@emilia-protocol/gate 0.11.0 → 0.13.0

package/reliance-kernel.js

@@ -1,113 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * EP-RELIANCE-KERNEL-v1 — runtime enforcement wrapper.
- *
- * The pure verdict lives in @emilia-protocol/verify/reliance (evaluateReliance).
- * This is the deny-by-default RUNTIME point a relying party puts in front of a
- * consequential action: it evaluates the evidence packet against the relying
- * party's pinned EP-RELIANCE-PROFILE-v1, appends the decision to a tamper-evident
- * evidence log, and — on anything other than `rely` — returns a machine-readable
- * refusal (HTTP 428, the same Receipt-Required status the Gate uses) naming the
- * closed verdict and what evidence was required.
- *
- * ALLOW iff verdict === 'rely'. Every other closed verdict, a thrown verifier,
- * or a strict evidence-log failure denies. The kernel never re-derives a verdict
- * of its own — it enforces the one the pure offline verifier computed.
- */
-import { createEvidenceLog } from './evidence.js';
-import {
-  evaluateReliance,
-  RELIANCE_PROFILE_VERSION,
-  RELIANCE_VERDICTS,
-} from '@emilia-protocol/verify/reliance';
-
-const RECEIPT_REQUIRED_STATUS = 428;
-
-export { RELIANCE_VERDICTS, RELIANCE_PROFILE_VERSION };
-
-/** Build the 428 refusal for a non-`rely` verdict. */
-function relianceChallenge(verdict, reasons, profile) {
-  return {
-    status: RECEIPT_REQUIRED_STATUS,
-    error: 'do_not_rely',
-    verdict,
-    reasons: Array.isArray(reasons) ? reasons : [],
-    required_assurance: profile?.required_assurance ?? null,
-    required_authority: profile?.required_authority === true,
-    required_evidence: Array.isArray(profile?.required_evidence) ? profile.required_evidence : [],
-    header: { name: 'Reliance-Refused', value: verdict },
-  };
-}
-
-/**
- * Create a reliance kernel bound to one relying-party profile.
- *
- * @param {object} cfg
- * @param {object} cfg.profile        the pinned EP-RELIANCE-PROFILE-v1
- * @param {object} [cfg.log]          an evidence log (createEvidenceLog); one is created if absent
- * @param {boolean} [cfg.strictEvidence=true]  fail closed if the evidence log sink fails
- * @returns {{ check: Function, evidence: object }}
- */
-export function createRelianceKernel({ profile, log, strictEvidence = true } = {}) {
-  const evidence = log || createEvidenceLog({ strict: strictEvidence });
-
-  /**
-   * Evaluate + enforce one evidence packet.
-   * @param {object} input  the evaluateReliance input MINUS relying_party_profile (bound here)
-   * @param {object} [opts] verifier options { approverKeys, logPublicKey, rpId, revokerKeys }
-   * @returns {Promise<{ allow:boolean, status:number, verdict:string, reasons:string[], checks:object, challenge:(object|null), decision:object }>}
-   */
-  async function check(input = {}, opts = {}) {
-    let result;
-    try {
-      result = evaluateReliance({ ...input, relying_party_profile: profile }, opts);
-    } catch (err) {
-      // A thrown verifier is not a maybe — it is a refusal.
-      result = { verdict: 'do_not_rely_unsigned', rely: false, reasons: [`verifier_error:${err?.message || 'threw'}`], checks: {} };
-    }
-
-    const allow = result.verdict === 'rely';
-    const actionHash = input?.action?.action_hash ?? input?.receipt?.action_hash ?? null;
-
-    // Deny-by-default: record the decision to the tamper-evident log first. In
-    // strict mode a log-sink failure THROWS, which we convert to a refusal — an
-    // action whose decision cannot be durably recorded must not proceed.
-    let decision;
-    try {
-      decision = await evidence.record({
-        type: 'reliance.decision',
-        verdict: result.verdict,
-        allow,
-        action_hash: actionHash,
-        reasons: result.reasons,
-        checks: result.checks,
-        profile: result.profile ?? null,
-      });
-    } catch (err) {
-      return {
-        allow: false,
-        status: RECEIPT_REQUIRED_STATUS,
-        verdict: 'do_not_rely_unsigned',
-        reasons: [`evidence_log_failed:${err?.message || 'sink'}`],
-        checks: result.checks || {},
-        challenge: relianceChallenge('do_not_rely_unsigned', ['evidence_log_failed'], profile),
-        decision: null,
-      };
-    }
-
-    return {
-      allow,
-      status: allow ? 200 : RECEIPT_REQUIRED_STATUS,
-      verdict: result.verdict,
-      reasons: result.reasons,
-      checks: result.checks,
-      challenge: allow ? null : relianceChallenge(result.verdict, result.reasons, profile),
-      decision,
-    };
-  }
-
-  return { check, evidence };
-}
-
-const relianceKernelApi = { createRelianceKernel };
-export default relianceKernelApi;
+// Compatibility entry point for the TypeScript reliance-kernel module.
+export * from './dist/reliance-kernel.js';
+export { default } from './dist/reliance-kernel.js';

package/reliance-packet.js

@@ -1,176 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-// Auditor / insurer-facing reliance packet for an EMILIA Gate decision.
-
-export const RELIANCE_PACKET_VERSION = 'EP-GATE-RELIANCE-PACKET-v1';
-
-// The CLOSED admissibility verdict set (mirror of lib/evidence/admissibility.js
-// ADMISSIBILITY_VERDICTS). The gate does NOT import that app module — it stays a
-// dependency-light published package — so the closed set is restated here as a
-// value contract. 'admissible' is the ONLY verdict that reads as success; every
-// other member, and anything not in this set, fails closed. Precedence lives in
-// the evaluator; the gate never re-derives a verdict, it only checks the one the
-// relying party's offline evaluator already computed.
-export const ADMISSIBILITY_VERDICTS = Object.freeze([
-  'admissible', 'missing_evidence', 'stale', 'conflicted', 'unverifiable',
-]);
-
-/**
- * Normalize an admissibility block onto the packet. FAIL CLOSED: a missing block,
- * a missing/unrecognized verdict, or a non-'admissible' verdict all produce
- * admissible:false. The block is only carried when the caller supplies one; when
- * absent, `admissibility` is null and no admissibility gating applies (backwards
- * compatible with pre-profile packets).
- *
- * @param {object|null} adm  the relying-party evaluator's result, carrying
- *   { admissibility_profile:{id,version}, profile_hash, verdict, replay_digest, challenge_id?, challenge_digest? }
- */
-function normalizeAdmissibility(adm) {
-  if (!adm || typeof adm !== 'object') return null;
-  const verdict = typeof adm.verdict === 'string' ? adm.verdict : null;
-  const recognized = verdict !== null && ADMISSIBILITY_VERDICTS.includes(verdict);
-  // Only a recognized 'admissible' verdict reads as success. Missing, malformed,
-  // or any other closed-set member (missing_evidence/stale/conflicted/unverifiable)
-  // is non-admissible.
-  const admissible = recognized && verdict === 'admissible';
-  const profile = adm.admissibility_profile && typeof adm.admissibility_profile === 'object'
-    ? { id: adm.admissibility_profile.id ?? null, version: adm.admissibility_profile.version ?? null }
-    : null;
-  return {
-    admissibility_profile: profile,
-    profile_hash: typeof adm.profile_hash === 'string' ? adm.profile_hash : null,
-    verdict: verdict, // preserved verbatim (including null / unrecognized) for the auditor
-    verdict_recognized: recognized,
-    admissible,
-    replay_digest: typeof adm.replay_digest === 'string' ? adm.replay_digest : null,
-    // The evidence-challenge loop (lib/negotiate/evidence-challenge.js) keys each
-    // round by challenge_id; challenge_digest is carried through when the caller
-    // hashes the challenge. Either identifies which challenge round this verdict
-    // answers. Both null-safe.
-    challenge_id: adm.challenge_id ?? null,
-    challenge_digest: typeof adm.challenge_digest === 'string' ? adm.challenge_digest : null,
-  };
-}
-
-async function evidenceStatus(evidence) {
-  if (!evidence) {
-    return { ok: false, length: null, head: null, reason: 'evidence_verification_unavailable' };
-  }
-  try {
-    const status = typeof evidence.verify === 'function'
-      ? await evidence.verify()
-      : await evidence;
-    if (!status || typeof status !== 'object' || Array.isArray(status)) {
-      return { ok: false, length: null, head: null, reason: 'evidence_verification_malformed' };
-    }
-    if (status.ok !== true) {
-      return {
-        ok: false,
-        length: Number.isSafeInteger(status.length) ? status.length : null,
-        head: typeof status.head === 'string' ? status.head : null,
-        reason: status.reason || 'evidence_verification_rejected',
-      };
-    }
-    return {
-      ...status,
-      ok: true,
-      length: Number.isSafeInteger(status.length) ? status.length : null,
-      head: typeof status.head === 'string' ? status.head : null,
-    };
-  } catch {
-    return { ok: false, length: null, head: null, reason: 'evidence_verification_failed' };
-  }
-}
-
-function check(id, ok, detail = null) {
-  return { id, ok, ...(detail ? { detail } : {}) };
-}
-
-export async function buildReliancePacket({
-  decision,
-  execution = null,
-  evidence = null,
-  manifest = null,
-  binding = null,
-  admissibility = null,
-  verifier = '@emilia-protocol/gate',
-} = {}) {
-  const evidenceCheck = await evidenceStatus(evidence);
-  const decisionHash = decision?.evidence?.hash || decision?.hash || null;
-  const executionBound = Boolean(
-    execution
-    && execution.kind === 'execution'
-    && decisionHash
-    && execution.authorizes_decision === decisionHash,
-  );
-  const bindingCheck = binding || decision?.evidence?.execution_binding || decision?.execution_binding || null;
-  const allowed = decision?.allow === true;
-  const evidenceOk = evidenceCheck.ok === true;
-  const bindingOk = bindingCheck ? bindingCheck.ok === true : true;
-
-  // Admissibility block (relying-party evaluator output, computed OFFLINE against
-  // its PINNED profile — never re-derived here). When present it is an additional
-  // gate on 'rely': a non-'admissible' verdict (or a missing/unrecognized one)
-  // fails closed. When absent, admissibility does not affect the verdict.
-  const adm = normalizeAdmissibility(admissibility);
-  const admissibilityOk = adm === null ? true : adm.admissible === true;
-
-  const verdict = allowed && executionBound && evidenceOk && bindingOk && admissibilityOk ? 'rely' : 'do_not_rely';
-
-  return {
-    '@version': RELIANCE_PACKET_VERSION,
-    product: 'EMILIA Gate',
-    verifier,
-    verdict,
-    summary: {
-      action: decision?.action || null,
-      receipt_id: decision?.evidence?.receipt_id || decision?.receipt_id || null,
-      subject: decision?.evidence?.subject || null,
-      policy_id: decision?.evidence?.evaluated_policy_id || null,
-      policy_hash: decision?.evidence?.evaluated_policy_hash || null,
-      tenant_id: decision?.evidence?.evaluated_tenant_id || null,
-      approvers: decision?.evidence?.evaluated_approvers || [],
-      required_tier: decision?.evidence?.required_tier || decision?.required_tier || null,
-      observed_tier: decision?.evidence?.have_tier || decision?.have_tier || null,
-      decision_hash: decisionHash,
-      execution_hash: execution?.hash || null,
-      evidence_head: evidenceCheck.head || null,
-      // Surface the admissibility verdict + pinned profile in the summary so an
-      // auditor sees WHICH bar was cleared without digging into checks. Null when
-      // no admissibility block was supplied.
-      admissibility_verdict: adm ? adm.verdict : null,
-      admissibility_profile: adm ? adm.admissibility_profile : null,
-      admissibility_profile_hash: adm ? adm.profile_hash : null,
-    },
-    // Full admissibility block (or null). The auditor / gate can re-check
-    // {profile_hash, verdict, replay_digest} against the profile the relying party
-    // pinned. Carried verbatim, fail-closed by construction (see normalizeAdmissibility).
-    admissibility: adm,
-    checks: [
-      check('receipt_present_and_valid', allowed && !String(decision?.reason || '').startsWith('receipt_rejected'), decision?.reason || null),
-      check('assurance_sufficient', allowed || decision?.reason !== 'assurance_too_low', decision?.reason === 'assurance_too_low' ? 'receipt tier below action requirement' : null),
-      check('receipt_one_time_consumed', allowed || decision?.reason === 'replay_refused' ? decision?.reason !== 'replay_refused' : null),
-      check('execution_fields_bound', bindingCheck ? bindingCheck.ok === true : null, bindingCheck ? { missing_observed_fields: bindingCheck.missing_observed_fields || [], mismatched_fields: bindingCheck.mismatched_fields || [] } : 'no material execution-field binding required by this action'),
-      check('execution_attests_decision', executionBound, execution ? null : 'no execution record supplied'),
-      check('evidence_log_intact', evidenceCheck.ok === true, evidenceCheck.reason || null),
-      // Admissibility verdict against the relying party's PINNED profile. null when
-      // no profile/verdict was supplied (this reliance did not gate on admissibility);
-      // true only for a recognized 'admissible' verdict; false otherwise (fail closed).
-      check(
-        'admissibility_verdict_admissible',
-        adm === null ? null : adm.admissible === true,
-        adm === null
-          ? 'no admissibility profile / verdict supplied for this reliance'
-          : { verdict: adm.verdict, verdict_recognized: adm.verdict_recognized, profile: adm.admissibility_profile, profile_hash: adm.profile_hash, replay_digest: adm.replay_digest },
-      ),
-    ],
-    manifest_version: manifest?.['@version'] || null,
-    limitations: [
-      'The packet proves the gate verified a receipt and enforced its configured policy; it does not prove the human made a wise decision.',
-      'Identity, authority enrollment, and key custody remain external trust roots that must be operated correctly.',
-      'For execution-field binding, observedAction must come from the system of record, not from attacker-controlled request input.',
-      'An admissible verdict means the evidence bundle cleared the bar THIS relying party pinned; it does not establish the action is correct, safe, or currently valid beyond the freshness bounds evaluated. The verdict is computed OFFLINE by the relying party against its own pinned profile — EMILIA neither hosts the authoritative registry nor adjudicates.',
-    ],
-  };
-}
-
-export default { RELIANCE_PACKET_VERSION, ADMISSIBILITY_VERDICTS, buildReliancePacket };
+// Compatibility entry point for the TypeScript reliance-packet module.
+export * from './dist/reliance-packet.js';
+export { default } from './dist/reliance-packet.js';

package/remedy-program-postgres.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript Remedy Program PostgreSQL store.
+export * from './dist/remedy-program-postgres.js';
+export { default } from './dist/remedy-program-postgres.js';

package/remedy-program-receipt.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript Remedy Program receipt module.
+export * from './dist/remedy-program-receipt.js';
+export { default } from './dist/remedy-program-receipt.js';

package/remedy-program.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript Gate Remedy Program module.
+export * from './dist/remedy-program.js';
+export { default } from './dist/remedy-program.js';

package/reports/assurance-package.js

@@ -1,313 +1,3 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * EP-ASSURANCE-PACKAGE-v1 — the reliance assurance layer.
- *
- * The layer above the reliance kernel. The kernel answers "may this party rely on
- * this action?" The assurance package answers the question an INDEPENDENT assurer
- * (an audit firm, a regulator, an insurer) asks: "can I reproduce, test, and
- * attest that an organization's automated actions were governed by admissible
- * evidence under the organization's OWN pinned rule?"
- *
- * Two halves, mirroring the re-performance discipline of reperform.js:
- *   buildAssurancePackage(decisions, ...)      the organization bundles its
- *      automated decisions + the evidence each relied on into ONE portable,
- *      content-addressed package (action, receipt, profile, authority proof,
- *      revocation check, consumption, denial/exception history, policy hash).
- *   reperformAssurancePackage(pkg, ...)         the assurer RE-PERFORMS every
- *      reliance verdict offline from that evidence, TRUSTING NOTHING the package
- *      asserts: it recomputes each verdict with evaluateReliance, compares to the
- *      verdict the org's runtime CLAIMED (drift = a control failure the assurer
- *      caught), maps every verdict to a control objective, and emits an
- *      auditor-style workpaper. It does not conclude; the assurer concludes.
- *
- * PCAOB AS 1105 alignment (why this is audit evidence): the source is
- * cryptographic, the decision trail is immutable and content-addressed, the rule
- * is a pinned profile, and the verdict is re-performable directly. This module
- * SUPPORTS a re-performance procedure; it never issues an opinion.
- */
-import { hashCanonical } from '../execution-binding.js';
-import { evaluateReliance, RELIANCE_VERDICTS } from '@emilia-protocol/verify/reliance';
-
-export const ASSURANCE_PACKAGE_VERSION = 'EP-ASSURANCE-PACKAGE-v1';
-export const ASSURANCE_REPERFORMANCE_VERSION = 'EP-ASSURANCE-REPERFORMANCE-v1';
-
-export { RELIANCE_VERDICTS };
-
-/**
- * The reliance control catalog: every reliance verdict maps to the control
- * objective it exercises. A `rely` shows the control PASSING; every do_not_rely_*
- * shows the control OPERATING (it refused a non-admissible action). Denials are
- * the control working, not the control failing.
- */
-export const RELIANCE_CONTROL_CATALOG = Object.freeze({
-  'RC-1': { objective: 'Only a human with valid organization-bound, scoped authority for THIS exact action may authorize it', verdicts: ['do_not_rely_authority_missing', 'do_not_rely_authority_subject_mismatch', 'do_not_rely_authority_organization_mismatch', 'do_not_rely_authority_revoked', 'do_not_rely_authority_expired', 'do_not_rely_scope_mismatch', 'do_not_rely_amount_exceeded', 'do_not_rely_registry_unavailable'] },
-  'RC-2': { objective: 'Authorization uses a device-bound named-human ceremony (Class-A or quorum)', verdicts: ['do_not_rely_no_class_a', 'do_not_rely_quorum_unsatisfied'] },
-  'RC-3': { objective: 'The action conforms to a pinned, accepted policy', verdicts: ['do_not_rely_policy_mismatch'] },
-  'RC-4': { objective: 'Authorization is consumed exactly once (no replay)', verdicts: ['do_not_rely_already_consumed'] },
-  'RC-5': { objective: 'Reliance is evaluated against fresh revocation state', verdicts: ['do_not_rely_stale_revocation'] },
-  'RC-6': { objective: 'Evidence is signed by a trusted issuer and evaluated under a pinned rule', verdicts: ['do_not_rely_unsigned', 'do_not_rely_untrusted_issuer', 'do_not_rely_no_profile'] },
-});
-
-const VERDICT_TO_CONTROL = Object.freeze(
-  Object.entries(RELIANCE_CONTROL_CATALOG).reduce((m, [cid, c]) => {
-    for (const v of c.verdicts) m[v] = cid;
-    return m;
-  }, {}),
-);
-
-/** Which control objective a verdict exercises (rely passes ALL, so returns null). */
-function controlForVerdict(verdict) {
-  if (verdict === 'rely') return null;
-  return VERDICT_TO_CONTROL[verdict] || null;
-}
-
-function toIso(now) {
-  const ms = typeof now === 'function' ? now() : now;
-  return new Date(ms == null ? 0 : ms).toISOString();
-}
-
-function portableJsonCopy(value, active = new Set()) {
-  if (value === null || typeof value === 'string' || typeof value === 'boolean') return value;
-  if (typeof value === 'number') {
-    if (!Number.isFinite(value) || Object.is(value, -0)) {
-      throw new TypeError('assurance-package: value is not canonical JSON');
-    }
-    return value;
-  }
-  if (typeof value !== 'object') {
-    throw new TypeError('assurance-package: value is not JSON');
-  }
-  if (active.has(value)) throw new TypeError('assurance-package: cyclic value');
-  active.add(value);
-  try {
-    if (Array.isArray(value)) return value.map((entry) => portableJsonCopy(entry, active));
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null) {
-      throw new TypeError('assurance-package: value must use plain JSON objects');
-    }
-    return Object.fromEntries(
-      Object.entries(value).map(([key, entry]) => [key, portableJsonCopy(entry, active)]),
-    );
-  } finally {
-    active.delete(value);
-  }
-}
-
-/**
- * Bundle N automated reliance decisions + the evidence each relied on into one
- * portable, content-addressed assurance package. Does NOT re-perform (that is the
- * assurer's independent step); it packages faithfully, including the verdict the
- * org's runtime CLAIMED, so drift is checkable later.
- *
- * @param {Array<object>} decisions  each: { decision_id, action, receipt, quorum?,
- *   authority_proof?, revocation_state?, consumption?, stated_verdict? }
- * @param {object} opts
- * @param {object} opts.profile       the pinned EP-RELIANCE-PROFILE-v1 the org operated under
- * @param {object} [opts.organization] { id, name } (no PHI)
- * @param {number|function} [opts.now]
- * @returns {object} EP-ASSURANCE-PACKAGE-v1
- */
-export function buildAssurancePackage(decisions = [], { profile, organization = null, now = 0 } = {}) {
-  if (!Array.isArray(decisions)) throw new Error('assurance-package: decisions must be an array');
-  const items = decisions.map((d, i) => {
-    const source = portableJsonCopy(d ?? {});
-    const decision_id = source.decision_id ?? `decision-${i}`;
-    return {
-      decision_id,
-      action: source.action ?? null,
-      policy_hash: source.action?.policy_hash ?? null,
-      stated_verdict: typeof source.stated_verdict === 'string' ? source.stated_verdict : null,
-      evidence: {
-        receipt: source.receipt ?? null,
-        quorum: source.quorum ?? null,
-        authority_proof: source.authority_proof ?? null,
-        revocation_state: source.revocation_state ?? null,
-        consumption: source.consumption ?? null,
-      },
-    };
-  });
-  // Denial/exception history = the decisions the org itself recorded as refused.
-  const exceptions = items.filter((it) => it.stated_verdict && it.stated_verdict !== 'rely')
-    .map((it) => ({ decision_id: it.decision_id, stated_verdict: it.stated_verdict, control_id: controlForVerdict(it.stated_verdict) }));
-
-  const profileCopy = profile == null ? null : portableJsonCopy(profile);
-  const body = {
-    '@version': ASSURANCE_PACKAGE_VERSION,
-    organization: organization == null ? null : portableJsonCopy(organization),
-    reliance_profile: profileCopy,
-    profile_hash: profileCopy ? hashCanonical(profileCopy) : null,
-    control_catalog: RELIANCE_CONTROL_CATALOG,
-    decisions: items,
-    exception_history: exceptions,
-    counts: {
-      decisions: items.length,
-      stated_admissible: items.filter((it) => it.stated_verdict === 'rely').length,
-      stated_refused: items.filter((it) => it.stated_verdict && it.stated_verdict !== 'rely').length,
-      stated_unknown: items.filter((it) => !it.stated_verdict).length,
-    },
-    assembled_at: toIso(now),
-  };
-  // Content address over everything EXCEPT the timestamp (so the same evidence
-  // yields the same digest regardless of when it was packaged).
-  const { assembled_at: _t, ...digestScope } = body;
-  return { ...body, package_digest: hashCanonical(digestScope) };
-}
-
-/**
- * INDEPENDENT re-performance. Recompute every reliance verdict offline from the
- * packaged evidence under the package's pinned profile and AUDITOR-supplied keys,
- * trusting nothing the package asserts. Detect drift (recomputed ≠ stated), map
- * to control objectives, and emit an auditor-style workpaper. Conclusion fields
- * are ALWAYS null: the assurer concludes, not this tool.
- *
- * @param {object} pkg  an EP-ASSURANCE-PACKAGE-v1
- * @param {object} opts
- * @param {object} [opts.approverKeys]  auditor-pinned approver keys (out of band)
- * @param {string} [opts.logPublicKey]  auditor-pinned transparency-log key
- * @param {string} [opts.rpId]
- * @param {string[]} [opts.allowedOrigins]
- * @param {object} [opts.revokerKeys]
- * @param {(key:object)=>boolean} [opts.isConsumed] auditor-owned consumption lookup
- * @param {number|string|Date} [opts.now]  reliance-evaluation clock (pin for determinism)
- * @returns {object} EP-ASSURANCE-REPERFORMANCE-v1
- */
-export function reperformAssurancePackage(pkg, { approverKeys = {}, logPublicKey = null, rpId = null, allowedOrigins = [], revokerKeys = {}, isConsumed, now = 0 } = {}) {
-  if (!pkg || pkg['@version'] !== ASSURANCE_PACKAGE_VERSION) throw new Error('assurance-reperform: not an EP-ASSURANCE-PACKAGE-v1');
-  const profile = pkg.reliance_profile;
-  const evalOpts = { approverKeys, logPublicKey, rpId, allowedOrigins, revokerKeys, ...(typeof isConsumed === 'function' ? { isConsumed } : {}) };
-  const relianceNow = typeof now === 'function' ? now() : now;
-
-  const results = (Array.isArray(pkg.decisions) ? pkg.decisions : []).map((it) => {
-    const ev = it.evidence || {};
-    const input = {
-      action: it.action || {},
-      receipt: ev.receipt,
-      quorum: ev.quorum || undefined,
-      authority_proof: ev.authority_proof || undefined,
-      revocation_state: ev.revocation_state || undefined,
-      consumption: ev.consumption || undefined,
-      relying_party_profile: profile,
-      now: relianceNow,
-    };
-    let recomputed;
-    try {
-      recomputed = evaluateReliance(input, evalOpts);
-    } catch (err) {
-      recomputed = { verdict: 'do_not_rely_unsigned', rely: false, reasons: [`reperform_error:${err?.message || 'threw'}`] };
-    }
-    const recomputed_verdict = recomputed.verdict;
-    const stated_verdict = it.stated_verdict ?? null;
-    // Drift: the org's runtime claimed one outcome, independent re-performance
-    // computed another. A claimed `rely` that recomputes to a refusal is the
-    // material finding — the org relied on evidence that does not support reliance.
-    const drift = stated_verdict !== null && stated_verdict !== recomputed_verdict;
-    return {
-      decision_id: it.decision_id,
-      action_type: it.action?.action_type ?? null,
-      stated_verdict,
-      recomputed_verdict,
-      admissible: recomputed_verdict === 'rely',
-      drift,
-      drift_severity: drift ? (stated_verdict === 'rely' ? 'relied_on_inadmissible_evidence' : 'refused_admissible_or_reclassified') : null,
-      control_id: controlForVerdict(recomputed_verdict),
-      reasons: recomputed.reasons || [],
-    };
-  });
-
-  const byVerdict = Object.create(null);
-  const byControl = Object.create(null);
-  let admissible = 0;
-  let refused = 0;
-  let drift = 0;
-  for (const r of results) {
-    byVerdict[r.recomputed_verdict] = (byVerdict[r.recomputed_verdict] || 0) + 1;
-    if (r.admissible) admissible += 1; else refused += 1;
-    if (r.drift) drift += 1;
-    if (r.control_id) byControl[r.control_id] = (byControl[r.control_id] || 0) + 1;
-  }
-
-  // Recompute the package digest from the package's OWN contents rather than
-  // trusting pkg.package_digest. "No value the package asserts is trusted" has to
-  // include the digest: copying the stated one verbatim would let a tampered
-  // package carry a lying content-address through re-performance unchecked. Mirror
-  // buildAssurancePackage's digestScope exactly (body minus assembled_at and the
-  // digest field itself), then compare.
-  const { assembled_at: _statedAt, package_digest: _statedDigest, ...digestScope } = pkg;
-  const recomputedPackageDigest = hashCanonical(digestScope);
-  const packageDigestVerified = pkg.package_digest != null && recomputedPackageDigest === pkg.package_digest;
-
-  const doc = {
-    '@version': ASSURANCE_REPERFORMANCE_VERSION,
-    product: 'EMILIA Reliance Assurance',
-    package_digest: recomputedPackageDigest,
-    stated_package_digest: pkg.package_digest ?? null,
-    package_digest_verified: packageDigestVerified,
-    profile_hash: pkg.profile_hash ?? null,
-    generated_at: toIso(now),
-    honesty: {
-      reperforms:
-        'Independent recomputation of every reliance verdict from the packaged evidence, under the package\'s pinned '
-        + 'EP-RELIANCE-PROFILE-v1 and auditor-supplied keys, using the offline reliance kernel. No value the package '
-        + 'asserts (including the stated verdict) is trusted; the stated verdict is compared, never relied on.',
-      does_not_establish: [
-        'Completeness of the decision population: decisions withheld before packaging are not detectable from the package alone. Bind the population to an externally anchored count to close this.',
-        'Runtime freshness or one-time consumption AT THE MOMENT OF DECISION: those were live properties; re-performance checks the evidence as packaged, not the runtime state that existed then.',
-        'Issuer, approver, and registrar key custody, enrollment, or identity proofing, which remain external trust roots the auditor supplies out of band.',
-        'The business correctness or wisdom of any authorized action.',
-      ],
-      status: 'Support for an audit re-performance procedure. This document does not conclude, opine, or certify; any conclusion is the auditor\'s.',
-    },
-    population: {
-      decisions: results.length,
-      admissible,
-      refused,
-      drift,
-      relied_on_inadmissible_evidence: results.filter((r) => r.drift_severity === 'relied_on_inadmissible_evidence').length,
-      by_recomputed_verdict: byVerdict,
-      by_control: byControl,
-    },
-    control_catalog: RELIANCE_CONTROL_CATALOG,
-    results,
-    reperformance_digest: null, // filled below
-    // Conclusion fields are ALWAYS null: a machine may support re-performance, it
-    // may never fill in the auditor's sign-off. A renderer must refuse to print a
-    // non-null conclusion here.
-    conclusion: { supportable: null, opinion: null, signed_off_by: null },
-  };
-  // Deterministic re-performance digest over the recomputed results + population
-  // (excludes timestamps), so a second assurer reproduces it byte-for-byte.
-  doc.reperformance_digest = hashCanonical({ package_digest: doc.package_digest, population: doc.population, results });
-  return doc;
-}
-
-/** Render a plain-text auditor workpaper. Refuses to print a filled conclusion. */
-export function renderAssuranceWorkpaper(doc) {
-  if (!doc || doc['@version'] !== ASSURANCE_REPERFORMANCE_VERSION) throw new Error('render: not an EP-ASSURANCE-REPERFORMANCE-v1');
-  if (doc.conclusion && (doc.conclusion.supportable !== null || doc.conclusion.opinion !== null || doc.conclusion.signed_off_by !== null)) {
-    throw new Error('render refused: conclusion fields must be null (the auditor concludes, not the tool)');
-  }
-  const p = doc.population;
-  const lines = [];
-  lines.push(`EMILIA Reliance Assurance — re-performance workpaper (${doc['@version']})`);
-  lines.push(`package_digest:       ${doc.package_digest} (recomputed)`);
-  lines.push(`package_digest match: ${doc.package_digest_verified ? 'YES — recomputed digest equals the package\'s stated digest' : 'NO — stated digest does NOT match recomputed contents (tamper or drift)'}`);
-  lines.push(`reperformance_digest: ${doc.reperformance_digest}`);
-  lines.push('');
-  lines.push(`Population: ${p.decisions} decisions | admissible(rely): ${p.admissible} | refused: ${p.refused} | drift: ${p.drift}`);
-  lines.push(`Relied on INADMISSIBLE evidence (claimed rely, recomputed refusal): ${p.relied_on_inadmissible_evidence}`);
-  lines.push('');
-  lines.push('By recomputed verdict:');
-  for (const [v, n] of Object.entries(p.by_recomputed_verdict)) lines.push(`  ${v}: ${n}`);
-  lines.push('');
-  lines.push('Control objectives exercised (denials are the control operating):');
-  for (const [cid, n] of Object.entries(p.by_control)) lines.push(`  ${cid} (${RELIANCE_CONTROL_CATALOG[cid].objective}): ${n}`);
-  lines.push('');
-  const drifts = doc.results.filter((r) => r.drift);
-  if (drifts.length) {
-    lines.push('DRIFT (independent re-performance disagrees with the runtime\'s stated verdict):');
-    for (const r of drifts) lines.push(`  ${r.decision_id}: stated=${r.stated_verdict} recomputed=${r.recomputed_verdict} [${r.drift_severity}]`);
-    lines.push('');
-  }
-  lines.push('Conclusion: NULL by construction. The auditor concludes; this workpaper only supports the procedure.');
-  return lines.join('\n');
-}
+// Compatibility entry point for the TypeScript assurance-package report module.
+export * from '../dist/reports/assurance-package.js';