@emilia-protocol/gate 0.11.0 → 0.14.0

package/dist/evidence.js

@@ -0,0 +1,369 @@
+// @ts-nocheck
+/**
+ * @emilia-protocol/gate — evidence log (tamper-detecting audit of decisions).
+ * @license Apache-2.0
+ *
+ * Every gate decision — allow or deny — appends a hash-chained record. Each
+ * record commits to the previous one, so removing or altering any decision
+ * breaks the chain and `verify()` catches it. This is the compliance and
+ * insurance artifact: a provable account of exactly which consequential actions
+ * were authorized, refused, and why. Default sink is in-memory; pass `sink` to
+ * stream records to storage. This local chain detects alteration only when the
+ * verifier receives its complete history from genesis; a sink alone cannot
+ * prevent truncation, restart-from-genesis, or cross-replica forks. Use
+ * createAtomicEvidenceLog for a shared production head.
+ *
+ * Hashing is over CANONICAL JSON (sorted keys) so the same logical record hashes
+ * identically across systems and languages — a plain JSON.stringify is
+ * insertion-order dependent and would make cross-system verification fragile.
+ *
+ * `strict` mode makes the log fail CLOSED: if a durable `sink` write fails, the
+ * record is NOT appended and `record()` throws. The gate uses this so it never
+ * authorizes an action it cannot durably account for. In non-strict (observe)
+ * mode a sink failure is best-effort and swallowed.
+ */
+import crypto from 'node:crypto';
+function sha256hex(s) {
+    return crypto.createHash('sha256').update(s).digest('hex');
+}
+/** Canonical JSON (recursive sorted keys) — matches @emilia-protocol/verify. */
+export function canonicalEvidenceJson(v) {
+    if (v === null || v === undefined)
+        return JSON.stringify(v);
+    if (Array.isArray(v))
+        return `[${v.map(canonicalEvidenceJson).join(',')}]`;
+    if (typeof v === 'object') {
+        return `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonicalEvidenceJson(v[k])).join(',')}}`;
+    }
+    return JSON.stringify(v);
+}
+const canonical = canonicalEvidenceJson;
+export function createEvidenceLog({ sink, strict = false } = {}) {
+    const records = [];
+    let prev = 'genesis';
+    return {
+        // A sink can persist this process-local chain, but it cannot make the head
+        // atomic across replicas or continue it after restart. Never advertise the
+        // local logger as a fleet-safe production ledger.
+        durable: false,
+        persisted: typeof sink === 'function' && strict === true,
+        strict: strict === true,
+        forkAware: false,
+        atomicAppend: false,
+        async record(entry) {
+            // Deep-copy the caller's entry: a shallow spread embeds live references to
+            // nested objects, so a caller mutating them after record() would silently
+            // corrupt the hash-chained evidence record (and anything a sink persisted).
+            const snapshot = entry && typeof entry === 'object' ? structuredClone(entry) : entry;
+            const body = { seq: records.length, prev_hash: prev, ...snapshot };
+            const hash = sha256hex(canonical(body));
+            const rec = { ...body, hash };
+            if (sink) {
+                try {
+                    await sink(rec);
+                }
+                catch (e) {
+                    // Fail closed in strict mode: do NOT advance the chain, surface the
+                    // failure so the caller (the gate) can refuse the action. The seq is
+                    // left unconsumed so a retry produces a consistent chain.
+                    if (strict) {
+                        const err = new Error('evidence_sink_failed');
+                        err.cause = e;
+                        throw err;
+                    }
+                    /* non-strict (observe): best-effort, swallow — never break the gate */
+                }
+            }
+            records.push(rec);
+            prev = hash;
+            return rec;
+        },
+        all() {
+            return records.slice();
+        },
+        /** Recompute the chain; detects any altered or removed record. */
+        verify() {
+            let p = 'genesis';
+            for (const r of records) {
+                const { hash, ...body } = r;
+                if (body.prev_hash !== p)
+                    return { ok: false, at: r.seq, reason: 'prev_hash_mismatch' };
+                if (sha256hex(canonical(body)) !== hash)
+                    return { ok: false, at: r.seq, reason: 'hash_mismatch' };
+                p = hash;
+            }
+            return { ok: true, length: records.length, head: p === 'genesis' ? null : p };
+        },
+    };
+}
+const LOG_HEX_256 = /^[0-9a-f]{64}$/;
+const LOG_RESERVED_FIELDS = new Set(['seq', 'prev_hash', 'record_id', 'hash']);
+/**
+ * Verify one logger acknowledgement independently of the logger that emitted it.
+ */
+export function verifyEvidenceRecord(record, { atomicRequired = false, expectedEntry } = {}) {
+    try {
+        if (!record || typeof record !== 'object' || Array.isArray(record)
+            || !Number.isSafeInteger(record.seq) || record.seq < 0
+            || (record.prev_hash !== 'genesis' && !LOG_HEX_256.test(record.prev_hash))
+            || !LOG_HEX_256.test(record.hash))
+            return false;
+        const hasRecordId = Object.prototype.hasOwnProperty.call(record, 'record_id');
+        if ((atomicRequired && !hasRecordId)
+            || (hasRecordId && (typeof record.record_id !== 'string'
+                || record.record_id.length < 16 || record.record_id.length > 256)))
+            return false;
+        const { hash, ...body } = record;
+        if (sha256hex(canonical(body)) !== hash)
+            return false;
+        if (expectedEntry !== undefined) {
+            if (!expectedEntry || typeof expectedEntry !== 'object' || Array.isArray(expectedEntry))
+                return false;
+            const entry = Object.fromEntries(Object.entries(record).filter(([key]) => !LOG_RESERVED_FIELDS.has(key)));
+            if (canonical(entry) !== canonical(expectedEntry))
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function assertLogEntry(entry) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry)) {
+        throw new Error('atomic evidence entry must be an object');
+    }
+    for (const field of LOG_RESERVED_FIELDS) {
+        if (Object.prototype.hasOwnProperty.call(entry, field)) {
+            throw new Error(`atomic evidence entry must not supply reserved field ${field}`);
+        }
+    }
+    const stack = [{ value: entry, depth: 0 }];
+    const seen = new WeakSet();
+    let nodes = 0;
+    let stringBytes = 0;
+    while (stack.length) {
+        const { value, depth } = stack.pop();
+        if (++nodes > 50000 || depth > 64)
+            throw new Error('atomic evidence entry exceeds resource limits');
+        if (value === null || typeof value === 'boolean')
+            continue;
+        if (typeof value === 'number') {
+            if (!Number.isSafeInteger(value))
+                throw new Error('atomic evidence entry contains a non-safe integer');
+            continue;
+        }
+        if (typeof value === 'string') {
+            stringBytes += Buffer.byteLength(value, 'utf8');
+            if (stringBytes > 1024 * 1024)
+                throw new Error('atomic evidence entry exceeds string limit');
+            continue;
+        }
+        if (typeof value !== 'object')
+            throw new Error('atomic evidence entry is not canonical JSON');
+        if (seen.has(value))
+            throw new Error('atomic evidence entry contains a cycle or alias');
+        seen.add(value);
+        if (Array.isArray(value)) {
+            for (const child of value)
+                stack.push({ value: child, depth: depth + 1 });
+        }
+        else {
+            for (const [key, child] of Object.entries(value)) {
+                stringBytes += Buffer.byteLength(key, 'utf8');
+                if (stringBytes > 1024 * 1024)
+                    throw new Error('atomic evidence entry exceeds string limit');
+                stack.push({ value: child, depth: depth + 1 });
+            }
+        }
+    }
+}
+function validateAtomicRecord(record, expectedId, expectedEntry, expectedRecord = null) {
+    return record?.record_id === expectedId
+        && verifyEvidenceRecord(record, { atomicRequired: true, expectedEntry })
+        && (expectedRecord === null || canonical(record) === canonical(expectedRecord));
+}
+function validHead(head) {
+    return head === null || Boolean(head && Number.isSafeInteger(head.seq) && head.seq >= 0 && LOG_HEX_256.test(head.hash));
+}
+/**
+ * Fleet-safe, fail-closed evidence log over an atomic shared-head backend.
+ *
+ * Backend contract (all operations are scoped by streamId):
+ *   readHead(streamId) -> null | { seq, hash }
+ *   getById(streamId, recordId) -> null | record
+ *   appendIfHead(streamId, expectedHeadHash|null, record) -> boolean
+ *   readAll(streamId) -> record[]                    // optional, for verify/all
+ *
+ * appendIfHead MUST atomically compare the current head, append the immutable
+ * record, reject duplicate record_id, and advance the head in one durable
+ * transaction. A true return MUST provide immediate read-after-write visibility
+ * through getById. `backend.durable === true` is a deployment capability
+ * assertion; this module tests the protocol but cannot prove storage hardware
+ * semantics.
+ */
+export function createAtomicEvidenceLog(backend, { streamId = 'emilia-gate', maxRetries = 32, recordIdFactory = () => crypto.randomUUID(), } = {}) {
+    for (const method of ['readHead', 'getById', 'appendIfHead']) {
+        if (typeof backend?.[method] !== 'function') {
+            throw new Error(`createAtomicEvidenceLog: backend must implement async ${method}()`);
+        }
+    }
+    if (typeof streamId !== 'string' || !streamId || streamId.length > 256) {
+        throw new Error('createAtomicEvidenceLog: streamId must be a non-empty string of at most 256 characters');
+    }
+    if (!Number.isSafeInteger(maxRetries) || maxRetries < 1 || maxRetries > 1024) {
+        throw new Error('createAtomicEvidenceLog: maxRetries must be an integer from 1 to 1024');
+    }
+    if (typeof recordIdFactory !== 'function') {
+        throw new Error('createAtomicEvidenceLog: recordIdFactory must be a function');
+    }
+    async function recover(recordId, snapshot, expectedRecord = null) {
+        const existing = await backend.getById(streamId, recordId);
+        if (existing === null || existing === undefined)
+            return null;
+        if (!validateAtomicRecord(existing, recordId, snapshot, expectedRecord)) {
+            throw new Error('atomic evidence backend returned a conflicting record_id');
+        }
+        return structuredClone(existing);
+    }
+    return {
+        durable: backend.durable === true,
+        persisted: backend.durable === true,
+        strict: true,
+        forkAware: true,
+        atomicAppend: true,
+        streamId,
+        async health() {
+            if (typeof backend.health !== 'function')
+                return { ok: false, reason: 'backend_health_unavailable' };
+            return backend.health();
+        },
+        async record(entry) {
+            const snapshot = structuredClone(entry);
+            assertLogEntry(snapshot);
+            const recordId = recordIdFactory();
+            if (typeof recordId !== 'string' || recordId.length < 16 || recordId.length > 256) {
+                throw new Error('atomic evidence record id must be a string of 16 to 256 characters');
+            }
+            for (let attempt = 0; attempt < maxRetries; attempt++) {
+                const recovered = await recover(recordId, snapshot);
+                if (recovered)
+                    return recovered;
+                const head = await backend.readHead(streamId);
+                if (!validHead(head))
+                    throw new Error('atomic evidence backend returned a malformed head');
+                const seq = head === null ? 0 : head.seq + 1;
+                const prevHash = head === null ? 'genesis' : head.hash;
+                const body = { seq, prev_hash: prevHash, record_id: recordId, ...snapshot };
+                const record = { ...body, hash: sha256hex(canonical(body)) };
+                try {
+                    if ((await backend.appendIfHead(streamId, head?.hash ?? null, record)) === true) {
+                        const persisted = await recover(recordId, snapshot, record);
+                        if (persisted)
+                            return persisted;
+                        throw new Error('atomic_evidence_append_not_observable');
+                    }
+                }
+                catch (error) {
+                    // The append may have linearized before its response was lost. Recover
+                    // by stable id; if no record is visible, fail closed and let the caller
+                    // retain/freeze its execution reservation.
+                    const afterError = await recover(recordId, snapshot, record);
+                    if (afterError)
+                        return afterError;
+                    const wrapped = new Error('atomic_evidence_append_indeterminate');
+                    wrapped.cause = error;
+                    throw wrapped;
+                }
+            }
+            throw new Error('atomic_evidence_contention_limit');
+        },
+        async all() {
+            if (typeof backend.readAll !== 'function')
+                throw new Error('atomic evidence backend does not expose readAll()');
+            const records = await backend.readAll(streamId);
+            if (!Array.isArray(records))
+                throw new Error('atomic evidence backend returned malformed history');
+            return structuredClone(records);
+        },
+        async verify() {
+            try {
+                if (typeof backend.readAll !== 'function')
+                    return { ok: false, reason: 'read_all_unavailable' };
+                const records = await backend.readAll(streamId);
+                if (!Array.isArray(records))
+                    return { ok: false, reason: 'malformed_history' };
+                let prev = 'genesis';
+                const ids = new Set();
+                for (let index = 0; index < records.length; index++) {
+                    const record = records[index];
+                    if (!record || typeof record !== 'object' || Array.isArray(record)
+                        || record.seq !== index || record.prev_hash !== prev
+                        || typeof record.record_id !== 'string' || ids.has(record.record_id)) {
+                        return { ok: false, at: index, reason: 'sequence_or_predecessor_mismatch' };
+                    }
+                    const { hash, ...body } = record;
+                    if (!LOG_HEX_256.test(hash) || sha256hex(canonical(body)) !== hash) {
+                        return { ok: false, at: index, reason: 'hash_mismatch' };
+                    }
+                    ids.add(record.record_id);
+                    prev = hash;
+                }
+                const head = await backend.readHead(streamId);
+                const expectedHead = records.length === 0 ? null : { seq: records.length - 1, hash: prev };
+                if (canonical(head) !== canonical(expectedHead))
+                    return { ok: false, reason: 'head_mismatch' };
+                return { ok: true, length: records.length, head: expectedHead?.hash ?? null };
+            }
+            catch {
+                return { ok: false, reason: 'backend_read_failed_or_malformed' };
+            }
+        },
+    };
+}
+/** In-memory contract model for tests. It is intentionally not durable. */
+export function createMemoryAtomicEvidenceBackend() {
+    const streams = new Map();
+    const state = (streamId) => {
+        if (!streams.has(streamId))
+            streams.set(streamId, { records: [], byId: new Map() });
+        return streams.get(streamId);
+    };
+    return {
+        durable: false,
+        async readHead(streamId) {
+            const records = state(streamId).records;
+            const record = records[records.length - 1];
+            return record ? { seq: record.seq, hash: record.hash } : null;
+        },
+        async getById(streamId, recordId) {
+            return structuredClone(state(streamId).byId.get(recordId) ?? null);
+        },
+        async appendIfHead(streamId, expectedHeadHash, record) {
+            const s = state(streamId);
+            const head = s.records[s.records.length - 1] ?? null;
+            const actual = head?.hash ?? null;
+            if (actual !== expectedHeadHash || s.byId.has(record.record_id)
+                || record.seq !== s.records.length || record.prev_hash !== (head?.hash ?? 'genesis'))
+                return false;
+            const snapshot = structuredClone(record);
+            s.records.push(snapshot);
+            s.byId.set(snapshot.record_id, snapshot);
+            return true;
+        },
+        async readAll(streamId) { return structuredClone(state(streamId).records); },
+    };
+}
+export const __atomicEvidenceSecurityInternals = Object.freeze({
+    canonical,
+    assertLogEntry,
+    validateAtomicRecord,
+    validHead,
+});
+export default {
+    createEvidenceLog,
+    verifyEvidenceRecord,
+    createAtomicEvidenceLog,
+    createMemoryAtomicEvidenceBackend,
+};
+//# sourceMappingURL=evidence.js.map

package/dist/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,SAAS,SAAS,CAAC,CAAC;IAClB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAExC,MAAM,UAAU,iBAAiB,CAC/B,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,KAAwD,EAAE;IAEhF,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,IAAI,IAAI,GAAG,SAAS,CAAC;IAErB,OAAO;QACL,2EAA2E;QAC3E,2EAA2E;QAC3E,kDAAkD;QAClD,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,OAAO,IAAI,KAAK,UAAU,IAAI,MAAM,KAAK,IAAI;QACxD,MAAM,EAAE,MAAM,KAAK,IAAI;QACvB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,KAAK;QACnB,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,2EAA2E;YAC3E,0EAA0E;YAC1E,4EAA4E;YAC5E,MAAM,QAAQ,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrF,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;YAC9B,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,oEAAoE;oBACpE,qEAAqE;oBACrE,0DAA0D;oBAC1D,IAAI,MAAM,EAAE,CAAC;wBACX,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;wBAC9C,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;wBACd,MAAM,GAAG,CAAC;oBACZ,CAAC;oBACD,uEAAuE;gBACzE,CAAC;YACH,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,IAAI,GAAG,IAAI,CAAC;YACZ,OAAO,GAAG,CAAC;QACb,CAAC;QAED,GAAG;YACD,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;QAED,kEAAkE;QAClE,MAAM;YACJ,IAAI,CAAC,GAAG,SAAS,CAAC;YAClB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5B,IAAI,IAAI,CAAC,SAAS,KAAK,CAAC;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;gBACxF,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBAClG,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAW,EACX,EAAE,cAAc,GAAG,KAAK,EAAE,aAAa,KAAwD,EAAE;IAEjG,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;eAC3D,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC;eACnD,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;eACvE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,CAAC;eAC7B,CAAC,WAAW,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;mBACnD,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACvF,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACjC,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;gBAAE,OAAO,KAAK,CAAC;YACtG,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACxE,CAAC;YACF,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,aAAa,CAAC;gBAAE,OAAO,KAAK,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAK;IAC3B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,GAAG,EAAmC,CAAC;QACtE,IAAI,EAAE,KAAK,GAAG,KAAK,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACpG,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,SAAS;QAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvG,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,WAAW,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC9F,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC9C,IAAI,WAAW,GAAG,IAAI,GAAG,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,cAAc,GAAG,IAAI;IACpF,OAAO,MAAM,EAAE,SAAS,KAAK,UAAU;WAClC,oBAAoB,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;WACrE,CAAC,cAAc,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,IAAI;IACrB,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAO,EAAE,EAC/C,QAAQ,GAAG,aAAa,EACxB,UAAU,GAAG,EAAE,EACf,eAAe,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,GAC5C,GAAG,EAAE;IACJ,KAAK,MAAM,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,yDAAyD,MAAM,IAAI,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,IAAI,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,GAAG,IAAI;QAC9D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;QACjC,SAAS,EAAE,OAAO,CAAC,OAAO,KAAK,IAAI;QACnC,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,QAAQ;QAER,KAAK,CAAC,MAAM;YACV,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;YACrG,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACxC,cAAc,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;YACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAClF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACxF,CAAC;YAED,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;gBACtD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACpD,IAAI,SAAS;oBAAE,OAAO,SAAS,CAAC;gBAEhC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAC3F,MAAM,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBAC7C,MAAM,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACvD,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC5E,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBACH,IAAI,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;wBAChF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;wBAC5D,IAAI,SAAS;4BAAE,OAAO,SAAS,CAAC;wBAChC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,uEAAuE;oBACvE,wEAAwE;oBACxE,2CAA2C;oBAC3C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;oBAC7D,IAAI,UAAU;wBAAE,OAAO,UAAU,CAAC;oBAClC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;oBAClE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;oBACtB,MAAM,OAAO,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,CAAC,GAAG;YACP,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YAChH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACnG,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,MAAM;YACV,IAAI,CAAC;gBACH,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;gBAChG,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;gBAC/E,IAAI,IAAI,GAAG,SAAS,CAAC;gBACrB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;gBACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;oBACpD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;oBAC9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;2BAC3D,MAAM,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;2BACjD,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;wBACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;oBAC9E,CAAC;oBACD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;oBACjC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;wBACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;oBAC3D,CAAC;oBACD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC1B,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC3F,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,YAAY,CAAC;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;gBAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC;YAChF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;YACnE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,iCAAiC;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,EAAE;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QACpF,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC;IACF,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACrB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC;YACxC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ;YAC9B,OAAO,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM;YACnD,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;YACrD,MAAM,MAAM,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;YAClC,IAAI,MAAM,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC;mBACxD,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvG,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7D,SAAS;IACT,cAAc;IACd,oBAAoB;IACpB,SAAS;CACV,CAAC,CAAC;AAEH,eAAe;IACb,iBAAiB;IACjB,oBAAoB;IACpB,uBAAuB;IACvB,iCAAiC;CAClC,CAAC"}

package/dist/execution-binding.d.ts

@@ -0,0 +1,49 @@
+export declare const EXECUTION_BINDING_VERSION = "EP-GATE-EXECUTION-BINDING-v1";
+export declare function canonicalize(v: any): any;
+export declare function hashCanonical(v: any): string;
+export declare function materialFieldsFor(requirement: any): any[];
+/**
+ * Verifies that the signed claim and the executor-observed mutation fields
+ * match for the action pack. The executor must pass `observedAction` from the
+ * system of record, not from the agent request body.
+ */
+export declare function verifyExecutionBinding({ requirement, receipt, observedAction }?: {
+    requirement?: any;
+    receipt?: any;
+    observedAction?: any;
+}): {
+    ok: boolean;
+    required: boolean;
+    required_fields: never[];
+    signed_hash: null;
+    observed_hash: null;
+    '@version'?: undefined;
+    missing_signed_fields?: undefined;
+    missing_observed_fields?: undefined;
+    invalid_signed_fields?: undefined;
+    invalid_observed_fields?: undefined;
+    mismatched_fields?: undefined;
+    note?: undefined;
+} | {
+    '@version': string;
+    ok: boolean;
+    required: boolean;
+    required_fields: any[];
+    missing_signed_fields: PropertyKey[];
+    missing_observed_fields: PropertyKey[];
+    invalid_signed_fields: PropertyKey[];
+    invalid_observed_fields: PropertyKey[];
+    mismatched_fields: PropertyKey[];
+    signed_hash: string | null;
+    observed_hash: string | null;
+    note: string;
+};
+declare const _default: {
+    EXECUTION_BINDING_VERSION: string;
+    canonicalize: typeof canonicalize;
+    hashCanonical: typeof hashCanonical;
+    materialFieldsFor: typeof materialFieldsFor;
+    verifyExecutionBinding: typeof verifyExecutionBinding;
+};
+export default _default;
+//# sourceMappingURL=execution-binding.d.ts.map

package/dist/execution-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-binding.d.ts","sourceRoot":"","sources":["../src/execution-binding.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,yBAAyB,iCAAiC,CAAC;AAkGxE,wBAAgB,YAAY,CAAC,CAAC,KAAA,OAG7B;AAED,wBAAgB,aAAa,CAAC,CAAC,KAAA,UAE9B;AAoBD,wBAAgB,iBAAiB,CAAC,WAAW,KAAA,SAG5C;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,GAAE;IAC/E,WAAW,CAAC,EAAE,GAAG,CAAC;IAClB,OAAO,CAAC,EAAE,GAAG,CAAC;IACd,cAAc,CAAC,EAAE,GAAG,CAAC;CACjB;;;;;;;;;;;;;;;;;;;;;;;;;;EAkFL;;;;;;;;AAED,wBAME"}