@emilia-protocol/gate 0.11.0 → 0.13.0

package/dist/remedy-program-postgres.js

@@ -0,0 +1,291 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Durable, tenant-aware PostgreSQL CAS store for the Remedy Program kernel.
+ *
+ * Tables are never addressed directly. Each operation calls one service-role
+ * RPC on one pinned pg client inside an explicit transaction. Logical refusals
+ * have stable reasons; malformed rows, connection failures, and uncertain
+ * commit outcomes throw so callers cannot mistake ambiguity for success.
+ */
+import { createHash } from 'node:crypto';
+import { canonicalize } from '../execution-binding.js';
+export const REMEDY_PROGRAM_PG_STORE_VERSION = 'EP-GATE-REMEDY-PROGRAM-PG-STORE-v1';
+export const REMEDY_PROGRAM_MAX_STATE_BYTES = 4 * 1024 * 1024;
+export const REMEDY_PROGRAM_MAX_FORWARD_SKEW_MINUTES = 5;
+const INSTANCE_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+const STRICT_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/;
+const ENVELOPE_KEYS = new Set([
+    'ok', 'reason', 'tenant_id', 'instance_id', 'revision',
+    'state_json', 'state_digest', 'recorded_at',
+]);
+export const REMEDY_PROGRAM_POSTGRES_SQL = Object.freeze({
+    create: `SELECT ok, reason, tenant_id, instance_id, revision, state_json, state_digest, recorded_at
+FROM remedy_program_private.remedy_program_create(
+  $1::text, $2::text, $3::text, $4::text, $5::text
+)`,
+    get: `SELECT ok, reason, tenant_id, instance_id, revision, state_json, state_digest, recorded_at
+FROM remedy_program_private.remedy_program_get($1::text, $2::text)`,
+    compareAndSwap: `SELECT ok, reason, tenant_id, instance_id, revision, state_json, state_digest, recorded_at
+FROM remedy_program_private.remedy_program_compare_and_swap(
+  $1::text, $2::text, $3::bigint, $4::bigint, $5::text, $6::text, $7::text
+)`,
+});
+function isRecord(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function exactKeys(value, expected) {
+    const keys = Reflect.ownKeys(value);
+    return keys.length === expected.size
+        && keys.every((key) => typeof key === 'string' && expected.has(key));
+}
+function fail(reason) {
+    return { ok: false, reason };
+}
+function assertTenantId(value) {
+    if (typeof value !== 'string'
+        || Buffer.byteLength(value, 'utf8') < 1
+        || Buffer.byteLength(value, 'utf8') > 512
+        || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new TypeError('remedy-program tenantId is invalid');
+    }
+}
+function assertInstanceId(value) {
+    if (typeof value !== 'string' || !INSTANCE_ID.test(value)) {
+        throw new TypeError('remedy-program instanceId is invalid');
+    }
+}
+function assertRevision(value, label) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new TypeError(`remedy-program ${label} revision is invalid`);
+    }
+}
+function stateDigest(stateJson) {
+    return `sha256:${createHash('sha256').update(stateJson, 'utf8').digest('hex')}`;
+}
+function stateEventAt(state) {
+    const value = state.updated_at;
+    if (typeof value !== 'string'
+        || !STRICT_INSTANT.test(value)
+        || !Number.isFinite(Date.parse(value))) {
+        throw new TypeError('remedy-program state updated_at is invalid');
+    }
+    return value;
+}
+function encodeState(state, tenantId, instanceId, revision) {
+    if (!isRecord(state)
+        || state.tenant_id !== tenantId
+        || state.instance_id !== instanceId
+        || state.revision !== revision) {
+        throw new TypeError('remedy-program state binding does not match the store operation');
+    }
+    let stateJson;
+    try {
+        stateJson = canonicalize(state);
+    }
+    catch {
+        throw new TypeError('remedy-program state must be canonical JSON');
+    }
+    if (Buffer.byteLength(stateJson, 'utf8') > REMEDY_PROGRAM_MAX_STATE_BYTES) {
+        throw new TypeError('remedy-program state exceeds the durable store limit');
+    }
+    return {
+        stateJson,
+        stateDigest: stateDigest(stateJson),
+        eventAt: stateEventAt(state),
+    };
+}
+function safeRevision(value) {
+    const revision = typeof value === 'string' && /^(?:0|[1-9]\d*)$/.test(value)
+        ? Number(value)
+        : value;
+    if (!Number.isSafeInteger(revision) || revision < 0) {
+        throw new Error('remedy-program Postgres returned an invalid revision');
+    }
+    return revision;
+}
+function assertRecordedAt(value) {
+    if (typeof value !== 'string'
+        || !STRICT_INSTANT.test(value)
+        || !Number.isFinite(Date.parse(value))) {
+        throw new Error('remedy-program Postgres returned an invalid recorded_at');
+    }
+}
+function decodeState(row, expectedTenantId, expectedInstanceId, expectedRevision) {
+    if (row.tenant_id !== expectedTenantId
+        || row.instance_id !== expectedInstanceId
+        || typeof row.state_json !== 'string'
+        || typeof row.state_digest !== 'string'
+        || !DIGEST.test(row.state_digest)
+        || Buffer.byteLength(row.state_json, 'utf8') > REMEDY_PROGRAM_MAX_STATE_BYTES
+        || row.state_digest !== stateDigest(row.state_json)) {
+        throw new Error('remedy-program Postgres returned an invalid state envelope');
+    }
+    assertRecordedAt(row.recorded_at);
+    const revision = safeRevision(row.revision);
+    if (expectedRevision !== undefined && revision !== expectedRevision) {
+        throw new Error('remedy-program Postgres returned an unexpected revision');
+    }
+    let state;
+    try {
+        state = JSON.parse(row.state_json);
+        if (!isRecord(state)
+            || canonicalize(state) !== row.state_json
+            || state.tenant_id !== expectedTenantId
+            || state.instance_id !== expectedInstanceId
+            || state.revision !== revision) {
+            throw new Error('state binding mismatch');
+        }
+        stateEventAt(state);
+    }
+    catch {
+        throw new Error('remedy-program Postgres returned non-canonical state');
+    }
+    return state;
+}
+function definitiveRow(result, operation, tenantId, instanceId, allowedReasons, expectedRevision) {
+    if (!result || result.rowCount !== 1 || !Array.isArray(result.rows) || result.rows.length !== 1) {
+        throw new Error(`remedy-program ${operation} outcome is ambiguous`);
+    }
+    const row = result.rows[0];
+    if (!isRecord(row) || !exactKeys(row, ENVELOPE_KEYS) || typeof row.ok !== 'boolean') {
+        throw new Error(`remedy-program ${operation} outcome is malformed`);
+    }
+    if (row.tenant_id !== tenantId || row.instance_id !== instanceId) {
+        throw new Error(`remedy-program ${operation} Postgres returned a mismatched identity`);
+    }
+    if (!row.ok) {
+        if (typeof row.reason !== 'string'
+            || !allowedReasons.has(row.reason)
+            || row.revision !== null
+            || row.state_json !== null
+            || row.state_digest !== null
+            || row.recorded_at !== null) {
+            throw new Error(`remedy-program ${operation} refusal is unrecognized`);
+        }
+        return fail(row.reason);
+    }
+    if (row.reason !== null) {
+        throw new Error(`remedy-program ${operation} success carried a refusal reason`);
+    }
+    return {
+        ok: true,
+        state: decodeState(row, tenantId, instanceId, expectedRevision),
+    };
+}
+function lookupInput(value) {
+    if (!isRecord(value)
+        || Reflect.ownKeys(value).length !== 2
+        || !Object.hasOwn(value, 'tenantId')
+        || !Object.hasOwn(value, 'instanceId')) {
+        throw new TypeError('remedy-program lookup input is invalid');
+    }
+    assertTenantId(value.tenantId);
+    assertInstanceId(value.instanceId);
+    return { tenantId: value.tenantId, instanceId: value.instanceId };
+}
+/** Build the exact durable store consumed by createRemedyProgramKernel(). */
+export function createRemedyProgramPostgresStore({ pool } = {}) {
+    if (!pool || typeof pool.connect !== 'function') {
+        throw new TypeError('createRemedyProgramPostgresStore requires a transaction-capable pg pool');
+    }
+    async function transaction(readOnly, work) {
+        const client = await pool.connect();
+        if (!client || typeof client.query !== 'function' || typeof client.release !== 'function') {
+            throw new TypeError('remedy-program pg pool returned an invalid client');
+        }
+        let began = false;
+        try {
+            await client.query(readOnly
+                ? 'BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY'
+                : 'BEGIN ISOLATION LEVEL READ COMMITTED READ WRITE');
+            began = true;
+            const value = await work(client);
+            await client.query('COMMIT');
+            began = false;
+            return value;
+        }
+        catch (error) {
+            if (began) {
+                try {
+                    await client.query('ROLLBACK');
+                }
+                catch (rollbackError) {
+                    throw new AggregateError([error, rollbackError], 'remedy-program transaction and rollback both failed');
+                }
+            }
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+    return Object.freeze({
+        durable: true,
+        async create(state) {
+            const tenantId = state?.tenant_id;
+            const instanceId = state?.instance_id;
+            assertTenantId(tenantId);
+            assertInstanceId(instanceId);
+            const encoded = encodeState(state, tenantId, instanceId, 0);
+            return transaction(false, async (client) => definitiveRow(await client.query(REMEDY_PROGRAM_POSTGRES_SQL.create, [
+                tenantId,
+                instanceId,
+                encoded.stateJson,
+                encoded.stateDigest,
+                encoded.eventAt,
+            ]), 'create', tenantId, instanceId, new Set([
+                'instance_exists', 'clock_forward_skew',
+                'evidence_replayed', 'remedy_operation_replayed',
+            ]), 0));
+        },
+        async get(input) {
+            const { tenantId, instanceId } = lookupInput(input);
+            return transaction(true, async (client) => definitiveRow(await client.query(REMEDY_PROGRAM_POSTGRES_SQL.get, [tenantId, instanceId]), 'get', tenantId, instanceId, new Set(['instance_not_found'])));
+        },
+        async compareAndSwap(input) {
+            if (!isRecord(input)
+                || Reflect.ownKeys(input).length !== 4
+                || !Object.hasOwn(input, 'tenantId')
+                || !Object.hasOwn(input, 'instanceId')
+                || !Object.hasOwn(input, 'expectedRevision')
+                || !Object.hasOwn(input, 'state')) {
+                throw new TypeError('remedy-program compareAndSwap input is invalid');
+            }
+            const { tenantId, instanceId, expectedRevision, state } = input;
+            assertTenantId(tenantId);
+            assertInstanceId(instanceId);
+            assertRevision(expectedRevision, 'expected');
+            const nextRevision = expectedRevision + 1;
+            if (!Number.isSafeInteger(nextRevision)) {
+                throw new TypeError('remedy-program next revision is invalid');
+            }
+            const encoded = encodeState(state, tenantId, instanceId, nextRevision);
+            return transaction(false, async (client) => definitiveRow(await client.query(REMEDY_PROGRAM_POSTGRES_SQL.compareAndSwap, [
+                tenantId,
+                instanceId,
+                expectedRevision,
+                nextRevision,
+                encoded.stateJson,
+                encoded.stateDigest,
+                encoded.eventAt,
+            ]), 'compareAndSwap', tenantId, instanceId, new Set([
+                'instance_not_found', 'revision_conflict',
+                'clock_regression', 'clock_forward_skew',
+                'evidence_replayed', 'remedy_operation_replayed',
+            ]), nextRevision));
+        },
+    });
+}
+export default {
+    REMEDY_PROGRAM_PG_STORE_VERSION,
+    REMEDY_PROGRAM_MAX_STATE_BYTES,
+    REMEDY_PROGRAM_MAX_FORWARD_SKEW_MINUTES,
+    REMEDY_PROGRAM_POSTGRES_SQL,
+    createRemedyProgramPostgresStore,
+};
+//# sourceMappingURL=remedy-program-postgres.js.map

package/dist/remedy-program-postgres.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remedy-program-postgres.js","sourceRoot":"","sources":["../src/remedy-program-postgres.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAOvD,MAAM,CAAC,MAAM,+BAA+B,GAAG,oCAAoC,CAAC;AACpF,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC;AAEzD,MAAM,WAAW,GAAG,qCAAqC,CAAC;AAC1D,MAAM,MAAM,GAAG,uBAAuB,CAAC;AACvC,MAAM,cAAc,GAAG,sDAAsD,CAAC;AAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU;IACtD,YAAY,EAAE,cAAc,EAAE,aAAa;CAC5C,CAAC,CAAC;AAUH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,MAAM,EAAE;;;EAGR;IACA,GAAG,EAAE;mEAC4D;IACjE,cAAc,EAAE;;;EAGhB;CACD,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,QAA6B;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI;WAC/B,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ;WACtB,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;WACpC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG;WACtC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,kBAAkB,KAAK,sBAAsB,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;WACtB,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;WAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,KAAc,EACd,QAAgB,EAChB,UAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;WACb,KAAK,CAAC,SAAS,KAAK,QAAQ;WAC5B,KAAK,CAAC,WAAW,KAAK,UAAU;WAChC,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,8BAA8B,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO;QACL,SAAS;QACT,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC;QACnC,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACf,CAAC,CAAC,KAAK,CAAC;IACV,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAK,QAAmB,GAAG,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,QAAkB,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;WACtB,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;WAC3B,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,GAAe,EACf,gBAAwB,EACxB,kBAA0B,EAC1B,gBAAyB;IAEzB,IAAI,GAAG,CAAC,SAAS,KAAK,gBAAgB;WAC/B,GAAG,CAAC,WAAW,KAAK,kBAAkB;WACtC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;WAClC,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;WACpC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;WAC9B,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,8BAA8B;WAC1E,GAAG,CAAC,YAAY,KAAK,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,gBAAgB,KAAK,SAAS,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;eACb,YAAY,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,UAAU;eACtC,KAAK,CAAC,SAAS,KAAK,gBAAgB;eACpC,KAAK,CAAC,WAAW,KAAK,kBAAkB;eACxC,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAA2B,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CACpB,MAAmB,EACnB,SAAiB,EACjB,QAAgB,EAChB,UAAkB,EAClB,cAAmC,EACnC,gBAAyB;IAEzB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,uBAAuB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,0CAA0C,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;eAC3B,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;eAC/B,GAAG,CAAC,QAAQ,KAAK,IAAI;eACrB,GAAG,CAAC,UAAU,KAAK,IAAI;eACvB,GAAG,CAAC,YAAY,KAAK,IAAI;eACzB,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,0BAA0B,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,SAAS,mCAAmC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;WACb,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;WACnC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;WACjC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAChE,CAAC;IACD,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,gBAAgB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;AACpE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gCAAgC,CAC9C,EAAE,IAAI,KAAwB,EAAE;IAEhC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CACjB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CAAI,QAAiB,EAAE,IAAsC;QACrF,MAAM,MAAM,GAAG,MAAM,IAAK,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAC1F,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ;gBACzB,CAAC,CAAC,iDAAiD;gBACnD,CAAC,CAAC,iDAAiD,CAAC,CAAC;YACvD,KAAK,GAAG,IAAI,CAAC;YACb,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,KAAK,GAAG,KAAK,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACjC,CAAC;gBAAC,OAAO,aAAa,EAAE,CAAC;oBACvB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,aAAa,CAAC,EACtB,qDAAqD,CACtD,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,IAAI;QACb,KAAK,CAAC,MAAM,CAAC,KAAyB;YACpC,MAAM,QAAQ,GAAI,KAAoB,EAAE,SAAS,CAAC;YAClD,MAAM,UAAU,GAAI,KAAoB,EAAE,WAAW,CAAC;YACtD,cAAc,CAAC,QAAQ,CAAC,CAAC;YACzB,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;YAC5D,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,aAAa,CACvD,MAAM,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,MAAM,EAAE;gBACrD,QAAQ;gBACR,UAAU;gBACV,OAAO,CAAC,SAAS;gBACjB,OAAO,CAAC,WAAW;gBACnB,OAAO,CAAC,OAAO;aAChB,CAAC,EACF,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,IAAI,GAAG,CAAC;gBACN,iBAAiB,EAAE,oBAAoB;gBACvC,mBAAmB,EAAE,2BAA2B;aACjD,CAAC,EACF,CAAC,CACF,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,KAA+C;YACvD,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACpD,OAAO,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,aAAa,CACtD,MAAM,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAC3E,KAAK,EACL,QAAQ,EACR,UAAU,EACV,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAChC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,KAKpB;YACC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;mBACb,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;mBACnC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;mBACjC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC;mBACnC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC;mBACzC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YAChE,cAAc,CAAC,QAAQ,CAAC,CAAC;YACzB,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7B,cAAc,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,YAAY,GAAG,gBAAgB,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;YACvE,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,aAAa,CACvD,MAAM,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,cAAc,EAAE;gBAC7D,QAAQ;gBACR,UAAU;gBACV,gBAAgB;gBAChB,YAAY;gBACZ,OAAO,CAAC,SAAS;gBACjB,OAAO,CAAC,WAAW;gBACnB,OAAO,CAAC,OAAO;aAChB,CAAC,EACF,gBAAgB,EAChB,QAAQ,EACR,UAAU,EACV,IAAI,GAAG,CAAC;gBACN,oBAAoB,EAAE,mBAAmB;gBACzC,kBAAkB,EAAE,oBAAoB;gBACxC,mBAAmB,EAAE,2BAA2B;aACjD,CAAC,EACF,YAAY,CACb,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,eAAe;IACb,+BAA+B;IAC/B,8BAA8B;IAC9B,uCAAuC;IACvC,2BAA2B;IAC3B,gCAAgC;CACjC,CAAC"}

package/dist/remedy-program-receipt.d.ts

@@ -0,0 +1,97 @@
+export declare const ACTION_REMEDY_RECEIPT_VERSION = "EP-ACTION-REMEDY-RECEIPT-v1";
+export declare const REMEDY_PROGRAM_RECEIPT_VERSION = "EP-ACTION-REMEDY-RECEIPT-v1";
+export declare const ACTION_REMEDY_RECEIPT_DOMAIN = "EP-ACTION-REMEDY-RECEIPT-v1\0";
+type DataRecord = Record<string, any>;
+export interface RemedyReceiptExpectedBindings extends Record<string, unknown> {
+    original_operation_id: string;
+    original_action_digest: string;
+    original_terminal_evidence_digest: string;
+    case_instance_id: string;
+    case_revision: number;
+    case_status: string;
+    remedy_operation_id: string;
+    remedy_action_digest: string;
+    remedy_caid: string;
+    destination_binding_digest: string;
+    units: number;
+    unit: string;
+    owner_mode: string;
+    owner_digest: string;
+}
+/** Derive every relying-party binding that must be independently expected. */
+export declare function expectedRemedyProgramReceiptBindings(state: unknown, remedyOperationId: string): Readonly<RemedyReceiptExpectedBindings>;
+/** Return the exact domain-separated canonical bytes signed by Ed25519. */
+export declare function remedyProgramReceiptSigningBytes(receipt: unknown): Buffer;
+/**
+ * Issue one receipt. Local private keys require an explicit ephemeral/test
+ * opt-in; production issuance requires an external signer declaring KMS/HSM
+ * custody. Every returned signature is verified against the configured public
+ * key before the receipt leaves this function.
+ */
+export declare function issueRemedyProgramReceipt(input?: {
+    state?: unknown;
+    remedyOperationId?: string;
+}, options?: {
+    context?: unknown;
+    privateKey?: unknown;
+    signer?: unknown;
+    allowEphemeralState?: boolean;
+}): Promise<Readonly<{
+    signature: {
+        algorithm: string;
+        value: string;
+    };
+    content_digest: string;
+    version: string;
+    issuer: DataRecord;
+    payload: DataRecord;
+}>>;
+export declare const signRemedyProgramReceipt: typeof issueRemedyProgramReceipt;
+export declare const createRemedyProgramReceipt: typeof issueRemedyProgramReceipt;
+/**
+ * Verify a receipt without network access. Trust keys, all issuer fields, the
+ * exact current state snapshot, and every material original/remedy binding are
+ * relying-party inputs; none are accepted from the receipt itself.
+ */
+export declare function verifyRemedyProgramReceipt(receipt: unknown, { trustedKeys, expectedIssuer, state, expected, }?: {
+    trustedKeys?: unknown;
+    expectedIssuer?: unknown;
+    state?: unknown;
+    expected?: unknown;
+}): Readonly<{
+    valid: false;
+    reason: string;
+    checks: Readonly<{
+        [x: string]: boolean;
+    }>;
+    content_digest: null;
+    payload: null;
+}> | Readonly<{
+    valid: boolean;
+    reason: string;
+    checks: {
+        structure: boolean;
+        payload: boolean;
+        content_digest: boolean;
+        issuer_pin: boolean;
+        key: boolean;
+        signature: boolean;
+        state_snapshot: boolean;
+        expected_bindings: boolean;
+    };
+    content_digest: string;
+    payload: DataRecord;
+}>;
+declare const _default: {
+    ACTION_REMEDY_RECEIPT_VERSION: string;
+    REMEDY_PROGRAM_RECEIPT_VERSION: string;
+    ACTION_REMEDY_RECEIPT_DOMAIN: string;
+    expectedRemedyProgramReceiptBindings: typeof expectedRemedyProgramReceiptBindings;
+    remedyProgramReceiptSigningBytes: typeof remedyProgramReceiptSigningBytes;
+    issueRemedyProgramReceipt: typeof issueRemedyProgramReceipt;
+    signRemedyProgramReceipt: typeof issueRemedyProgramReceipt;
+    createRemedyProgramReceipt: typeof issueRemedyProgramReceipt;
+    verifyRemedyProgramReceipt: typeof verifyRemedyProgramReceipt;
+};
+export default _default;
+//# sourceMappingURL=remedy-program-receipt.d.ts.map

package/dist/remedy-program-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remedy-program-receipt.d.ts","sourceRoot":"","sources":["../src/remedy-program-receipt.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAC3E,eAAO,MAAM,8BAA8B,gCAAgC,CAAC;AAC5E,eAAO,MAAM,4BAA4B,kCAAuC,CAAC;AAoFjF,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEtC,MAAM,WAAW,6BAA8B,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,iCAAiC,EAAE,MAAM,CAAC;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B,EAAE,MAAM,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAkXD,8EAA8E;AAC9E,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,EACd,iBAAiB,EAAE,MAAM,GACxB,QAAQ,CAAC,6BAA6B,CAAC,CAGzC;AAiDD,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAMzE;AAsID;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,GAAE;IACL,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACvB,EACN,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B;;;;;;;;;IAkDP;AAED,eAAO,MAAM,wBAAwB,kCAA4B,CAAC;AAClE,eAAO,MAAM,0BAA0B,kCAA4B,CAAC;AAYpE;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,EAC3D,WAAW,EACX,cAAc,EACd,KAAK,EACL,QAAQ,GACT,GAAE;IACD,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACf;;;;;;;;;;;;;;;;;;;;;;;GAmGL;;;;;;;;;;;;AAED,wBAUE"}