@emilia-protocol/gate 0.11.0 → 0.14.0

package/dist/execution-binding.js

@@ -0,0 +1,243 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+// Execution-field binding for EMILIA Gate. This is the executor-side control
+// that prevents "the signed claim said X, the system mutated Y".
+import crypto from 'node:crypto';
+export const EXECUTION_BINDING_VERSION = 'EP-GATE-EXECUTION-BINDING-v1';
+const MAX_JSON_DEPTH = 64;
+const MAX_JSON_NODES = 50000;
+const MAX_JSON_STRING_BYTES = 1024 * 1024;
+function validUnicodeString(value) {
+    for (let i = 0; i < value.length; i++) {
+        const unit = value.charCodeAt(i);
+        if (unit >= 0xd800 && unit <= 0xdbff) {
+            const next = value.charCodeAt(++i);
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                return false;
+        }
+        else if (unit >= 0xdc00 && unit <= 0xdfff)
+            return false;
+    }
+    return true;
+}
+function isPlainObject(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+/**
+ * Match the hardened EP canonical JSON safety profile: valid Unicode strings,
+ * booleans, null, safe integers, dense arrays, and plain data objects. Object
+ * identity is unique across the graph, so cycles and aliases both refuse.
+ */
+function assertCanonicalJson(value) {
+    const stack = [{ value, depth: 0 }];
+    const seen = new WeakSet();
+    let nodes = 0;
+    let stringBytes = 0;
+    while (stack.length) {
+        // stack.length > 0 here guarantees pop() returns an element, but
+        // Array#pop()'s type is always T | undefined.
+        const current = stack.pop();
+        if (++nodes > MAX_JSON_NODES || current.depth > MAX_JSON_DEPTH) {
+            throw new TypeError('value exceeds the EP canonical JSON resource profile');
+        }
+        const v = current.value;
+        if (v === null || typeof v === 'boolean')
+            continue;
+        if (typeof v === 'string') {
+            if (!validUnicodeString(v))
+                throw new TypeError('value contains invalid Unicode');
+            stringBytes += Buffer.byteLength(v, 'utf8');
+            if (stringBytes > MAX_JSON_STRING_BYTES)
+                throw new TypeError('value exceeds the EP canonical JSON string limit');
+            continue;
+        }
+        if (typeof v === 'number') {
+            if (!Number.isSafeInteger(v))
+                throw new TypeError('value contains a non-safe integer');
+            continue;
+        }
+        if (!Array.isArray(v) && !isPlainObject(v)) {
+            throw new TypeError('value contains a non-plain JSON object');
+        }
+        if (seen.has(v))
+            throw new TypeError('value contains a cycle or alias');
+        seen.add(v);
+        if (Array.isArray(v)) {
+            const ownKeys = Reflect.ownKeys(v);
+            if (ownKeys.length !== v.length + 1 || !ownKeys.includes('length')) {
+                throw new TypeError('value contains a sparse or extended array');
+            }
+            for (let i = 0; i < v.length; i++) {
+                const descriptor = Object.getOwnPropertyDescriptor(v, String(i));
+                if (!descriptor || descriptor.enumerable !== true || !Object.hasOwn(descriptor, 'value')) {
+                    throw new TypeError('value contains a sparse or accessor array');
+                }
+                stack.push({ value: descriptor.value, depth: current.depth + 1 });
+            }
+            continue;
+        }
+        for (const key of Reflect.ownKeys(v)) {
+            if (typeof key !== 'string' || !validUnicodeString(key)) {
+                throw new TypeError('value contains a non-JSON object key');
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(v, key);
+            if (!descriptor || descriptor.enumerable !== true || !Object.hasOwn(descriptor, 'value')) {
+                throw new TypeError('value contains a non-data JSON property');
+            }
+            stringBytes += Buffer.byteLength(key, 'utf8');
+            if (stringBytes > MAX_JSON_STRING_BYTES)
+                throw new TypeError('value exceeds the EP canonical JSON string limit');
+            stack.push({ value: descriptor.value, depth: current.depth + 1 });
+        }
+    }
+}
+function canonicalizeValidated(v) {
+    if (v === null)
+        return 'null';
+    if (Array.isArray(v))
+        return `[${v.map(canonicalizeValidated).join(',')}]`;
+    if (typeof v === 'object') {
+        return `{${Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonicalizeValidated(v[k])).join(',')}}`;
+    }
+    return JSON.stringify(v);
+}
+export function canonicalize(v) {
+    assertCanonicalJson(v);
+    return canonicalizeValidated(v);
+}
+export function hashCanonical(v) {
+    return crypto.createHash('sha256').update(canonicalize(v)).digest('hex');
+}
+function fieldValue(container, field) {
+    if (!isPlainObject(container))
+        return { state: 'invalid' };
+    const descriptor = Object.getOwnPropertyDescriptor(container, field);
+    if (!descriptor)
+        return { state: 'missing' };
+    if (descriptor.enumerable !== true || !Object.hasOwn(descriptor, 'value'))
+        return { state: 'invalid' };
+    if (descriptor.value === null)
+        return { state: 'missing' };
+    try {
+        assertCanonicalJson(descriptor.value);
+        return { state: 'valid', value: descriptor.value };
+    }
+    catch {
+        return { state: 'invalid' };
+    }
+}
+function equalValue(a, b) {
+    return canonicalize(a) === canonicalize(b);
+}
+export function materialFieldsFor(requirement) {
+    const fields = requirement?.execution_binding?.required_fields;
+    return Array.isArray(fields) ? [...new Set(fields.filter(Boolean))] : [];
+}
+/**
+ * Verifies that the signed claim and the executor-observed mutation fields
+ * match for the action pack. The executor must pass `observedAction` from the
+ * system of record, not from the agent request body.
+ */
+export function verifyExecutionBinding({ requirement, receipt, observedAction } = {}) {
+    const requiredFields = materialFieldsFor(requirement);
+    if (requiredFields.length === 0) {
+        return { ok: true, required: false, required_fields: [], signed_hash: null, observed_hash: null };
+    }
+    const signed = receipt?.payload?.claim || {};
+    const observed = observedAction || {};
+    const missingSigned = [];
+    const missingObserved = [];
+    const invalidSigned = [];
+    const invalidObserved = [];
+    const mismatched = [];
+    // Null-prototype accumulators. A required field literally named `__proto__`
+    // written onto a plain `{}` hits Object.prototype's setter instead of
+    // creating an own key: the value silently escapes the binding digest, and
+    // when it is an object it repoints the accumulator's prototype so the
+    // aggregate re-check below throws with nothing to attribute the refusal to.
+    const signedValues = Object.create(null);
+    const observedValues = Object.create(null);
+    // Field names accepted into each accumulator, recorded at the point of
+    // acceptance. The aggregate re-check refuses by this list rather than reading
+    // the accumulator back, so a refusal stays attributable for every property
+    // key -- including names no `Object.keys` walk can return.
+    const signedAccepted = [];
+    const observedAccepted = [];
+    for (const field of requiredFields) {
+        // Resolve the property key exactly once per iteration. A non-string entry
+        // is coerced on every use, so reading through the raw entry and writing
+        // through it again can address two different properties.
+        const key = typeof field === 'symbol' ? field : String(field);
+        const expected = fieldValue(signed, key);
+        const actual = fieldValue(observed, key);
+        if (expected.state === 'missing') {
+            missingSigned.push(key);
+        }
+        else if (expected.state === 'invalid') {
+            invalidSigned.push(key);
+        }
+        else {
+            signedValues[key] = expected.value;
+            signedAccepted.push(key);
+        }
+        if (actual.state === 'missing') {
+            missingObserved.push(key);
+        }
+        else if (actual.state === 'invalid') {
+            invalidObserved.push(key);
+        }
+        else {
+            observedValues[key] = actual.value;
+            observedAccepted.push(key);
+        }
+        if (expected.state === 'valid' && actual.state === 'valid'
+            && !equalValue(expected.value, actual.value))
+            mismatched.push(key);
+    }
+    // Per-field checks do not see one object reused by two required fields.
+    // Validate the aggregate graphs before computing either digest.
+    try {
+        assertCanonicalJson(signedValues);
+    }
+    catch {
+        for (const field of signedAccepted) {
+            if (!invalidSigned.includes(field))
+                invalidSigned.push(field);
+        }
+    }
+    try {
+        assertCanonicalJson(observedValues);
+    }
+    catch {
+        for (const field of observedAccepted) {
+            if (!invalidObserved.includes(field))
+                invalidObserved.push(field);
+        }
+    }
+    return {
+        '@version': EXECUTION_BINDING_VERSION,
+        ok: missingSigned.length === 0 && missingObserved.length === 0
+            && invalidSigned.length === 0 && invalidObserved.length === 0 && mismatched.length === 0,
+        required: true,
+        required_fields: requiredFields,
+        missing_signed_fields: missingSigned,
+        missing_observed_fields: missingObserved,
+        invalid_signed_fields: invalidSigned,
+        invalid_observed_fields: invalidObserved,
+        mismatched_fields: mismatched,
+        signed_hash: invalidSigned.length === 0 ? hashCanonical(signedValues) : null,
+        observed_hash: invalidObserved.length === 0 ? hashCanonical(observedValues) : null,
+        note: 'Executor MUST provide observedAction from the system of record; request-body fields are not a trust source.',
+    };
+}
+export default {
+    EXECUTION_BINDING_VERSION,
+    canonicalize,
+    hashCanonical,
+    materialFieldsFor,
+    verifyExecutionBinding,
+};
+//# sourceMappingURL=execution-binding.js.map

package/dist/execution-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-binding.js","sourceRoot":"","sources":["../src/execution-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,6EAA6E;AAC7E,iEAAiE;AAEjE,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAExE,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,SAAS,kBAAkB,CAAC,KAAK;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAC;QACxD,CAAC;aAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM;YAAE,OAAO,KAAK,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAK;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAK;IAChC,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,iEAAiE;QACjE,8CAA8C;QAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC7B,IAAI,EAAE,KAAK,GAAG,cAAc,IAAI,OAAO,CAAC,KAAK,GAAG,cAAc,EAAE,CAAC;YAC/D,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,SAAS;QACnD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,gCAAgC,CAAC,CAAC;YAClF,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5C,IAAI,WAAW,GAAG,qBAAqB;gBAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,iCAAiC,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEZ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;YACnE,CAAC;YACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAClC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;oBACzF,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;gBACnE,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,SAAS;QACX,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;gBACzF,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACjE,CAAC;YACD,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,WAAW,GAAG,qBAAqB;gBAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;YACjH,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3E,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClH,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAC;IAC5B,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACvB,OAAO,qBAAqB,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,UAAU,CAAC,SAAS,EAAE,KAAK;IAClC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvG,IAAI,UAAU,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,mBAAmB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,CAAC,EAAE,CAAC;IACtB,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAW;IAC3C,MAAM,MAAM,GAAG,WAAW,EAAE,iBAAiB,EAAE,eAAe,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,KAIzE,EAAE;IACJ,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,cAAc,IAAI,EAAE,CAAC;IACtC,MAAM,aAAa,GAAkB,EAAE,CAAC;IACxC,MAAM,eAAe,GAAkB,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAkB,EAAE,CAAC;IACxC,MAAM,eAAe,GAAkB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAkB,EAAE,CAAC;IACrC,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,uEAAuE;IACvE,8EAA8E;IAC9E,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,cAAc,GAAkB,EAAE,CAAC;IACzC,MAAM,gBAAgB,GAAkB,EAAE,CAAC;IAE3C,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,0EAA0E;QAC1E,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,GAAG,GAAgB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC;YACnC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACtC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;YACnC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO;eACnD,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IAED,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,CAAC;QAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAClD,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU,EAAE,yBAAyB;QACrC,EAAE,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;eACzD,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAC1F,QAAQ,EAAE,IAAI;QACd,eAAe,EAAE,cAAc;QAC/B,qBAAqB,EAAE,aAAa;QACpC,uBAAuB,EAAE,eAAe;QACxC,qBAAqB,EAAE,aAAa;QACpC,uBAAuB,EAAE,eAAe;QACxC,iBAAiB,EAAE,UAAU;QAC7B,WAAW,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5E,aAAa,EAAE,eAAe,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI;QAClF,IAAI,EAAE,6GAA6G;KACpH,CAAC;AACJ,CAAC;AAED,eAAe;IACb,yBAAyB;IACzB,YAAY;IACZ,aAAa;IACb,iBAAiB;IACjB,sBAAsB;CACvB,CAAC"}

package/dist/formal-runtime-map.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Machine-checked source map for the explicit formal-to-runtime bridge.
+ *
+ * This is a coverage binding, not a compiler: the monitor remains reviewed
+ * JavaScript and the TLA+ model remains the source of the formal theorem.
+ */
+export declare const FORMAL_RUNTIME_BRIDGE_VERSION = "EP-FORMAL-RUNTIME-BRIDGE-v1";
+export declare const FORMAL_RUNTIME_SPEC = "formal/ep_handshake.tla";
+export declare const FORMAL_RUNTIME_CONFIG = "formal/ep_handshake.cfg";
+export declare const FORMAL_RUNTIME_INVARIANT_MAP: readonly (Readonly<{
+    runtime: "ConsumeOnceSafety";
+    formal: "ConsumeOnceSafety";
+    transition: "consumptionCommitted";
+}> | Readonly<{
+    runtime: "WriteBypassSafety";
+    formal: "WriteBypassSafety";
+    transition: "beginExecution";
+}> | Readonly<{
+    runtime: "SignoffBindingMatch";
+    formal: "SignoffBindingMatch";
+    transition: "recordDecision";
+}>)[];
+declare const _default: {
+    FORMAL_RUNTIME_BRIDGE_VERSION: string;
+    FORMAL_RUNTIME_SPEC: string;
+    FORMAL_RUNTIME_CONFIG: string;
+    FORMAL_RUNTIME_INVARIANT_MAP: readonly (Readonly<{
+        runtime: "ConsumeOnceSafety";
+        formal: "ConsumeOnceSafety";
+        transition: "consumptionCommitted";
+    }> | Readonly<{
+        runtime: "WriteBypassSafety";
+        formal: "WriteBypassSafety";
+        transition: "beginExecution";
+    }> | Readonly<{
+        runtime: "SignoffBindingMatch";
+        formal: "SignoffBindingMatch";
+        transition: "recordDecision";
+    }>)[];
+};
+export default _default;
+//# sourceMappingURL=formal-runtime-map.d.ts.map

package/dist/formal-runtime-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"formal-runtime-map.d.ts","sourceRoot":"","sources":["../src/formal-runtime-map.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAC3E,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAC7D,eAAO,MAAM,qBAAqB,4BAA4B,CAAC;AAE/D,eAAO,MAAM,4BAA4B;;;;;;;;;;;;KAIvC,CAAC;;;;;;;;;;;;;;;;;;;AAEH,wBAKE"}

package/dist/formal-runtime-map.js

@@ -0,0 +1,23 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Machine-checked source map for the explicit formal-to-runtime bridge.
+ *
+ * This is a coverage binding, not a compiler: the monitor remains reviewed
+ * JavaScript and the TLA+ model remains the source of the formal theorem.
+ */
+export const FORMAL_RUNTIME_BRIDGE_VERSION = 'EP-FORMAL-RUNTIME-BRIDGE-v1';
+export const FORMAL_RUNTIME_SPEC = 'formal/ep_handshake.tla';
+export const FORMAL_RUNTIME_CONFIG = 'formal/ep_handshake.cfg';
+export const FORMAL_RUNTIME_INVARIANT_MAP = Object.freeze([
+    Object.freeze({ runtime: 'ConsumeOnceSafety', formal: 'ConsumeOnceSafety', transition: 'consumptionCommitted' }),
+    Object.freeze({ runtime: 'WriteBypassSafety', formal: 'WriteBypassSafety', transition: 'beginExecution' }),
+    Object.freeze({ runtime: 'SignoffBindingMatch', formal: 'SignoffBindingMatch', transition: 'recordDecision' }),
+]);
+export default {
+    FORMAL_RUNTIME_BRIDGE_VERSION,
+    FORMAL_RUNTIME_SPEC,
+    FORMAL_RUNTIME_CONFIG,
+    FORMAL_RUNTIME_INVARIANT_MAP,
+};
+//# sourceMappingURL=formal-runtime-map.js.map

package/dist/formal-runtime-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"formal-runtime-map.js","sourceRoot":"","sources":["../src/formal-runtime-map.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,6BAA6B,CAAC;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AAE/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IAChH,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,EAAE,mBAAmB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC1G,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAC/G,CAAC,CAAC;AAEH,eAAe;IACb,6BAA6B;IAC7B,mBAAmB;IACnB,qBAAqB;IACrB,4BAA4B;CAC7B,CAAC"}