@emilia-protocol/gate 0.18.2 → 0.20.0

package/CHANGELOG.md

@@ -4,6 +4,62 @@
 All notable changes to `@emilia-protocol/gate` are documented here.
 This package follows [Semantic Versioning](https://semver.org/).
 
+## 0.20.0 (2026-07-28)
+
+### Added
+
+- A separately signed Loss-Allocation Schedule pinned to an exact Reliance
+  Program through a relying-party-owned Admissibility Profile.
+- An Open Exposure Ledger with aggregate ceilings across tenant, program,
+  counterparty, and action class; durable PostgreSQL custody; and mandatory
+  independent reconciliation for indeterminate execution.
+- Exact-action signed refusal statements with atomic replay acceptance and
+  optional delivery, custody, and transparency evidence references.
+- Period Coverage Reconciliation Attestations, governed-taxonomy Receipt Census
+  aggregates with coarse primary suppression, and signed external Loss
+  Experience Feeds with trusted correction lineage.
+- A bounded composed lifecycle model and runtime-refinement trace covering
+  admission, exposure reservation, invocation, uncertainty, reconciliation,
+  refusal, and terminal-state preservation.
+
+### Security
+
+- Loss schedules, refusal statements, coverage attestations, and loss feeds
+  remain separate from authorization and cannot create execution authority.
+- Open exposure remains reserved through `INVOKING` and `INDETERMINATE`; there
+  is no blind release or retry, and origin, executor, and reconciler authority
+  must remain distinct.
+- Coverage and census artifacts reconcile only supplied populations. They do
+  not establish completeness, causation, insurance coverage, legal liability,
+  adjudicated loss, solvency, or payment.
+
+## 0.19.0 (2026-07-28)
+
+### Added
+
+- `./reliance-program`, a closed, relying-party-signed source policy and
+  deterministic compiler to the existing
+  `EP-GATE-TRUST-PROGRAM-PROFILE-v1` wire format.
+- Admissibility Profile references as digest-pinned program fragments, with a
+  relying-party-owned evaluator adapter that prevents presenters from choosing
+  the acceptance bar.
+- A public JSON Schema, compiler trace, and explicit consequence ownership by
+  either a receipt program or Action Escrow.
+
+### Security
+
+- Gate now pins the independently published
+  `@emilia-protocol/verify@3.17.0` registry tarball. Reliance Program decision
+  citations therefore execute against the exact AEB/AEC verifier release whose
+  bytes are recorded in the governed package registry.
+- Compilation requires an Ed25519 signer whose pinned key is bound to the
+  named relying party, recomputes every profile self-hash, and refuses unknown
+  fields, substituted profiles, disconnected stages, action drift, and
+  ambiguous consequence ownership.
+- Compilation proves only that the signed source maps to the existing Trust
+  Program. It does not assert evidence sufficiency, authorization, provider
+  outcome, observed effect, or deployment completion.
+
 ## 0.18.2 (2026-07-27)
 
 ### Added

package/README.md

@@ -59,6 +59,48 @@ if (!out.ok) throw out.body; // 428 Receipt Required
 console.log(out.packet.verdict); // "rely"
 ```
 
+## Customer-owned Reliance Programs
+
+`@emilia-protocol/gate/reliance-program` turns a relying party's signed policy
+source into the existing Gate Trust Program wire format. It does not add a
+second authorization engine. An Admissibility Profile remains the acceptance
+bar for one evidence role; a Reliance Program composes those hash-pinned bars
+across stages and selects exactly one consequence owner.
+
+```js
+import {
+  compileRelianceProgram,
+  createAdmissibilityProfileTrustAdapter,
+  signRelianceProgram,
+} from '@emilia-protocol/gate/reliance-program';
+
+const signed = signRelianceProgram(customerOwnedSource, rpPrivateKey);
+const compiled = compileRelianceProgram(signed, {
+  trustedKeys: {
+    'rp-key-1': {
+      relying_party_id: 'payer:example',
+      public_key: rpPublicKey,
+    },
+  },
+  profiles: relyingPartyPinnedAdmissibilityProfiles,
+});
+
+// `compiled.program` is EP-GATE-TRUST-PROGRAM-PROFILE-v1.
+// The adapter runs the already-shipped profile evaluator under a constructor-
+// pinned profile; the presenter supplies evidence, never policy or trust roots.
+const verifier = createAdmissibilityProfileTrustAdapter({
+  profile: relyingPartyPinnedAdmissibilityProfiles[0],
+  evaluate: evaluateAdmissibilityProfile,
+  project: projectVerifiedPrincipalsAndTimes,
+  now: () => new Date().toISOString(),
+});
+```
+
+The signed source, its `source_digest`, the compiled `program_digest`, and the
+compiler trace remain distinct. Compilation proves a deterministic policy
+mapping; it does not prove that evidence is sufficient, authorize an action, or
+claim an external effect occurred.
+
 ## Gate Qualification v2
 
 Gate Qualification v2 treats model or agent qualification as one input to a
@@ -778,6 +820,28 @@ consequential actions by default**, so the parties with leverage (clouds, paymen
 insurers) can *require* a receipt — and "no receipt" becomes like "no TLS cert" or "unsigned binary":
 not always illegal, just untrusted. Necessary, not sufficient.
 
+## Reliance risk plane
+
+Gate `0.20.0` adds a consequence-risk plane around the existing Reliance
+Program and execution lifecycle:
+
+- `./loss-allocation-schedule` verifies separately signed, exact-program terms;
+- `./open-exposure-ledger` and `./open-exposure-ledger-postgres` reserve and
+  aggregate open exposure before provider invocation;
+- `./action-refusal-statement` emits a signed exact-action technical refusal;
+- `./coverage-reconciliation-attestation` reconciles supplied effect and
+  receipt populations for a bounded period;
+- `./receipt-census` emits governed-taxonomy aggregates with coarse primary suppression; and
+- `./loss-experience-feed` carries signed external observations whose
+  corrections require a trusted current-head lineage resolver.
+
+These artifacts do not create authority. EMILIA does not bear or allocate loss,
+adjudicate disputes, verify insurance coverage or solvency, or move money.
+Open exposure is an operational ceiling: an `INDETERMINATE` provider outcome
+stays open until an independent reconciler supplies authenticated evidence.
+See `docs/architecture/RELIANCE-RISK-PLANE.md` for the composed state model and
+claim boundaries.
+
 ## Standards
 
 The mechanism is specified in `draft-schrock-ep-enforcement-point` (the Receipt-Required rail) over

package/action-refusal-statement.js

@@ -0,0 +1 @@
+export * from './dist/action-refusal-statement.js';

package/coverage-reconciliation-attestation.js

@@ -0,0 +1 @@
+export * from './dist/coverage-reconciliation-attestation.js';

package/dist/action-refusal-statement.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Exact-action technical refusal evidence. It is not a legal determination,
+ * an adverse-benefit denial, an authorization grant, or proof of delivery.
+ */
+import { type RiskRecord, type TrustedRiskKeys } from './reliance-risk-crypto.js';
+export declare const ACTION_REFUSAL_STATEMENT_VERSION = "EP-ACTION-REFUSAL-STATEMENT-v1";
+export declare const ACTION_REFUSAL_CLAIM_BOUNDARY = "technical_refusal_not_legal_or_benefit_determination";
+export declare const ACTION_REFUSAL_CLASSES: readonly string[];
+export type ActionRefusalExpectedBindings = {
+    caid?: string;
+    action_digest?: string;
+    relying_party_id?: string;
+    program_id?: string;
+    program_version?: number;
+    source_digest?: string;
+    program_digest?: string;
+    nonce?: string;
+};
+export type ActionRefusalReplayStore = {
+    durable: boolean;
+    consume(relyingPartyId: string, nonce: string, refusalDigest: string): Promise<{
+        accepted: boolean;
+        reason: string | null;
+    }>;
+};
+export declare function signActionRefusalStatement(input: RiskRecord, signer: {
+    issuer_id: string;
+    key_id: string;
+    private_key: any;
+}): RiskRecord;
+export declare function actionRefusalStatementDigest(statement: unknown): string;
+export declare function verifyActionRefusalStatement(statement: unknown, options?: {
+    trusted_keys?: TrustedRiskKeys;
+    now?: string | number;
+    max_future_skew_sec?: number;
+    expected?: ActionRefusalExpectedBindings;
+}): {
+    accepted: false;
+    verified: false;
+    reason: string;
+    refusal_digest: string | null;
+    semantics: null;
+    delivery_evidence: "NOT_EVIDENCED";
+    custody_evidence: "NOT_EVIDENCED";
+    transparency_anchor: "NOT_REFERENCED";
+    claim_boundary: string;
+} | {
+    accepted: true;
+    verified: true;
+    reason: null;
+    refusal_digest: string | null;
+    relying_party_id: any;
+    nonce: any;
+    semantics: any;
+    delivery_evidence: string;
+    custody_evidence: string;
+    transparency_anchor: string;
+    claim_boundary: string;
+};
+export declare function createMemoryActionRefusalReplayStore(): ActionRefusalReplayStore;
+export declare function acceptActionRefusalStatement(statement: unknown, options?: {
+    trusted_keys?: TrustedRiskKeys;
+    now?: string | number;
+    max_future_skew_sec?: number;
+    expected?: ActionRefusalExpectedBindings;
+    replayStore?: ActionRefusalReplayStore;
+    allowEphemeralReplayStore?: boolean;
+}): Promise<{
+    accepted: false;
+    reason: string;
+    replay_checked: boolean;
+    replay_store_durable: boolean;
+    verified: false;
+    refusal_digest: string | null;
+    semantics: null;
+    delivery_evidence: "NOT_EVIDENCED";
+    custody_evidence: "NOT_EVIDENCED";
+    transparency_anchor: "NOT_REFERENCED";
+    claim_boundary: string;
+} | {
+    accepted: false;
+    reason: string;
+    replay_checked: boolean;
+    replay_store_durable: boolean;
+    verified: true;
+    refusal_digest: string | null;
+    relying_party_id: any;
+    nonce: any;
+    semantics: any;
+    delivery_evidence: string;
+    custody_evidence: string;
+    transparency_anchor: string;
+    claim_boundary: string;
+} | {
+    accepted: true;
+    replay_checked: boolean;
+    replay_store_durable: boolean;
+    verified: true;
+    reason: null;
+    refusal_digest: string | null;
+    relying_party_id: any;
+    nonce: any;
+    semantics: any;
+    delivery_evidence: string;
+    custody_evidence: string;
+    transparency_anchor: string;
+    claim_boundary: string;
+}>;
+//# sourceMappingURL=action-refusal-statement.d.ts.map

package/dist/action-refusal-statement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-refusal-statement.d.ts","sourceRoot":"","sources":["../src/action-refusal-statement.ts"],"names":[],"mappings":"AACA;;;GAGG;AACH,OAAO,EAEkD,KAAK,UAAU,EACtE,KAAK,eAAe,EACrB,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,gCAAgC,mCAAmC,CAAC;AACjF,eAAO,MAAM,6BAA6B,yDAAyD,CAAC;AACpG,eAAO,MAAM,sBAAsB,mBAQjC,CAAC;AA8BH,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CACL,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1D,CAAC;AA6KF,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,GAAG,CAAA;CAAE,cAKhE;AAED,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAEvE;AAuBD,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAE;IACxE,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,6BAA6B,CAAC;CACrC;;;;;;;;;;;;;;;;;;;;;;EA2CL;AAED,wBAAgB,oCAAoC,IAAI,wBAAwB,CAe/E;AAED,wBAAsB,4BAA4B,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAE;IAC9E,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,6BAA6B,CAAC;IACzC,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CAChC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CL"}

package/dist/action-refusal-statement.js

@@ -0,0 +1,333 @@
+// @ts-nocheck
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Exact-action technical refusal evidence. It is not a legal determination,
+ * an adverse-benefit denial, an authorization grant, or proof of delivery.
+ */
+import { RISK_CAID, RISK_DIGEST, riskClone, riskDigest, riskExact, riskIdentifier, riskInstant, riskRecord, signRiskBody, verifyRiskBody, } from './reliance-risk-crypto.js';
+export const ACTION_REFUSAL_STATEMENT_VERSION = 'EP-ACTION-REFUSAL-STATEMENT-v1';
+export const ACTION_REFUSAL_CLAIM_BOUNDARY = 'technical_refusal_not_legal_or_benefit_determination';
+export const ACTION_REFUSAL_CLASSES = Object.freeze([
+    'verification_failed',
+    'action_mismatch',
+    'evidence_unsatisfied',
+    'authorization_refused',
+    'replay_detected',
+    'expired',
+    'indeterminate',
+]);
+const PROGRAM_KEYS = ['program_id', 'version', 'source_digest', 'program_digest'];
+const DELIVERY_KEYS = ['channel', 'recipient_id', 'delivered_at', 'custody_digest'];
+const CUSTODY_KEYS = ['custodian_id', 'acknowledged_at', 'evidence_digest'];
+const ANCHOR_KEYS = ['method', 'evidence_digest'];
+const SEMANTIC_KEYS = ['verification', 'match', 'satisfaction', 'authorization'];
+const BODY_KEYS = [
+    '@version', 'refusal_id', 'relying_party_id', 'caid', 'action_digest',
+    'program', 'failed_requirement_ids', 'evidence_digests',
+    'challenge_digests', 'nonce', 'refused_at', 'expires_at', 'refusal_class',
+    'semantics', 'delivery', 'custody', 'transparency_anchor', 'claim_boundary',
+];
+const INPUT_KEYS = new Set([
+    ...BODY_KEYS.filter((key) => key !== '@version' && key !== 'semantics'
+        && key !== 'delivery' && key !== 'custody' && key !== 'transparency_anchor'
+        && key !== 'challenge_digests'),
+    'semantics', 'delivery', 'custody', 'transparency_anchor',
+    'challenge_digest', 'challenge_digests',
+]);
+const EXPECTED_KEYS = [
+    'caid', 'action_digest', 'relying_party_id', 'program_id', 'program_version',
+    'source_digest', 'program_digest', 'nonce',
+];
+const VERIFICATION = new Set(['VERIFIED', 'NOT_VERIFIED', 'INDETERMINATE']);
+const MATCH = new Set(['MATCH', 'MISMATCH', 'INDETERMINATE']);
+const SATISFACTION = new Set(['SATISFIED', 'NOT_SATISFIED', 'INDETERMINATE']);
+const AUTHORIZATION = new Set(['AUTHORIZED', 'NOT_AUTHORIZED', 'NOT_EVALUATED', 'INDETERMINATE']);
+function canonicalSet(value, validator, maximum, requireNonEmpty) {
+    if (!Array.isArray(value) || value.length > maximum
+        || (requireNonEmpty && value.length === 0) || !value.every(validator)
+        || new Set(value).size !== value.length)
+        return false;
+    return value.every((entry, index) => index === 0
+        || Buffer.from(value[index - 1]).compare(Buffer.from(entry)) < 0);
+}
+function sortedUnique(value, validator, maximum, label, requireNonEmpty) {
+    if (!Array.isArray(value) || value.length > maximum
+        || (requireNonEmpty && value.length === 0) || !value.every(validator)) {
+        throw new TypeError(`action refusal ${label} are invalid`);
+    }
+    if (new Set(value).size !== value.length) {
+        throw new TypeError(`action refusal ${label} are duplicate`);
+    }
+    return [...value].sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
+}
+function defaultSemantics(refusalClass) {
+    const base = {
+        verification: 'VERIFIED',
+        match: 'MATCH',
+        satisfaction: 'NOT_SATISFIED',
+        authorization: 'NOT_EVALUATED',
+    };
+    if (refusalClass === 'verification_failed')
+        return { ...base, verification: 'NOT_VERIFIED' };
+    if (refusalClass === 'action_mismatch')
+        return { ...base, match: 'MISMATCH' };
+    if (refusalClass === 'authorization_refused')
+        return { ...base, authorization: 'NOT_AUTHORIZED' };
+    if (refusalClass === 'indeterminate')
+        return { ...base, satisfaction: 'INDETERMINATE' };
+    return base;
+}
+function validSemantics(value, refusalClass) {
+    if (!riskExact(value, SEMANTIC_KEYS)
+        || !VERIFICATION.has(value.verification) || !MATCH.has(value.match)
+        || !SATISFACTION.has(value.satisfaction) || !AUTHORIZATION.has(value.authorization)
+        || value.satisfaction === 'SATISFIED')
+        return false;
+    if (refusalClass === 'verification_failed')
+        return value.verification === 'NOT_VERIFIED';
+    if (refusalClass === 'action_mismatch')
+        return value.match === 'MISMATCH';
+    if (refusalClass === 'evidence_unsatisfied')
+        return value.satisfaction === 'NOT_SATISFIED';
+    if (refusalClass === 'authorization_refused')
+        return value.authorization === 'NOT_AUTHORIZED';
+    if (refusalClass === 'indeterminate')
+        return Object.values(value).includes('INDETERMINATE');
+    return true;
+}
+function validate(value) {
+    if (!riskRecord(value))
+        throw new TypeError('action refusal statement shape is invalid');
+    const { issuer, ...body } = value;
+    if (issuer !== undefined && (!riskExact(issuer, ['id', 'key_id'])
+        || !riskIdentifier(issuer.id) || !riskIdentifier(issuer.key_id))) {
+        throw new TypeError('action refusal issuer is invalid');
+    }
+    if (!riskExact(body, BODY_KEYS) || body['@version'] !== ACTION_REFUSAL_STATEMENT_VERSION
+        || !riskIdentifier(body.refusal_id) || !riskIdentifier(body.relying_party_id)
+        || typeof body.caid !== 'string' || !RISK_CAID.test(body.caid)
+        || typeof body.action_digest !== 'string' || !RISK_DIGEST.test(body.action_digest)
+        || !riskExact(body.program, PROGRAM_KEYS) || !riskIdentifier(body.program.program_id)
+        || !Number.isSafeInteger(body.program.version) || body.program.version < 1
+        || typeof body.program.source_digest !== 'string' || !RISK_DIGEST.test(body.program.source_digest)
+        || typeof body.program.program_digest !== 'string' || !RISK_DIGEST.test(body.program.program_digest)
+        || !riskIdentifier(body.nonce) || !ACTION_REFUSAL_CLASSES.includes(body.refusal_class)
+        || !validSemantics(body.semantics, body.refusal_class)
+        || body.claim_boundary !== ACTION_REFUSAL_CLAIM_BOUNDARY) {
+        throw new TypeError('action refusal statement shape is invalid');
+    }
+    if (!canonicalSet(body.failed_requirement_ids, riskIdentifier, 128, true)) {
+        throw new TypeError('action refusal requirements are invalid, duplicate, or unsorted');
+    }
+    if (!canonicalSet(body.evidence_digests, (entry) => typeof entry === 'string' && RISK_DIGEST.test(entry), 256, false) || !canonicalSet(body.challenge_digests, (entry) => typeof entry === 'string' && RISK_DIGEST.test(entry), 256, true))
+        throw new TypeError('action refusal evidence or challenge binding is invalid');
+    const refused = riskInstant(body.refused_at);
+    const expires = riskInstant(body.expires_at);
+    if (!Number.isFinite(refused) || !Number.isFinite(expires) || expires <= refused) {
+        throw new TypeError('action refusal time window is invalid');
+    }
+    if (body.delivery !== null && (!riskExact(body.delivery, DELIVERY_KEYS)
+        || !riskIdentifier(body.delivery.channel) || !riskIdentifier(body.delivery.recipient_id)
+        || !Number.isFinite(riskInstant(body.delivery.delivered_at))
+        || riskInstant(body.delivery.delivered_at) < refused
+        || riskInstant(body.delivery.delivered_at) > expires
+        || typeof body.delivery.custody_digest !== 'string'
+        || !RISK_DIGEST.test(body.delivery.custody_digest))) {
+        throw new TypeError('action refusal delivery evidence is invalid');
+    }
+    if (body.custody !== null && (body.delivery === null
+        || !riskExact(body.custody, CUSTODY_KEYS)
+        || !riskIdentifier(body.custody.custodian_id)
+        || !Number.isFinite(riskInstant(body.custody.acknowledged_at))
+        || riskInstant(body.custody.acknowledged_at) < riskInstant(body.delivery.delivered_at)
+        || riskInstant(body.custody.acknowledged_at) > expires
+        || typeof body.custody.evidence_digest !== 'string'
+        || !RISK_DIGEST.test(body.custody.evidence_digest))) {
+        throw new TypeError('action refusal custody evidence is invalid');
+    }
+    if (body.transparency_anchor !== null && (!riskExact(body.transparency_anchor, ANCHOR_KEYS)
+        || !riskIdentifier(body.transparency_anchor.method)
+        || typeof body.transparency_anchor.evidence_digest !== 'string'
+        || !RISK_DIGEST.test(body.transparency_anchor.evidence_digest))) {
+        throw new TypeError('action refusal transparency anchor is invalid');
+    }
+}
+function normalizedInput(input) {
+    const required = [
+        'refusal_id', 'relying_party_id', 'caid', 'action_digest', 'program',
+        'failed_requirement_ids', 'evidence_digests', 'nonce', 'refused_at',
+        'expires_at', 'refusal_class', 'claim_boundary',
+    ];
+    if (!riskRecord(input) || !required.every((key) => Object.hasOwn(input, key))
+        || !Object.keys(input).every((key) => INPUT_KEYS.has(key))
+        || (Object.hasOwn(input, 'challenge_digest') === Object.hasOwn(input, 'challenge_digests'))) {
+        throw new TypeError('action refusal input shape is invalid');
+    }
+    const rawChallenges = input.challenge_digests ?? [input.challenge_digest];
+    return {
+        '@version': ACTION_REFUSAL_STATEMENT_VERSION,
+        refusal_id: input.refusal_id,
+        relying_party_id: input.relying_party_id,
+        caid: input.caid,
+        action_digest: input.action_digest,
+        program: input.program,
+        failed_requirement_ids: sortedUnique(input.failed_requirement_ids, riskIdentifier, 128, 'requirements', true),
+        evidence_digests: sortedUnique(input.evidence_digests, (entry) => typeof entry === 'string' && RISK_DIGEST.test(entry), 256, 'evidence digests', false),
+        challenge_digests: sortedUnique(rawChallenges, (entry) => typeof entry === 'string' && RISK_DIGEST.test(entry), 256, 'challenge digests', true),
+        nonce: input.nonce,
+        refused_at: input.refused_at,
+        expires_at: input.expires_at,
+        refusal_class: input.refusal_class,
+        semantics: input.semantics ?? defaultSemantics(input.refusal_class),
+        delivery: input.delivery ?? null,
+        custody: input.custody ?? null,
+        transparency_anchor: input.transparency_anchor ?? null,
+        claim_boundary: input.claim_boundary,
+    };
+}
+export function signActionRefusalStatement(input, signer) {
+    const body = normalizedInput(input);
+    validate(body);
+    return signRiskBody(ACTION_REFUSAL_STATEMENT_VERSION, body, signer);
+}
+export function actionRefusalStatementDigest(statement) {
+    return riskDigest(statement);
+}
+function expectedMismatch(body, expected) {
+    if (expected === undefined)
+        return null;
+    if (!riskRecord(expected) || !Object.keys(expected).every((key) => EXPECTED_KEYS.includes(key))) {
+        return 'expected_binding_invalid';
+    }
+    const bindings = {
+        caid: body.caid,
+        action_digest: body.action_digest,
+        relying_party_id: body.relying_party_id,
+        program_id: body.program.program_id,
+        program_version: body.program.version,
+        source_digest: body.program.source_digest,
+        program_digest: body.program.program_digest,
+        nonce: body.nonce,
+    };
+    for (const key of Object.keys(expected)) {
+        if (bindings[key] !== expected[key])
+            return `${key}_mismatch`;
+    }
+    return null;
+}
+export function verifyActionRefusalStatement(statement, options = {}) {
+    const refuse = (reason, refusalDigest = null) => ({
+        accepted: false,
+        verified: false,
+        reason,
+        refusal_digest: refusalDigest,
+        semantics: null,
+        delivery_evidence: 'NOT_EVIDENCED',
+        custody_evidence: 'NOT_EVIDENCED',
+        transparency_anchor: 'NOT_REFERENCED',
+        claim_boundary: ACTION_REFUSAL_CLAIM_BOUNDARY,
+    });
+    const signed = verifyRiskBody(statement, ACTION_REFUSAL_STATEMENT_VERSION, options.trusted_keys);
+    if (!signed.valid || !signed.body)
+        return refuse(signed.reason ?? 'refusal_invalid');
+    try {
+        validate(signed.body);
+    }
+    catch {
+        return refuse('refusal_schema_invalid', signed.artifact_digest);
+    }
+    const now = options.now === undefined
+        ? Date.now() : (typeof options.now === 'string' ? Date.parse(options.now) : Number(options.now));
+    const skew = options.max_future_skew_sec ?? 30;
+    if (!Number.isFinite(now) || !Number.isSafeInteger(skew) || skew < 0 || skew > 3600) {
+        return refuse('verification_time_invalid', signed.artifact_digest);
+    }
+    if (riskInstant(signed.body.refused_at) > now + skew * 1000) {
+        return refuse('refusal_from_future', signed.artifact_digest);
+    }
+    if (now >= riskInstant(signed.body.expires_at)) {
+        return refuse('refusal_expired', signed.artifact_digest);
+    }
+    const mismatch = expectedMismatch(signed.body, options.expected);
+    if (mismatch)
+        return refuse(mismatch, signed.artifact_digest);
+    return {
+        accepted: true,
+        verified: true,
+        reason: null,
+        refusal_digest: signed.artifact_digest,
+        relying_party_id: signed.body.relying_party_id,
+        nonce: signed.body.nonce,
+        semantics: riskClone(signed.body.semantics),
+        delivery_evidence: signed.body.delivery === null ? 'NOT_EVIDENCED' : 'REFERENCED',
+        custody_evidence: signed.body.custody === null ? 'NOT_EVIDENCED' : 'REFERENCED',
+        transparency_anchor: signed.body.transparency_anchor === null
+            ? 'NOT_REFERENCED' : 'REFERENCED_NOT_EXTERNALLY_VERIFIED',
+        claim_boundary: ACTION_REFUSAL_CLAIM_BOUNDARY,
+    };
+}
+export function createMemoryActionRefusalReplayStore() {
+    const consumed = new Map();
+    return Object.freeze({
+        durable: false,
+        async consume(relyingPartyId, nonce, refusalDigest) {
+            const key = JSON.stringify([relyingPartyId, nonce]);
+            const existing = consumed.get(key);
+            if (existing === undefined) {
+                consumed.set(key, refusalDigest);
+                return { accepted: true, reason: null };
+            }
+            if (existing === refusalDigest)
+                return { accepted: false, reason: 'statement_replay' };
+            return { accepted: false, reason: 'nonce_equivocation' };
+        },
+    });
+}
+export async function acceptActionRefusalStatement(statement, options = {}) {
+    const verification = verifyActionRefusalStatement(statement, options);
+    const refused = (reason, checked = false, durable = false) => ({
+        ...verification,
+        accepted: false,
+        reason,
+        replay_checked: checked,
+        replay_store_durable: durable,
+    });
+    if (!verification.verified)
+        return refused(verification.reason);
+    if (typeof verification.refusal_digest !== 'string')
+        return refused('refusal_digest_missing');
+    if (!riskExact(options.expected, EXPECTED_KEYS))
+        return refused('complete_expected_binding_required');
+    const store = options.replayStore;
+    if (!store || typeof store.consume !== 'function' || typeof store.durable !== 'boolean') {
+        return refused('replay_store_required');
+    }
+    if (!store.durable && options.allowEphemeralReplayStore !== true) {
+        return refused('durable_replay_store_required');
+    }
+    let result;
+    try {
+        result = await store.consume(verification.relying_party_id, verification.nonce, verification.refusal_digest);
+    }
+    catch {
+        return refused('replay_store_unavailable', false, store.durable);
+    }
+    if (!riskExact(result, ['accepted', 'reason']) || typeof result.accepted !== 'boolean'
+        || (result.reason !== null && typeof result.reason !== 'string')) {
+        return refused('replay_store_result_invalid', false, store.durable);
+    }
+    if (!result.accepted) {
+        const reason = result.reason === 'statement_replay' || result.reason === 'nonce_equivocation'
+            ? result.reason : 'replay_store_refused';
+        return refused(reason, true, store.durable);
+    }
+    if (result.reason !== null)
+        return refused('replay_store_result_invalid', true, store.durable);
+    return {
+        ...verification,
+        accepted: true,
+        replay_checked: true,
+        replay_store_durable: store.durable,
+    };
+}
+//# sourceMappingURL=action-refusal-statement.js.map

package/dist/action-refusal-statement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"action-refusal-statement.js","sourceRoot":"","sources":["../src/action-refusal-statement.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC;;;GAGG;AACH,OAAO,EACL,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EACxE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,GAEtD,MAAM,2BAA2B,CAAC;AAEnC,MAAM,CAAC,MAAM,gCAAgC,GAAG,gCAAgC,CAAC;AACjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,sDAAsD,CAAC;AACpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,qBAAqB;IACrB,iBAAiB;IACjB,sBAAsB;IACtB,uBAAuB;IACvB,iBAAiB;IACjB,SAAS;IACT,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,CAAU,CAAC;AAC3F,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,CAAU,CAAC;AAC7F,MAAM,YAAY,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,CAAU,CAAC;AACrF,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,iBAAiB,CAAU,CAAC;AAC3D,MAAM,aAAa,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,eAAe,CAAU,CAAC;AAC1F,MAAM,SAAS,GAAG;IAChB,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe;IACrE,SAAS,EAAE,wBAAwB,EAAE,kBAAkB;IACvD,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe;IACzE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB,EAAE,gBAAgB;CACnE,CAAC;AACX,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW;WACjE,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,qBAAqB;WACxE,GAAG,KAAK,mBAAmB,CAAC;IACjC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,qBAAqB;IACzD,kBAAkB,EAAE,mBAAmB;CACxC,CAAC,CAAC;AACH,MAAM,aAAa,GAAG;IACpB,MAAM,EAAE,eAAe,EAAE,kBAAkB,EAAE,YAAY,EAAE,iBAAiB;IAC5E,eAAe,EAAE,gBAAgB,EAAE,OAAO;CAClC,CAAC;AAEX,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;AAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;AAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAsBlG,SAAS,YAAY,CACnB,KAAc,EACd,SAAsC,EACtC,OAAe,EACf,eAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO;WAC5C,CAAC,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;WAClE,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC;WAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,SAAsC,EACtC,OAAe,EACf,KAAa,EACb,eAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO;WAC5C,CAAC,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,kBAAkB,KAAK,cAAc,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,SAAS,CAAC,kBAAkB,KAAK,gBAAgB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAqB;IAC7C,MAAM,IAAI,GAAG;QACX,YAAY,EAAE,UAAU;QACxB,KAAK,EAAE,OAAO;QACd,YAAY,EAAE,eAAe;QAC7B,aAAa,EAAE,eAAe;KAC/B,CAAC;IACF,IAAI,YAAY,KAAK,qBAAqB;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC;IAC7F,IAAI,YAAY,KAAK,iBAAiB;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC9E,IAAI,YAAY,KAAK,uBAAuB;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClG,IAAI,YAAY,KAAK,eAAe;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,YAAqB;IAC3D,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC;WAC7B,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;WAChE,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;WAChF,KAAK,CAAC,YAAY,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,YAAY,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAC,YAAY,KAAK,cAAc,CAAC;IACzF,IAAI,YAAY,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC;IAC1E,IAAI,YAAY,KAAK,sBAAsB;QAAE,OAAO,KAAK,CAAC,YAAY,KAAK,eAAe,CAAC;IAC3F,IAAI,YAAY,KAAK,uBAAuB;QAAE,OAAO,KAAK,CAAC,aAAa,KAAK,gBAAgB,CAAC;IAC9F,IAAI,YAAY,KAAK,eAAe;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACzF,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;WAC1D,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,gCAAgC;WACjF,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC;WAC1E,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;WAC3D,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;WAC/E,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;WAClF,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC;WACvE,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;WAC/F,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;WACjG,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;WACnF,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC;WACnD,IAAI,CAAC,cAAc,KAAK,6BAA6B,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,YAAY,CACf,IAAI,CAAC,gBAAgB,EACrB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/D,GAAG,EACH,KAAK,CACN,IAAI,CAAC,YAAY,CAChB,IAAI,CAAC,iBAAiB,EACtB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/D,GAAG,EACH,IAAI,CACL;QAAE,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC;WAChE,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;WACrF,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;WACzD,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,OAAO;WACjD,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,OAAO;WACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,KAAK,QAAQ;WAChD,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI;WAC7C,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC;WACtC,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;WAC1C,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;WAC3D,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;WACnF,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO;WACnD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,KAAK,QAAQ;WAChD,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC;WACpF,CAAC,cAAc,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;WAChD,OAAO,IAAI,CAAC,mBAAmB,CAAC,eAAe,KAAK,QAAQ;WAC5D,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,QAAQ,GAAG;QACf,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS;QACpE,wBAAwB,EAAE,kBAAkB,EAAE,OAAO,EAAE,YAAY;QACnE,YAAY,EAAE,eAAe,EAAE,gBAAgB;KAChD,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;WACtE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;WACvD,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,kBAAkB,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,aAAa,GAAG,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC1E,OAAO;QACL,UAAU,EAAE,gCAAgC;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,sBAAsB,EAAE,YAAY,CAClC,KAAK,CAAC,sBAAsB,EAAE,cAAc,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,CACxE;QACD,gBAAgB,EAAE,YAAY,CAC5B,KAAK,CAAC,gBAAgB,EACtB,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/D,GAAG,EACH,kBAAkB,EAClB,KAAK,CACN;QACD,iBAAiB,EAAE,YAAY,CAC7B,aAAa,EACb,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/D,GAAG,EACH,mBAAmB,EACnB,IAAI,CACL;QACD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,aAAa,CAAC;QACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,IAAI;QACtD,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAiB,EACjB,MAA+D;IAE/D,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACf,OAAO,YAAY,CAAC,gCAAgC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,SAAkB;IAC7D,OAAO,UAAU,CAAC,SAAS,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB,EAAE,QAAiB;IAC3D,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAU,CAAC,CAAC,EAAE,CAAC;QACvG,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAe;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;QACnC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;QACrC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa;QACzC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;QAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,GAAG,WAAW,CAAC;IAChE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,SAAkB,EAAE,UAK7D,EAAE;IACJ,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,gBAA+B,IAAI,EAAE,EAAE,CAAC,CAAC;QACvE,QAAQ,EAAE,KAAc;QACxB,QAAQ,EAAE,KAAc;QACxB,MAAM;QACN,cAAc,EAAE,aAAa;QAC7B,SAAS,EAAE,IAAI;QACf,iBAAiB,EAAE,eAAwB;QAC3C,gBAAgB,EAAE,eAAwB;QAC1C,mBAAmB,EAAE,gBAAyB;QAC9C,cAAc,EAAE,6BAA6B;KAC9C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,gCAAgC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACjG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;IACrF,IAAI,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,MAAM,CAAC,wBAAwB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IACzG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,SAAS;QACnC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,IAAI,EAAE,CAAC;QACpF,OAAO,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC9D,OAAO;QACL,QAAQ,EAAE,IAAa;QACvB,QAAQ,EAAE,IAAa;QACvB,MAAM,EAAE,IAAI;QACZ,cAAc,EAAE,MAAM,CAAC,eAAe;QACtC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,gBAAgB;QAC9C,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;QACxB,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;QACjF,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY;QAC/E,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,IAAI;YAC3D,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,oCAAoC;QAC3D,cAAc,EAAE,6BAA6B;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK;QACd,KAAK,CAAC,OAAO,CAAC,cAAsB,EAAE,KAAa,EAAE,aAAqB;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;gBACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1C,CAAC;YACD,IAAI,QAAQ,KAAK,aAAa;gBAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;YACvF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC3D,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,SAAkB,EAAE,UAOnE,EAAE;IACJ,MAAM,YAAY,GAAG,4BAA4B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,OAAO,GAAG,KAAK,EAAE,OAAO,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,GAAG,YAAY;QACf,QAAQ,EAAE,KAAc;QACxB,MAAM;QACN,cAAc,EAAE,OAAO;QACvB,oBAAoB,EAAE,OAAO;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,OAAO,YAAY,CAAC,cAAc,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC9F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,OAAO,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,yBAAyB,KAAK,IAAI,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAC1B,YAAY,CAAC,gBAAgB,EAC7B,YAAY,CAAC,KAAK,EAClB,YAAY,CAAC,cAAc,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,0BAA0B,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,SAAS;WAC/E,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC,6BAA6B,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,kBAAkB,IAAI,MAAM,CAAC,MAAM,KAAK,oBAAoB;YAC3F,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC3C,OAAO,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,6BAA6B,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/F,OAAO;QACL,GAAG,YAAY;QACf,QAAQ,EAAE,IAAa;QACvB,cAAc,EAAE,IAAI;QACpB,oBAAoB,EAAE,KAAK,CAAC,OAAO;KACpC,CAAC;AACJ,CAAC"}

package/dist/coverage-reconciliation-attestation.d.ts

@@ -0,0 +1,29 @@
+/** Signed period reconciliation of supplied populations; never proof that the supplied population is complete. */
+import { type RiskRecord, type TrustedRiskKeys } from './reliance-risk-crypto.js';
+export declare const COVERAGE_RECONCILIATION_ATTESTATION_VERSION = "EP-COVERAGE-RECONCILIATION-ATTESTATION-v1";
+export declare const COVERAGE_RECONCILIATION_CLAIM_BOUNDARY = "signed_reconciliation_of_supplied_populations_not_population_completeness";
+export declare function signCoverageReconciliationAttestation(input: RiskRecord, signer: {
+    issuer_id: string;
+    key_id: string;
+    private_key: any;
+}): RiskRecord;
+export declare function verifyCoverageReconciliationAttestation(attestation: unknown, options?: {
+    trusted_keys?: TrustedRiskKeys;
+    now?: string | number;
+    expected_program?: RiskRecord;
+    expected_census_digest?: string;
+    expected_relying_party_id?: string;
+}): {
+    accepted: boolean;
+    verified: boolean;
+    reason: string;
+    attestation_digest: string | null;
+    claim_boundary: string;
+} | {
+    accepted: boolean;
+    verified: boolean;
+    reason: null;
+    attestation_digest: string | null;
+    claim_boundary: string;
+};
+//# sourceMappingURL=coverage-reconciliation-attestation.d.ts.map

package/dist/coverage-reconciliation-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-reconciliation-attestation.d.ts","sourceRoot":"","sources":["../src/coverage-reconciliation-attestation.ts"],"names":[],"mappings":"AACA,kHAAkH;AAClH,OAAO,EAEyB,KAAK,UAAU,EAAE,KAAK,eAAe,EACpE,MAAM,2BAA2B,CAAC;AAEnC,eAAO,MAAM,2CAA2C,8CAA8C,CAAC;AACvG,eAAO,MAAM,sCAAsC,8EAA8E,CAAC;AAkDlI,wBAAgB,qCAAqC,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,GAAG,CAAA;CAAE,cAKvI;AAED,wBAAgB,uCAAuC,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,GAAE;IACrF,YAAY,CAAC,EAAE,eAAe,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,UAAU,CAAC;IACrF,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAAC,yBAAyB,CAAC,EAAE,MAAM,CAAC;CAChE;;;;;;;;;;;;EAsCL"}