@fides-anima/fpp-protocol-core 1.0.2

package/dist/receipts.js

@@ -0,0 +1,104 @@
+/**
+ * Conformance receipt schema (emission deferred to later plans).
+ */
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { GovernanceEpochSchema, GovernanceModeSchema, } from "./governance.js";
+const DigestHexSchema = Type.String({ pattern: "^[0-9a-f]{64}$" });
+export const ReceiptInclusionEvidenceV1Schema = Type.Object({
+    evidenceVersion: Type.Literal(1),
+    logKind: Type.Literal("conformance-receipt"),
+    entry: Type.Object({
+        previousHash: DigestHexSchema,
+        timestamp: Type.String({ minLength: 1 }),
+        kind: Type.Literal("conformance-receipt"),
+        receipt: Type.Unknown(),
+        hash: DigestHexSchema,
+    }, { additionalProperties: false }),
+    proof: Type.Object({
+        leaf: DigestHexSchema,
+        index: Type.Integer({ minimum: 0 }),
+        path: Type.Array(Type.Object({
+            hash: DigestHexSchema,
+            position: Type.Union([
+                Type.Literal("left"),
+                Type.Literal("right"),
+            ]),
+        }, { additionalProperties: false })),
+        root: DigestHexSchema,
+    }, { additionalProperties: false }),
+}, { additionalProperties: false });
+export function parseReceiptInclusionEvidence(input) {
+    if (!Value.Check(ReceiptInclusionEvidenceV1Schema, input)) {
+        return { ok: false, error: "invalid ReceiptInclusionEvidenceV1" };
+    }
+    return { ok: true, evidence: input };
+}
+export const ConformanceReceiptV1Schema = Type.Union([
+    Type.Object({
+        schemaVersion: Type.Literal(1),
+        receiptClass: Type.Literal("conformance"),
+        actionDigest: DigestHexSchema,
+        policyId: Type.String({ minLength: 1 }),
+        policyVersion: Type.String({ minLength: 1 }),
+        implementationVersion: Type.String({ minLength: 1 }),
+        disposition: Type.Union([
+            Type.Literal("allow"),
+            Type.Literal("deny"),
+            Type.Literal("require_approval"),
+            Type.Literal("abstain"),
+            Type.Literal("allow_staged"),
+            Type.Literal("allow_minimal"),
+        ]),
+        authorization: Type.String({ minLength: 1 }),
+        outcome: Type.String({ minLength: 1 }),
+        issuedAt: Type.String({ minLength: 1 }),
+        constitutionHash: Type.Optional(DigestHexSchema),
+        classifierRulesetHash: Type.Optional(DigestHexSchema),
+        effectiveConfigHash: Type.Optional(DigestHexSchema),
+        // Forbidden when unpaired — both keys must be absent in this branch.
+        governanceEpoch: Type.Optional(Type.Never()),
+        governanceMode: Type.Optional(Type.Never()),
+    }, { additionalProperties: true }),
+    Type.Object({
+        schemaVersion: Type.Literal(1),
+        receiptClass: Type.Literal("conformance"),
+        actionDigest: DigestHexSchema,
+        policyId: Type.String({ minLength: 1 }),
+        policyVersion: Type.String({ minLength: 1 }),
+        implementationVersion: Type.String({ minLength: 1 }),
+        disposition: Type.Union([
+            Type.Literal("allow"),
+            Type.Literal("deny"),
+            Type.Literal("require_approval"),
+            Type.Literal("abstain"),
+            Type.Literal("allow_staged"),
+            Type.Literal("allow_minimal"),
+        ]),
+        authorization: Type.String({ minLength: 1 }),
+        outcome: Type.String({ minLength: 1 }),
+        issuedAt: Type.String({ minLength: 1 }),
+        constitutionHash: Type.Optional(DigestHexSchema),
+        classifierRulesetHash: Type.Optional(DigestHexSchema),
+        effectiveConfigHash: Type.Optional(DigestHexSchema),
+        /** Gateway governance binding — both fields required together. */
+        governanceEpoch: GovernanceEpochSchema,
+        governanceMode: GovernanceModeSchema,
+    }, { additionalProperties: true }),
+]);
+export function parseConformanceReceipt(input) {
+    if (!Value.Check(ConformanceReceiptV1Schema, input)) {
+        return { ok: false, error: "invalid ConformanceReceiptV1" };
+    }
+    const issuedAt = input.issuedAt;
+    const issuedAtMs = Date.parse(issuedAt);
+    if (!Number.isFinite(issuedAtMs) ||
+        new Date(issuedAtMs).toISOString() !== issuedAt) {
+        return {
+            ok: false,
+            error: "invalid ConformanceReceiptV1: issuedAt must be canonical ISO-8601",
+        };
+    }
+    return { ok: true, receipt: input };
+}
+//# sourceMappingURL=receipts.js.map

package/dist/receipts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipts.js","sourceRoot":"","sources":["../src/receipts.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAe,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAChD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,gCAAgC,GAAG,IAAI,CAAC,MAAM,CACzD;IACE,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAC5C,KAAK,EAAE,IAAI,CAAC,MAAM,CAChB;QACE,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACxC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACzC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;QACvB,IAAI,EAAE,eAAe;KACtB,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;IACD,KAAK,EAAE,IAAI,CAAC,MAAM,CAChB;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACnC,IAAI,EAAE,IAAI,CAAC,KAAK,CACd,IAAI,CAAC,MAAM,CACT;YACE,IAAI,EAAE,eAAe;YACrB,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;aACtB,CAAC;SACH,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CACF;QACD,IAAI,EAAE,eAAe;KACtB,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC;CACF,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAChC,CAAC;AAUF,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,KAAK,CAAC;IACnD,IAAI,CAAC,MAAM,CACT;QACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC5C,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;SAC9B,CAAC;QACF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACtC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACvC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QAChD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QACrD,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QACnD,qEAAqE;QACrE,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5C,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;KAC5C,EACD,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAC/B;IACD,IAAI,CAAC,MAAM,CACT;QACE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9B,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QACzC,YAAY,EAAE,eAAe;QAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC5C,qBAAqB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;SAC9B,CAAC;QACF,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACtC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACvC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QAChD,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QACrD,mBAAmB,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;QACnD,kEAAkE;QAClE,eAAe,EAAE,qBAAqB;QACtC,cAAc,EAAE,oBAAoB;KACrC,EACD,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAC/B;CACF,CAAC,CAAC;AAQH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAI,KAA8B,CAAC,QAAQ,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAC/C,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mEAAmE;SAC3E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAA6B,EAAE,CAAC;AAC9D,CAAC"}

package/dist/steward-authorization.d.ts

@@ -0,0 +1,200 @@
+/**
+ * Steward / operator authorization wire contracts.
+ *
+ * Key-independent human steward identity and OpenPGP-signed authorization
+ * payloads. Verification backends live in `@fides-anima/fpp-steward-auth-core`;
+ * this module defines schemas, mint/parse helpers, and domain digests only.
+ */
+import { type Static } from "@sinclair/typebox";
+/**
+ * Domain separators for steward digests (not credentials).
+ * Object key is `authz` (not the secret-scanner trigger name) so static
+ * analyzers do not treat the domain string as an exposed API token.
+ */
+export declare const STEWARD_DIGEST_DOMAINS: {
+    readonly evidence: "fpp:v2:steward-evidence";
+    readonly replay: "fpp:v2:steward-replay";
+    readonly attestation: "fpp:v2:steward-attestation";
+    readonly authz: "fpp:v2:steward-authorization";
+    readonly revocation: "fpp:v2:steward-authorization-revocation";
+};
+export type StewardIdV1 = `fpp:steward:v1:${string}`;
+export type ParsedStewardIdV1 = {
+    kind: "v1";
+    raw: StewardIdV1;
+    idBody: string;
+};
+export type StewardIdParseResult = {
+    ok: true;
+    stewardId: ParsedStewardIdV1;
+} | {
+    ok: false;
+    error: string;
+};
+export type ParsedKeyRef = {
+    algorithm: string;
+    identifier: string;
+    raw: string;
+};
+export type KeyRefParseResult = {
+    ok: true;
+    keyRef: ParsedKeyRef;
+} | {
+    ok: false;
+    error: string;
+};
+/** Mint a key-independent steward ID from 128 random bits. */
+export declare function mintStewardIdV1(): StewardIdV1;
+export declare function isStewardIdV1(value: unknown): value is StewardIdV1;
+export declare function parseStewardIdV1(value: unknown): StewardIdParseResult;
+export declare const KeyRefSchema: import("@sinclair/typebox").TString;
+export declare function parseKeyRef(value: unknown): KeyRefParseResult;
+export declare const StewardKeyAttestationV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<1>;
+    kind: import("@sinclair/typebox").TLiteral<"steward-key-attestation">;
+    attestationId: import("@sinclair/typebox").TString;
+    operation: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"initial-bind">, import("@sinclair/typebox").TLiteral<"add">, import("@sinclair/typebox").TLiteral<"rotate">, import("@sinclair/typebox").TLiteral<"revoke">]>;
+    stewardId: import("@sinclair/typebox").TString;
+    audience: import("@sinclair/typebox").TString;
+    subjectKey: import("@sinclair/typebox").TObject<{
+        algorithm: import("@sinclair/typebox").TString;
+        keyRef: import("@sinclair/typebox").TString;
+        publicKeyArmored: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    }>;
+    replacesKeyRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    issuedAt: import("@sinclair/typebox").TString;
+    nonce: import("@sinclair/typebox").TString;
+    reason: import("@sinclair/typebox").TString;
+}>;
+export type StewardKeyAttestationV1 = Static<typeof StewardKeyAttestationV1Schema>;
+export type StewardKeyAttestationParseResult = {
+    ok: true;
+    attestation: StewardKeyAttestationV1;
+} | {
+    ok: false;
+    error: string;
+};
+/** Immutable local ledger policy caps bound into a signed genesis bootstrap. */
+export declare const StewardBootstrapPolicyCapsV1Schema: import("@sinclair/typebox").TObject<{
+    instanceAudience: import("@sinclair/typebox").TString;
+    maxStandingLifetimeMs: import("@sinclair/typebox").TInteger;
+    maxStandingUses: import("@sinclair/typebox").TInteger;
+    maxOneShotLifetimeMs: import("@sinclair/typebox").TInteger;
+    allowedClockSkewMs: import("@sinclair/typebox").TInteger;
+}>;
+export type StewardBootstrapPolicyCapsV1 = Static<typeof StewardBootstrapPolicyCapsV1Schema>;
+/**
+ * Signed steward genesis bundle: policy caps + initial key binding.
+ * Signed bytes are canonicalizeV2 of the full object (no private keys).
+ */
+export declare const StewardBootstrapV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<1>;
+    kind: import("@sinclair/typebox").TLiteral<"steward-bootstrap">;
+    bootstrapId: import("@sinclair/typebox").TString;
+    stewardId: import("@sinclair/typebox").TString;
+    audience: import("@sinclair/typebox").TString;
+    policy: import("@sinclair/typebox").TObject<{
+        instanceAudience: import("@sinclair/typebox").TString;
+        maxStandingLifetimeMs: import("@sinclair/typebox").TInteger;
+        maxStandingUses: import("@sinclair/typebox").TInteger;
+        maxOneShotLifetimeMs: import("@sinclair/typebox").TInteger;
+        allowedClockSkewMs: import("@sinclair/typebox").TInteger;
+    }>;
+    initialBinding: import("@sinclair/typebox").TObject<{
+        schemaVersion: import("@sinclair/typebox").TLiteral<1>;
+        kind: import("@sinclair/typebox").TLiteral<"steward-key-attestation">;
+        attestationId: import("@sinclair/typebox").TString;
+        operation: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"initial-bind">, import("@sinclair/typebox").TLiteral<"add">, import("@sinclair/typebox").TLiteral<"rotate">, import("@sinclair/typebox").TLiteral<"revoke">]>;
+        stewardId: import("@sinclair/typebox").TString;
+        audience: import("@sinclair/typebox").TString;
+        subjectKey: import("@sinclair/typebox").TObject<{
+            algorithm: import("@sinclair/typebox").TString;
+            keyRef: import("@sinclair/typebox").TString;
+            publicKeyArmored: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        }>;
+        replacesKeyRef: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        issuedAt: import("@sinclair/typebox").TString;
+        nonce: import("@sinclair/typebox").TString;
+        reason: import("@sinclair/typebox").TString;
+    }>;
+    issuedAt: import("@sinclair/typebox").TString;
+    nonce: import("@sinclair/typebox").TString;
+}>;
+export type StewardBootstrapV1 = Static<typeof StewardBootstrapV1Schema>;
+export type StewardBootstrapParseResult = {
+    ok: true;
+    bootstrap: StewardBootstrapV1;
+} | {
+    ok: false;
+    error: string;
+};
+export declare const OperatorAuthorizationV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<1>;
+    kind: import("@sinclair/typebox").TLiteral<"operator-authorization">;
+    authorizationId: import("@sinclair/typebox").TString;
+    stewardId: import("@sinclair/typebox").TString;
+    signingKeyRef: import("@sinclair/typebox").TString;
+    audience: import("@sinclair/typebox").TString;
+    mode: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"one-shot">, import("@sinclair/typebox").TLiteral<"standing">]>;
+    scope: import("@sinclair/typebox").TObject<{
+        classifications: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        toolNames: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        resourcePaths: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    }>;
+    issuedAt: import("@sinclair/typebox").TString;
+    expiresAt: import("@sinclair/typebox").TString;
+    nonce: import("@sinclair/typebox").TString;
+    maxUses: import("@sinclair/typebox").TInteger;
+    reason: import("@sinclair/typebox").TString;
+}>;
+export type OperatorAuthorizationV1 = Static<typeof OperatorAuthorizationV1Schema>;
+export type OperatorAuthorizationParseResult = {
+    ok: true;
+    authorization: OperatorAuthorizationV1;
+} | {
+    ok: false;
+    error: string;
+};
+export declare const OperatorAuthorizationRevocationV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<1>;
+    kind: import("@sinclair/typebox").TLiteral<"operator-authorization-revocation">;
+    authorizationId: import("@sinclair/typebox").TString;
+    stewardId: import("@sinclair/typebox").TString;
+    signingKeyRef: import("@sinclair/typebox").TString;
+    audience: import("@sinclair/typebox").TString;
+    issuedAt: import("@sinclair/typebox").TString;
+    nonce: import("@sinclair/typebox").TString;
+    reason: import("@sinclair/typebox").TString;
+}>;
+export type OperatorAuthorizationRevocationV1 = Static<typeof OperatorAuthorizationRevocationV1Schema>;
+export type OperatorAuthorizationRevocationParseResult = {
+    ok: true;
+    revocation: OperatorAuthorizationRevocationV1;
+} | {
+    ok: false;
+    error: string;
+};
+export type BoundsResult = {
+    ok: true;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function containsOpenPgpSecretKeyArmor(value: string): boolean;
+export declare function parseStewardKeyAttestation(input: unknown): StewardKeyAttestationParseResult;
+export declare function parseStewardBootstrap(input: unknown): StewardBootstrapParseResult;
+export declare function parseOperatorAuthorization(input: unknown): OperatorAuthorizationParseResult;
+export declare function parseOperatorAuthorizationRevocation(input: unknown): OperatorAuthorizationRevocationParseResult;
+/**
+ * Temporal / mode bounds for a schema-shaped authorization.
+ * Local policy caps (max lifetime / maxUses) are applied by steward-auth-core.
+ */
+export declare function validateOperatorAuthorizationBounds(authorization: OperatorAuthorizationV1): BoundsResult;
+/** Signed bytes are exactly canonicalizeV2 of these fields (no trailing newline). */
+export declare function attestationSigningFields(attestation: StewardKeyAttestationV1): Record<string, unknown>;
+export declare function bootstrapSigningFields(bootstrap: StewardBootstrapV1): Record<string, unknown>;
+export declare function authorizationSigningFields(authorization: OperatorAuthorizationV1): Record<string, unknown>;
+export declare function authorizationRevocationSigningFields(revocation: OperatorAuthorizationRevocationV1): Record<string, unknown>;
+export declare function buildStewardEvidenceDigest(payload: unknown): string;
+export declare function buildStewardReplayDigest(payload: unknown): string;
+//# sourceMappingURL=steward-authorization.d.ts.map

package/dist/steward-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"steward-authorization.d.ts","sourceRoot":"","sources":["../src/steward-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAsBtD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;CAMzB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,kBAAkB,MAAM,EAAE,CAAC;AAErD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,IAAI,CAAC;IACX,GAAG,EAAE,WAAW,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,iBAAiB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,YAAY,GAAG;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAoBjC,8DAA8D;AAC9D,wBAAgB,eAAe,IAAI,WAAW,CAG7C;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAmBrE;AAED,eAAO,MAAM,YAAY,qCAGvB,CAAC;AAEH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAgC7D;AAWD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;EAoBzC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAC1C,OAAO,6BAA6B,CACrC,CAAC;AAEF,MAAM,MAAM,gCAAgC,GACxC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,uBAAuB,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,gFAAgF;AAChF,eAAO,MAAM,kCAAkC;;;;;;EAS9C,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,MAAM,CAC/C,OAAO,kCAAkC,CAC1C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAapC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,kBAAkB,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAiBjC,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;EAiBzC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAC1C,OAAO,6BAA6B,CACrC,CAAC;AAEF,MAAM,MAAM,gCAAgC,GACxC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,uBAAuB,CAAA;CAAE,GACpD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,eAAO,MAAM,uCAAuC;;;;;;;;;;EAanD,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG,MAAM,CACpD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,MAAM,MAAM,0CAA0C,GAClD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,iCAAiC,CAAA;CAAE,GAC3D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AA6FvE,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpE;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,gCAAgC,CAyDlC;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,GACb,2BAA2B,CAgE7B;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,gCAAgC,CAkClC;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,GACb,0CAA0C,CAuB5C;AAED;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,aAAa,EAAE,uBAAuB,GACrC,YAAY,CAmBd;AAED,qFAAqF;AACrF,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,uBAAuB,GACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,kBAAkB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,uBAAuB,GACrC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,iCAAiC,GAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAMnE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAMjE"}