@common-agent/reputations 0.0.0-stage → 0.1.0

package/dist/score.js

@@ -0,0 +1,129 @@
+/**
+ * fdbk-score-1 — the published scoring formula of the Agent Reputations
+ * specification (§5, §7), the arithmetic of the Agent Reputations core. Pure arithmetic over an event pool: no I/O, no
+ * randomness, no iteration. Anyone holding the events computes the same
+ * numbers, which is the whole point — a score that cannot be recomputed is
+ * an opinion with a haircut.
+ *
+ * The constants are formula constants, not tunables: changing any of them is
+ * a new formula version (fdbk-score-2), never a quiet edit to this one.
+ */
+/** Quality value per outcome code (spec §5). DECLINED and UNREACHABLE carry
+ *  no quality value: declining feeds candor, unreachability feeds facts.
+ *
+ *  VALUE_OK and VALUE_POOR answer a DIFFERENT question — was the spend worth
+ *  it, on engagements where nothing was named that either party could accept
+ *  (§6.6) — and enter the pool at the reduced weight of §7.6. They carry the
+ *  same 1.0/0.0 values as acceptance and rejection; what separates them is
+ *  the weight, not the value. */
+export const OUTCOME_VALUES = {
+    OK: 1.0,
+    OK_CORRECTED: 0.6,
+    FAILED: 0.15,
+    FAILED_SILENT: 0.0,
+    CONTRACT: 0.0,
+    VALUE_OK: 1.0,
+    VALUE_POOR: 0.0,
+};
+/** The two value-judgment codes (§6.6), by name. A value judgment MUST NOT be
+ *  recorded through the acceptance path, and an acceptance MUST NOT be
+ *  recorded through this one; the doors check against this set. */
+export const VALUE_OUTCOMES = new Set(["VALUE_OK", "VALUE_POOR"]);
+/** Outcomes excluded from the quality pool but still counted elsewhere. */
+export const UNSCORED_OUTCOMES = new Set(["DECLINED", "UNREACHABLE"]);
+export const FORMULA_VERSION = "fdbk-score-1";
+export const HALF_LIFE_DAYS = 60;
+/** Below this effective sample size a capability is UNPROVEN (§7.4). */
+export const UNPROVEN_THRESHOLD = 20;
+/**
+ * §7.6: a value judgment's decay weight is multiplied by this.
+ *
+ * A formula constant of fdbk-score-1, alongside H and the UNPROVEN threshold,
+ * not a tunable. With no artifact to point at, a judgment about whether money
+ * was well spent is more subjective and more disputable than a judgment about
+ * work that was named and delivered, and the honest way to price that is one
+ * number a reader can see and argue with. The spec forbids setting it above
+ * 1.0 and advises against above 0.5; 0.5 is the published default and what
+ * this bureau uses.
+ */
+export const K_VALUE = 0.5;
+/** z for the ~10th percentile lower confidence bound (§7.3). */
+const Z = 1.2816;
+/** Exponential decay weight (§7.2): w = 2^(-age_days / H). Future-dated
+ *  events get weight 1 rather than >1 — clock skew is not extra credit. */
+export function decayWeight(atIso, nowMs, halfLifeDays = HALF_LIFE_DAYS) {
+    const ageMs = nowMs - Date.parse(atIso);
+    if (!Number.isFinite(ageMs) || ageMs <= 0)
+        return 1;
+    return Math.pow(2, -(ageMs / 86_400_000) / halfLifeDays);
+}
+/** The weight one event contributes: the §7.2 decay, times §7.6's K_value
+ *  when the event is a value judgment. Because the multiplier lands on w_i it
+ *  reduces the event's effect on mean, sd, lcb and n_eff together — which is
+ *  the correct reading of thinner evidence, and why §7.6 needs no other
+ *  change to §7.3. */
+export function eventWeight(e, nowMs, halfLifeDays = HALF_LIFE_DAYS) {
+    const w = decayWeight(e.at, nowMs, halfLifeDays);
+    return e.value_judgment ? K_VALUE * w : w;
+}
+export const UNIFORM_PRIOR = { a0: 1, b0: 1 };
+/** §7.5: a portfolio prior's weight, a0 + b0 − 2, MUST NOT exceed this. A formula constant. */
+export const MAX_PRIOR_WEIGHT = 10;
+/** Throws when a prior is not one §7.5 allows: both terms positive and finite, its weight from 0 to 10. */
+export function checkPrior(prior) {
+    const { a0, b0 } = prior;
+    if (!Number.isFinite(a0) || !Number.isFinite(b0) || a0 <= 0 || b0 <= 0)
+        throw new Error("a prior's a0 and b0 are positive numbers");
+    const weight = a0 + b0 - 2;
+    if (weight < 0 || weight > MAX_PRIOR_WEIGHT + 1e-12) {
+        throw new Error(`a prior's weight, a0 + b0 - 2, is from 0 to ${MAX_PRIOR_WEIGHT} (§7.5); this one is ${weight}`);
+    }
+}
+/**
+ * A portfolio prior from the anchor's other agents RATED for the same
+ * capability (§7.5), as their mean quality spread over `weight` effective
+ * events: a0 = 1 + weight · m, b0 = 1 + weight · (1 − m). The uniform prior
+ * when there are none. The caller chooses which agents count; §7.5 says only
+ * the anchor's own members RATED for this capability may.
+ */
+export function portfolioPrior(ratedMeans, weight = MAX_PRIOR_WEIGHT) {
+    const means = ratedMeans.filter((m) => Number.isFinite(m) && m >= 0 && m <= 1);
+    if (!means.length)
+        return UNIFORM_PRIOR;
+    const w = Math.min(Math.max(weight, 0), MAX_PRIOR_WEIGHT);
+    const m = means.reduce((x, y) => x + y, 0) / means.length;
+    return { a0: 1 + w * m, b0: 1 + w * (1 - m) };
+}
+/**
+ * The Beta posterior summary of §7.3 over weighted values, with the prior of
+ * §7.5. n_eff counts direct evidence only: a + b less the two prior terms, so
+ * a portfolio prior moves the mean and the bound and never makes a capability
+ * RATED (§7.4).
+ */
+export function scoreWeighted(entries, prior = UNIFORM_PRIOR) {
+    checkPrior(prior);
+    let sumWV = 0;
+    let sumW = 0;
+    let valueW = 0;
+    for (const e of entries) {
+        sumWV += e.w * e.v;
+        sumW += e.w;
+        if (e.value_judgment)
+            valueW += e.w;
+    }
+    const a = prior.a0 + sumWV;
+    const b = prior.b0 + (sumW - sumWV);
+    const mean = a / (a + b);
+    const sd = Math.sqrt((a * b) / ((a + b) * (a + b) * (a + b + 1)));
+    const lcb = Math.max(0, mean - Z * sd);
+    const n_eff = a + b - (prior.a0 + prior.b0);
+    return {
+        a, b, mean, sd, lcb, n_eff,
+        unproven: n_eff < UNPROVEN_THRESHOLD,
+        value_judgment_share: sumW > 0 ? valueW / sumW : 0,
+    };
+}
+/** The Beta posterior summary of §7.3, exactly as published, over scored events, with an optional prior (§7.5). */
+export function scorePool(events, nowMs, prior = UNIFORM_PRIOR) {
+    return scoreWeighted(events.map((e) => ({ v: e.value, w: eventWeight(e, nowMs), value_judgment: e.value_judgment })), prior);
+}

package/dist/signing.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Signing and verifying a report (Agent Reputations §8.1.1 to §8.1.3).
+ *
+ * The signed bytes are the tag (`fdbk-report-v1`, or `fdbk-org-report-v1`
+ * for an organization report), one line feed, and the JCS (RFC 8785)
+ * canonical JSON of the signed object. The signature is Ed25519 over those
+ * bytes, and it travels beside the object in an envelope with the key and the
+ * key's id, all in padded base64. A consumer checks the key against the key
+ * set it pinned for the bureau it asked, never against the envelope's word.
+ *
+ * Reports this bureau signed before 0.6.0 carry the same signed bytes (the
+ * same tag and line feed, over canonical JSON that matches JCS for every value
+ * a report holds) in an older envelope: the key as an nkey (`U…`), no key id,
+ * and the signature in base64url. verifyReport reads both, and both are held
+ * to the pinned key set, so the older envelope never brings its own trust.
+ *
+ * Pure: the shared crypto core (../crypto/), over node:crypto, and nothing else.
+ */
+import { jcs } from "@common-agent/crypto";
+export declare const REPORT_TAG = "fdbk-report-v1";
+export declare const ORG_REPORT_TAG = "fdbk-org-report-v1";
+/** The `use` every report signing key carries in a key set (§8.1.2 rule 4). */
+export declare const REPORT_KEY_USE = "fdbk-report-signing";
+/** The clock-skew grace §8.1.3 step 5 recommends at most. */
+export declare const CLOCK_GRACE_SECONDS = 60;
+/** One entry of a bureau's key set (§8.1.2). */
+export interface KeySetEntry {
+    kid: string;
+    key: string;
+    status: "current" | "retired" | (string & {});
+    use: string;
+}
+/** A bureau's key set, as `GET <bureau>/api/bureau-key` serves it (§8.1.2). */
+export interface KeySet {
+    bureau: string;
+    keys: string[];
+    key_set: KeySetEntry[];
+}
+/** What signs a report: the key it signs with, in padded base64, and Ed25519 over bytes. */
+export interface ReportSigner {
+    key: string;
+    sign(bytes: Uint8Array): Uint8Array;
+}
+/**
+ * The JCS canonical JSON of a value, from the shared crypto core: members
+ * sorted by the UTF-16 code units of their names, and a value JCS has no form
+ * for refused with a CanonicalJSONError: a number that is not finite, a
+ * string or member name with a lone surrogate (JCS requires I-JSON), an
+ * undefined member, and anything that is not plain JSON.
+ */
+export { jcs };
+/** The bytes a report's signature covers: the tag, one line feed, and the JCS of the signed object (§8.1.1). */
+export declare function signedBytes(tag: string, object: unknown): Uint8Array;
+/** A key's id: the first 12 lowercase hex digits of the SHA-256 of its base64 text (§8.1.2 rule 1). */
+export declare function kidOf(key: string): string;
+/** A key set for a bureau, in the order given within each status, current keys first (§8.1.2 rule 2). */
+export declare function keySetFor(bureau: string, keys: ReadonlyArray<{
+    key: string;
+    status: "current" | "retired";
+}>): KeySet;
+/**
+ * The 32-byte Ed25519 public key inside an nkey public user key (`U…`), the
+ * form the bureau's reports carried before 0.6.0. Throws on anything else,
+ * including a checksum that does not match.
+ */
+export declare function rawKeyFromNkey(nkey: string): Uint8Array;
+/** A raw 32-byte Ed25519 public key in the padded base64 a key set and an envelope carry. */
+export declare function keyFromRaw(raw: Uint8Array): string;
+/** A signer from a 32-byte Ed25519 seed (RFC 8032 §5.1.5). The test vectors use one; a bureau may use its own. */
+export declare function seedSigner(seed: Uint8Array): ReportSigner;
+/** A signed report, or a signed organization report, in the envelope of §8.1. */
+export type ReportEnvelope<M extends string = "report"> = {
+    [K in M]: Record<string, unknown>;
+} & {
+    bureau_key: string;
+    bureau_kid: string;
+    bureau_sig: string;
+};
+/**
+ * The first number in a value that a signed object may not hold (§8.1.1): an
+ * integer whose magnitude is above 2^53, which JCS writes but not exactly. A
+ * count that large is written as a string. Null when there is none.
+ */
+export declare function inexactInteger(value: unknown, path?: string): string | null;
+/** Sign a report object and put it in its envelope (§8.1.1). Refuses an object holding an integer above 2^53. */
+export declare function signReport<M extends string = "report">(object: Record<string, unknown>, signer: ReportSigner, opts?: {
+    tag?: string;
+    member?: M;
+}): ReportEnvelope<M>;
+export type VerifyResult = {
+    ok: true;
+    format: "0.6.0" | "pre-0.6.0";
+    kid: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * What the consumer asked about, which the report must answer (§8.1.3 step 6).
+ * A report answers about a subject and a capability; `capability: null` means
+ * the consumer asked about none in particular, which only a report from before
+ * 0.6.0 can answer, because those carry every capability in one list. An
+ * organization report answers about an anchor.
+ */
+export type ExpectedAnswer = {
+    subject: string;
+    capability: string | null;
+} | {
+    anchor: string;
+};
+export interface VerifyOptions {
+    /** The pinned key set for the bureau the consumer asked (§8.1.2). */
+    keySet: KeySet;
+    /** The URL of the bureau the consumer asked (§8.1.3 step 2). */
+    bureau: string;
+    /** The verification instant. Anything that is not a time fails verification. */
+    now: number | string | Date;
+    /** What the consumer asked about (§8.1.3 step 6). */
+    expect: ExpectedAnswer;
+    tag?: string;
+    member?: string;
+    graceSeconds?: number;
+}
+/**
+ * The steps of §8.1.3 that need no network, in order, stopping at the first
+ * that fails: the envelope, the bureau, the key against the pinned set, the
+ * signature, the time window, and the answer. The reasons are the conformance
+ * file's words where it has them.
+ *
+ * An envelope from before 0.6.0 (an nkey `bureau_key`, no `bureau_kid`, a
+ * base64url signature) is read too. Its key must still be in the pinned set,
+ * as the same 32 bytes, so it is trusted no further than a 0.6.0 envelope.
+ *
+ * This takes a parsed envelope, so it cannot see a member name repeated in
+ * the text; a consumer holding the text calls verifyReportText instead.
+ */
+export declare function verifyReport(envelope: unknown, opts: VerifyOptions): VerifyResult;
+/**
+ * §8.1.3 from the text a consumer received: the text must be one JSON value
+ * with no member name repeated in any object (§8.1.1), and then the envelope
+ * it holds must verify.
+ */
+export declare function verifyReportText(text: string, opts: VerifyOptions): VerifyResult;
+/**
+ * The first member name that repeats inside one object of a JSON text, or
+ * null. JSON.parse keeps the last of two members with one name, so a consumer
+ * that must reject a report with a repeated member (§8.1.1, §8.1.3 step 1)
+ * checks the text it received before parsing it.
+ */
+export declare function repeatedMember(text: string): string | null;

package/dist/signing.js

@@ -0,0 +1,299 @@
+/**
+ * Signing and verifying a report (Agent Reputations §8.1.1 to §8.1.3).
+ *
+ * The signed bytes are the tag (`fdbk-report-v1`, or `fdbk-org-report-v1`
+ * for an organization report), one line feed, and the JCS (RFC 8785)
+ * canonical JSON of the signed object. The signature is Ed25519 over those
+ * bytes, and it travels beside the object in an envelope with the key and the
+ * key's id, all in padded base64. A consumer checks the key against the key
+ * set it pinned for the bureau it asked, never against the envelope's word.
+ *
+ * Reports this bureau signed before 0.6.0 carry the same signed bytes (the
+ * same tag and line feed, over canonical JSON that matches JCS for every value
+ * a report holds) in an older envelope: the key as an nkey (`U…`), no key id,
+ * and the signature in base64url. verifyReport reads both, and both are held
+ * to the pinned key set, so the older envelope never brings its own trust.
+ *
+ * Pure: the shared crypto core (../crypto/), over node:crypto, and nothing else.
+ */
+import { decodeSignature, encodeSignature, jcs, rawFromBase64Key, rawUserKey, sha256Digest, signerFromRawSeed, toBase64, verifyRaw } from "@common-agent/crypto";
+export const REPORT_TAG = "fdbk-report-v1";
+export const ORG_REPORT_TAG = "fdbk-org-report-v1";
+/** The `use` every report signing key carries in a key set (§8.1.2 rule 4). */
+export const REPORT_KEY_USE = "fdbk-report-signing";
+/** The clock-skew grace §8.1.3 step 5 recommends at most. */
+export const CLOCK_GRACE_SECONDS = 60;
+// ── JCS (RFC 8785) ───────────────────────────────────────────────────────────
+const MAX_EXACT_INTEGER = 2 ** 53;
+/**
+ * The JCS canonical JSON of a value, from the shared crypto core: members
+ * sorted by the UTF-16 code units of their names, and a value JCS has no form
+ * for refused with a CanonicalJSONError: a number that is not finite, a
+ * string or member name with a lone surrogate (JCS requires I-JSON), an
+ * undefined member, and anything that is not plain JSON.
+ */
+export { jcs };
+/** The bytes a report's signature covers: the tag, one line feed, and the JCS of the signed object (§8.1.1). */
+export function signedBytes(tag, object) {
+    return new TextEncoder().encode(`${tag}\n${jcs(object)}`);
+}
+// ── keys ─────────────────────────────────────────────────────────────────────
+/** A key's id: the first 12 lowercase hex digits of the SHA-256 of its base64 text (§8.1.2 rule 1). */
+export function kidOf(key) {
+    return sha256Digest(key).slice("sha256:".length, "sha256:".length + 12);
+}
+/** A key set for a bureau, in the order given within each status, current keys first (§8.1.2 rule 2). */
+export function keySetFor(bureau, keys) {
+    const ordered = [...keys.filter((k) => k.status === "current"), ...keys.filter((k) => k.status !== "current")];
+    return {
+        bureau,
+        keys: ordered.map((k) => k.key),
+        key_set: ordered.map((k) => ({ kid: kidOf(k.key), key: k.key, status: k.status, use: REPORT_KEY_USE })),
+    };
+}
+/**
+ * The 32-byte Ed25519 public key inside an nkey public user key (`U…`), the
+ * form the bureau's reports carried before 0.6.0. Throws on anything else,
+ * including a checksum that does not match.
+ */
+export function rawKeyFromNkey(nkey) {
+    const raw = rawUserKey(nkey);
+    if (!raw)
+        throw new Error("not an nkey public user key, or its checksum does not match");
+    return raw;
+}
+/** A raw 32-byte Ed25519 public key in the padded base64 a key set and an envelope carry. */
+export function keyFromRaw(raw) {
+    return toBase64(raw);
+}
+/** A signer from a 32-byte Ed25519 seed (RFC 8032 §5.1.5). The test vectors use one; a bureau may use its own. */
+export function seedSigner(seed) {
+    const s = signerFromRawSeed(new Uint8Array(seed));
+    return { key: keyFromRaw(s.raw), sign: s.sign };
+}
+/**
+ * The first number in a value that a signed object may not hold (§8.1.1): an
+ * integer whose magnitude is above 2^53, which JCS writes but not exactly. A
+ * count that large is written as a string. Null when there is none.
+ */
+export function inexactInteger(value, path = "$") {
+    if (typeof value === "number")
+        return Number.isInteger(value) && Math.abs(value) > MAX_EXACT_INTEGER ? path : null;
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            const found = inexactInteger(value[i], `${path}[${i}]`);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    if (value !== null && typeof value === "object") {
+        for (const [k, v] of Object.entries(value)) {
+            const found = inexactInteger(v, `${path}.${k}`);
+            if (found)
+                return found;
+        }
+    }
+    return null;
+}
+/** Sign a report object and put it in its envelope (§8.1.1). Refuses an object holding an integer above 2^53. */
+export function signReport(object, signer, opts = {}) {
+    const tag = opts.tag ?? REPORT_TAG;
+    const member = (opts.member ?? "report");
+    const inexact = inexactInteger(object);
+    if (inexact)
+        throw new Error(`the integer at ${inexact} is above 2^53; a signed object writes it as a string (§8.1.1)`);
+    const sig = signer.sign(signedBytes(tag, object));
+    return {
+        [member]: object,
+        bureau_key: signer.key,
+        bureau_kid: kidOf(signer.key),
+        bureau_sig: encodeSignature(sig),
+    };
+}
+const fail = (reason) => ({ ok: false, reason });
+const trimUrl = (u) => u.replace(/\/+$/, "");
+/**
+ * The steps of §8.1.3 that need no network, in order, stopping at the first
+ * that fails: the envelope, the bureau, the key against the pinned set, the
+ * signature, the time window, and the answer. The reasons are the conformance
+ * file's words where it has them.
+ *
+ * An envelope from before 0.6.0 (an nkey `bureau_key`, no `bureau_kid`, a
+ * base64url signature) is read too. Its key must still be in the pinned set,
+ * as the same 32 bytes, so it is trusted no further than a 0.6.0 envelope.
+ *
+ * This takes a parsed envelope, so it cannot see a member name repeated in
+ * the text; a consumer holding the text calls verifyReportText instead.
+ */
+export function verifyReport(envelope, opts) {
+    const tag = opts.tag ?? REPORT_TAG;
+    const member = opts.member ?? "report";
+    // 1. The envelope.
+    if (envelope === null || typeof envelope !== "object" || Array.isArray(envelope))
+        return fail("the envelope is not an object");
+    const env = envelope;
+    const obj = env[member];
+    if (obj === null || typeof obj !== "object" || Array.isArray(obj))
+        return fail(`the envelope has no ${member}`);
+    for (const k of ["bureau_key", "bureau_sig"])
+        if (typeof env[k] !== "string" || !env[k])
+            return fail(`the envelope has no ${k}`);
+    const legacy = !("bureau_kid" in env) && /^U[A-Z2-7]{55}$/.test(env.bureau_key);
+    if (!legacy && (typeof env.bureau_kid !== "string" || !env.bureau_kid))
+        return fail("the envelope has no bureau_kid");
+    const allowed = new Set([member, "bureau_key", "bureau_sig", ...(legacy ? [] : ["bureau_kid"])]);
+    const extra = Object.keys(env).find((k) => !allowed.has(k));
+    if (extra !== undefined)
+        return fail(`the envelope holds a member it may not: ${extra}`);
+    const report = obj;
+    // 2. The bureau, and a key set pinned for that same bureau.
+    if (report.bureau !== opts.bureau)
+        return fail("the report names another bureau");
+    if (typeof opts.keySet?.bureau !== "string" || trimUrl(opts.keySet.bureau) !== trimUrl(opts.bureau)) {
+        return fail("the key set is for another bureau");
+    }
+    // 3. The key.
+    let entry;
+    if (legacy) {
+        let key;
+        try {
+            key = keyFromRaw(rawKeyFromNkey(env.bureau_key));
+        }
+        catch {
+            return fail("the key is not in the pinned key set");
+        }
+        entry = opts.keySet.key_set.find((k) => k.key === key);
+    }
+    else {
+        entry = opts.keySet.key_set.find((k) => k.kid === env.bureau_kid);
+        if (entry && entry.key !== env.bureau_key)
+            entry = undefined;
+    }
+    if (!entry || entry.use !== REPORT_KEY_USE || (entry.status !== "current" && entry.status !== "retired")) {
+        return fail("the key is not in the pinned key set");
+    }
+    // 4. The signature, over the JCS of the object as parsed.
+    let bytes;
+    try {
+        bytes = signedBytes(tag, report);
+    }
+    catch {
+        return fail("the report holds a value JCS cannot write");
+    }
+    const sig = decodeSignature(env.bureau_sig, legacy ? "base64url" : "base64");
+    if (!sig)
+        return fail("the signature is not encoded as the envelope requires");
+    if (!verifyRaw(rawFromBase64Key(entry.key), bytes, sig))
+        return fail("the signature does not verify");
+    // 5. The time.
+    const now = opts.now instanceof Date ? opts.now.getTime() : typeof opts.now === "number" ? opts.now : Date.parse(String(opts.now));
+    if (!Number.isFinite(now))
+        return fail("the verification instant is not a time");
+    const graceSeconds = opts.graceSeconds ?? CLOCK_GRACE_SECONDS;
+    if (typeof graceSeconds !== "number" || !Number.isFinite(graceSeconds) || graceSeconds < 0)
+        return fail("the clock grace is not a number of seconds");
+    const grace = graceSeconds * 1000;
+    const expires = Date.parse(String(report.expires_at));
+    const issued = Date.parse(String(report.issued_at));
+    if (!Number.isFinite(expires) || expires + grace < now)
+        return fail("the report has expired");
+    if (!Number.isFinite(issued) || issued - grace > now)
+        return fail("the report was issued in the future");
+    // 6. The answer.
+    const asked = opts.expect;
+    if (!asked || typeof asked !== "object")
+        return fail("the consumer did not say what it asked about");
+    if ("anchor" in asked) {
+        if (typeof asked.anchor !== "string" || report.anchor !== asked.anchor)
+            return fail("the report answers about another anchor");
+    }
+    else {
+        if (typeof asked.subject !== "string" || report.subject !== asked.subject)
+            return fail("the report answers about another subject");
+        if (!answersCapability(report, asked.capability))
+            return fail("the report answers about another capability");
+    }
+    return { ok: true, format: legacy ? "pre-0.6.0" : "0.6.0", kid: entry.kid };
+}
+/**
+ * Whether a report answers about the capability asked. A 0.6.0 report names
+ * one, at the top. A report from before 0.6.0 names none at the top and lists
+ * its capabilities instead: asked about one, every entry must be that one;
+ * asked about none, it answers for all of them, which only that kind can.
+ */
+function answersCapability(report, asked) {
+    if (asked === undefined)
+        return false;
+    if ("capability" in report)
+        return asked !== null && report.capability === asked;
+    if (!Array.isArray(report.capabilities))
+        return false;
+    if (asked === null)
+        return true;
+    return report.capabilities.every((c) => c?.capability === asked);
+}
+/**
+ * §8.1.3 from the text a consumer received: the text must be one JSON value
+ * with no member name repeated in any object (§8.1.1), and then the envelope
+ * it holds must verify.
+ */
+export function verifyReportText(text, opts) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return fail("the envelope is not JSON");
+    }
+    const repeated = repeatedMember(text);
+    if (repeated !== null)
+        return fail(`the envelope repeats the member ${repeated}`);
+    return verifyReport(parsed, opts);
+}
+/**
+ * The first member name that repeats inside one object of a JSON text, or
+ * null. JSON.parse keeps the last of two members with one name, so a consumer
+ * that must reject a report with a repeated member (§8.1.1, §8.1.3 step 1)
+ * checks the text it received before parsing it.
+ */
+export function repeatedMember(text) {
+    const stack = [];
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (c === "{")
+            stack.push({ keys: new Set(), expectKey: true });
+        else if (c === "[")
+            stack.push({ keys: null, expectKey: false });
+        else if (c === "}" || c === "]")
+            stack.pop();
+        else if (c === "," || c === ":") {
+            const top = stack[stack.length - 1];
+            if (top?.keys)
+                top.expectKey = c === ",";
+        }
+        else if (c === '"') {
+            let j = i + 1;
+            while (j < text.length && text[j] !== '"')
+                j += text[j] === "\\" ? 2 : 1;
+            const top = stack[stack.length - 1];
+            if (top?.keys && top.expectKey) {
+                // A name that is not valid JSON is compared as written; the caller's
+                // parse refuses the text anyway, and this never throws.
+                let name;
+                try {
+                    name = JSON.parse(text.slice(i, j + 1));
+                }
+                catch {
+                    name = text.slice(i, j + 1);
+                }
+                if (top.keys.has(name))
+                    return name;
+                top.keys.add(name);
+                top.expectKey = false;
+            }
+            i = j;
+        }
+    }
+    return null;
+}

package/package.json

@@ -1,6 +1,55 @@
 {
   "name": "@common-agent/reputations",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Reference implementation of Agent Reputations: the scoring formula, the pool, signed reports and their verification, the heads commitment, and NDA breach claims.",
+  "keywords": [
+    "common-agent",
+    "agent-reputations",
+    "reputation",
+    "scoring"
+  ],
+  "homepage": "https://agentreputations.com",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/CommonAgent/common-agent-ts.git",
+    "directory": "packages/reputations"
+  },
+  "bugs": {
+    "url": "https://github.com/CommonAgent/common-agent-ts/issues"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./ports": {
+      "types": "./dist/ports.d.ts",
+      "default": "./dist/ports.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE",
+    "LICENSE-UNICODE"
+  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=20.10"
+  },
+  "dependencies": {
+    "@common-agent/crypto": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}