');
+            if (accepted && !existing?.accepted)
+                validateAuthorizationRequestTime(request, now);
+            requests[requestKey] = { request_hash: request.request_binding.request_hash, nonce: request.nonce, expires_at: request.expires_at, accepted: existing?.accepted || accepted };
+            nonces[nonceKey] = { request_id: request.request_id, request_hash: request.request_binding.request_hash, expires_at: request.expires_at };
+        });
+    }
+    async verifyRequest(request, authentication, options = {}) {
+        this.requestShape(request);
+        await this.buildPackage(request.grant.lineage);
+        const now = options.now ?? this.clock();
+        if (request.actor !== authentication.actor || request.aud !== authentication.service_aid || request.target !== authentication.service_aid || !authentication.authentication_ref)
+            fail('authenticated actor or service differs from request', 'SEMANTIC_IDENTITY_INVALID');
+        const leaf = this.effective(request.grant.lineage.at(-1));
+        if (request.sub !== leaf.sub || !leaf.aud.includes(request.aud))
+            fail('request subject or audience differs from leaf', 'SEMANTIC_BINDING_INVALID');
+        if (request.actor !== request.sub && !await options.representedActor?.(request.actor, request.sub))
+            fail('actor representation evidence is required', 'SEMANTIC_PERMISSION_DENIED');
+        same(request.params_hash, digest(request.params), 'request params digest differs');
+        const requestHash = await this.requestHash(request);
+        same(request.request_binding.request_hash, requestHash, 'authorization request digest differs');
+        await this.rememberRequest(request, true, now);
+        return { request_hash: requestHash, checked: ['authenticated_actor', 'authenticated_service', 'subject', 'params_hash', 'request_hash', 'nonce_binding'], required: ['package_verification', 'business_acceptance', 'atomic_execution_idempotency'] };
+    }
+    async buildDecisionInput(request, bodies, facts, policy) {
+        const leaf = request.grant.lineage.at(-1);
+        if (!leaf?.metadata || !bodies.length)
+            fail('semantic decision requires verified leaf metadata and bodies');
+        for (const entry of request.grant.lineage)
+            if (entry.credential.ver === 'aun-cap/semantic-1' && !bodies.some(body => body.credential_hash === digest(entry.credential)))
+                fail('decision is missing an applicable semantic body');
+        for (const body of bodies)
+            if (body.body_hash !== bytesDigest(new TextEncoder().encode(body.text)) || !request.grant.lineage.some(entry => digest(entry.credential) === body.credential_hash))
+                fail('decision body binding differs', 'SEMANTIC_BINDING_INVALID');
+        const { actor, sub, target, aud, ns, action, resource, params } = request;
+        const evidence = [...new Set(bodies.flatMap(body => body.evidence_hashes))].sort();
+        const lineage = request.grant.lineage.map(entry => {
+            const body = bodies.find(item => item.credential_hash === digest(entry.credential));
+            return { revision: entry.credential.ver === 'aun-cap/semantic-1' ? reference(entry.metadata, entry.credential.cid)
+                    : { cid: entry.credential.cid, original_hash: digest(entry.credential) },
+                ...(body ? { body_hash: body.body_hash, evidence_hashes: [...new Set(body.evidence_hashes)].sort() } : {}) };
+        });
+        return clone({ credential_hash: digest(leaf.credential), metadata_hash: digest(leaf.metadata), metadata_version: leaf.metadata.version,
+            lineage_hash: digest(lineage), request_hash: await this.requestHash(request), evidence_hashes: evidence,
+            bodies: bodies.map(body => ({ credential_hash: body.credential_hash, body_hash: body.body_hash, text: body.text })),
+            operation: { actor, sub, target, aud, ns, action, resource, params }, facts, facts_hash: digest(facts), policy });
+    }
+    async createEvidenceRef(bytes, profile, locator) { return createEvidenceRef(bytes, profile, locator); }
+    async resolveEvidence(ref, resolvers = {}) { return resolveEvidence(ref, resolvers); }
+    async archiveMessage(envelope, received) { return archiveMessage(envelope, received); }
+    async verifyMessageBody(value, context = {}) {
+        return verifyMessageBody(value, { ...this.client._semanticMessageVerificationContext?.(), ...context, ...this.context(context) });
+    }
+}
+//# sourceMappingURL=semantic-facade.js.map