@emilia-protocol/gate 0.11.0 → 0.14.0

package/roster.js

@@ -1,265 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * EMILIA Gate — signer-roster sync from an enterprise IdP (EP-GATE-ROSTER-v1).
- *
- * The boring key story: WHO may approve is an HR fact, not a crypto fact. This
- * module turns a SCIM-like IdP export into a versioned signer roster and
- * reconciles a key registry (key-registry.js) against it, so a deprovisioned
- * employee STOPS being an acceptable approver on the next sync. Fail closed:
- *   - only `active === true` users' keys are ever pinned; anything else
- *     (false, missing, truthy-but-not-boolean) never pins;
- *   - a user absent from the import — offboarded, or silently dropped by a
- *     broken IdP export — has every previously pinned key revoked;
- *   - a kid claimed by two principals (or carrying two different key
- *     materials) is CONTESTED: it pins nothing and is revoked if present;
- *   - an import that would leave ZERO active signers requires an explicit
- *     `allowEmpty` acknowledgment, so an empty/broken IdP response cannot
- *     silently mass-revoke every approver.
- *
- * importRoster/diffRoster are pure (inputs in, artifact out; `importedAt` is
- * the caller-supplied clock). applyRosterToRegistry mutates the given registry
- * through its real API: key-registry CAN express revocation (`revoke(kid, at)`,
- * hard and fail-closed), so reconciliation performs it directly and the
- * returned `revoked` list is the exact set of revocations performed.
- */
-
-export const ROSTER_VERSION = 'EP-GATE-ROSTER-v1';
-
-/**
- * Import a SCIM-like IdP user export into a signer roster.
- * @param {Array<{id:string, userName:string, active:boolean, emails?:any, keys?:Array<{kid:string, publicKey:string}>}>} idpUsers
- * @param {object} o
- * @param {string} o.source        IdP provenance, e.g. 'scim:okta:acme' (required)
- * @param {string|number} [o.importedAt]  import time (ISO or ms); the caller's clock
- * @param {boolean} [o.allowEmpty=false]  acknowledge an import with zero active signers
- * @returns {{version:string, source:string, imported_at:string, signers:Array<{principal:string, kid:string, publicKey:string, active:boolean}>, integrity_warnings:object[]}}
- */
-export function importRoster(idpUsers, { source, importedAt, allowEmpty = false } = {}) {
-  if (!Array.isArray(idpUsers)) throw new Error('roster import: idpUsers must be an array');
-  if (!source || typeof source !== 'string') {
-    throw new Error('roster import: source (IdP provenance, e.g. "scim:okta:acme") is required');
-  }
-  const atMs = importedAt == null
-    ? Date.now()
-    : (typeof importedAt === 'number' ? importedAt : Date.parse(importedAt));
-  if (!Number.isFinite(atMs)) throw new Error('roster import: importedAt is not a valid time');
-
-  const warnings = [];
-  const candidates = [];
-  const usersByPrincipal = new Map();
-
-  for (const u of idpUsers) {
-    // A user without a stable id AND a userName cannot be diffed or revoked
-    // reliably later — excluded, never an approver.
-    if (!u || typeof u !== 'object'
-      || typeof u.id !== 'string' || !u.id
-      || typeof u.userName !== 'string' || !u.userName) {
-      warnings.push({ code: 'malformed_user', id: u?.id ?? null, userName: u?.userName ?? null });
-      continue;
-    }
-    const principal = u.userName;
-    usersByPrincipal.set(principal, (usersByPrincipal.get(principal) || 0) + 1);
-    const active = u.active === true; // strictly boolean true; anything else never pins
-    for (const k of Array.isArray(u.keys) ? u.keys : []) {
-      if (!k || typeof k.kid !== 'string' || !k.kid
-        || typeof k.publicKey !== 'string' || !k.publicKey) {
-        warnings.push({ code: 'malformed_key', principal, kid: k?.kid ?? null });
-        continue;
-      }
-      candidates.push({ principal, kid: k.kid, publicKey: k.publicKey, active });
-    }
-  }
-
-  // Two IdP users claiming one principal: identity is ambiguous — neither pins.
-  const contestedPrincipals = new Set();
-  for (const [principal, count] of usersByPrincipal) {
-    if (count > 1) {
-      contestedPrincipals.add(principal);
-      warnings.push({ code: 'duplicate_principal', principal, users: count });
-    }
-  }
-  let entries = candidates.filter((c) => !contestedPrincipals.has(c.principal));
-
-  // Exact-duplicate rows collapse silently (same principal + kid + key).
-  const seen = new Set();
-  entries = entries.filter((c) => {
-    const id = `${c.principal}\n${c.kid}\n${c.publicKey}`;
-    if (seen.has(id)) return false;
-    seen.add(id);
-    return true;
-  });
-
-  // One kid claimed by two principals, or one kid carrying two key materials,
-  // is an integrity failure: the contested kid pins NOTHING for anyone.
-  const byKid = new Map();
-  for (const c of entries) {
-    const g = byKid.get(c.kid) || { principals: new Set(), keys: new Set() };
-    g.principals.add(c.principal);
-    g.keys.add(c.publicKey);
-    byKid.set(c.kid, g);
-  }
-  const contestedKids = new Set();
-  for (const [kid, g] of byKid) {
-    if (g.principals.size > 1 || g.keys.size > 1) {
-      contestedKids.add(kid);
-      warnings.push({ code: 'duplicate_kid', kid, principals: [...g.principals].sort() });
-    }
-  }
-  entries = entries.filter((c) => !contestedKids.has(c.kid));
-
-  // Mass-deprovision guard: a roster with zero active signers would, on apply,
-  // revoke EVERY approver. That is indistinguishable from a broken IdP export,
-  // so it requires the operator's explicit acknowledgment.
-  if (!allowEmpty && !entries.some((e) => e.active)) {
-    throw new Error('roster import: zero active signers (mass-deprovision guard) — pass allowEmpty:true to acknowledge revoking every approver');
-  }
-
-  entries.sort((a, b) => (a.principal < b.principal ? -1 : a.principal > b.principal ? 1
-    : a.kid < b.kid ? -1 : a.kid > b.kid ? 1 : 0));
-
-  return {
-    version: ROSTER_VERSION,
-    source,
-    imported_at: new Date(atMs).toISOString(),
-    signers: entries.map(({ principal, kid, publicKey, active }) => ({ principal, kid, publicKey, active })),
-    integrity_warnings: warnings,
-  };
-}
-
-/** A roster must be well-formed before it can drive a diff or a registry mutation. */
-function assertRoster(r, name) {
-  if (!r || r.version !== ROSTER_VERSION || !Array.isArray(r.signers)) {
-    throw new Error(`roster: ${name} is not an ${ROSTER_VERSION} roster`);
-  }
-  for (const s of r.signers) {
-    if (!s || typeof s.principal !== 'string' || !s.principal
-      || typeof s.kid !== 'string' || !s.kid
-      || typeof s.publicKey !== 'string' || !s.publicKey
-      || typeof s.active !== 'boolean') {
-      throw new Error(`roster: ${name} contains a malformed signer entry`);
-    }
-  }
-}
-
-function groupByPrincipal(roster) {
-  const m = new Map();
-  for (const s of roster.signers) {
-    const g = m.get(s.principal) || { kids: new Set(), active: false };
-    g.kids.add(s.kid);
-    if (s.active === true) g.active = true;
-    m.set(s.principal, g);
-  }
-  return m;
-}
-
-/**
- * Diff two rosters at the principal level.
- * `removed`/`deactivated` carry the PREVIOUS roster's kids — the revocation
- * candidates; `added` carries the next roster's kids.
- * @returns {{added:Array<{principal:string,kids:string[]}>, removed:Array<{principal:string,kids:string[]}>, deactivated:Array<{principal:string,kids:string[]}>}}
- */
-export function diffRoster(previous, next) {
-  assertRoster(previous, 'previous');
-  assertRoster(next, 'next');
-  const prev = groupByPrincipal(previous);
-  const nxt = groupByPrincipal(next);
-  const added = [];
-  const removed = [];
-  const deactivated = [];
-  for (const [principal, g] of nxt) {
-    if (!prev.has(principal)) added.push({ principal, kids: [...g.kids].sort() });
-  }
-  for (const [principal, g] of prev) {
-    if (!nxt.has(principal)) { removed.push({ principal, kids: [...g.kids].sort() }); continue; }
-    if (g.active && !nxt.get(principal).active) deactivated.push({ principal, kids: [...g.kids].sort() });
-  }
-  const byPrincipal = (a, b) => (a.principal < b.principal ? -1 : a.principal > b.principal ? 1 : 0);
-  added.sort(byPrincipal); removed.sort(byPrincipal); deactivated.sort(byPrincipal);
-  return { added, removed, deactivated };
-}
-
-/**
- * Reconcile a key registry (createKeyRegistry) against a roster:
- *   - PIN each ACTIVE, uncontested signer's key not already present;
- *   - REVOKE every registry kid not owned by an active roster signer — absent
- *     or inactive means deprovisioned. The registry passed here must therefore
- *     be DEDICATED to roster-managed approver keys.
- * key-registry's API DOES express revocation (revoke(kid, at) — hard,
- * fail-closed), so revocations are performed directly; `revoked` is the exact
- * set performed, returned for the caller's evidence trail.
- * A kid the registry has EVER revoked is never re-pinned (a rehire gets a new
- * key; revoked key material stays dead).
- * @param {object} roster    an EP-GATE-ROSTER-v1 roster
- * @param {object} registry  createKeyRegistry() instance (add/revoke/status)
- * @param {object} [o]
- * @param {string|number} [o.revokedAt=roster.imported_at]  revocation timestamp
- * @returns {{pinned:Array<{principal:string,kid:string}>, already_pinned:string[], revoked:Array<{kid:string,revoked_at:string|number,reason:string}>, refused:Array<{principal:string,kid:string,reason:string}>}}
- */
-export function applyRosterToRegistry(roster, registry, { revokedAt } = {}) {
-  assertRoster(roster, 'roster');
-  // Fail closed on the registry too: never coerce a flat key array here —
-  // asKeyRegistry would build a DETACHED registry and every revocation this
-  // function performs would be silently lost.
-  if (!registry || typeof registry.add !== 'function'
-    || typeof registry.revoke !== 'function' || typeof registry.status !== 'function') {
-    throw new Error('roster apply: registry must expose add/revoke/status (createKeyRegistry)');
-  }
-  const at = revokedAt ?? roster.imported_at;
-
-  // Recompute kid contests here as well — a hand-built roster must not bypass
-  // the import-time duplicate-kid integrity check.
-  const byKid = new Map();
-  for (const s of roster.signers) {
-    const g = byKid.get(s.kid) || { principals: new Set(), keys: new Set() };
-    g.principals.add(s.principal);
-    g.keys.add(s.publicKey);
-    byKid.set(s.kid, g);
-  }
-  const contested = new Set();
-  for (const [kid, g] of byKid) {
-    if (g.principals.size > 1 || g.keys.size > 1) contested.add(kid);
-  }
-
-  const activeByKid = new Map();
-  for (const s of roster.signers) {
-    if (s.active === true && !contested.has(s.kid)) activeByKid.set(s.kid, s);
-  }
-
-  const status = registry.status();
-  const everRevoked = new Set(status.filter((e) => e.revoked).map((e) => e.kid));
-  const present = new Set(status.map((e) => e.kid));
-
-  const pinned = [];
-  const alreadyPinned = [];
-  const revoked = [];
-  const refused = [];
-
-  for (const s of roster.signers) {
-    if (s.active === true && contested.has(s.kid)) {
-      refused.push({ principal: s.principal, kid: s.kid, reason: 'contested_kid' });
-    }
-  }
-
-  for (const [kid, s] of activeByKid) {
-    if (everRevoked.has(kid)) {
-      refused.push({ principal: s.principal, kid, reason: 'kid_previously_revoked' });
-      continue;
-    }
-    if (present.has(kid)) { alreadyPinned.push(kid); continue; }
-    registry.add({ kid, key: s.publicKey });
-    pinned.push({ principal: s.principal, kid });
-  }
-
-  // Absent-or-inactive (and contested) kids stop being acceptable NOW.
-  const done = new Set();
-  for (const e of status) {
-    if (e.revoked || done.has(e.kid) || activeByKid.has(e.kid)) continue;
-    registry.revoke(e.kid, at);
-    done.add(e.kid);
-    revoked.push({ kid: e.kid, revoked_at: at, reason: contested.has(e.kid) ? 'contested_kid' : 'absent_or_inactive' });
-  }
-
-  return { pinned, already_pinned: alreadyPinned, revoked, refused };
-}
-
-export default { ROSTER_VERSION, importRoster, diffRoster, applyRosterToRegistry };
+// Compatibility entry point for the TypeScript roster module.
+export * from './dist/roster.js';
+export { default } from './dist/roster.js';

package/runtime-monitor.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Compatibility entry point for the TypeScript runtime-monitor module.
+export * from './dist/runtime-monitor.js';
+export { default } from './dist/runtime-monitor.js';

package/settlement.js

@@ -1,300 +1,4 @@
 // SPDX-License-Identifier: Apache-2.0
-/**
- * Deterministic evidence-completeness decision for settlement workflows.
- *
- * This is not a payment rail and does not decide legal liability. It answers a
- * narrower question: does a relying-party-pinned profile have every verified,
- * digest-joined artifact it required before its own settlement system acts?
- */
-import { canonicalize, hashCanonical } from './execution-binding.js';
-import {
-  NETWORK_WITNESS_EVENTS,
-  acceptNetworkWitnessStatement,
-  networkWitnessDigest,
-  validateTrustedNetworkWitnessAcceptance,
-} from './network-witness.js';
-
-export const SETTLEMENT_PROFILE_VERSION = 'EP-GATE-SETTLEMENT-PROFILE-v1';
-export const SETTLEMENT_RESULT_VERSION = 'EP-GATE-SETTLEMENT-RESULT-v1';
-export const SETTLEMENT_VERDICTS = Object.freeze([
-  'eligible',
-  'refuse_profile_invalid',
-  'refuse_authorization',
-  'refuse_execution',
-  'refuse_witness',
-  'refuse_outcome',
-  'refuse_coverage',
-  'refuse_binding',
-]);
-
-const DIGEST_RE = /^sha256:[0-9a-f]{64}$/;
-
-function isPlainObject(value) {
-  if (value === null || typeof value !== 'object' || Array.isArray(value)) return false;
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
-
-function exactKeys(value, allowed) {
-  return isPlainObject(value) && Object.keys(value).every((key) => allowed.has(key));
-}
-
-function string(value, max = 512) {
-  return typeof value === 'string' && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
-}
-
-function digest(value) {
-  return typeof value === 'string' && DIGEST_RE.test(value);
-}
-
-function canonicalSnapshot(value) {
-  return JSON.parse(canonicalize(value));
-}
-
-function validateProfile(profile) {
-  if (!exactKeys(profile, new Set([
-    '@version', 'profile_id', 'require_witness', 'require_outcome', 'require_coverage',
-    'required_witness_event', 'required_witness_id', 'required_capture_point_id',
-    'required_coverage_state', 'required_surface_id',
-  ]))) return 'profile_shape_invalid';
-  if (profile['@version'] !== SETTLEMENT_PROFILE_VERSION || !string(profile.profile_id)) return 'profile_identity_invalid';
-  for (const field of ['require_witness', 'require_outcome', 'require_coverage']) {
-    if (profile[field] !== true && profile[field] !== false) return `profile_${field}_invalid`;
-  }
-  if (profile.require_witness && (!string(profile.required_witness_event)
-      || !NETWORK_WITNESS_EVENTS.includes(profile.required_witness_event)
-      || !string(profile.required_witness_id) || !string(profile.required_capture_point_id))) {
-    return 'profile_witness_binding_invalid';
-  }
-  if (!profile.require_witness && (profile.required_witness_event !== undefined
-      || profile.required_witness_id !== undefined || profile.required_capture_point_id !== undefined)) {
-    return 'profile_witness_fields_forbidden';
-  }
-  if (profile.require_coverage && (profile.required_coverage_state !== 'gated'
-      || !string(profile.required_surface_id))) return 'profile_coverage_binding_invalid';
-  if (!profile.require_coverage && (profile.required_coverage_state !== undefined
-      || profile.required_surface_id !== undefined)) return 'profile_coverage_fields_forbidden';
-  try { canonicalize(profile); } catch { return 'profile_canonicalization_invalid'; }
-  return null;
-}
-
-export function settlementProfileDigest(profile) {
-  const invalid = validateProfile(profile);
-  if (invalid) throw new TypeError(invalid);
-  return `sha256:${hashCanonical(profile)}`;
-}
-
-function refused(verdict, reason, profileHash, checks, actionDigest = null) {
-  const body = {
-    '@version': SETTLEMENT_RESULT_VERSION,
-    verdict,
-    eligible: false,
-    reason,
-    profile_hash: profileHash,
-    action_digest: actionDigest,
-    checks,
-    limitations: [
-      'This result is evidence-completeness input to a relying party; it is not a legal settlement instruction or warranty.',
-      'A valid evidence bundle does not establish physical truth beyond the separately verified outcome source.',
-    ],
-  };
-  return Object.freeze({ ...body, result_hash: `sha256:${hashCanonical(body)}` });
-}
-
-async function invokeVerifier(verifier, artifact, context) {
-  if (typeof verifier !== 'function') return { accepted: false, reason: 'pinned_verifier_missing' };
-  try {
-    const result = await verifier(artifact, Object.freeze({ ...context }));
-    if (!isPlainObject(result)) return { accepted: false, reason: 'verifier_result_invalid' };
-    return canonicalSnapshot(result);
-  } catch {
-    return { accepted: false, reason: 'pinned_verifier_error' };
-  }
-}
-
-/**
- * Evaluate a raw evidence bundle. Authorization, execution, outcome, and
- * coverage are interpreted only by verifier functions pinned in code by the
- * relying party; no artifact may select its own verifier.
- */
-export async function evaluateSettlementEligibility(bundle = {}, options = {}) {
-  let profileInput;
-  let profileInputInvalid = false;
-  try { profileInput = canonicalSnapshot(options.profile); } catch { profileInputInvalid = true; }
-  let verifyAuthorization;
-  let verifyExecution;
-  let verifyOutcome;
-  let verifyCoverage;
-  let pinnedWitnesses;
-  let trustedWitnessAcceptance = null;
-  let hasTrustedWitnessAcceptance = false;
-  let witnessSequenceStore;
-  let allowEphemeralWitnessStore = false;
-  let witnessNow;
-  let witnessMaxAgeSec;
-  let maxFutureSkewSec;
-  try {
-    verifyAuthorization = options.verifyAuthorization;
-    verifyExecution = options.verifyExecution;
-    verifyOutcome = options.verifyOutcome;
-    verifyCoverage = options.verifyCoverage;
-    pinnedWitnesses = options.pinnedWitnesses === undefined
-      ? undefined
-      : canonicalSnapshot(options.pinnedWitnesses);
-    hasTrustedWitnessAcceptance = Object.hasOwn(options, 'trustedWitnessAcceptance');
-    if (hasTrustedWitnessAcceptance) {
-      trustedWitnessAcceptance = canonicalSnapshot(options.trustedWitnessAcceptance);
-    }
-    witnessSequenceStore = options.witnessSequenceStore;
-    allowEphemeralWitnessStore = options.allowEphemeralWitnessStore === true;
-    witnessNow = options.now;
-    witnessMaxAgeSec = options.witnessMaxAgeSec;
-    maxFutureSkewSec = options.maxFutureSkewSec;
-  } catch {
-    pinnedWitnesses = [];
-    hasTrustedWitnessAcceptance = true;
-    trustedWitnessAcceptance = null;
-  }
-  let profile;
-  let invalid;
-  if (profileInputInvalid) {
-    invalid = 'profile_hostile_input';
-    profile = null;
-  } else {
-    invalid = validateProfile(profileInput);
-    profile = profileInput;
-  }
-  const baseChecks = {
-    profile: !invalid,
-    authorization: false,
-    execution: false,
-    witness: profile?.require_witness === false,
-    outcome: profile?.require_outcome === false,
-    coverage: profile?.require_coverage === false,
-    digest_join: false,
-  };
-  if (invalid) return refused('refuse_profile_invalid', invalid, null, baseChecks);
-  const profileHash = settlementProfileDigest(profile);
-  let evidence;
-  try {
-    evidence = JSON.parse(canonicalize(bundle));
-  } catch {
-    return refused('refuse_binding', 'evidence_bundle_not_canonical_json', profileHash, baseChecks);
-  }
-  const actionDigest = evidence.action_digest;
-  if (!digest(actionDigest)) {
-    return refused('refuse_binding', 'action_digest_invalid', profileHash, baseChecks);
-  }
-  const context = { action_digest: actionDigest, profile_hash: profileHash };
-
-  const authorization = await invokeVerifier(verifyAuthorization, evidence.authorization, context);
-  if (authorization.accepted !== true || authorization.action_digest !== actionDigest
-      || !digest(authorization.decision_digest)) {
-    return refused('refuse_authorization', authorization.reason ?? 'authorization_not_verified', profileHash, baseChecks, actionDigest);
-  }
-  baseChecks.authorization = true;
-
-  const execution = await invokeVerifier(verifyExecution, evidence.execution, {
-    ...context,
-    authorization_digest: authorization.decision_digest,
-  });
-  if (execution.accepted !== true || execution.outcome !== 'executed'
-      || execution.action_digest !== actionDigest || !digest(execution.execution_digest)) {
-    return refused('refuse_execution', execution.reason ?? 'execution_not_verified', profileHash, baseChecks, actionDigest);
-  }
-  baseChecks.execution = true;
-  if (execution.authorization_digest !== authorization.decision_digest) {
-    return refused('refuse_binding', 'execution_authorization_digest_mismatch', profileHash, baseChecks, actionDigest);
-  }
-
-  let witness = null;
-  if (profile.require_witness) {
-    const witnessOptions = {
-      expectedActionDigest: actionDigest,
-      expectedEvent: profile.required_witness_event,
-      maxAgeSec: witnessMaxAgeSec,
-      maxFutureSkewSec,
-      now: witnessNow,
-      allowEphemeralStore: allowEphemeralWitnessStore,
-    };
-    if (hasTrustedWitnessAcceptance) {
-      let expectedStatementDigest;
-      try { expectedStatementDigest = networkWitnessDigest(evidence.witness); } catch {
-        return refused('refuse_witness', 'witness_statement_digest_invalid', profileHash, baseChecks, actionDigest);
-      }
-      witness = validateTrustedNetworkWitnessAcceptance(trustedWitnessAcceptance, {
-        ...witnessOptions,
-        expectedStatementDigest,
-      });
-    } else {
-      witness = await acceptNetworkWitnessStatement(evidence.witness, {
-        ...witnessOptions,
-        pinnedWitnesses,
-        sequenceStore: witnessSequenceStore,
-      });
-    }
-    if (!witness.accepted) {
-      return refused('refuse_witness', witness.reason ?? 'witness_not_verified', profileHash, baseChecks, actionDigest);
-    }
-    if (witness.witness_id !== profile.required_witness_id
-        || witness.capture_point_id !== profile.required_capture_point_id) {
-      return refused('refuse_binding', 'witness_capture_point_mismatch', profileHash, baseChecks, actionDigest);
-    }
-    baseChecks.witness = true;
-  }
-
-  let outcome = null;
-  if (profile.require_outcome) {
-    outcome = await invokeVerifier(verifyOutcome, evidence.outcome, {
-      ...context,
-      execution_digest: execution.execution_digest,
-    });
-    if (outcome.accepted !== true || outcome.within_tolerance !== true
-        || outcome.action_digest !== actionDigest || !digest(outcome.outcome_digest)
-        || outcome.execution_digest !== execution.execution_digest) {
-      return refused('refuse_outcome', outcome.reason ?? 'outcome_not_verified', profileHash, baseChecks, actionDigest);
-    }
-    baseChecks.outcome = true;
-  }
-
-  let coverage = null;
-  if (profile.require_coverage) {
-    coverage = await invokeVerifier(verifyCoverage, evidence.coverage, context);
-    if (coverage.accepted !== true || coverage.state !== profile.required_coverage_state
-        || coverage.surface_id !== profile.required_surface_id || !digest(coverage.report_hash)) {
-      return refused('refuse_coverage', coverage.reason ?? 'coverage_not_verified', profileHash, baseChecks, actionDigest);
-    }
-    baseChecks.coverage = true;
-  }
-
-  baseChecks.digest_join = true;
-  const body = {
-    '@version': SETTLEMENT_RESULT_VERSION,
-    verdict: 'eligible',
-    eligible: true,
-    reason: null,
-    profile_hash: profileHash,
-    action_digest: actionDigest,
-    evidence: {
-      authorization_digest: authorization.decision_digest,
-      execution_digest: execution.execution_digest,
-      ...(witness ? { witness_digest: witness.statement_digest } : {}),
-      ...(outcome ? { outcome_digest: outcome.outcome_digest } : {}),
-      ...(coverage ? { coverage_report_hash: coverage.report_hash, surface_id: coverage.surface_id } : {}),
-    },
-    checks: baseChecks,
-    limitations: [
-      'Eligible means the relying party\'s pinned evidence profile was satisfied; the relying party still owns pricing, legal effect, and payment execution.',
-      'The witness proves observation, not authorization or physical outcome; those are separate verified rows.',
-    ],
-  };
-  return Object.freeze({ ...body, result_hash: `sha256:${hashCanonical(body)}` });
-}
-
-export default {
-  SETTLEMENT_PROFILE_VERSION,
-  SETTLEMENT_RESULT_VERSION,
-  SETTLEMENT_VERDICTS,
-  settlementProfileDigest,
-  evaluateSettlementEligibility,
-};
+// Compatibility entry point for the TypeScript settlement module.
+export * from './dist/settlement.js';
+export { default } from './dist/settlement.js';