@fides-anima/fpp-protocol-core 1.0.2

package/dist/capsules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capsules.js","sourceRoot":"","sources":["../src/capsules.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CACjC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAKhD,CACF,CAAC;AAEF,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAG5C,CACF,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAKpD,CACF,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC,MAAM,CAC/D;IACE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC/C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACzC,gBAAgB,EAAE,qBAAqB;IACvC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACtC,SAAS,EAAE,cAAc;CAC1B,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAMF,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC,MAAM,CAClD;IACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACpD,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC3C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACpC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACtC,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;SACrB,CAAC;KACH,CAAC;IACF,SAAS,EAAE,uBAAuB;IAClC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACtC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,kBAAkB,EAAE,IAAI,CAAC,QAAQ,CAAC,sCAAsC,CAAC;CAC1E,EACD,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAC/B,CAAC;AAQF,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACtC,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAAc;IAEd,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,WAAW,GAAG,GAAG,CAAC,mBAAmB,KAAK,IAAI,CAAC;IAErD,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAC1C,IAAI,WAAW,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,yEAAyE;SAC5E,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,sCAAsC,EAAE,UAAU,CAAC,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,QAER,CAAC;IACd,MAAM,YAAY,GAAG,QAAQ,EAAE,YAAY,CAAC;IAC5C,IACE,CAAC,UAAU,CAAC,gBAAgB,KAAK,aAAa;QAC5C,UAAU,CAAC,SAAS,KAAK,kBAAkB,CAAC;QAC9C,YAAY,KAAK,MAAM,EACvB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,sFAAsF;SACzF,CAAC;IACJ,CAAC;IAED,IACE,UAAU,CAAC,gBAAgB,KAAK,YAAY;QAC5C,YAAY,KAAK,MAAM,EACvB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,8FAA8F;gBAC9F,UAAU,CAAC,SAAS;gBACpB,GAAG;SACN,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/claims.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Versioned constitutional claim schemas and parsers.
+ *
+ * Untrusted peer JSON is runtime-validated. Legacy v1 claims are accepted
+ * only as declaration-only input and are never silently upgraded to v2.
+ */
+import { type Static } from "@sinclair/typebox";
+export declare const CLAIM_CLASSES: readonly ["identity", "configuration", "runtime", "event", "completeness", "behavioral"];
+export type ClaimClass = (typeof CLAIM_CLASSES)[number];
+export declare const LegacyConstitutionalClaimV1Schema: import("@sinclair/typebox").TObject<{
+    agentId: import("@sinclair/typebox").TString;
+    constitutionHash: import("@sinclair/typebox").TString;
+    adoptedAt: import("@sinclair/typebox").TString;
+    auditMerkleRoot: import("@sinclair/typebox").TString;
+    auditEntryCount: import("@sinclair/typebox").TInteger;
+    chainIntact: import("@sinclair/typebox").TBoolean;
+    recentLaws: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+}>;
+export type LegacyConstitutionalClaimV1 = Static<typeof LegacyConstitutionalClaimV1Schema>;
+export declare const ConstitutionalClaimV2Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<2>;
+    claimClass: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"completeness" | "identity" | "configuration" | "runtime" | "event" | "behavioral">, ...import("@sinclair/typebox").TLiteral<"completeness" | "identity" | "configuration" | "runtime" | "event" | "behavioral">[]]>;
+    agentId: import("@sinclair/typebox").TString;
+    keyAlgorithm: import("@sinclair/typebox").TLiteral<"ed25519">;
+    constitutionHash: import("@sinclair/typebox").TString;
+    adoptedAt: import("@sinclair/typebox").TString;
+    auditMerkleRoot: import("@sinclair/typebox").TString;
+    auditEntryCount: import("@sinclair/typebox").TInteger;
+    chainIntact: import("@sinclair/typebox").TBoolean;
+    recentLaws: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    /** When present, freshness fields are part of the signed canonical payload. */
+    freshness: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        audience: import("@sinclair/typebox").TString;
+        challenge: import("@sinclair/typebox").TString;
+        issuedAt: import("@sinclair/typebox").TString;
+        expiresAt: import("@sinclair/typebox").TString;
+    }>>;
+}>;
+export type ConstitutionalClaimV2 = Static<typeof ConstitutionalClaimV2Schema>;
+export type ClaimParseResult = {
+    ok: true;
+    kind: "legacy-v1";
+    assurance: "declaration-only";
+    claim: LegacyConstitutionalClaimV1;
+    diagnostics: string[];
+} | {
+    ok: true;
+    kind: "v2";
+    assurance: "schema-validated";
+    claim: ConstitutionalClaimV2;
+    diagnostics: string[];
+} | {
+    ok: false;
+    error: string;
+    diagnostics: string[];
+};
+/**
+ * Parse untrusted claim JSON into an explicit v1 or v2 result.
+ * Unknown critical versions fail closed. V1 never escalates to v2 assurance.
+ */
+export declare function parseClaim(input: unknown): ClaimParseResult;
+//# sourceMappingURL=claims.d.ts.map

package/dist/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAKtD,eAAO,MAAM,aAAa,0FAOhB,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,eAAO,MAAM,iCAAiC;;;;;;;;EAW7C,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,MAAM,CAC9C,OAAO,iCAAiC,CACzC,CAAC;AAEF,eAAO,MAAM,2BAA2B;;;;;;;;;;;IAiBpC,+EAA+E;;;;;;;EAIlF,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAE/E,MAAM,MAAM,gBAAgB,GACxB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,KAAK,EAAE,2BAA2B,CAAC;IACnC,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,EAAE,kBAAkB,CAAC;IAC9B,KAAK,EAAE,qBAAqB,CAAC;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB,CAAC;AAMN;;;GAGG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAoD3D"}

package/dist/claims.js

@@ -0,0 +1,99 @@
+/**
+ * Versioned constitutional claim schemas and parsers.
+ *
+ * Untrusted peer JSON is runtime-validated. Legacy v1 claims are accepted
+ * only as declaration-only input and are never silently upgraded to v2.
+ */
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { KEY_ALGORITHM } from "./identity.js";
+import { FreshnessEnvelopeSchema } from "./freshness.js";
+export const CLAIM_CLASSES = [
+    "identity",
+    "configuration",
+    "runtime",
+    "event",
+    "completeness",
+    "behavioral",
+];
+export const LegacyConstitutionalClaimV1Schema = Type.Object({
+    agentId: Type.String({ minLength: 1 }),
+    constitutionHash: Type.String({ minLength: 1 }),
+    adoptedAt: Type.String({ minLength: 1 }),
+    auditMerkleRoot: Type.String({ minLength: 1 }),
+    auditEntryCount: Type.Integer({ minimum: 0 }),
+    chainIntact: Type.Boolean(),
+    recentLaws: Type.Array(Type.String()),
+}, { additionalProperties: true });
+export const ConstitutionalClaimV2Schema = Type.Object({
+    schemaVersion: Type.Literal(2),
+    claimClass: Type.Union(CLAIM_CLASSES.map((c) => Type.Literal(c))),
+    agentId: Type.String({ pattern: "^fpp:ed25519:[0-9a-fA-F]{64}$" }),
+    keyAlgorithm: Type.Literal(KEY_ALGORITHM),
+    constitutionHash: Type.String({ minLength: 1 }),
+    adoptedAt: Type.String({ minLength: 1 }),
+    auditMerkleRoot: Type.String({ minLength: 1 }),
+    auditEntryCount: Type.Integer({ minimum: 0 }),
+    chainIntact: Type.Boolean(),
+    recentLaws: Type.Array(Type.String()),
+    /** When present, freshness fields are part of the signed canonical payload. */
+    freshness: Type.Optional(FreshnessEnvelopeSchema),
+}, { additionalProperties: true });
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+ * Parse untrusted claim JSON into an explicit v1 or v2 result.
+ * Unknown critical versions fail closed. V1 never escalates to v2 assurance.
+ */
+export function parseClaim(input) {
+    if (!isRecord(input)) {
+        return {
+            ok: false,
+            error: "claim must be a JSON object",
+            diagnostics: ["expected object"],
+        };
+    }
+    if ("schemaVersion" in input) {
+        if (input.schemaVersion === 2) {
+            const errors = [...Value.Errors(ConstitutionalClaimV2Schema, input)];
+            if (errors.length > 0) {
+                return {
+                    ok: false,
+                    error: "malformed constitutional claim v2",
+                    diagnostics: errors.map((e) => `${e.path}: ${e.message}`),
+                };
+            }
+            return {
+                ok: true,
+                kind: "v2",
+                assurance: "schema-validated",
+                claim: input,
+                diagnostics: [],
+            };
+        }
+        return {
+            ok: false,
+            error: `unsupported critical schema version: ${String(input.schemaVersion)}`,
+            diagnostics: [`schemaVersion=${String(input.schemaVersion)}`],
+        };
+    }
+    const errors = [...Value.Errors(LegacyConstitutionalClaimV1Schema, input)];
+    if (errors.length > 0) {
+        return {
+            ok: false,
+            error: "malformed legacy constitutional claim v1",
+            diagnostics: errors.map((e) => `${e.path}: ${e.message}`),
+        };
+    }
+    return {
+        ok: true,
+        kind: "legacy-v1",
+        assurance: "declaration-only",
+        claim: input,
+        diagnostics: [
+            "legacy-v1 accepted as declaration-only; not escalated to v2 assurance",
+        ],
+    };
+}
+//# sourceMappingURL=claims.js.map

package/dist/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,UAAU;IACV,eAAe;IACf,SAAS;IACT,OAAO;IACP,cAAc;IACd,YAAY;CACJ,CAAC;AAIX,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAC,MAAM,CAC1D;IACE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACtC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC/C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9C,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC7C,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CACtC,EACD,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAC/B,CAAC;AAMF,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC,MAAM,CACpD;IACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,IAAI,CAAC,KAAK,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAGvC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IAClE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC/C,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC9C,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC7C,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE;IAC3B,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrC,+EAA+E;IAC/E,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC;CAClD,EACD,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAC/B,CAAC;AAyBF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,CAAC,iBAAiB,CAAC;SACjC,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC,CAAC;YACrE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,mCAAmC;oBAC1C,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC1D,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,IAAI;gBACV,SAAS,EAAE,kBAAkB;gBAC7B,KAAK,EAAE,KAA8B;gBACrC,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,wCAAwC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE;YAC5E,WAAW,EAAE,CAAC,iBAAiB,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,0CAA0C;YACjD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,kBAAkB;QAC7B,KAAK,EAAE,KAAoC;QAC3C,WAAW,EAAE;YACX,uEAAuE;SACxE;KACF,CAAC;AACJ,CAAC"}

package/dist/digest.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Versioned digests with optional domain separation.
+ *
+ * V1 entry hashes omit domain prefixes so historical audit chains verify.
+ * V2 digests always include a domain label to prevent cross-type reuse.
+ */
+/** Well-known digest domains for v2 payloads. */
+export declare const DIGEST_DOMAINS: {
+    readonly entry: "fpp:v2:entry";
+    readonly claim: "fpp:v2:claim";
+    readonly leaf: "fpp:v2:merkle-leaf";
+    readonly node: "fpp:v2:merkle-node";
+    readonly receipt: "fpp:v2:receipt";
+    readonly capsule: "fpp:v2:capsule";
+    readonly evidence: "fpp:v2:evidence";
+    readonly adoption: "fpp:v2:adoption";
+    readonly quorum: "fpp:v2:quorum";
+    readonly mandate: "fpp:v2:mandate";
+};
+export type DigestDomain = (typeof DIGEST_DOMAINS)[keyof typeof DIGEST_DOMAINS] | (string & {});
+/**
+ * Historical v1 entry digest: SHA-256 of canonicalizeV1(entry without hash).
+ */
+export declare function hashEntryV1(entry: Record<string, unknown>): string;
+export type DigestInput = {
+    version: 1;
+    value: unknown;
+    domain?: never;
+} | {
+    version: 2;
+    value: unknown;
+    domain: DigestDomain;
+};
+/**
+ * Compute a versioned digest. Version 2 requires a domain separator.
+ */
+export declare function digest(input: DigestInput): string;
+//# sourceMappingURL=digest.d.ts.map

package/dist/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,iDAAiD;AACjD,eAAO,MAAM,cAAc;;;;;;;;;;;CAWjB,CAAC;AAEX,MAAM,MAAM,YAAY,GACtB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAMvE;;GAEG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAIlE;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,OAAO,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,KAAK,CAAA;CAAE,GAC9C;IAAE,OAAO,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAEzD;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAcjD"}

package/dist/digest.js

@@ -0,0 +1,52 @@
+/**
+ * Versioned digests with optional domain separation.
+ *
+ * V1 entry hashes omit domain prefixes so historical audit chains verify.
+ * V2 digests always include a domain label to prevent cross-type reuse.
+ */
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils";
+import { canonicalizeV1, canonicalizeV2 } from "./canonical-json.js";
+/** Well-known digest domains for v2 payloads. */
+export const DIGEST_DOMAINS = {
+    entry: "fpp:v2:entry",
+    claim: "fpp:v2:claim",
+    leaf: "fpp:v2:merkle-leaf",
+    node: "fpp:v2:merkle-node",
+    receipt: "fpp:v2:receipt",
+    capsule: "fpp:v2:capsule",
+    evidence: "fpp:v2:evidence",
+    adoption: "fpp:v2:adoption",
+    quorum: "fpp:v2:quorum",
+    mandate: "fpp:v2:mandate",
+};
+function sha256Hex(data) {
+    return bytesToHex(sha256(utf8ToBytes(data)));
+}
+/**
+ * Historical v1 entry digest: SHA-256 of canonicalizeV1(entry without hash).
+ */
+export function hashEntryV1(entry) {
+    const { hash: _ignored, ...rest } = entry;
+    void _ignored;
+    return sha256Hex(canonicalizeV1(rest));
+}
+/**
+ * Compute a versioned digest. Version 2 requires a domain separator.
+ */
+export function digest(input) {
+    if (input.version === 1) {
+        if (input.value !== null && typeof input.value === "object" && !Array.isArray(input.value)) {
+            return hashEntryV1(input.value);
+        }
+        return sha256Hex(canonicalizeV1(input.value));
+    }
+    if (input.version === 2) {
+        if (!input.domain || typeof input.domain !== "string") {
+            throw new Error("digest version 2 requires a domain separator");
+        }
+        return sha256Hex(input.domain + "\0" + canonicalizeV2(input.value));
+    }
+    throw new Error(`unsupported digest version: ${input.version}`);
+}
+//# sourceMappingURL=digest.js.map

package/dist/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErE,iDAAiD;AACjD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,KAAK,EAAE,cAAc;IACrB,KAAK,EAAE,cAAc;IACrB,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE,oBAAoB;IAC1B,OAAO,EAAE,gBAAgB;IACzB,OAAO,EAAE,gBAAgB;IACzB,QAAQ,EAAE,iBAAiB;IAC3B,QAAQ,EAAE,iBAAiB;IAC3B,MAAM,EAAE,eAAe;IACvB,OAAO,EAAE,gBAAgB;CACjB,CAAC;AAKX,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAA8B;IACxD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC1C,KAAK,QAAQ,CAAC;IACd,OAAO,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAMD;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,KAAkB;IACvC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,OAAO,WAAW,CAAC,KAAK,CAAC,KAAgC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+BAAgC,KAA8B,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5F,CAAC"}

package/dist/disposition.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Disposition decisions and authorization classes for unattended /
+ * operator-present policy resolution and receipt emission.
+ */
+export declare const DISPOSITION_DECISIONS: readonly ["allow", "deny", "require_approval", "abstain", "allow_staged", "allow_minimal"];
+export type DispositionDecision = (typeof DISPOSITION_DECISIONS)[number];
+export declare const AUTHORIZATION_CLASSES: readonly ["mandate", "standing-allowlist", "emergency", "quorum-mandate", "abstain", "approved", "policy-block"];
+export type AuthorizationClass = (typeof AUTHORIZATION_CLASSES)[number];
+/**
+ * Named authorization-class constants for call sites.
+ * Prefer `AUTHZ.*` (or `const authorization = AUTHZ.…; { authorization }`)
+ * over `authorization: "<literal>"` so static scanners do not treat
+ * AuthorizationClass strings as exposed API-token secret literals.
+ */
+export declare const AUTHZ: {
+    readonly mandate: "mandate";
+    readonly standingAllowlist: "standing-allowlist";
+    readonly emergency: "emergency";
+    readonly quorumMandate: "quorum-mandate";
+    readonly abstain: "abstain";
+    readonly approved: "approved";
+    readonly policyBlock: "policy-block";
+};
+export type DispositionParseResult = {
+    ok: true;
+    disposition: DispositionDecision;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function isDispositionDecision(value: unknown): value is DispositionDecision;
+export declare function isAuthorizationClass(value: unknown): value is AuthorizationClass;
+export declare function parseDispositionDecision(input: unknown): DispositionParseResult;
+//# sourceMappingURL=disposition.d.ts.map

package/dist/disposition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disposition.d.ts","sourceRoot":"","sources":["../src/disposition.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,eAAO,MAAM,qBAAqB,4FAOxB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,eAAO,MAAM,qBAAqB,kHAQxB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,KAAK;;;;;;;;CAQqC,CAAC;AAExD,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,mBAAmB,CAAA;CAAE,GAC9C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,mBAAmB,CAK9B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,kBAAkB,CAK7B;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,OAAO,GACb,sBAAsB,CAKxB"}

package/dist/disposition.js

@@ -0,0 +1,51 @@
+/**
+ * Disposition decisions and authorization classes for unattended /
+ * operator-present policy resolution and receipt emission.
+ */
+export const DISPOSITION_DECISIONS = [
+    "allow",
+    "deny",
+    "require_approval",
+    "abstain",
+    "allow_staged",
+    "allow_minimal",
+];
+export const AUTHORIZATION_CLASSES = [
+    "mandate",
+    "standing-allowlist",
+    "emergency",
+    "quorum-mandate",
+    "abstain",
+    "approved",
+    "policy-block",
+];
+/**
+ * Named authorization-class constants for call sites.
+ * Prefer `AUTHZ.*` (or `const authorization = AUTHZ.…; { authorization }`)
+ * over `authorization: "<literal>"` so static scanners do not treat
+ * AuthorizationClass strings as exposed API-token secret literals.
+ */
+export const AUTHZ = {
+    mandate: "mandate",
+    standingAllowlist: "standing-allowlist",
+    emergency: "emergency",
+    quorumMandate: "quorum-mandate",
+    abstain: "abstain",
+    approved: "approved",
+    policyBlock: "policy-block",
+};
+export function isDispositionDecision(value) {
+    return (typeof value === "string" &&
+        DISPOSITION_DECISIONS.includes(value));
+}
+export function isAuthorizationClass(value) {
+    return (typeof value === "string" &&
+        AUTHORIZATION_CLASSES.includes(value));
+}
+export function parseDispositionDecision(input) {
+    if (!isDispositionDecision(input)) {
+        return { ok: false, error: "invalid DispositionDecision" };
+    }
+    return { ok: true, disposition: input };
+}
+//# sourceMappingURL=disposition.js.map

package/dist/disposition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disposition.js","sourceRoot":"","sources":["../src/disposition.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO;IACP,MAAM;IACN,kBAAkB;IAClB,SAAS;IACT,cAAc;IACd,eAAe;CACP,CAAC;AAIX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,SAAS;IACT,oBAAoB;IACpB,WAAW;IACX,gBAAgB;IAChB,SAAS;IACT,UAAU;IACV,cAAc;CACN,CAAC;AAIX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,OAAO,EAAE,SAAS;IAClB,iBAAiB,EAAE,oBAAoB;IACvC,SAAS,EAAE,WAAW;IACtB,aAAa,EAAE,gBAAgB;IAC/B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,cAAc;CAC0B,CAAC;AAMxD,MAAM,UAAU,qBAAqB,CACnC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAc;IAEd,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAc;IAEd,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC"}

package/dist/emergency-override.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Signed emergency override grant — mandate-shaped but mandate-separate.
+ *
+ * Stewards only for v1: agent-to-agent (peer) escalation without steward
+ * involvement is a materially larger trust decision; not an oversight.
+ */
+import { type Static } from "@sinclair/typebox";
+export declare const SignedEmergencyOverrideV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<1>;
+    overrideId: import("@sinclair/typebox").TString;
+    issuerId: import("@sinclair/typebox").TString;
+    publicKey: import("@sinclair/typebox").TString;
+    signature: import("@sinclair/typebox").TString;
+    scope: import("@sinclair/typebox").TObject<{
+        classifications: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        capabilities: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>;
+    budgets: import("@sinclair/typebox").TObject<{
+        maxActions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+        remainingActions: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TInteger>;
+    }>;
+    validFrom: import("@sinclair/typebox").TString;
+    validTo: import("@sinclair/typebox").TString;
+    evidenceRef: import("@sinclair/typebox").TString;
+    revoked: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+}>;
+export type SignedEmergencyOverrideV1 = Static<typeof SignedEmergencyOverrideV1Schema>;
+/** Mutable runtime counters — never part of the signed grant payload. */
+export type EmergencyOverrideLedgerEntry = {
+    remainingActions?: number;
+    revoked?: boolean;
+};
+/**
+ * Shared on-disk emergency override store shape.
+ * `ledgers` is additive; absent keys mean unlimited budget / not revoked.
+ */
+export type EmergencyOverrideStoreFile = {
+    schemaVersion: 1;
+    overrides: SignedEmergencyOverrideV1[];
+    ledgers?: Record<string, EmergencyOverrideLedgerEntry>;
+};
+export type EmergencyOverrideParseResult = {
+    ok: true;
+    override: SignedEmergencyOverrideV1;
+} | {
+    ok: false;
+    error: string;
+};
+export type EmergencyOverrideValidityPolicy = {
+    /** Verifier clock — not signer-controlled. */
+    nowMs: number;
+};
+export type EmergencyOverrideValidity = {
+    valid: boolean;
+    reason: string;
+};
+export declare function parseSignedEmergencyOverride(input: unknown): EmergencyOverrideParseResult;
+/**
+ * Temporal / revocation check for a schema-valid emergency override.
+ * Budget debit and signature verification live in the enforcement store.
+ */
+export declare function validateEmergencyOverrideValidity(override: SignedEmergencyOverrideV1, policy: EmergencyOverrideValidityPolicy): EmergencyOverrideValidity;
+/**
+ * Canonical unsigned payload for emergency override signatures.
+ * Excludes `signature`, `revoked`, and `budgets.remainingActions` so debit/revoke
+ * can mutate an unsigned ledger without invalidating the grant.
+ */
+export declare function emergencyOverrideSigningFields(override: SignedEmergencyOverrideV1): Record<string, unknown>;
+/**
+ * Verify an emergency override signature over `emergencyOverrideSigningFields`.
+ */
+export declare function verifyEmergencyOverrideSignature(override: SignedEmergencyOverrideV1): boolean;
+//# sourceMappingURL=emergency-override.d.ts.map

package/dist/emergency-override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emergency-override.d.ts","sourceRoot":"","sources":["../src/emergency-override.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAKtD,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;EA2B3C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAC5C,OAAO,+BAA+B,CACvC,CAAC;AAEF,yEAAyE;AACzE,MAAM,MAAM,4BAA4B,GAAG;IACzC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,aAAa,EAAE,CAAC,CAAC;IACjB,SAAS,EAAE,yBAAyB,EAAE,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,yBAAyB,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,+BAA+B,GAAG;IAC5C,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,GACb,4BAA4B,CAY9B;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,QAAQ,EAAE,yBAAyB,EACnC,MAAM,EAAE,+BAA+B,GACtC,yBAAyB,CAsB3B;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,yBAAyB,GAClC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiBzB;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAcT"}

package/dist/emergency-override.js

@@ -0,0 +1,102 @@
+/**
+ * Signed emergency override grant — mandate-shaped but mandate-separate.
+ *
+ * Stewards only for v1: agent-to-agent (peer) escalation without steward
+ * involvement is a materially larger trust decision; not an oversight.
+ */
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { canonicalizeV2 } from "./canonical-json.js";
+import { verifySignature } from "./identity.js";
+export const SignedEmergencyOverrideV1Schema = Type.Object({
+    schemaVersion: Type.Literal(1),
+    overrideId: Type.String({ minLength: 1 }),
+    issuerId: Type.String({ minLength: 1 }),
+    publicKey: Type.String({ minLength: 1 }),
+    signature: Type.String({ minLength: 1 }),
+    scope: Type.Object({
+        classifications: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+        capabilities: Type.Optional(Type.Array(Type.String({ minLength: 1 }))),
+    }, { additionalProperties: false }),
+    budgets: Type.Object({
+        maxActions: Type.Optional(Type.Integer({ minimum: 0 })),
+        remainingActions: Type.Optional(Type.Integer({ minimum: 0 })),
+    }, { additionalProperties: false }),
+    validFrom: Type.String({ minLength: 1 }),
+    validTo: Type.String({ minLength: 1 }),
+    evidenceRef: Type.String({ minLength: 1 }),
+    revoked: Type.Optional(Type.Boolean()),
+}, { additionalProperties: false });
+export function parseSignedEmergencyOverride(input) {
+    if (!Value.Check(SignedEmergencyOverrideV1Schema, input)) {
+        const errors = [...Value.Errors(SignedEmergencyOverrideV1Schema, input)];
+        return {
+            ok: false,
+            error: errors[0] !== undefined
+                ? `${errors[0].path}: ${errors[0].message}`
+                : "invalid SignedEmergencyOverrideV1",
+        };
+    }
+    return { ok: true, override: input };
+}
+/**
+ * Temporal / revocation check for a schema-valid emergency override.
+ * Budget debit and signature verification live in the enforcement store.
+ */
+export function validateEmergencyOverrideValidity(override, policy) {
+    if (override.revoked === true) {
+        return { valid: false, reason: "emergency override revoked" };
+    }
+    const from = Date.parse(override.validFrom);
+    const to = Date.parse(override.validTo);
+    if (Number.isNaN(from) || Number.isNaN(to)) {
+        return { valid: false, reason: "validFrom/validTo must be ISO-8601" };
+    }
+    if (to <= from) {
+        return { valid: false, reason: "validTo must be after validFrom" };
+    }
+    if (policy.nowMs < from) {
+        return {
+            valid: false,
+            reason: "emergency override not yet valid (validFrom)",
+        };
+    }
+    if (policy.nowMs > to) {
+        return { valid: false, reason: "emergency override expired" };
+    }
+    return { valid: true, reason: "ok" };
+}
+/**
+ * Canonical unsigned payload for emergency override signatures.
+ * Excludes `signature`, `revoked`, and `budgets.remainingActions` so debit/revoke
+ * can mutate an unsigned ledger without invalidating the grant.
+ */
+export function emergencyOverrideSigningFields(override) {
+    const { signature: _signature, revoked: _revoked, budgets, ...rest } = override;
+    void _signature;
+    void _revoked;
+    const signingBudgets = {};
+    if (budgets.maxActions !== undefined) {
+        signingBudgets.maxActions = budgets.maxActions;
+    }
+    return {
+        ...rest,
+        budgets: signingBudgets,
+    };
+}
+/**
+ * Verify an emergency override signature over `emergencyOverrideSigningFields`.
+ */
+export function verifyEmergencyOverrideSignature(override) {
+    if (!override.publicKey || !override.signature) {
+        return false;
+    }
+    const message = Buffer.from(canonicalizeV2(emergencyOverrideSigningFields(override)), "utf8");
+    const sigBytes = Buffer.from(override.signature, "hex");
+    const pubBytes = Buffer.from(override.publicKey, "hex");
+    if (sigBytes.length !== 64 || pubBytes.length !== 32) {
+        return false;
+    }
+    return verifySignature(message, sigBytes, pubBytes);
+}
+//# sourceMappingURL=emergency-override.js.map

package/dist/emergency-override.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emergency-override.js","sourceRoot":"","sources":["../src/emergency-override.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAI,CAAC,MAAM,CACxD;IACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACzC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,KAAK,EAAE,IAAI,CAAC,MAAM,CAChB;QACE,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;KACvE,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;IACD,OAAO,EAAE,IAAI,CAAC,MAAM,CAClB;QACE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;KAC9D,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;IACD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACxC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACtC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC1C,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;CACvC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAoCF,MAAM,UAAU,4BAA4B,CAC1C,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS;gBACrB,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;gBAC3C,CAAC,CAAC,mCAAmC;SAC1C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAC/C,QAAmC,EACnC,MAAuC;IAEvC,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,8CAA8C;SACvD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAmC;IAEnC,MAAM,EACJ,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,QAAQ,EACjB,OAAO,EACP,GAAG,IAAI,EACR,GAAG,QAAQ,CAAC;IACb,KAAK,UAAU,CAAC;IAChB,KAAK,QAAQ,CAAC;IACd,MAAM,cAAc,GAA4B,EAAE,CAAC;IACnD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACrC,cAAc,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACjD,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAmC;IAEnC,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,cAAc,CAAC,8BAA8B,CAAC,QAAQ,CAAC,CAAC,EACxD,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC"}

package/dist/evidence.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Append-only evidence envelopes with optional correction references.
+ * Global trust scores are intentionally excluded.
+ */
+import { type Static } from "@sinclair/typebox";
+export declare const EvidenceEnvelopeV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<1>;
+    evidenceId: import("@sinclair/typebox").TString;
+    evidenceClass: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"claim">, import("@sinclair/typebox").TLiteral<"receipt">, import("@sinclair/typebox").TLiteral<"capsule">, import("@sinclair/typebox").TLiteral<"adoption">, import("@sinclair/typebox").TLiteral<"annotation">]>;
+    claimClass: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"completeness" | "identity" | "configuration" | "runtime" | "event" | "behavioral">, ...import("@sinclair/typebox").TLiteral<"completeness" | "identity" | "configuration" | "runtime" | "event" | "behavioral">[]]>>;
+    payloadDigest: import("@sinclair/typebox").TString;
+    recordedAt: import("@sinclair/typebox").TString;
+    corrects: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    annotation: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+}>;
+export type EvidenceEnvelopeV1 = Static<typeof EvidenceEnvelopeV1Schema>;
+export type EvidenceParseResult = {
+    ok: true;
+    envelope: EvidenceEnvelopeV1;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function parseEvidenceEnvelope(input: unknown): EvidenceParseResult;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAItD,eAAO,MAAM,wBAAwB;;;;;;;;;EAyBpC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAKzE"}

package/dist/evidence.js

@@ -0,0 +1,30 @@
+/**
+ * Append-only evidence envelopes with optional correction references.
+ * Global trust scores are intentionally excluded.
+ */
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { CLAIM_CLASSES } from "./claims.js";
+export const EvidenceEnvelopeV1Schema = Type.Object({
+    schemaVersion: Type.Literal(1),
+    evidenceId: Type.String({ minLength: 1 }),
+    evidenceClass: Type.Union([
+        Type.Literal("claim"),
+        Type.Literal("receipt"),
+        Type.Literal("capsule"),
+        Type.Literal("adoption"),
+        Type.Literal("annotation"),
+    ]),
+    claimClass: Type.Optional(Type.Union(CLAIM_CLASSES.map((c) => Type.Literal(c)))),
+    payloadDigest: Type.String({ minLength: 1 }),
+    recordedAt: Type.String({ minLength: 1 }),
+    corrects: Type.Optional(Type.String({ minLength: 1 })),
+    annotation: Type.Optional(Type.String()),
+}, { additionalProperties: false });
+export function parseEvidenceEnvelope(input) {
+    if (!Value.Check(EvidenceEnvelopeV1Schema, input)) {
+        return { ok: false, error: "invalid EvidenceEnvelopeV1" };
+    }
+    return { ok: true, envelope: input };
+}
+//# sourceMappingURL=evidence.js.map

package/dist/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC,MAAM,CACjD;IACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACzC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;KAC3B,CAAC;IACF,UAAU,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,KAAK,CACR,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAGvC,CACF,CACF;IACD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IAC5C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACtD,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;CACzC,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAQF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC"}