@airprompter/agent-core 0.1.0

package/dist/esm/protocol/trust.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The trust chain (`protocol/trust-chain.md`): thumbprints, ES256 over
+ * canonical bytes, root-metadata acceptance R1–R5 and manifest verification
+ * M1–M12. Pure over its inputs; `now` is always passed in. This is what
+ * decides whether bytes go live, so it never reads the network or the disk.
+ */
+import { type Manifest, type ManifestPayload, type ManifestSlot, type P256PrivateJwk, type P256PublicJwk, type RefusalCode, type RootMetadata, type Target } from "./types.js";
+export declare const SUPPORTED_PROTOCOL_MAJORS: ReadonlySet<number>;
+/** RFC 7638: sha256 over canonical {crv, kty, x, y}, lowercase hex. */
+export declare function keyThumbprint(jwk: P256PublicJwk): string;
+export declare function publicJwkOf(jwk: P256PublicJwk | P256PrivateJwk): P256PublicJwk;
+/** ES256, P1363 r‖s, base64url without padding. Local keys only (the platform signs in KMS). */
+export declare function signBytes(bytes: Uint8Array, privateJwk: P256PrivateJwk): string;
+export declare function verifyBytes(bytes: Uint8Array, signature: string, publicJwk: P256PublicJwk): boolean;
+/** Timestamps compare as instants (RFC 3339), never as strings. */
+export declare function instant(text: string): number;
+/** The synthetic trusted document a runtime starts from: the pinned root key alone, in the root role. */
+export declare function trustedRootFromPinnedKey(input: {
+    purpose: "platform" | "countersign";
+    environment: Target;
+    pinnedRoot: P256PublicJwk;
+}): RootMetadata;
+export type Verdict<T = object> = ({
+    ok: true;
+} & T) | {
+    ok: false;
+    reason: RefusalCode;
+};
+/** R1–R5. */
+export declare function verifyRootMetadata(input: {
+    candidate: RootMetadata;
+    trusted: RootMetadata;
+    now: string;
+}): Verdict;
+/** Every content hash a manifest references, with the declared length: slots, steps, arm overrides. */
+export declare function referencedPayloads(payload: ManifestPayload): Map<string, number>;
+export interface VerifyManifestInput {
+    manifest: Manifest;
+    root: RootMetadata;
+    now: string;
+    scope: {
+        organizationId: string;
+        agentId: string;
+        target: Target;
+    };
+    storedGeneration: number;
+    /** contentHash → bytes for whatever was fetched; null skips M9/M10 (verify the envelope before fetching). */
+    payloads?: ReadonlyMap<string, Uint8Array> | null;
+    countersignRoot?: RootMetadata | null;
+    /** The local side may be stricter than the manifest. */
+    requireCountersign?: boolean;
+}
+/** M1–M14. */
+export declare function verifyManifest(input: VerifyManifestInput): Verdict<{
+    signingKeyId: string;
+    generation: number;
+}>;
+/** The digest input: pins sorted by tag, projected to exactly the covered members (canonical-json.md). */
+export declare function releaseDigestInput(slots: readonly ManifestSlot[]): unknown[];
+export declare function releaseDigest(slots: readonly ManifestSlot[]): `sha256:${string}`;

package/dist/esm/protocol/trust.js

@@ -0,0 +1,211 @@
+/**
+ * The trust chain (`protocol/trust-chain.md`): thumbprints, ES256 over
+ * canonical bytes, root-metadata acceptance R1–R5 and manifest verification
+ * M1–M12. Pure over its inputs; `now` is always passed in. This is what
+ * decides whether bytes go live, so it never reads the network or the disk.
+ */
+import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify } from "node:crypto";
+import { isAssignmentError, validateRamp } from "./assignment.js";
+import { canonicalBytes, canonicalJson, sha256Prefixed } from "./canonicalJson.js";
+import { DIRECTIVE_KINDS } from "./types.js";
+export const SUPPORTED_PROTOCOL_MAJORS = new Set([0]);
+/** RFC 7638: sha256 over canonical {crv, kty, x, y}, lowercase hex. */
+export function keyThumbprint(jwk) {
+    return createHash("sha256").update(canonicalJson({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y }), "utf8").digest("hex");
+}
+export function publicJwkOf(jwk) {
+    return { kty: "EC", crv: "P-256", x: jwk.x, y: jwk.y };
+}
+/** ES256, P1363 r‖s, base64url without padding. Local keys only (the platform signs in KMS). */
+export function signBytes(bytes, privateJwk) {
+    const key = createPrivateKey({ key: privateJwk, format: "jwk" });
+    return cryptoSign("sha256", bytes, { key, dsaEncoding: "ieee-p1363" }).toString("base64url");
+}
+export function verifyBytes(bytes, signature, publicJwk) {
+    if (!/^[A-Za-z0-9_-]{86}$/.test(signature))
+        return false;
+    try {
+        const key = createPublicKey({ key: publicJwk, format: "jwk" });
+        return cryptoVerify("sha256", bytes, { key, dsaEncoding: "ieee-p1363" }, Buffer.from(signature, "base64url"));
+    }
+    catch {
+        return false;
+    }
+}
+/** Timestamps compare as instants (RFC 3339), never as strings. */
+export function instant(text) {
+    const ms = Date.parse(text);
+    if (!Number.isFinite(ms))
+        throw new Error(`not an RFC 3339 timestamp: ${text}`);
+    return ms;
+}
+/** The synthetic trusted document a runtime starts from: the pinned root key alone, in the root role. */
+export function trustedRootFromPinnedKey(input) {
+    const keyId = keyThumbprint(input.pinnedRoot);
+    return {
+        signed: {
+            type: "root",
+            protocol: "0.0.0",
+            purpose: input.purpose,
+            environment: input.environment,
+            version: 0,
+            expires: "9999-12-31T23:59:59Z",
+            keys: { [keyId]: { keyType: "ecdsa-p256", scheme: "ES256", publicKey: publicJwkOf(input.pinnedRoot) } },
+            roles: { root: { keyIds: [keyId], threshold: 1 }, targets: { keyIds: [], threshold: 1 } },
+        },
+        signatures: [],
+    };
+}
+function countValidSignatures(bytes, signatures, keyIds, keys) {
+    const seen = new Set();
+    let valid = 0;
+    for (const signature of signatures) {
+        if (!keyIds.includes(signature.keyId) || seen.has(signature.keyId))
+            continue;
+        const key = keys[signature.keyId];
+        if (!key)
+            continue;
+        if (verifyBytes(bytes, signature.sig, key.publicKey)) {
+            seen.add(signature.keyId);
+            valid += 1;
+        }
+    }
+    return valid;
+}
+/** R1–R5. */
+export function verifyRootMetadata(input) {
+    const signed = input.candidate.signed;
+    const trusted = input.trusted.signed;
+    if (signed.purpose !== trusted.purpose || signed.environment !== trusted.environment)
+        return { ok: false, reason: "root_scope_mismatch" };
+    for (const [keyId, key] of Object.entries(signed.keys)) {
+        if (keyThumbprint(key.publicKey) !== keyId)
+            return { ok: false, reason: "key_id_mismatch" };
+    }
+    if (signed.version < trusted.version)
+        return { ok: false, reason: "root_rollback" };
+    if (signed.version === trusted.version && canonicalJson(signed) !== canonicalJson(trusted))
+        return { ok: false, reason: "root_rollback" };
+    const role = trusted.roles.root;
+    if (countValidSignatures(canonicalBytes(signed), input.candidate.signatures, role.keyIds, trusted.keys) < role.threshold) {
+        return { ok: false, reason: "root_signature_invalid" };
+    }
+    if (!(instant(signed.expires) > instant(input.now)))
+        return { ok: false, reason: "root_expired" };
+    return { ok: true };
+}
+/** Every content hash a manifest references, with the declared length: slots, steps, arm overrides. */
+export function referencedPayloads(payload) {
+    const hashes = new Map();
+    const add = (slot) => {
+        hashes.set(slot.contentHash, slot.byteLength);
+        for (const step of slot.steps ?? [])
+            hashes.set(step.contentHash, step.byteLength);
+        if (slot.goldenSet)
+            hashes.set(slot.goldenSet.contentHash, slot.goldenSet.byteLength);
+    };
+    for (const slot of payload.slots)
+        add(slot);
+    for (const arm of payload.experiment?.arms ?? [])
+        for (const override of arm.overrides)
+            add(override);
+    return hashes;
+}
+function keyUsableAt(key, now) {
+    const at = instant(now);
+    if (key.notBefore && !(instant(key.notBefore) <= at))
+        return false;
+    if (key.notAfter && !(at < instant(key.notAfter)))
+        return false;
+    return true;
+}
+/** M1–M14. */
+export function verifyManifest(input) {
+    const { manifest, root } = input;
+    const payload = manifest.payload;
+    if (!(instant(root.signed.expires) > instant(input.now)))
+        return { ok: false, reason: "root_expired" };
+    const major = Number(payload.protocol.split(".")[0]);
+    if (!SUPPORTED_PROTOCOL_MAJORS.has(major))
+        return { ok: false, reason: "protocol_unsupported" };
+    const targets = root.signed.roles.targets;
+    const named = manifest.signatures.filter((signature) => targets.keyIds.includes(signature.keyId) && root.signed.keys[signature.keyId]);
+    if (named.length === 0)
+        return { ok: false, reason: "unknown_signing_key" };
+    const usable = named.filter((signature) => keyUsableAt(root.signed.keys[signature.keyId], input.now));
+    if (usable.length === 0)
+        return { ok: false, reason: "signing_key_expired" };
+    const valid = countValidSignatures(canonicalBytes(payload), usable, targets.keyIds, root.signed.keys);
+    if (valid === 0)
+        return { ok: false, reason: "signature_invalid" };
+    if (valid < targets.threshold)
+        return { ok: false, reason: "signature_threshold" };
+    if (payload.organizationId !== input.scope.organizationId || payload.agentId !== input.scope.agentId || payload.target !== input.scope.target) {
+        return { ok: false, reason: "scope_mismatch" };
+    }
+    if (payload.generation < input.storedGeneration)
+        return { ok: false, reason: "generation_rollback" };
+    // M13 (S4): the kinds a runtime honours are a closed set; one it does not know refuses the whole manifest before a byte is fetched.
+    if (!Array.isArray(payload.directives) || payload.directives.some((directive) => !directive || typeof directive !== "object" || !DIRECTIVE_KINDS.has(directive.kind))) {
+        return { ok: false, reason: "directive_unknown" };
+    }
+    // M14 (S9): a ramp plan, when present, is well-formed — a malformed one is refused whole rather than walked wrongly.
+    if (payload.experiment?.ramp !== undefined) {
+        try {
+            validateRamp(payload.experiment.ramp, payload.experiment.arms.length);
+        }
+        catch (error) {
+            if (isAssignmentError(error) && error.reason === "ramp_invalid")
+                return { ok: false, reason: "ramp_invalid" };
+            throw error;
+        }
+    }
+    if (input.payloads) {
+        for (const [hash, byteLength] of referencedPayloads(payload)) {
+            const bytes = input.payloads.get(hash);
+            if (bytes === undefined)
+                return { ok: false, reason: "payload_missing" };
+            if (bytes.length !== byteLength || sha256Prefixed(bytes) !== hash)
+                return { ok: false, reason: "payload_hash_mismatch" };
+        }
+    }
+    if (payload.requireCountersign || input.requireCountersign) {
+        const digests = new Set([payload.releaseDigest, ...(payload.experiment?.arms ?? []).map((arm) => arm.releaseDigest)]);
+        const role = input.countersignRoot?.signed.roles.targets ?? { keyIds: [], threshold: 1 };
+        const keys = input.countersignRoot?.signed.keys ?? {};
+        for (const digest of digests) {
+            const candidates = (manifest.countersignatures ?? []).filter((c) => c.releaseDigest === digest && role.keyIds.includes(c.keyId) && keys[c.keyId]);
+            if (candidates.length === 0)
+                return { ok: false, reason: "countersign_missing" };
+            if (countValidSignatures(Buffer.from(digest, "utf8"), candidates, role.keyIds, keys) < role.threshold)
+                return { ok: false, reason: "countersign_invalid" };
+        }
+    }
+    return { ok: true, signingKeyId: usable[0].keyId, generation: payload.generation };
+}
+/** The digest input: pins sorted by tag, projected to exactly the covered members (canonical-json.md). */
+export function releaseDigestInput(slots) {
+    return [...slots]
+        .sort((a, b) => (a.tag < b.tag ? -1 : a.tag > b.tag ? 1 : 0))
+        .map((slot) => ({
+        tag: slot.tag,
+        kind: slot.kind,
+        artifactId: slot.artifactId,
+        versionId: slot.versionId,
+        versionOrdinal: slot.versionOrdinal,
+        contentHash: slot.contentHash,
+        byteLength: slot.byteLength,
+        model: slot.model,
+        ...(slot.modelRequired === true ? { modelRequired: true } : {}),
+        ...(Array.isArray(slot.outputChecks) && slot.outputChecks.length > 0 ? { outputChecks: slot.outputChecks } : {}),
+        ...(slot.goldenSet ? { goldenSet: { setId: slot.goldenSet.setId, cases: slot.goldenSet.cases, contentHash: slot.goldenSet.contentHash, byteLength: slot.goldenSet.byteLength, minPassBps: slot.goldenSet.minPassBps } } : {}),
+        variables: slot.variables.map((v) => ({ name: v.name, required: v.required, trust: v.trust })),
+        ...(slot.steps
+            ? { steps: slot.steps.map((s) => ({ stepId: s.stepId, ordinal: s.ordinal, promptArtifactId: s.promptArtifactId, promptVersionId: s.promptVersionId, contentHash: s.contentHash, byteLength: s.byteLength })) }
+            : {}),
+    }));
+}
+export function releaseDigest(slots) {
+    return sha256Prefixed(canonicalBytes(releaseDigestInput(slots)));
+}
+//# sourceMappingURL=trust.js.map

package/dist/esm/protocol/trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust.js","sourceRoot":"","sources":["../../../src/protocol/trust.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,aAAa,CAAC;AAExH,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,eAAe,EAA8L,MAAM,YAAY,CAAC;AAEzO,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3E,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,GAAkB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9H,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAmC;IAC7D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,KAAiB,EAAE,UAA0B;IACrE,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,UAAyD,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAChH,OAAO,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAiB,EAAE,SAAiB,EAAE,SAAwB;IACxF,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,SAAwD,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9G,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAChF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,wBAAwB,CAAC,KAA8F;IACrI,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,sBAAsB;YAC/B,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE;YACvG,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE;SAC1F;QACD,UAAU,EAAE,EAAE;KACf,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAiB,EAAE,UAAgC,EAAE,MAAyB,EAAE,IAAgC;IAC5I,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,SAAS;QAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IAAI,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID,aAAa;AACb,MAAM,UAAU,kBAAkB,CAAC,KAAsE;IACvG,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;IACrC,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC1I,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACpF,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1I,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IAChC,IAAI,oBAAoB,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACzH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAClG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,GAAG,GAAG,CAAC,IAAkB,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE;QAAE,KAAK,MAAM,QAAQ,IAAI,GAAG,CAAC,SAAS;YAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtG,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,GAAuC,EAAE,GAAW;IACvE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,IAAI,CAAC;AACd,CAAC;AAeD,cAAc;AACd,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACvG,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAEhG,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACvI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC7E,MAAM,KAAK,GAAG,oBAAoB,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtG,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACnE,IAAI,KAAK,GAAG,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAEnF,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,KAAK,CAAC,cAAc,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9I,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,gBAAgB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACrG,oIAAoI;IACpI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,GAAG,CAAE,SAAgC,CAAC,IAAc,CAAC,CAAC,EAAE,CAAC;QACxM,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,qHAAqH;IACrH,IAAI,OAAO,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;YAC9G,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC3H,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9H,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,GAAG,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAClJ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YACjF,IAAI,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC7J,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;AACtF,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,OAAO,CAAC,GAAG,KAAK,CAAC;SACd,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACd,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChH,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7N,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC9F,GAAG,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE;YAC9M,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAA8B;IAC1D,OAAO,cAAc,CAAC,cAAc,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/esm/protocol/types.d.ts

@@ -0,0 +1,235 @@
+/**
+ * Wire types for protocol 0.2 — hand-written to match `protocol/schemas/*`.
+ * The conformance vectors, not these types, are what proves agreement; keep
+ * them narrow and let the schema tests catch drift.
+ */
+export type Target = "dev" | "staging" | "prod";
+export type Sha256 = `sha256:${string}`;
+export interface SlotVariable {
+    name: string;
+    required: boolean;
+    trust: "operator" | "end_user";
+}
+export interface SlotStep {
+    stepId: string;
+    ordinal: number;
+    promptArtifactId: string;
+    promptVersionId: string;
+    contentHash: Sha256;
+    byteLength: number;
+}
+/** One declared output check as a pin carries it (checks.md): the kind's own members only. */
+export type OutputCheck = {
+    kind: "json_schema";
+    name: string;
+    schema: Record<string, unknown>;
+} | {
+    kind: "enum";
+    name: string;
+    path: string;
+    values: string[];
+} | {
+    kind: "length";
+    name: string;
+    minTokens?: number;
+    maxTokens?: number;
+} | {
+    kind: "must_match" | "must_not_match";
+    name: string;
+    pattern: string;
+    flags?: "i";
+};
+export interface ManifestSlot {
+    tag: string;
+    kind: "prompt" | "workflow";
+    artifactId: string;
+    versionId: string;
+    versionOrdinal: number | null;
+    contentHash: Sha256;
+    byteLength: number;
+    model: string;
+    /** The model is required: a runtime whose declared catalog lacks it refuses the release (`model_unavailable`). In the digest input only when true. */
+    modelRequired?: boolean;
+    /** T29: the slot's enabled output checks (checks.md), sorted by name; in the digest input only when present. */
+    outputChecks?: OutputCheck[];
+    /** T34: the slot's golden set (golden-sets.md) — a reference to a payload the runtime opens and runs before activation; in the digest input only when present. */
+    goldenSet?: GoldenSetRef;
+    variables: SlotVariable[];
+    steps?: SlotStep[];
+}
+/** T34: what the pin carries — the cases themselves are the payload under `contentHash`. */
+export interface GoldenSetRef {
+    setId: string;
+    cases: number;
+    contentHash: Sha256;
+    byteLength: number;
+    /** Pass-rate floor in basis points; below it a staged release is not activated. */
+    minPassBps: number;
+}
+export interface ExperimentArm {
+    arm: string;
+    weightBps: number;
+    releaseDigest: Sha256;
+    overrides: ManifestSlot[];
+}
+/** S9: one step of the signed ramp plan — from `notBefore` (inclusive, the host's clock) these are the arms' weights, in manifest order. */
+export interface RampStep {
+    notBefore: string;
+    weightBps: number[];
+}
+export interface Experiment {
+    experimentId: string;
+    salt: string;
+    subjectKey: "request" | "instance";
+    arms: ExperimentArm[];
+    /**
+     * S9: the signed ramp plan (assignment-hash.md › The ramp plan). The runtime walks it on its own clock — no check-in
+     * needed: the weights in force are the last step whose `notBefore` has passed, else `arms[].weightBps`. Steps are
+     * strictly increasing and at least an hour apart; each carries one weight per arm summing to 10000.
+     */
+    ramp?: RampStep[];
+}
+export type Directive = {
+    kind: "request_unlock";
+    releaseDigest: Sha256;
+    requestedBy: string;
+    requestedAt: string;
+    expiresAt: string;
+    note?: string;
+} | {
+    kind: "disable";
+    scope: "agent" | "slot" | "arm";
+    tag?: string;
+    arm?: string;
+    issuedAt: string;
+    reason?: string;
+};
+/**
+ * S4: the set of directive kinds a runtime honours is closed. `disable` is the one kind that acts without a
+ * local act (a reduction: it only ever stops serving); `request_unlock` is a request the runtime surfaces and
+ * never grants. A manifest carrying any other kind is refused whole (`directive_unknown`) — never partly obeyed.
+ */
+export declare const DIRECTIVE_KINDS: ReadonlySet<string>;
+/** S4: the apply policy a host holds, as store.json records it. */
+export type ApplyPolicy = "auto" | "unlock_required";
+export interface ManifestPayload {
+    protocol: string;
+    organizationId: string;
+    agentId: string;
+    target: Target;
+    generation: number;
+    releaseDigest: Sha256;
+    previousReleaseDigest?: Sha256;
+    issuedAt: string;
+    leaseSeconds: number;
+    onLeaseExpiry: "degrade" | "halt";
+    applyPolicy: "auto" | "unlock_required";
+    /** T9: the console's update window (advisory; a local `apply.window` wins). Only with `unlock_required`. */
+    unlockWindow?: {
+        timezone: string;
+        start: string;
+        end: string;
+        days?: Array<"mon" | "tue" | "wed" | "thu" | "fri" | "sat" | "sun">;
+    };
+    requireCountersign: boolean;
+    slots: ManifestSlot[];
+    experiment?: Experiment;
+    directives: Directive[];
+}
+export interface Signature {
+    keyId: string;
+    alg: "ES256";
+    sig: string;
+}
+export interface Countersignature extends Signature {
+    releaseDigest: Sha256;
+    signedAt: string;
+}
+export interface Manifest {
+    payload: ManifestPayload;
+    signatures: Signature[];
+    countersignatures?: Countersignature[];
+}
+export interface P256PublicJwk {
+    kty: "EC";
+    crv: "P-256";
+    x: string;
+    y: string;
+}
+export interface P256PrivateJwk extends P256PublicJwk {
+    d: string;
+}
+export interface RootKeyEntry {
+    keyType: "ecdsa-p256";
+    scheme: "ES256";
+    publicKey: P256PublicJwk;
+    notBefore?: string;
+    notAfter?: string;
+}
+export interface RootRole {
+    keyIds: string[];
+    threshold: number;
+}
+export interface RootMetadataSigned {
+    type: "root";
+    protocol: string;
+    purpose: "platform" | "countersign";
+    environment: Target;
+    version: number;
+    expires: string;
+    keys: Record<string, RootKeyEntry>;
+    roles: {
+        root: RootRole;
+        targets: RootRole;
+    };
+}
+export interface RootMetadata {
+    signed: RootMetadataSigned;
+    signatures: Signature[];
+}
+export interface EdgePointer {
+    generation: number;
+    releaseDigest: Sha256;
+    leaseSeconds: number;
+    issuedAt?: string;
+}
+export interface BundleContents {
+    createdAt: string;
+    notAfter: string;
+    manifest: Manifest;
+    keySet: RootMetadata;
+    countersignKeySet?: RootMetadata;
+    payloads: Array<{
+        contentHash: Sha256;
+        byteLength: number;
+        bytes: string;
+    }>;
+}
+export type Bundle = {
+    format: "apbundle";
+    version: 1;
+    protocol: string;
+    encryption: {
+        scheme: "none";
+        contents: BundleContents;
+    };
+} | {
+    format: "apbundle";
+    version: 1;
+    protocol: string;
+    encryption: {
+        scheme: "hpke-x25519-hkdf-sha256-aes-256-gcm";
+        recipientKeyId: string;
+        enc: string;
+        info?: "airprompter-apbundle-v1";
+        ciphertext: string;
+    };
+};
+/** trust-chain.md refusal vocabulary, in verification order. */
+export type RefusalCode = "root_scope_mismatch" | "key_id_mismatch" | "root_rollback" | "root_signature_invalid" | "root_expired" | "protocol_unsupported" | "unknown_signing_key" | "signing_key_expired" | "signature_invalid" | "signature_threshold" | "scope_mismatch" | "generation_rollback" | "payload_missing" | "payload_hash_mismatch" | "countersign_missing" | "countersign_invalid" | "schema_invalid"
+/** S4: a directive of a kind this runtime does not honour — the manifest is refused whole, never partly obeyed. */
+ | "directive_unknown"
+/** S9: the ramp plan is malformed (order, spacing, a weight per arm, sums) — refused whole before a byte is fetched. */
+ | "ramp_invalid"
+/** The chain verified; a slot's required model is not in this runtime's declared catalog (T15). */
+ | "model_unavailable";

package/dist/esm/protocol/types.js

@@ -0,0 +1,12 @@
+/**
+ * Wire types for protocol 0.2 — hand-written to match `protocol/schemas/*`.
+ * The conformance vectors, not these types, are what proves agreement; keep
+ * them narrow and let the schema tests catch drift.
+ */
+/**
+ * S4: the set of directive kinds a runtime honours is closed. `disable` is the one kind that acts without a
+ * local act (a reduction: it only ever stops serving); `request_unlock` is a request the runtime surfaces and
+ * never grants. A manifest carrying any other kind is refused whole (`directive_unknown`) — never partly obeyed.
+ */
+export const DIRECTIVE_KINDS = new Set(["request_unlock", "disable"]);
+//# sourceMappingURL=types.js.map

package/dist/esm/protocol/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/protocol/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsFH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAoB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC"}

package/dist/esm/protocol/version.d.ts

@@ -0,0 +1,4 @@
+/** The protocol this SDK speaks (`protocol/VERSION`); the manifest carries it and the heartbeat reports it. */
+export declare const PROTOCOL_VERSION = "0.2.5";
+/** This package's own version, as the heartbeat and store.json (S8: the writer) record it. */
+export declare const SDK_VERSION = "0.1.0";

package/dist/esm/protocol/version.js

@@ -0,0 +1,5 @@
+/** The protocol this SDK speaks (`protocol/VERSION`); the manifest carries it and the heartbeat reports it. */
+export const PROTOCOL_VERSION = "0.2.5";
+/** This package's own version, as the heartbeat and store.json (S8: the writer) record it. */
+export const SDK_VERSION = "0.1.0";
+//# sourceMappingURL=version.js.map

package/dist/esm/protocol/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../../src/protocol/version.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC"}

package/dist/esm/release/bundleRelease.d.ts

@@ -0,0 +1,45 @@
+/**
+ * A bundle the customer loads, as a `ReleaseReader` (S10): `agent-runtime`
+ * on its own — no store, no daemon, no network — renders and assigns over
+ * it. The same chain as OTA runs before a byte is served: the bundle's key
+ * set must descend from the pinned root (or be it), and the manifest's
+ * signatures, scope, expiry and every payload hash must verify. There is
+ * no anti-rollback here because there is no stored generation; that is the
+ * slot store's rule (`agent-sync`).
+ */
+import { type DistributionKey } from "../bundle/apbundle.js";
+import type { Bundle, RefusalCode, RootMetadata, Target } from "../protocol/types.js";
+import type { LoadedRelease, ReleaseReader } from "./reader.js";
+export interface BundleReleaseInput {
+    bundle: Bundle;
+    /** The pinned root of trust (`trustedRootFromPinnedKey`, or root metadata the host already holds). */
+    root: RootMetadata;
+    scope: {
+        organizationId: string;
+        agentId: string;
+        target: Target;
+    };
+    now: string;
+    distributionKey?: DistributionKey;
+    countersignRoot?: RootMetadata | null;
+    requireCountersign?: boolean;
+}
+/** A bundle refused before it became a release: the bundle itself (`bundle_*`), or the chain (a `RefusalCode`). */
+export type BundleReleaseRefusal = RefusalCode | "bundle_malformed" | "bundle_wrong_recipient" | "bundle_decrypt_failed" | "bundle_relabelled";
+export declare class BundleRelease implements ReleaseReader {
+    private readonly release;
+    /** The key set the bundle carried, once it verified against the pinned root: what a host pins next. */
+    readonly keySet: RootMetadata;
+    readonly notAfter: string;
+    readonly kind: "bundle";
+    private constructor();
+    /** Open, verify, and hold: `{ ok: false, reason }` names the first rule the bundle failed. */
+    static load(input: BundleReleaseInput): {
+        ok: true;
+        release: BundleRelease;
+    } | {
+        ok: false;
+        reason: BundleReleaseRefusal;
+    };
+    current(): LoadedRelease;
+}

package/dist/esm/release/bundleRelease.js

@@ -0,0 +1,57 @@
+/**
+ * A bundle the customer loads, as a `ReleaseReader` (S10): `agent-runtime`
+ * on its own — no store, no daemon, no network — renders and assigns over
+ * it. The same chain as OTA runs before a byte is served: the bundle's key
+ * set must descend from the pinned root (or be it), and the manifest's
+ * signatures, scope, expiry and every payload hash must verify. There is
+ * no anti-rollback here because there is no stored generation; that is the
+ * slot store's rule (`agent-sync`).
+ */
+import { bundlePayloadBytes, openBundle } from "../bundle/apbundle.js";
+import { verifyManifest, verifyRootMetadata } from "../protocol/trust.js";
+export class BundleRelease {
+    release;
+    keySet;
+    notAfter;
+    kind = "bundle";
+    constructor(release, 
+    /** The key set the bundle carried, once it verified against the pinned root: what a host pins next. */
+    keySet, notAfter) {
+        this.release = release;
+        this.keySet = keySet;
+        this.notAfter = notAfter;
+    }
+    /** Open, verify, and hold: `{ ok: false, reason }` names the first rule the bundle failed. */
+    static load(input) {
+        let contents;
+        try {
+            contents = openBundle(input.bundle, { agentId: input.scope.agentId, target: input.scope.target }, input.distributionKey);
+        }
+        catch (error) {
+            const code = error.name === "BundleError" ? error.code : "malformed";
+            return { ok: false, reason: `bundle_${code}` };
+        }
+        let root = input.root;
+        const rootVerdict = verifyRootMetadata({ candidate: contents.keySet, trusted: root, now: input.now });
+        if (rootVerdict.ok)
+            root = contents.keySet;
+        const payloads = bundlePayloadBytes(contents);
+        const verdict = verifyManifest({
+            manifest: contents.manifest,
+            root,
+            now: input.now,
+            scope: input.scope,
+            storedGeneration: 0,
+            payloads,
+            countersignRoot: input.countersignRoot ?? null,
+            ...(input.requireCountersign !== undefined ? { requireCountersign: input.requireCountersign } : {}),
+        });
+        if (!verdict.ok)
+            return { ok: false, reason: verdict.reason };
+        return { ok: true, release: new BundleRelease({ manifest: contents.manifest, generation: verdict.generation, payloads }, root, contents.notAfter) };
+    }
+    current() {
+        return this.release;
+    }
+}
+//# sourceMappingURL=bundleRelease.js.map